@geekmidas/cli 10.0.0-alpha.124 → 10.0.0-alpha.125

package/dist/index.mjs

@@ -2,28 +2,28 @@
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { n as isGkmError, t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { _ as storeDokployCredentials, d as getDokployRegistryId, f as getDokployToken, g as removeGoDaddyCredentials, h as removeDokployCredentials, i as CommandFailed, l as getCredentialsPath, m as readCredentials, o as DEFAULT_TIMEOUT_MS, u as getDokployCredentials, v as storeGoDaddyToken, y as storeHostingerToken } from "./credentials-DpfnUvIR.mjs";
-import { C as dockerCompose, S as sshTarget, _ as parseDigests, b as dockerHost, c as edgeRef, f as derivedCredentials, h as EDGE_PROJECT, i as ComposePushNeedsBuild, l as removeEdgeRoutes, m as stackPlan, o as stackOverrideFile, p as stackDir, r as ComposePinNeedsPull, t as composeTarget, u as composeProject, v as pinnedRef, w as projectNetwork, y as composeServer } from "./compose-DJvvmF3X.mjs";
-import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-DUnnVjqC.mjs";
-import { D as RUNNER_PATH, E as BACKUPS_URL_KEY, F as runTime, I as stageBackups, N as backupFile, P as backupsPrefix, T as BACKUPS_SERVICE, _ as awsClientConfig, j as backupDatabases, v as awsEndpoint, y as awsProvisioningCredentials } from "./snsSubscriptions-CvBIGGp0.mjs";
+import { C as dockerCompose, S as sshTarget, _ as parseDigests, b as dockerHost, c as edgeRef, f as derivedCredentials, h as EDGE_PROJECT, i as ComposePushNeedsBuild, l as removeEdgeRoutes, m as stackPlan, o as stackOverrideFile, p as stackDir, r as ComposePinNeedsPull, t as composeTarget, u as composeProject, v as pinnedRef, w as projectNetwork, y as composeServer } from "./compose-BFmdLig3.mjs";
+import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-DBHF9Gba.mjs";
+import { D as BACKUPS_SERVICE, F as backupFile, I as backupsPrefix, L as runTime, N as backupDatabases, O as BACKUPS_URL_KEY, R as stageBackups, b as awsEndpoint, k as RUNNER_PATH, x as awsProvisioningCredentials, y as awsClientConfig } from "./snsSubscriptions-BmYeeTH8.mjs";
 import { o as email } from "./schemas-BCwKKA42.mjs";
-import { $ as assertDevServicesFlag, At as findAvailablePort, Et as providerOf, Fn as appTelemetry, Ft as prepareEntryCredentials, G as QueueGenerator, H as WorkerGenerator, K as CronGenerator, Kn as describeServices, Ln as scopeTelemetryEnv, Lt as secretsStoreFor, Mn as TELEMETRY_CONTAINER, Mt as loadEnvFiles, Nt as loadPortState, Ot as createCredentialsPreload, Pt as loadSecretsForApp, Qn as LOCAL_LOGS_EMAIL, Qt as isImageBuild, R as dockerCommand, Rn as surfaceClientTraced, St as CLUSTER_DATABASE, Tt as eventsBackendFor, U as workerBundleName, Ut as toEmbeddableSecrets, Vt as maskPassword, W as workerEntryDir, Wt as withCustomSecret, Yn as portsOf, Zn as primaryPortKey, Zt as imageBuildCredentials, _n as readLocalCredentials, _t as forgetState, a as dnsResources, dn as quoteIdentifier, dt as backendsOf$1, en as isUnder, ft as constructGlobs, gt as LOCAL_CA_PATH, jt as isPortAvailable, kt as createEntryWrapper, l as describeActor, ln as postgresDatabaseNames, mt as reconcileWorkspace, pt as derivedContainers, qn as fakeKey, tn as workerUnits, ut as FAKE_ENV, vn as FileSecretsStore, wt as cacheBackendFor, xn as projectKey, xt as pgClient, yn as getKeyPath, zn as telemetryOf } from "./seeds-rG-Evfz9.mjs";
+import { $n as telemetryOf, $t as maskPassword, Bt as createCredentialsPreload, Cn as postgresDatabaseNames, Ct as backendsOf$1, Et as reconcileWorkspace, Fn as projectKey, G as workerBundleName, Gt as loadPortState, Ht as findAvailablePort, It as cacheBackendFor, J as CronGenerator, K as workerEntryDir, Kn as TELEMETRY_CONTAINER, Kt as loadSecretsForApp, Lt as eventsBackendFor, Mn as FileSecretsStore, Nn as getKeyPath, Nt as pgClient, Ot as LOCAL_CA_PATH, Pt as CLUSTER_DATABASE, Q as processorInfo, Qn as surfaceClientTraced, R as dockerCommand, Rt as providerOf, St as FAKE_ENV, Tn as quoteIdentifier, Tt as derivedContainers, Ut as isPortAvailable, Vt as createEntryWrapper, W as WorkerGenerator, Wt as loadEnvFiles, X as processorBundleName, Y as ProcessorGenerator, Yn as appTelemetry, Yt as secretsStoreFor, Z as processorEntryDir, Zn as scopeTelemetryEnv, a as dnsResources, dn as isImageBuild, dr as primaryPortKey, fr as LOCAL_LOGS_EMAIL, hn as workerUnits, jn as readLocalCredentials, kt as forgetState, l as describeActor, lr as portsOf, mn as processorUnits, nn as withCustomSecret, or as describeServices, pn as isUnder, q as QueueGenerator, qt as prepareEntryCredentials, sr as fakeKey, tn as toEmbeddableSecrets, un as imageBuildCredentials, ut as assertDevServicesFlag, wt as constructGlobs } from "./seeds-CK7w79VC.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { f as isCacheBackend, n as assertTestCredentials, t as SubscriberGenerator } from "./SubscriberGenerator-COAVPgM-.mjs";
+import { f as isCacheBackend, n as assertTestCredentials, t as SubscriberGenerator } from "./SubscriberGenerator-ocQ2yj0K.mjs";
 import { n as deployIdentity } from "./identity-CBXr4wNi.mjs";
-import { a as startTelemetryCode, c as parseTelemetryFlag, i as routeTelemetry, n as runtimeFor, o as telemetryFor, r as mountRequestSpansCode, s as writeTelemetryModule, t as EndpointGenerator } from "./EndpointGenerator-Z_BUTocT.mjs";
-import { d as ConstructGenerator, i as discover, r as consumedBy, u as withOwningTsconfigJsx } from "./discover-BvJOVsYG.mjs";
+import { a as startTelemetryCode, c as parseTelemetryFlag, i as routeTelemetry, n as runtimeFor, o as telemetryFor, r as mountRequestSpansCode, s as writeTelemetryModule, t as EndpointGenerator } from "./EndpointGenerator-errMeldx.mjs";
+import { d as ConstructGenerator, i as discover, r as consumedBy, u as withOwningTsconfigJsx } from "./discover-CzGM5P3p.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { a as describeHolder, c as withAppPorts, i as assignAppPorts, o as describeMove, r as appTag, s as holderOf, t as APP_TAG_ENV } from "./appPorts-BoXMwolc.mjs";
-import { a as opensKmsKeys, n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-Chb5Akov.mjs";
-import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-CNpuV_6Q.mjs";
+import { a as opensKmsKeys, n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-C-VqMtld.mjs";
+import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-CiJGdy_f.mjs";
 import { t as LocalSandbox } from "./local-B7Zv1NoA.mjs";
-import { S as createStateStore, k as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-DVPgfyHr.mjs";
-import { t as deploy$1 } from "./deploy-CiRYwFmr.mjs";
-import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-DLKbxYBy.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-CtOjpV1w.mjs";
+import { S as createStateStore, k as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-g9v7cqDN.mjs";
+import { t as deploy$1 } from "./deploy-D8pUA9Y0.mjs";
+import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-DaMpt-Dx.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-ojY_BiMK.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
-import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-DqsyadOs.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-Ca883OvY.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Command, Option } from "commander";
@@ -51,7 +51,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.124";
+var version = "10.0.0-alpha.125";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -134,7 +134,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-DVPgfyHr.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-g9v7cqDN.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2174,7 +2174,7 @@ async function execCommand(commandArgs, options = {}, stageDeps) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	if (options.stage && !isImageBuild()) {
-		const { execOnStage } = await import("./stage-2EKpzPQ1.mjs").then((n) => n.n);
+		const { execOnStage } = await import("./stage-C-I2dVw1.mjs").then((n) => n.n);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { workspace } = await loadWorkspaceConfig(cwd);
 		if (options.stage !== workspace.stages.local) {
@@ -2747,9 +2747,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-CnbvrVag.mjs");
+		const { prepareDevDatabases } = await import("./migrate-NfbPVhi9.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-CnbvrVag.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-NfbPVhi9.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3775,7 +3775,8 @@ async function writeManifest(input) {
 		functions: builds.flatMap((build) => build.functions),
 		crons: builds.flatMap((build) => build.crons),
 		queues: builds.flatMap((build) => build.queues),
-		subscribers: builds.flatMap((build) => build.subscribers)
+		subscribers: builds.flatMap((build) => build.subscribers),
+		processors: builds.flatMap((build) => build.processors ?? [])
 	});
 	const path = join(manifestDir, `${target}.ts`);
 	await writeFile(path, manifestModule(folded, backends));
@@ -3825,7 +3826,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await import("./bundler-D6KFNpQk.mjs");
+			const { bundleServer } = await import("./bundler-DpZ9uBGN.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3876,6 +3877,10 @@ async function buildApp(input) {
 	const hostedIds = new Set(hosted.map((unit) => unit.id));
 	const appRootAbs = resolve(appRoot);
 	const hostedHere = (list) => list.filter(({ construct, path }) => construct.owner !== void 0 ? hostedIds.has(construct.owner) : isUnder(path.absolute, appRootAbs));
+	const processorGenerator = new ProcessorGenerator();
+	const loadedProcessors = await processorGenerator.load(code, appRoot, bustCache);
+	const hostedUnits = input.workspace ? processorUnits(input.workspace, declared).filter((unit) => unit.app === appName) : [];
+	const hostedProcessors = input.workspace ? loadedProcessors.filter(({ construct }) => hostedUnits.some((unit) => unit.id === construct.surfaceId)) : loadedProcessors;
 	const hostedCrons = hostedHere(allCrons);
 	const hostedQueues = hostedHere(allQueues);
 	const hostedSubscribers = hostedHere(allSubscribers);
@@ -3889,12 +3894,20 @@ async function buildApp(input) {
 		queues: hostedQueues,
 		subscribers: hostedSubscribers
 	};
-	const reach = derived.surface ? reachedBy(declared, [derived.surface.id, ...servesOnly ? [] : hosted.map((unit) => unit.id)], [
+	const reach = derived.surface ? reachedBy(declared, [
+		derived.surface.id,
+		...servesOnly ? [] : hosted.map((unit) => unit.id),
+		...production?.enabled ? [] : hostedUnits.flatMap((unit) => {
+			const server = declared[unit.id];
+			return server?.kind === "file-server" ? [unit.id, server.of] : [unit.id];
+		})
+	], [
 		...allEndpoints,
 		...allFunctions,
 		...inProcess.crons,
 		...inProcess.queues,
-		...inProcess.subscribers
+		...inProcess.subscribers,
+		...production?.enabled ? [] : hostedProcessors
 	]) : declared;
 	Object.assign(buildContext, runtimeDrivers({
 		appRoot,
@@ -3926,6 +3939,10 @@ async function buildApp(input) {
 		...production,
 		subscribers: "exclude"
 	};
+	if (target === "server" && !production?.enabled && hostedProcessors.length) {
+		await processorGenerator.buildDev(join(appRoot, ".gkm", "server"), hostedProcessors);
+		buildContext.devProcessors = true;
+	}
 	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, inProcess.crons, inProcess.subscribers, inProcess.queues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
 	if (target === "server" && production?.enabled) await buildWorkers({
 		context: (workerId, work) => ({
@@ -3954,6 +3971,32 @@ async function buildApp(input) {
 		bundle: Boolean(production.bundle && !input.skipBundle),
 		...input.stage ? { stage: input.stage } : {}
 	});
+	let processors = [];
+	if (target === "aws") processors = await processorGenerator.build(buildContext, hostedProcessors, join(appRoot, ".gkm", target), {
+		target,
+		root: workspaceRoot
+	});
+	else if (production?.enabled) processors = await buildProcessors({
+		context: buildContext,
+		units: hostedUnits.map((unit) => unit.id),
+		serverDir: join(appRoot, ".gkm", "server"),
+		processors: hostedProcessors,
+		telemetry: (fileServerId) => telemetryFor({
+			node: telemetryOf(declared, fileServerId),
+			appRoot,
+			app: appNameOf(input),
+			cwd: workspaceRoot,
+			serviceName: fileServerId,
+			...input.workspaceName && { workspaceName: input.workspaceName }
+		}),
+		workspaceRoot,
+		bundle: Boolean(production.bundle && !input.skipBundle),
+		...input.stage ? { stage: input.stage } : {}
+	});
+	if (processors.length > 0 && result.built) result.built = {
+		...result.built,
+		processors
+	};
 	await generateOpenApi(allEndpoints.map(({ construct }) => construct), {
 		openapi: config.openapi,
 		root: workspaceRoot,
@@ -4028,7 +4071,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-D6KFNpQk.mjs");
+		const { bundleServer } = await import("./bundler-DpZ9uBGN.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -4048,6 +4091,45 @@ async function buildWorkers(input) {
 	}
 }
 /**
+* Write each processor unit's entry — and, for an image, bundle it — from the
+* processors of its file server and no other.
+*/
+async function buildProcessors(input) {
+	const generator = new ProcessorGenerator();
+	const infos = [];
+	for (const fileServerId of input.units) {
+		const processors = input.processors.filter(({ construct }) => construct.surfaceId === fileServerId);
+		if (processors.length === 0) continue;
+		const { context } = input;
+		const telemetry = input.telemetry(fileServerId);
+		const entryPoint = await generator.buildEntry({
+			context,
+			fileServerId,
+			...telemetry ? { telemetry } : {},
+			outputDir: processorEntryDir(input.serverDir, fileServerId),
+			processors
+		});
+		const handler = relative(input.workspaceRoot, entryPoint);
+		for (const { key, construct } of processors) infos.push(await processorInfo(key, construct, handler, context));
+		logger$4.log(`Generated processors for ${fileServerId}: ${processors.map(({ key }) => key).join(", ")}`);
+		if (!input.bundle) continue;
+		const { bundleServer } = await import("./bundler-DpZ9uBGN.mjs");
+		const outfile = processorBundleName(fileServerId);
+		await bundleServer({
+			entryPoint,
+			outputDir: join(input.serverDir, "dist"),
+			outfile,
+			minify: context.production?.minify ?? false,
+			sourcemap: false,
+			external: [...context.production?.external ?? [], ...new Set(processors.flatMap(({ construct }) => construct.native))],
+			...input.stage ? { stage: input.stage } : {},
+			constructs: processors.map((p) => p.construct)
+		});
+		logger$4.log(`✅ Bundle complete: .gkm/server/dist/${outfile}`);
+	}
+	return infos;
+}
+/**
 * Whether the surface's generated client propagates trace context, and at
 * what rate: on when a site that calls it has an edge to a `Telemetry`
 * construct, at the stage's sample rate — every trace locally, and on a build
@@ -4114,7 +4196,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-D6KFNpQk.mjs");
+			const { bundleServer } = await import("./bundler-DpZ9uBGN.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5948,25 +6030,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.124",
-	"@geekmidas/auth": "~10.0.0-alpha.124",
-	"@geekmidas/cache": "~10.0.0-alpha.124",
-	"@geekmidas/client": "~10.0.0-alpha.124",
-	"@geekmidas/cloud": "~10.0.0-alpha.124",
-	"@geekmidas/constructs": "~10.0.0-alpha.124",
-	"@geekmidas/db": "~10.0.0-alpha.124",
-	"@geekmidas/emailkit": "~10.0.0-alpha.124",
-	"@geekmidas/envkit": "~10.0.0-alpha.124",
-	"@geekmidas/errors": "~10.0.0-alpha.124",
-	"@geekmidas/events": "~10.0.0-alpha.124",
-	"@geekmidas/logger": "~10.0.0-alpha.124",
-	"@geekmidas/manifest": "~10.0.0-alpha.124",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.124",
-	"@geekmidas/schema": "~10.0.0-alpha.124",
-	"@geekmidas/services": "~10.0.0-alpha.124",
-	"@geekmidas/storage": "~10.0.0-alpha.124",
-	"@geekmidas/telescope": "~10.0.0-alpha.124",
-	"@geekmidas/testkit": "~10.0.0-alpha.124",
+	"@geekmidas/audit": "~10.0.0-alpha.125",
+	"@geekmidas/auth": "~10.0.0-alpha.125",
+	"@geekmidas/cache": "~10.0.0-alpha.125",
+	"@geekmidas/client": "~10.0.0-alpha.125",
+	"@geekmidas/cloud": "~10.0.0-alpha.125",
+	"@geekmidas/constructs": "~10.0.0-alpha.125",
+	"@geekmidas/db": "~10.0.0-alpha.125",
+	"@geekmidas/emailkit": "~10.0.0-alpha.125",
+	"@geekmidas/envkit": "~10.0.0-alpha.125",
+	"@geekmidas/errors": "~10.0.0-alpha.125",
+	"@geekmidas/events": "~10.0.0-alpha.125",
+	"@geekmidas/logger": "~10.0.0-alpha.125",
+	"@geekmidas/manifest": "~10.0.0-alpha.125",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.125",
+	"@geekmidas/schema": "~10.0.0-alpha.125",
+	"@geekmidas/services": "~10.0.0-alpha.125",
+	"@geekmidas/storage": "~10.0.0-alpha.125",
+	"@geekmidas/telescope": "~10.0.0-alpha.125",
+	"@geekmidas/testkit": "~10.0.0-alpha.125",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7159,7 +7241,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "33ebde06b34316de23d1914f1ff7a35ee31dce89", version = cliVersion()) {
+function stagesActionUses(commit = "72a50c6bd9e71af983cc5e2a7c9f3654bfc1afdc", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -16131,8 +16213,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-CnbvrVag.mjs");
-	const { discover } = await import("./discover-BvJOVsYG.mjs").then((n) => n.a);
+	const { migrateAndSeed } = await import("./migrate-NfbPVhi9.mjs");
+	const { discover } = await import("./discover-CzGM5P3p.mjs").then((n) => n.a);
 	const sources = {};
 	const manifest = await discover({
 		patterns: constructGlobs(workspace),
@@ -16555,7 +16637,7 @@ program.command("eas:sync").description("Set up a mobile app's EAS project for a
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { easSync } = await import("./eas-1Ee6kql0.mjs");
+		const { easSync } = await import("./eas-DaobzDks.mjs");
 		await easSync(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16565,7 +16647,7 @@ program.command("publish").description("Ship a mobile app for a deployed stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { publish, PublishModeConflict } = await import("./publish-BISBrrqR.mjs");
+		const { publish, PublishModeConflict } = await import("./publish-BuUVaZVy.mjs");
 		if (options.build && options.update) throw new PublishModeConflict();
 		const { build, update, ...rest } = options;
 		await publish({
@@ -16581,7 +16663,7 @@ program.command("deploy:google-play").description("Let EAS Submit publish a mobi
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGooglePlay } = await import("./googlePlay-CK05QiTq.mjs");
+		const { deployGooglePlay } = await import("./googlePlay-lF7Atm_N.mjs");
 		await deployGooglePlay(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16603,7 +16685,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-CnbvrVag.mjs");
+		const { migrateCommand } = await import("./migrate-NfbPVhi9.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16616,7 +16698,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-CnbvrVag.mjs");
+		const { seedCommand } = await import("./migrate-NfbPVhi9.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16629,7 +16711,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-CnbvrVag.mjs");
+		const { migrationCommand } = await import("./migrate-NfbPVhi9.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16729,7 +16811,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-CIjmgzkb.mjs");
+		const { secretsAddCommand } = await import("./add-C7ZBXIzM.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16739,7 +16821,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-B8Bk1Mvu.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-DV31gEY8.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16749,7 +16831,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-B8Bk1Mvu.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-DV31gEY8.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16788,7 +16870,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./seeds-rG-Evfz9.mjs").then((n) => n.zt);
+		const { secretsStoreFor } = await import("./seeds-CK7w79VC.mjs").then((n) => n.Zt);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -16797,7 +16879,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-rG-Evfz9.mjs").then((n) => n.ht);
+		const { derivedContainers } = await import("./seeds-CK7w79VC.mjs").then((n) => n.Dt);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16814,14 +16896,14 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-BzCHT9qs.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-_sBX0pve.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
-	const { deployCli } = await import("./cli-DNtSTtMc.mjs");
+	const { deployCli } = await import("./cli-BWfYyy1k.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -16841,8 +16923,8 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-DbP0KuDw.mjs").then((n) => n.a);
-		const { terminalCredentials } = await import("./terminal-BAVrDhhN.mjs");
+		const { rollbackStage } = await import("./rollback-CWyyTQ0B.mjs").then((n) => n.a);
+		const { terminalCredentials } = await import("./terminal-bqY33lpN.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -16860,7 +16942,7 @@ program.command("compose:server").description("Set up a stage's server for compo
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { composeServerCommand } = await import("./serverSetup-xGw1fxuZ.mjs");
+		const { composeServerCommand } = await import("./serverSetup-BAPNuNEX.mjs");
 		await composeServerCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16885,7 +16967,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-BUlKJfOV.mjs");
+		const { deployGithubCommand } = await import("./github-Nep8pI4_.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16895,7 +16977,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await import("./stages-DSltTW2d.mjs");
+		const { stagesCommand } = await import("./stages-DTTv0NZW.mjs");
 		await stagesCommand(options);
 	} catch (error) {
 		exitWithError(error);