@geekmidas/cli 10.0.0-alpha.124 → 10.0.0-alpha.125

package/dist/{seeds-rG-Evfz9.mjs → seeds-CK7w79VC.mjs}

@@ -1,14 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { s as run$1, x as gkmHome } from "./credentials-DpfnUvIR.mjs";
-import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as UnknownSecretsStoreProvider, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, j as TEST_STAGE, pt as SERVER_IPV6_KEY, ut as s3SecretsLocation, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-DUnnVjqC.mjs";
+import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as UnknownSecretsStoreProvider, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, j as TEST_STAGE, pt as SERVER_IPV6_KEY, ut as s3SecretsLocation, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-DBHF9Gba.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { c as DEFAULT_CACHE, d as holdsEveryCache, i as readFakes, l as DEFAULT_EVENTS$1, o as objectsRoute, r as readCredentialFakes, t as SubscriberGenerator, u as DEFAULT_STORAGE } from "./SubscriberGenerator-COAVPgM-.mjs";
+import { c as DEFAULT_CACHE, d as holdsEveryCache, i as readFakes, l as DEFAULT_EVENTS$1, o as objectsRoute, r as readCredentialFakes, t as SubscriberGenerator, u as DEFAULT_STORAGE } from "./SubscriberGenerator-ocQ2yj0K.mjs";
 import { n as deployIdentity } from "./identity-CBXr4wNi.mjs";
-import { a as startTelemetryCode, n as runtimeFor, s as writeTelemetryModule, u as telemetryArgs } from "./EndpointGenerator-Z_BUTocT.mjs";
-import { d as ConstructGenerator, f as output, h as eventsEdgeBucket, i as discover } from "./discover-BvJOVsYG.mjs";
+import { a as startTelemetryCode, n as runtimeFor, s as writeTelemetryModule, u as telemetryArgs } from "./EndpointGenerator-errMeldx.mjs";
+import { d as ConstructGenerator, f as output, h as eventsEdgeBucket, i as discover } from "./discover-CzGM5P3p.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { c as runtimeOf } from "./resolve-BT7fkPN5.mjs";
+import { c as runtimeOf } from "./resolve-BCU9pYDx.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -16,7 +16,7 @@ import { homedir, hostname, networkInterfaces, userInfo } from "node:os";
 import { execFile, spawn } from "node:child_process";
 import { createServer } from "node:net";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from "node:crypto";
-import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, PUBLIC_PREFIX, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, drawSecret, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
+import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, PUBLIC_PREFIX, TELEMETRY_KEYS, bucketExpiry, cacheTable, cookieDomain, dependenciesOf, dependentsOf, drawSecret, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
 import { formatKeyring, generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import * as snsUrl from "@geekmidas/events/sns/url";
@@ -25,6 +25,7 @@ import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import { config } from "dotenv";
 import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
+import { Processor } from "@geekmidas/constructs/processors";
 import { Queue } from "@geekmidas/constructs/queue";
 import { CreateBucketCommand, DeleteBucketLifecycleCommand, GetBucketLifecycleConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, HeadBucketCommand, ListBucketsCommand, PutBucketLifecycleConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
 import { CreateTopicCommand, GetTopicAttributesCommand, SNSClient } from "@aws-sdk/client-sns";
@@ -486,6 +487,21 @@ function volumeOf(container) {
 	}[container];
 }
 //#endregion
+//#region src/generators/processorRoute.ts
+/**
+* Where `gkm dev` serves a file server's processors, on the dev server of the
+* app holding them: named after the file server.
+*
+* One definition for both sides — the dev server mounts it, and the local
+* edge rewrites each processor pattern on the file server's host onto it — so
+* the path the edge sends and the path the server answers cannot drift.
+*/
+const PROCESSORS_DEV_PREFIX = "/__gkm/processors/";
+/** The base a file server's processors answer under, in `gkm dev`. */
+function processorsDevRoute(fileServerId) {
+	return `${PROCESSORS_DEV_PREFIX}${fileServerId}`;
+}
+//#endregion
 //#region src/reconcile/caddyfile.ts
 /**
 * The Caddy configuration a plan implies.
@@ -552,19 +568,26 @@ const LOCAL_TLD = "localhost";
 * are a legitimate arrangement — two cache behaviours, one origin — and naming
 * the host after the bucket would make them collide.
 */
-function sitesFor(plan, project, addresses = {}) {
+function sitesFor(plan, project, addresses = {}, processorAddresses = {}) {
 	const byId = new Map(plan.resources.map((r) => [r.id, r]));
 	const sites = [];
 	for (const resource of plan.resources) {
 		if (!EDGE_KINDS[resource.kind]) continue;
-		const host = hostFor(resource, project);
+		const host = hostFor$1(resource, project);
 		if (resource.kind === "file-server") {
 			const origin = resource.of ? byId.get(resource.of) : void 0;
 			if (!origin) continue;
+			const address = processorAddresses[resource.id];
+			const port = address ? portOf(address) : void 0;
 			sites.push({
 				host,
 				upstream: "http://minio:9000",
-				rewrite: `/${origin.name}{uri}`
+				rewrite: `/${origin.name}{uri}`,
+				...resource.processors?.length && port ? { processors: {
+					prefixes: resource.processors,
+					upstream: `http://${HOST_GATEWAY$1}:${port}`,
+					under: processorsDevRoute(resource.id)
+				} } : {}
 			});
 			continue;
 		}
@@ -596,7 +619,7 @@ function portOf(address) {
 * name, because an empty label makes `uploads..localhost` — a host nothing
 * resolves and no certificate can be issued for.
 */
-function hostFor(resource, project) {
+function hostFor$1(resource, project) {
 	return [
 		resource.root && project ? stageOf(resource) : labelOf(resource),
 		project,
@@ -654,14 +677,24 @@ function toCaddyfile(sites) {
 	if (sites.length === 0) return `${GENERATED}
 # No file server is declared in this stage, so it routes nothing.
 `;
-	const blocks = sites.map(({ host, upstream, rewrite }) => `
+	const blocks = sites.map(({ host, upstream, rewrite, processors }) => `
 https://${host} {
 	tls internal
 
 	# gkm's own header, which only a service of this stack may send: the auth
 	# server rate-limits by the client address it carries.
 	request_header -${CLIENT_IP_HEADER}
-
+${processors ? `
+	# Its processors' patterns, to the dev server holding them — under the
+	# route it mounts them on. Answered there, so the bucket below never is.
+	@processors path ${processors.prefixes.map((prefix) => `${prefix}*`).join(" ")}
+	handle @processors {
+		reverse_proxy ${processors.upstream} {
+			rewrite ${processors.under}{uri}
+			header_up Host {host}
+		}
+	}
+` : ""}
 	reverse_proxy ${upstream} {${rewrite ? `
 		rewrite ${rewrite}
 		# MinIO routes and signs on the Host header, so forwarding the requested
@@ -846,13 +879,14 @@ function nodeOf(manifest, id) {
 	return node?.kind === "telemetry" ? node : void 0;
 }
 /**
-* The `Telemetry` node the process for `id` — a surface or a worker, by
-* construct id — emits through, or undefined when it has no edge to one.
+* The `Telemetry` node the process for `id` — a surface, a worker, or a file
+* server's processor unit, by construct id — emits through, or undefined
+* when it has no edge to one.
 */
 function telemetryOf(manifest, id) {
 	const declaration = manifest[id];
 	if (!declaration) return void 0;
-	if (declaration.kind === "worker") return nodeOf(manifest, declaration.telemetry);
+	if (declaration.kind === "worker" || declaration.kind === "file-server") return nodeOf(manifest, declaration.telemetry);
 	if (declaration.kind !== "rest-api") return void 0;
 	return nodeOf(manifest, declaration.telemetry);
 }
@@ -866,7 +900,7 @@ function appTelemetry(manifest, appName) {
 }
 /** Whether any process in the manifest emits through a `Telemetry` node. */
 function usesTelemetry(manifest) {
-	return Object.entries(manifest).some(([id, d]) => (d.kind === "rest-api" || d.kind === "worker") && telemetryOf(manifest, id) !== void 0);
+	return Object.entries(manifest).some(([id, d]) => (d.kind === "rest-api" || d.kind === "worker" || d.kind === "file-server") && telemetryOf(manifest, id) !== void 0);
 }
 /**
 * One process's share of the telemetry keys a stage resolved: all of them,
@@ -1127,7 +1161,8 @@ function planFor(manifest, stage, order, options = {}) {
 				...declaration.scheme ? { scheme: declaration.scheme } : {}
 			} : {},
 			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
-			...declaration.kind === "objects" && declaration.expire ? { expire: declaration.expire } : {},
+			...declaration.kind === "file-server" && declaration.processors?.length ? { processors: [...new Set(declaration.processors.map((p) => p.prefix))].sort() } : {},
+			...declaration.kind === "objects" && bucketExpiry(manifest, id) ? { expire: bucketExpiry(manifest, id) } : {},
 			...(declaration.kind === "rest-api" || declaration.kind === "site") && declaration.subdomain ? { subdomain: declaration.subdomain } : {},
 			...fake ? { fake: {
 				key: fake.key,
@@ -1476,7 +1511,7 @@ function urlFor(resource, plan, ports, project, addresses, credential) {
 	if (resource.kind === "rest-api" || resource.kind === "site") {
 		const address = addresses?.[resource.id];
 		const edge = plan.containers.includes("caddy") ? ports[primaryPortKey("caddy")] : void 0;
-		return address && edge !== void 0 ? `https://${hostFor(resource, project)}:${edge}` : address;
+		return address && edge !== void 0 ? `https://${hostFor$1(resource, project)}:${edge}` : address;
 	}
 	if (!resource.container) return void 0;
 	const port = ports[primaryPortKey(resource.container)];
@@ -1503,7 +1538,7 @@ function urlFor(resource, plan, ports, project, addresses, credential) {
 		case "file-server": {
 			const origin = plan.resources.find((r) => r.id === resource.of);
 			if (!origin) return void 0;
-			return plan.containers.includes("caddy") ? `https://${hostFor(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
+			return plan.containers.includes("caddy") ? `https://${hostFor$1(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
 		}
 		case "cache":
 			if (resource.of) {
@@ -2863,14 +2898,7 @@ var WorkerNameTaken = class extends GkmError {
 * @param background Each worker's files, from discovery's `background`.
 */
 function workerUnits(workspace, manifest, background) {
-	const hosts = Object.entries(workspace.apps).filter(([, app]) => app.type === "backend" && !app.entry).map(([name, app]) => {
-		const surface = Object.entries(manifest).find(([id, d]) => d.kind === "rest-api" && appKey(id) === name)?.[1];
-		return {
-			name,
-			root: isAbsolute(app.path) ? app.path : join(workspace.root, app.path),
-			generated: !(surface?.kind === "rest-api" && surface.endpoints.length > 0)
-		};
-	}).sort((a, b) => a.name.localeCompare(b.name));
+	const hosts = hostApps(workspace, manifest);
 	const units = [];
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "worker") continue;
@@ -2878,12 +2906,8 @@ function workerUnits(workspace, manifest, background) {
 		if (files.length === 0) continue;
 		const name = appKey(id);
 		if (workspace.apps[name]) throw new WorkerNameTaken(id, name);
-		const ranked = hosts.map((host) => ({
-			host,
-			holds: files.filter((file) => isUnder(file, host.root)).length
-		})).sort((a, b) => b.holds - a.holds || Number(b.host.generated) - Number(a.host.generated));
-		const host = ranked[0]?.host;
-		if (!host || ranked[0].holds === 0 && !host.generated) throw new WorkerHasNoApp(id);
+		const host = hostFor(hosts, files);
+		if (!host) throw new WorkerHasNoApp(id);
 		units.push({
 			id,
 			name,
@@ -2892,6 +2916,70 @@ function workerUnits(workspace, manifest, background) {
 	}
 	return units.sort((a, b) => a.name.localeCompare(b.name));
 }
+/** The service and image name of a file server's processors: `assets-processors`. */
+function processorUnitName(fileServerId) {
+	return `${appKey(fileServerId.replace(/Server$/, ""))}-processors`;
+}
+/** A file server with processors and no backend app to build them from. */
+var ProcessorsHaveNoApp = class extends GkmError {
+	fileServer;
+	constructor(fileServer) {
+		super(`The file server '${fileServer}' has processors, and the workspace has no backend app that builds a server to carry their entry. Declare a RestApi whose app holds the processors' code.`);
+		this.fileServer = fileServer;
+		this.name = "ProcessorsHaveNoApp";
+	}
+};
+/**
+* The processor units a workspace deploys — each file server with processors
+* — and the app each is built from, chosen as a worker's is: the backend app
+* holding the most of its processors' files.
+*/
+function processorUnits(workspace, manifest) {
+	const hosts = hostApps(workspace, manifest);
+	const units = [];
+	for (const declaration of Object.values(manifest)) {
+		if (declaration.kind !== "file-server") continue;
+		const processors = declaration.processors ?? [];
+		if (processors.length === 0) continue;
+		const host = hostFor(hosts, processors.map(({ handler }) => {
+			const file = handler.split("#")[0] ?? handler;
+			return isAbsolute(file) ? file : join(workspace.root, file);
+		}));
+		if (!host) throw new ProcessorsHaveNoApp(declaration.id);
+		const name = processorUnitName(declaration.id);
+		if (workspace.apps[name]) throw new WorkerNameTaken(declaration.id, name);
+		units.push({
+			id: declaration.id,
+			name,
+			app: host.name
+		});
+	}
+	return units.sort((a, b) => a.name.localeCompare(b.name));
+}
+/** The backend apps whose builds generate a server, each where it lives. */
+function hostApps(workspace, manifest) {
+	return Object.entries(workspace.apps).filter(([, app]) => app.type === "backend" && !app.entry).map(([name, app]) => {
+		const surface = Object.entries(manifest).find(([id, d]) => d.kind === "rest-api" && appKey(id) === name)?.[1];
+		return {
+			name,
+			root: isAbsolute(app.path) ? app.path : join(workspace.root, app.path),
+			generated: !(surface?.kind === "rest-api" && surface.endpoints.length > 0)
+		};
+	}).sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* The app holding the most of these files; then one that generates a server;
+* then by name. None when no app holds any and none generates a server.
+*/
+function hostFor(hosts, files) {
+	const ranked = hosts.map((host) => ({
+		host,
+		holds: files.filter((file) => isUnder(file, host.root)).length
+	})).sort((a, b) => b.holds - a.holds || Number(b.host.generated) - Number(a.host.generated));
+	const host = ranked[0]?.host;
+	if (!host || ranked[0].holds === 0 && !host.generated) return void 0;
+	return host;
+}
 /** Whether `file` is inside `dir`. */
 function isUnder(file, dir) {
 	const rel = relative(dir, file);
@@ -3541,6 +3629,8 @@ function generateBackendDockerfile(options) {
 }
 /** The port a worker answers its health check on, inside its container. */
 const WORKER_PORT = 3e3;
+/** The port a processor unit answers on, inside its container. */
+const PROCESSOR_PORT = 3e3;
 /**
 * A Worker's image: the same build as its host app's backend — a pruned
 * slice, `gkm build --provider server --production` in the image, with the
@@ -3557,6 +3647,19 @@ function generateWorkerDockerfile(options) {
 		expose: false
 	});
 }
+/**
+* A file server's processor unit: its host app's build, and the unit's bundle
+* as the runner. Its native packages — `sharp` — are installed for the image's
+* platform beside the bundle, at the versions the build resolved.
+*/
+function generateProcessorDockerfile(options) {
+	return gkmBundleDockerfile(options, {
+		title: `Processors Dockerfile (${options.fileServer})`,
+		bundle: options.bundle,
+		as: "processors.mjs",
+		expose: true
+	});
+}
 function gkmBundleDockerfile(options, runner) {
 	const { port, healthCheckPath = "/health" } = options;
 	const { app } = layout(options);
@@ -3583,7 +3686,7 @@ RUN apk add --no-cache tini
 RUN addgroup --system --gid 1001 nodejs && \\
     adduser --system --uid 1001 hono
 
-# The bundled ${runner.as === "server.mjs" ? "server" : "worker"}
+# The bundled ${runner.as.replace(/\.mjs$/, "")}
 COPY --from=builder --chown=hono:nodejs ${app}/.gkm/server/dist/${runner.bundle} ./${runner.as === runner.bundle ? "" : runner.as}${externals.copy}
 
 ENV NODE_ENV=production
@@ -4075,7 +4178,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
 		case "s3": {
-			const { S3SecretsStore } = await import("./s3-B4FTQQkV.mjs");
+			const { S3SecretsStore } = await import("./s3-BZzSnker.mjs");
 			const { deployIdentity } = await import("./identity-CBXr4wNi.mjs").then((n) => n.r);
 			const location = s3SecretsLocation(config, workspace.state);
 			return new S3SecretsStore({
@@ -5679,7 +5782,7 @@ async function reconcile(options) {
 		...options.apps ? { apps: options.apps(plan.containers) } : {},
 		...options.objectWebhooks?.length ? { objectWebhooks: options.objectWebhooks } : {}
 	});
-	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
+	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses, options.processorAddresses));
 	const hash = planHash(plan, compose, {
 		caddyfile,
 		postgres: postgresStatements(plan, project, seed).map((statement) => statement.create).join(";\n")
@@ -5858,6 +5961,7 @@ var workspace_exports = /* @__PURE__ */ __exportAll({
 	fakesApply: () => fakesApply,
 	localObjectWebhooks: () => localObjectWebhooks,
 	metroPorts: () => metroPorts,
+	processorAddresses: () => processorAddresses,
 	reconcileWorkspace: () => reconcileWorkspace,
 	surfaceAddresses: () => surfaceAddresses
 });
@@ -5949,6 +6053,7 @@ async function reconcileWorkspace(workspace, options) {
 		...backendsOf(workspace),
 		saved: await loadPortState(workspace.root),
 		addresses: surfaceAddresses(workspace, manifest),
+		processorAddresses: processorAddresses(workspace, manifest),
 		metroPorts: metroPorts(workspace, manifest),
 		fakes,
 		credentialFakes,
@@ -6015,6 +6120,19 @@ function metroPorts(workspace, manifest) {
 	return ports;
 }
 /**
+* Where each file server's processors answer locally: the dev server of the
+* app holding them, which `gkm dev` mounts them on — the same app whose build
+* writes their unit deployed.
+*/
+function processorAddresses(workspace, manifest) {
+	const addresses = {};
+	for (const unit of processorUnits(workspace, manifest)) {
+		const port = workspace.apps[unit.app]?.port;
+		if (port) addresses[unit.id] = localAddress(port);
+	}
+	return addresses;
+}
+/**
 * Where each declared surface and site answers locally.
 *
 * The addresses come from the ports the workspace already assigns; which
@@ -6193,6 +6311,21 @@ function workerEnvKeys(manifest, workerId, runnables = {}) {
 	return keys;
 }
 /** What each construct an edge reaches hands the process that reaches it. */
+/**
+* The keys a file server's processor unit reads: its bucket's, and what each
+* of its processors depends on. `undefined` for a file server with none.
+*/
+function processorEnvKeys(manifest, fileServerId, runnables = {}) {
+	const server = manifest[fileServerId];
+	if (server?.kind !== "file-server" || !server.processors?.length) return;
+	const keys = /* @__PURE__ */ new Set();
+	addEdgeKeys(manifest, [
+		server.of,
+		...server.processors.flatMap((p) => p.dependencies.map((d) => d.target)),
+		...runnables[fileServerId] ?? []
+	], keys);
+	return keys;
+}
 function addEdgeKeys(manifest, edges, keys) {
 	for (const id of edges) {
 		const bucket = eventsEdgeBucket(id);
@@ -6660,6 +6793,308 @@ function validateImageRef(ref) {
 	return ref;
 }
 //#endregion
+//#region src/providers/processorOrigin.ts
+/**
+* A file server's processors as a CDN origin: the names both sides agree on.
+*
+* On a compose stage whose bucket is on S3, the CDN serves the bucket and
+* sends each processor pattern to the stack's processor unit, at a host of
+* its own. That host is public — a CDN reaches its origin over the internet —
+* so the CDN adds a secret header and the edge refuses any request without
+* it. One definition, read by the CDN that sends the header and by the stack
+* whose edge checks it, so the two cannot drift.
+*/
+/** The header the CDN adds to every request it sends a processor. */
+const ORIGIN_VERIFY_HEADER = "X-Gkm-Origin-Verify";
+/** Where a file server's processors answer the CDN: `<fileserver>-processors.<domain>`. */
+function processorOriginHost(serverId, domain) {
+	return `${appKey(serverId)}-processors.${domain}`.toLowerCase();
+}
+/** The stage secret holding the header's value: `ASSETS_SERVER_ORIGIN_SECRET`. */
+function originSecretKey(serverId) {
+	return provideKey(serverId, "originSecret");
+}
+/**
+* What the processor unit reads that secret from. Set wherever the CDN fronts
+* it, so the unit refuses a request without the header itself — on Dokploy,
+* whose edge cannot match a header, the only check; behind the stack's own
+* edge, a second one.
+*/
+const PROCESSOR_ORIGIN_SECRET_ENV = "GKM_PROCESSOR_ORIGIN_SECRET";
+/** A new value for that secret: random, generated once, kept in the stage. */
+function newOriginSecret() {
+	return randomBytes(32).toString("base64url");
+}
+//#endregion
+//#region src/generators/ProcessorGenerator.ts
+/** Where a file server's processor entry lives, under an app's `.gkm/server`. */
+function processorEntryDir(serverDir, fileServerId) {
+	return join(serverDir, "processors", processorUnitName(fileServerId));
+}
+/** The file its bundle is written to, beside the server's. */
+function processorBundleName(fileServerId) {
+	return `${processorUnitName(fileServerId)}.mjs`;
+}
+/**
+* A file server's processors, as the build generates them.
+*
+* On AWS each is a Lambda behind a function URL — the CDN's origin for its
+* pattern. On a server they are one process per file server, the processor
+* unit (see {@link ProcessorGenerator.buildEntry}), so the `server` target
+* generates nothing per processor here.
+*/
+var ProcessorGenerator = class extends ConstructGenerator {
+	isConstruct(value) {
+		return Processor.isProcessor(value);
+	}
+	async build(context, constructs, outputDir, options) {
+		if ((options?.target ?? "aws") !== "aws" || constructs.length === 0) return [];
+		const dir = join(outputDir, "processors");
+		await mkdir(dir, { recursive: true });
+		const infos = [];
+		for (const { key, construct, path } of constructs) {
+			const file = join(dir, `${key}.ts`);
+			const importPath = relative(dirname(file), path.relative).replace(/\.ts$/, ".js");
+			await writeFile(file, `import { AWSLambdaProcessor } from '@geekmidas/constructs/processors';
+import { ${key} } from '${importPath}';
+${context.storageDrivers?.imports ?? ""}
+${context.storageDrivers?.setup ? `\n// The handler registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
+const adapter = new AWSLambdaProcessor(${key});
+
+export const handler = adapter.handler;
+`);
+			infos.push(await processorInfo(key, construct, relative(options?.root ?? process.cwd(), file).replace(/\.ts$/, ".handler"), context));
+		}
+		return infos;
+	}
+	/**
+	* `gkm dev`'s half: `processors.ts` beside the dev server's app, mounting
+	* each file server's processors under `/__gkm/processors/<FileServer>`.
+	* The local edge sends each pattern on the file server's host there, so
+	* `processedUrl()` answers locally as it does deployed.
+	*
+	* In the dev server's own process rather than a unit of its own: locally
+	* there is no CPU to protect, and the dev server already reloads on change.
+	*/
+	async buildDev(outputDir, processors) {
+		await mkdir(outputDir, { recursive: true });
+		const file = join(outputDir, "processors.ts");
+		const imports = processors.map(({ key, path }) => {
+			const specifier = relative(outputDir, path.absolute).replace(/\.ts$/, ".js");
+			return `import { ${key} } from '${specifier.startsWith(".") ? specifier : `./${specifier}`}';`;
+		}).join("\n");
+		const byServer = /* @__PURE__ */ new Map();
+		for (const { key, construct } of processors) byServer.set(construct.surfaceId, [...byServer.get(construct.surfaceId) ?? [], key]);
+		const units = [...byServer.entries()].map(([id, keys]) => `    ${JSON.stringify(id)}: [${keys.join(", ")}],`).join("\n");
+		await writeFile(file, `/**
+ * Generated processors setup for \`gkm dev\`.
+ *
+ * Each file server's processors, under ${PROCESSORS_DEV_PREFIX}<FileServer>: the
+ * local edge rewrites each processor pattern on the file server's host here.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import { processorServer } from '@geekmidas/constructs/processors';
+${imports}
+
+export function setupProcessors(
+  app: { all: (path: string, handler: (c: any) => unknown) => unknown },
+  envParser: EnvironmentParser<any>,
+): void {
+  const units: Record<string, ReturnType<typeof processorServer>> = Object.fromEntries(
+    Object.entries({
+${units}
+    }).map(([id, processors]) => [id, processorServer(processors, envParser)]),
+  );
+
+  app.all('${PROCESSORS_DEV_PREFIX}:server/*', async (c: any) => {
+    const server = c.req.param('server') as string;
+    const serve = units[server];
+    if (!serve) return c.notFound();
+    const path = c.req.path.slice(\`${PROCESSORS_DEV_PREFIX}\${server}\`.length) || '/';
+    const response = await serve({ method: c.req.method, path });
+    if (!response) {
+      return new Response(null, {
+        status: 404,
+        headers: { 'cache-control': 'public, max-age=60' },
+      });
+    }
+    return new Response(c.req.method === 'HEAD' ? null : response.body, {
+      status: response.status,
+      headers: response.headers,
+    });
+  });
+}
+`);
+		return file;
+	}
+	/**
+	* A file server's processor unit: one process answering each of its
+	* processors' patterns, and `/health`. Returns its entry, `processors.ts`.
+	*
+	* Its own process because making a derivative is CPU-bound — a resize
+	* spike in the API's process would be every request's latency.
+	*/
+	async buildEntry(input) {
+		const { context, outputDir, processors } = input;
+		await mkdir(outputDir, { recursive: true });
+		await writeTelemetryModule(outputDir, input.telemetry);
+		const healthCheck = context.production?.healthCheck ?? "/health";
+		const imports = processors.map(({ key, path }) => {
+			const specifier = relative(outputDir, path.absolute).replace(/\.ts$/, ".js");
+			return `import { ${key} } from '${specifier.startsWith(".") ? specifier : `./${specifier}`}';`;
+		}).join("\n");
+		const entry = join(outputDir, "processors.ts");
+		await writeFile(entry, `#!/usr/bin/env node
+/**
+ * Production entry for ${input.fileServerId}'s processors.
+ * Generated by 'gkm build --production'.
+ *
+ * Answers each processor's pattern, and ${healthCheck} on PORT. The edge
+ * routes only those patterns here; everything else on the file server's
+ * domain is the bucket.
+ */
+import { timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { runShutdownHooks } from '@geekmidas/constructs';
+import { processorServer } from '@geekmidas/constructs/processors';
+${context.storageDrivers?.imports ?? ""}
+${imports}
+
+${startTelemetryCode([healthCheck])}
+${context.storageDrivers?.setup ? `// The entry point registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
+process.env.GKM_APP_NAME ??= ${JSON.stringify(processorUnitName(input.fileServerId))};
+
+const processors = [${processors.map(({ key }) => key).join(", ")}];
+const serve = processorServer(processors);
+const port = Number(process.env.PORT) || 3000;
+let stopping = false;
+
+${input.telemetry ? REQUEST_SPANS : NO_REQUEST_SPANS}
+// Where the CDN fronts this unit, the secret it adds to every request: one
+// without it is refused here, whatever the edge in front did or could not.
+const originSecret = process.env.${PROCESSOR_ORIGIN_SECRET_ENV}
+  ? Buffer.from(process.env.${PROCESSOR_ORIGIN_SECRET_ENV})
+  : undefined;
+const fromOrigin = (header: string | string[] | undefined) => {
+  if (!originSecret) return true;
+  const given = Buffer.from(typeof header === 'string' ? header : '');
+  return given.length === originSecret.length && timingSafeEqual(given, originSecret);
+};
+
+const server = createServer(async (req, res) => {
+  const method = req.method ?? 'GET';
+  const path = (req.url ?? '/').split('?')[0] ?? '/';
+  if (path === ${JSON.stringify(healthCheck)}) {
+    res.writeHead(stopping ? 503 : 200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ status: stopping ? 'stopping' : 'ok' }));
+    return;
+  }
+  if (!fromOrigin(req.headers[${JSON.stringify(ORIGIN_VERIFY_HEADER.toLowerCase())}])) {
+    res.writeHead(403, { 'cache-control': 'no-store' }).end();
+    return;
+  }
+  await traced(method, path, async () => {
+    try {
+      const response = await serve({ method, path });
+      if (!response) {
+        res.writeHead(404, { 'cache-control': 'public, max-age=60' }).end();
+        return 404;
+      }
+      res.writeHead(response.status, response.headers);
+      res.end(method === 'HEAD' ? undefined : response.body);
+      return response.status;
+    } catch (error) {
+      console.error(error);
+      res.writeHead(500, { 'cache-control': 'no-store' }).end();
+      return 500;
+    }
+  });
+});
+server.listen(port);
+
+const shutdown = async () => {
+  if (stopping) return;
+  stopping = true;
+  setTimeout(() => process.exit(1), Number(process.env.GKM_SHUTDOWN_TIMEOUT_MS) || 8000).unref();
+  server.close();
+  await runShutdownHooks((error) => console.error(error));
+  process.exit(0);
+};
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
+`);
+		return entry;
+	}
+};
+/**
+* A SERVER span per request, once telemetry has started — opened by the unit
+* rather than by hooking node:http, which sees nothing inside a bundle. Named
+* after the processor's pattern, never the key, which has no bound.
+*
+* Only in an entry whose file server has a `Telemetry` node: the bundle
+* follows the import, and an app without one need not install the API.
+*/
+const REQUEST_SPANS = `const tracing = requestSpans ? await import('@opentelemetry/api') : undefined;
+const routeOf = (path: string) =>
+  processors.find((processor) => path.startsWith(processor.prefix))?.pattern;
+
+async function traced(
+  method: string,
+  path: string,
+  run: () => Promise<number>,
+): Promise<void> {
+  if (!tracing) {
+    await run();
+    return;
+  }
+  const route = routeOf(path);
+  await tracing.trace.getTracer('@geekmidas/processors').startActiveSpan(
+    route ? \`\${method} \${route}\` : method,
+    {
+      kind: tracing.SpanKind.SERVER,
+      attributes: {
+        'http.request.method': method,
+        'url.path': path,
+        ...(route ? { 'http.route': route } : {}),
+      },
+    },
+    async (span) => {
+      try {
+        const status = await run();
+        span.setAttribute('http.response.status_code', status);
+        if (status >= 500) span.setStatus({ code: tracing.SpanStatusCode.ERROR });
+      } finally {
+        span.end();
+      }
+    },
+  );
+}
+`;
+/** The same shape without telemetry: each request just runs. */
+const NO_REQUEST_SPANS = `async function traced(
+  _method: string,
+  _path: string,
+  run: () => Promise<number>,
+): Promise<void> {
+  await run();
+}
+`;
+/** What the manifest records of one processor. */
+async function processorInfo(name, processor, handler, context) {
+	return {
+		name,
+		handler,
+		fileServer: processor.surfaceId,
+		path: processor.pattern,
+		prefix: processor.prefix,
+		...processor.native.length ? { native: [...processor.native] } : {},
+		...processor.timeout !== void 0 ? { timeout: processor.timeout } : {},
+		...processor.memorySize !== void 0 ? { memorySize: processor.memorySize } : {},
+		environment: await processor.getEnvironment({ markOptional: context.markOptional }),
+		dependencies: processor.constructs
+	};
+}
+//#endregion
 //#region src/generators/CronGenerator.ts
 var CronGenerator = class extends ConstructGenerator {
 	async build(context, constructs, outputDir, options) {
@@ -7570,6 +8005,25 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 			imageName: imageNames[worker.name] ?? worker.name
 		});
 	}
+	for (const unit of manifest ? processorUnits(workspace, manifest) : []) {
+		logger$1.log(`\n   📄 Generating Dockerfile for ${unit.name} (processors of ${unit.id}, built from ${unit.app})`);
+		const dockerfile = processorDockerfile(unit, workspace.apps[unit.app], {
+			layout,
+			workspaceRoot: workspace.root,
+			native: processorNative(manifest, unit.id)
+		});
+		const path = workerDockerfileOf(unit.name);
+		const dockerfilePath = join(workspace.root, path);
+		await mkdir(dirname(dockerfilePath), { recursive: true });
+		await writeFile(dockerfilePath, dockerfile);
+		logger$1.log(`      Generated: ${path}`);
+		results.push({
+			appName: unit.name,
+			type: "backend",
+			dockerfile: dockerfilePath,
+			imageName: imageNames[unit.name] ?? unit.name
+		});
+	}
 	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
 	logger$1.log(`\n   Ensured: ${dockerignorePath}`);
 	const composePath = await writeConstructsCompose(workspace);
@@ -7629,6 +8083,29 @@ function workerDockerfile(worker, host, options) {
 		...options.cache ? { cache: options.cache } : {}
 	});
 }
+/** The native packages a file server's processors named, once each. */
+function processorNative(manifest, fileServerId) {
+	const server = manifest[fileServerId];
+	if (server?.kind !== "file-server") return [];
+	return [...new Set((server.processors ?? []).flatMap((p) => p.native ?? []))].sort();
+}
+/**
+* A file server's processor unit's Dockerfile: its host app's build, and the
+* unit's bundle as the runner, with its processors' native packages
+* installed beside it — see `generateProcessorDockerfile`.
+*/
+function processorDockerfile(unit, host, options) {
+	return generateProcessorDockerfile({
+		...appImageOptions(options.layout, unit.app, host, options.workspaceRoot),
+		imageName: unit.name,
+		port: PROCESSOR_PORT,
+		fileServer: unit.id,
+		bundle: processorBundleName(unit.id),
+		healthCheckPath: "/health",
+		...options.native.length ? { external: [...options.native] } : {},
+		...options.cache ? { cache: options.cache } : {}
+	});
+}
 /**
 * A site's Dockerfile, with an `ARG` for every key its bundler inlines.
 *
@@ -7806,7 +8283,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-55x4o-4z.mjs");
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-BN1dODm9.mjs");
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8655,6 +9132,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { assertDevServicesFlag as $, LOGS_SERVICE as $n, publicBuildValues as $t, StageProviderDisabled as A, envFor as An, findAvailablePort as At, workerDockerfile as B, usesTelemetry as Bn, initStageSecrets as Bt, recordRollback as C, withGeneratedSecrets as Cn, composeFor as Ct, setPostgresBackupId as D, runsRedis as Dn, storageBackendFor as Dt, setGeneratedSecret as E, redisService as En, providerOf as Et, DockerBuildFailed as F, appTelemetry as Fn, prepareEntryCredentials as Ft, QueueGenerator as G, DEFAULT_IMAGES as Gn, composeBuildPaths as Gt, WorkerGenerator as H, watchedBuckets as Hn, storage_exports as Ht, DockerPushFailed as I, isTelemetryKey as In, isRemoteStore as It, AllowDevServicesTakesNoValue as J, portKeys as Jn, WORKER_PORT as Jt, CronGenerator as K, describeServices as Kn, imageLayout as Kt, appDockerfile as L, scopeTelemetryEnv as Ln, secretsStoreFor as Lt, provisionCommand as M, TELEMETRY_CONTAINER as Mn, loadEnvFiles as Mt, stageProviderNotes as N, planFor as Nn, loadPortState as Nt, DnsRecordsUnreadable as O, stackRedis as On, createCredentialsPreload as Ot, PROVIDER_KINDS as P, resourceName as Pn, loadSecretsForApp as Pt, STORAGE_KEY_PAIR as Q, LOCAL_LOGS_EMAIL as Qn, isImageBuild as Qt, dockerCommand as R, surfaceClientTraced as Rn, storeFromConfig as Rt, recordRelease as S, readKey as Sn, CLUSTER_DATABASE as St, setBackupState as T, STACK_CACHE as Tn, eventsBackendFor as Tt, workerBundleName as U, EMULATOR_ACCESS_KEY_ID as Un, toEmbeddableSecrets as Ut, workerDockerfileOf as V, minioWebhookEnv as Vn, maskPassword as Vt, workerEntryDir as W, hostFor as Wn, withCustomSecret as Wt, DevServicesNeedServerTarget as X, postgresImage as Xn, findBuildRoot as Xt, DEV_SERVICES as Y, portsOf as Yn, detectPackageManager as Yt, ExternalServicesNotConfigured as Z, primaryPortKey as Zn, imageBuildCredentials as Zt, asDokployState as _, readLocalCredentials as _n, forgetState as _t, dnsResources as a, applyPolicies as an, isMainFrontendApp as ar, suppliedOnly as at, getBackupState as b, keystoreProject as bn, bucketClient as bt, currentActor as c, bucketPolicies as cn, networkEnv as ct, DeployJournal as d, quoteIdentifier as dn, backendsOf as dt, isUnder as en, logsAccess as er, devServicesUsed as et, extractSubdomain as f, mergeLifecycle as fn, constructGlobs as ft, verifyDnsRecords as g, postgresSuperuser as gn, LOCAL_CA_PATH as gt, orchestrateDns as h, postgresRoleSlug as hn, workspace_exports as ht, dnsRecordResource as i, applyNotifications as in, NoDomainForStage as ir, stageServiceDeclarations as it, assertStageProvidersEnabled as j, localRolePassword as jn, isPortAvailable as jt, createDnsProvider as k, withRedisPassword as kn, createEntryWrapper as kt, describeActor as l, postgresDatabaseNames as ln, workerEnvKeys as lt, normalizeDnsConfig as m, loadLocalCredentials as mn, reconcileWorkspace as mt, reportDatabaseRuns as n, applyBuckets as nn, stackLogs as nr, reportDevServices as nt, forgetDnsResource as o, applyPostgres as on, resolveHost as or, appEnvKeys as ot, findRootDomain as p, LOCAL_RABBITMQ_USER as pn, derivedContainers as pt, validateImageRef as q, fakeKey as qn, TURBO_VERSION as qt, reportPlannedSeeds as r, applyLifecycles as rn, withLogsPassword as rr, requiredStageKeys as rt, recordDnsChanges as s, bucketLifecycles as sn, dockerfileOf as st, DeploySeedsFailed as t, workerUnits as tn, logsService as tr, externalServices as tt, isCi as u, postgresStatements as un, FAKE_ENV as ut, createComposeState as v, FileSecretsStore as vn, LEGACY_LOCAL_LOGIN as vt, setApplicationId as w, REDIS_SERVICE as wn, cacheBackendFor as wt, getGeneratedSecret as x, projectKey as xn, pgClient as xt, createEmptyState as y, getKeyPath as yn, ensurePostgresLogin as yt, ensureDockerignore as z, telemetryOf as zn, store_exports as zt };
+export { ORIGIN_VERIFY_HEADER as $, telemetryOf as $n, maskPassword as $t, StageProviderDisabled as A, postgresSuperuser as An, LEGACY_LOCAL_LOGIN as At, processorDockerfile as B, redisService as Bn, createCredentialsPreload as Bt, recordRollback as C, postgresDatabaseNames as Cn, backendsOf as Ct, setPostgresBackupId as D, LOCAL_RABBITMQ_USER as Dn, workspace_exports as Dt, setGeneratedSecret as E, mergeLifecycle as En, reconcileWorkspace as Et, DockerBuildFailed as F, projectKey as Fn, composeFor as Ft, workerBundleName as G, localRolePassword as Gn, loadPortState as Gt, workerDockerfile as H, stackRedis as Hn, findAvailablePort as Ht, DockerPushFailed as I, readKey as In, cacheBackendFor as It, CronGenerator as J, resourceName as Jn, isRemoteStore as Jt, workerEntryDir as K, TELEMETRY_CONTAINER as Kn, loadSecretsForApp as Kt, appDockerfile as L, withGeneratedSecrets as Ln, eventsBackendFor as Lt, provisionCommand as M, FileSecretsStore as Mn, bucketClient as Mt, stageProviderNotes as N, getKeyPath as Nn, pgClient as Nt, DnsRecordsUnreadable as O, loadLocalCredentials as On, LOCAL_CA_PATH as Ot, PROVIDER_KINDS as P, keystoreProject as Pn, CLUSTER_DATABASE as Pt, processorInfo as Q, surfaceClientTraced as Qn, initStageSecrets as Qt, dockerCommand as R, REDIS_SERVICE as Rn, providerOf as Rt, recordRelease as S, bucketPolicies as Sn, FAKE_ENV as St, setBackupState as T, quoteIdentifier as Tn, derivedContainers as Tt, workerDockerfileOf as U, withRedisPassword as Un, isPortAvailable as Ut, processorNative as V, runsRedis as Vn, createEntryWrapper as Vt, WorkerGenerator as W, envFor as Wn, loadEnvFiles as Wt, processorBundleName as X, isTelemetryKey as Xn, storeFromConfig as Xt, ProcessorGenerator as Y, appTelemetry as Yn, secretsStoreFor as Yt, processorEntryDir as Z, scopeTelemetryEnv as Zn, store_exports as Zt, asDokployState as _, applyLifecycles as _n, withLogsPassword as _r, appEnvKeys as _t, dnsResources as a, PROCESSOR_PORT as an, DEFAULT_IMAGES as ar, AllowDevServicesTakesNoValue as at, getBackupState as b, applyPostgres as bn, resolveHost as br, processorEnvKeys as bt, currentActor as c, detectPackageManager as cn, portKeys as cr, ExternalServicesNotConfigured as ct, DeployJournal as d, isImageBuild as dn, primaryPortKey as dr, devServicesUsed as dt, storage_exports as en, usesTelemetry as er, PROCESSOR_ORIGIN_SECRET_ENV as et, extractSubdomain as f, publicBuildValues as fn, LOCAL_LOGS_EMAIL as fr, externalServices as ft, verifyDnsRecords as g, applyBuckets as gn, stackLogs as gr, suppliedOnly as gt, orchestrateDns as h, workerUnits as hn, logsService as hr, stageServiceDeclarations as ht, dnsRecordResource as i, imageLayout as in, hostFor$1 as ir, validateImageRef as it, assertStageProvidersEnabled as j, readLocalCredentials as jn, ensurePostgresLogin as jt, createDnsProvider as k, postgresRoleSlug as kn, forgetState as kt, describeActor as l, findBuildRoot as ln, portsOf as lr, STORAGE_KEY_PAIR as lt, normalizeDnsConfig as m, processorUnits as mn, logsAccess as mr, requiredStageKeys as mt, reportDatabaseRuns as n, withCustomSecret as nn, watchedBuckets as nr, originSecretKey as nt, forgetDnsResource as o, TURBO_VERSION as on, describeServices as or, DEV_SERVICES as ot, findRootDomain as p, isUnder as pn, LOGS_SERVICE as pr, reportDevServices as pt, QueueGenerator as q, planFor as qn, prepareEntryCredentials as qt, reportPlannedSeeds as r, composeBuildPaths as rn, EMULATOR_ACCESS_KEY_ID as rr, processorOriginHost as rt, recordDnsChanges as s, WORKER_PORT as sn, fakeKey as sr, DevServicesNeedServerTarget as st, DeploySeedsFailed as t, toEmbeddableSecrets as tn, minioWebhookEnv as tr, newOriginSecret as tt, isCi as u, imageBuildCredentials as un, postgresImage as ur, assertDevServicesFlag as ut, createComposeState as v, applyNotifications as vn, NoDomainForStage as vr, dockerfileOf as vt, setApplicationId as w, postgresStatements as wn, constructGlobs as wt, getGeneratedSecret as x, bucketLifecycles as xn, workerEnvKeys as xt, createEmptyState as y, applyPolicies as yn, isMainFrontendApp as yr, networkEnv as yt, ensureDockerignore as z, STACK_CACHE as zn, storageBackendFor as zt };
 
-//# sourceMappingURL=seeds-rG-Evfz9.mjs.map
+//# sourceMappingURL=seeds-CK7w79VC.mjs.map