@geekmidas/cli 10.0.0-alpha.124 → 10.0.0-alpha.125

package/dist/{seeds-DOfxmDRO.cjs → seeds-CPEcmoPn.cjs}

@@ -1,14 +1,14 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_credentials = require("./credentials-D7XJypNd.cjs");
-const require_workspace = require("./workspace-C82GLPnf.cjs");
+const require_workspace = require("./workspace-Du4Afb03.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-C3QTae-R.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-BDUp7OeY.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-B2MUa4M2.cjs");
-const require_discover = require("./discover-ojkcbxHw.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-BGxf9jWE.cjs");
+const require_discover = require("./discover-DL6h-J97.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-C7GKQcE4.cjs");
+const require_resolve = require("./resolve-C9QqOl5t.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -27,6 +27,7 @@ let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
 let dotenv = require("dotenv");
 let node_util = require("node:util");
 let _geekmidas_constructs_crons = require("@geekmidas/constructs/crons");
+let _geekmidas_constructs_processors = require("@geekmidas/constructs/processors");
 let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_client_sns = require("@aws-sdk/client-sns");
@@ -488,6 +489,21 @@ function volumeOf(container) {
 	}[container];
 }
 //#endregion
+//#region src/generators/processorRoute.ts
+/**
+* Where `gkm dev` serves a file server's processors, on the dev server of the
+* app holding them: named after the file server.
+*
+* One definition for both sides — the dev server mounts it, and the local
+* edge rewrites each processor pattern on the file server's host onto it — so
+* the path the edge sends and the path the server answers cannot drift.
+*/
+const PROCESSORS_DEV_PREFIX = "/__gkm/processors/";
+/** The base a file server's processors answer under, in `gkm dev`. */
+function processorsDevRoute(fileServerId) {
+	return `${PROCESSORS_DEV_PREFIX}${fileServerId}`;
+}
+//#endregion
 //#region src/reconcile/caddyfile.ts
 /**
 * The Caddy configuration a plan implies.
@@ -554,19 +570,26 @@ const LOCAL_TLD = "localhost";
 * are a legitimate arrangement — two cache behaviours, one origin — and naming
 * the host after the bucket would make them collide.
 */
-function sitesFor(plan, project, addresses = {}) {
+function sitesFor(plan, project, addresses = {}, processorAddresses = {}) {
 	const byId = new Map(plan.resources.map((r) => [r.id, r]));
 	const sites = [];
 	for (const resource of plan.resources) {
 		if (!EDGE_KINDS[resource.kind]) continue;
-		const host = hostFor(resource, project);
+		const host = hostFor$1(resource, project);
 		if (resource.kind === "file-server") {
 			const origin = resource.of ? byId.get(resource.of) : void 0;
 			if (!origin) continue;
+			const address = processorAddresses[resource.id];
+			const port = address ? portOf(address) : void 0;
 			sites.push({
 				host,
 				upstream: "http://minio:9000",
-				rewrite: `/${origin.name}{uri}`
+				rewrite: `/${origin.name}{uri}`,
+				...resource.processors?.length && port ? { processors: {
+					prefixes: resource.processors,
+					upstream: `http://${HOST_GATEWAY$1}:${port}`,
+					under: processorsDevRoute(resource.id)
+				} } : {}
 			});
 			continue;
 		}
@@ -598,7 +621,7 @@ function portOf(address) {
 * name, because an empty label makes `uploads..localhost` — a host nothing
 * resolves and no certificate can be issued for.
 */
-function hostFor(resource, project) {
+function hostFor$1(resource, project) {
 	return [
 		resource.root && project ? stageOf(resource) : labelOf(resource),
 		project,
@@ -656,14 +679,24 @@ function toCaddyfile(sites) {
 	if (sites.length === 0) return `${GENERATED}
 # No file server is declared in this stage, so it routes nothing.
 `;
-	const blocks = sites.map(({ host, upstream, rewrite }) => `
+	const blocks = sites.map(({ host, upstream, rewrite, processors }) => `
 https://${host} {
 	tls internal
 
 	# gkm's own header, which only a service of this stack may send: the auth
 	# server rate-limits by the client address it carries.
 	request_header -${_geekmidas_manifest.CLIENT_IP_HEADER}
-
+${processors ? `
+	# Its processors' patterns, to the dev server holding them — under the
+	# route it mounts them on. Answered there, so the bucket below never is.
+	@processors path ${processors.prefixes.map((prefix) => `${prefix}*`).join(" ")}
+	handle @processors {
+		reverse_proxy ${processors.upstream} {
+			rewrite ${processors.under}{uri}
+			header_up Host {host}
+		}
+	}
+` : ""}
 	reverse_proxy ${upstream} {${rewrite ? `
 		rewrite ${rewrite}
 		# MinIO routes and signs on the Host header, so forwarding the requested
@@ -848,13 +881,14 @@ function nodeOf(manifest, id) {
 	return node?.kind === "telemetry" ? node : void 0;
 }
 /**
-* The `Telemetry` node the process for `id` — a surface or a worker, by
-* construct id — emits through, or undefined when it has no edge to one.
+* The `Telemetry` node the process for `id` — a surface, a worker, or a file
+* server's processor unit, by construct id — emits through, or undefined
+* when it has no edge to one.
 */
 function telemetryOf(manifest, id) {
 	const declaration = manifest[id];
 	if (!declaration) return void 0;
-	if (declaration.kind === "worker") return nodeOf(manifest, declaration.telemetry);
+	if (declaration.kind === "worker" || declaration.kind === "file-server") return nodeOf(manifest, declaration.telemetry);
 	if (declaration.kind !== "rest-api") return void 0;
 	return nodeOf(manifest, declaration.telemetry);
 }
@@ -868,7 +902,7 @@ function appTelemetry(manifest, appName) {
 }
 /** Whether any process in the manifest emits through a `Telemetry` node. */
 function usesTelemetry(manifest) {
-	return Object.entries(manifest).some(([id, d]) => (d.kind === "rest-api" || d.kind === "worker") && telemetryOf(manifest, id) !== void 0);
+	return Object.entries(manifest).some(([id, d]) => (d.kind === "rest-api" || d.kind === "worker" || d.kind === "file-server") && telemetryOf(manifest, id) !== void 0);
 }
 /**
 * One process's share of the telemetry keys a stage resolved: all of them,
@@ -1129,7 +1163,8 @@ function planFor(manifest, stage, order, options = {}) {
 				...declaration.scheme ? { scheme: declaration.scheme } : {}
 			} : {},
 			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
-			...declaration.kind === "objects" && declaration.expire ? { expire: declaration.expire } : {},
+			...declaration.kind === "file-server" && declaration.processors?.length ? { processors: [...new Set(declaration.processors.map((p) => p.prefix))].sort() } : {},
+			...declaration.kind === "objects" && (0, _geekmidas_manifest.bucketExpiry)(manifest, id) ? { expire: (0, _geekmidas_manifest.bucketExpiry)(manifest, id) } : {},
 			...(declaration.kind === "rest-api" || declaration.kind === "site") && declaration.subdomain ? { subdomain: declaration.subdomain } : {},
 			...fake ? { fake: {
 				key: fake.key,
@@ -1478,7 +1513,7 @@ function urlFor(resource, plan, ports, project, addresses, credential) {
 	if (resource.kind === "rest-api" || resource.kind === "site") {
 		const address = addresses?.[resource.id];
 		const edge = plan.containers.includes("caddy") ? ports[primaryPortKey("caddy")] : void 0;
-		return address && edge !== void 0 ? `https://${hostFor(resource, project)}:${edge}` : address;
+		return address && edge !== void 0 ? `https://${hostFor$1(resource, project)}:${edge}` : address;
 	}
 	if (!resource.container) return void 0;
 	const port = ports[primaryPortKey(resource.container)];
@@ -1505,7 +1540,7 @@ function urlFor(resource, plan, ports, project, addresses, credential) {
 		case "file-server": {
 			const origin = plan.resources.find((r) => r.id === resource.of);
 			if (!origin) return void 0;
-			return plan.containers.includes("caddy") ? `https://${hostFor(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
+			return plan.containers.includes("caddy") ? `https://${hostFor$1(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
 		}
 		case "cache":
 			if (resource.of) {
@@ -2865,14 +2900,7 @@ var WorkerNameTaken = class extends require_errors.GkmError {
 * @param background Each worker's files, from discovery's `background`.
 */
 function workerUnits(workspace, manifest, background) {
-	const hosts = Object.entries(workspace.apps).filter(([, app]) => app.type === "backend" && !app.entry).map(([name, app]) => {
-		const surface = Object.entries(manifest).find(([id, d]) => d.kind === "rest-api" && require_derive.appKey(id) === name)?.[1];
-		return {
-			name,
-			root: (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path),
-			generated: !(surface?.kind === "rest-api" && surface.endpoints.length > 0)
-		};
-	}).sort((a, b) => a.name.localeCompare(b.name));
+	const hosts = hostApps(workspace, manifest);
 	const units = [];
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "worker") continue;
@@ -2880,12 +2908,8 @@ function workerUnits(workspace, manifest, background) {
 		if (files.length === 0) continue;
 		const name = require_derive.appKey(id);
 		if (workspace.apps[name]) throw new WorkerNameTaken(id, name);
-		const ranked = hosts.map((host) => ({
-			host,
-			holds: files.filter((file) => isUnder(file, host.root)).length
-		})).sort((a, b) => b.holds - a.holds || Number(b.host.generated) - Number(a.host.generated));
-		const host = ranked[0]?.host;
-		if (!host || ranked[0].holds === 0 && !host.generated) throw new WorkerHasNoApp(id);
+		const host = hostFor(hosts, files);
+		if (!host) throw new WorkerHasNoApp(id);
 		units.push({
 			id,
 			name,
@@ -2894,6 +2918,70 @@ function workerUnits(workspace, manifest, background) {
 	}
 	return units.sort((a, b) => a.name.localeCompare(b.name));
 }
+/** The service and image name of a file server's processors: `assets-processors`. */
+function processorUnitName(fileServerId) {
+	return `${require_derive.appKey(fileServerId.replace(/Server$/, ""))}-processors`;
+}
+/** A file server with processors and no backend app to build them from. */
+var ProcessorsHaveNoApp = class extends require_errors.GkmError {
+	fileServer;
+	constructor(fileServer) {
+		super(`The file server '${fileServer}' has processors, and the workspace has no backend app that builds a server to carry their entry. Declare a RestApi whose app holds the processors' code.`);
+		this.fileServer = fileServer;
+		this.name = "ProcessorsHaveNoApp";
+	}
+};
+/**
+* The processor units a workspace deploys — each file server with processors
+* — and the app each is built from, chosen as a worker's is: the backend app
+* holding the most of its processors' files.
+*/
+function processorUnits(workspace, manifest) {
+	const hosts = hostApps(workspace, manifest);
+	const units = [];
+	for (const declaration of Object.values(manifest)) {
+		if (declaration.kind !== "file-server") continue;
+		const processors = declaration.processors ?? [];
+		if (processors.length === 0) continue;
+		const host = hostFor(hosts, processors.map(({ handler }) => {
+			const file = handler.split("#")[0] ?? handler;
+			return (0, node_path.isAbsolute)(file) ? file : (0, node_path.join)(workspace.root, file);
+		}));
+		if (!host) throw new ProcessorsHaveNoApp(declaration.id);
+		const name = processorUnitName(declaration.id);
+		if (workspace.apps[name]) throw new WorkerNameTaken(declaration.id, name);
+		units.push({
+			id: declaration.id,
+			name,
+			app: host.name
+		});
+	}
+	return units.sort((a, b) => a.name.localeCompare(b.name));
+}
+/** The backend apps whose builds generate a server, each where it lives. */
+function hostApps(workspace, manifest) {
+	return Object.entries(workspace.apps).filter(([, app]) => app.type === "backend" && !app.entry).map(([name, app]) => {
+		const surface = Object.entries(manifest).find(([id, d]) => d.kind === "rest-api" && require_derive.appKey(id) === name)?.[1];
+		return {
+			name,
+			root: (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path),
+			generated: !(surface?.kind === "rest-api" && surface.endpoints.length > 0)
+		};
+	}).sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* The app holding the most of these files; then one that generates a server;
+* then by name. None when no app holds any and none generates a server.
+*/
+function hostFor(hosts, files) {
+	const ranked = hosts.map((host) => ({
+		host,
+		holds: files.filter((file) => isUnder(file, host.root)).length
+	})).sort((a, b) => b.holds - a.holds || Number(b.host.generated) - Number(a.host.generated));
+	const host = ranked[0]?.host;
+	if (!host || ranked[0].holds === 0 && !host.generated) return void 0;
+	return host;
+}
 /** Whether `file` is inside `dir`. */
 function isUnder(file, dir) {
 	const rel = (0, node_path.relative)(dir, file);
@@ -3543,6 +3631,8 @@ function generateBackendDockerfile(options) {
 }
 /** The port a worker answers its health check on, inside its container. */
 const WORKER_PORT = 3e3;
+/** The port a processor unit answers on, inside its container. */
+const PROCESSOR_PORT = 3e3;
 /**
 * A Worker's image: the same build as its host app's backend — a pruned
 * slice, `gkm build --provider server --production` in the image, with the
@@ -3559,6 +3649,19 @@ function generateWorkerDockerfile(options) {
 		expose: false
 	});
 }
+/**
+* A file server's processor unit: its host app's build, and the unit's bundle
+* as the runner. Its native packages — `sharp` — are installed for the image's
+* platform beside the bundle, at the versions the build resolved.
+*/
+function generateProcessorDockerfile(options) {
+	return gkmBundleDockerfile(options, {
+		title: `Processors Dockerfile (${options.fileServer})`,
+		bundle: options.bundle,
+		as: "processors.mjs",
+		expose: true
+	});
+}
 function gkmBundleDockerfile(options, runner) {
 	const { port, healthCheckPath = "/health" } = options;
 	const { app } = layout(options);
@@ -3585,7 +3688,7 @@ RUN apk add --no-cache tini
 RUN addgroup --system --gid 1001 nodejs && \\
     adduser --system --uid 1001 hono
 
-# The bundled ${runner.as === "server.mjs" ? "server" : "worker"}
+# The bundled ${runner.as.replace(/\.mjs$/, "")}
 COPY --from=builder --chown=hono:nodejs ${app}/.gkm/server/dist/${runner.bundle} ./${runner.as === runner.bundle ? "" : runner.as}${externals.copy}
 
 ENV NODE_ENV=production
@@ -4077,7 +4180,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
 		case "s3": {
-			const { S3SecretsStore } = await Promise.resolve().then(() => require("./s3-DwKLXwUT.cjs"));
+			const { S3SecretsStore } = await Promise.resolve().then(() => require("./s3-pqgmCTOq.cjs"));
 			const { deployIdentity } = await Promise.resolve().then(() => require("./identity-CbLfgQNT.cjs")).then((n) => n.identity_exports);
 			const location = require_workspace.s3SecretsLocation(config, workspace.state);
 			return new S3SecretsStore({
@@ -5681,7 +5784,7 @@ async function reconcile(options) {
 		...options.apps ? { apps: options.apps(plan.containers) } : {},
 		...options.objectWebhooks?.length ? { objectWebhooks: options.objectWebhooks } : {}
 	});
-	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
+	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses, options.processorAddresses));
 	const hash = planHash(plan, compose, {
 		caddyfile,
 		postgres: postgresStatements(plan, project, seed).map((statement) => statement.create).join(";\n")
@@ -5860,6 +5963,7 @@ var workspace_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	fakesApply: () => fakesApply,
 	localObjectWebhooks: () => localObjectWebhooks,
 	metroPorts: () => metroPorts,
+	processorAddresses: () => processorAddresses,
 	reconcileWorkspace: () => reconcileWorkspace,
 	surfaceAddresses: () => surfaceAddresses
 });
@@ -5951,6 +6055,7 @@ async function reconcileWorkspace(workspace, options) {
 		...backendsOf(workspace),
 		saved: await loadPortState(workspace.root),
 		addresses: surfaceAddresses(workspace, manifest),
+		processorAddresses: processorAddresses(workspace, manifest),
 		metroPorts: metroPorts(workspace, manifest),
 		fakes,
 		credentialFakes,
@@ -6017,6 +6122,19 @@ function metroPorts(workspace, manifest) {
 	return ports;
 }
 /**
+* Where each file server's processors answer locally: the dev server of the
+* app holding them, which `gkm dev` mounts them on — the same app whose build
+* writes their unit deployed.
+*/
+function processorAddresses(workspace, manifest) {
+	const addresses = {};
+	for (const unit of processorUnits(workspace, manifest)) {
+		const port = workspace.apps[unit.app]?.port;
+		if (port) addresses[unit.id] = localAddress(port);
+	}
+	return addresses;
+}
+/**
 * Where each declared surface and site answers locally.
 *
 * The addresses come from the ports the workspace already assigns; which
@@ -6195,6 +6313,21 @@ function workerEnvKeys(manifest, workerId, runnables = {}) {
 	return keys;
 }
 /** What each construct an edge reaches hands the process that reaches it. */
+/**
+* The keys a file server's processor unit reads: its bucket's, and what each
+* of its processors depends on. `undefined` for a file server with none.
+*/
+function processorEnvKeys(manifest, fileServerId, runnables = {}) {
+	const server = manifest[fileServerId];
+	if (server?.kind !== "file-server" || !server.processors?.length) return;
+	const keys = /* @__PURE__ */ new Set();
+	addEdgeKeys(manifest, [
+		server.of,
+		...server.processors.flatMap((p) => p.dependencies.map((d) => d.target)),
+		...runnables[fileServerId] ?? []
+	], keys);
+	return keys;
+}
 function addEdgeKeys(manifest, edges, keys) {
 	for (const id of edges) {
 		const bucket = require_discover.eventsEdgeBucket(id);
@@ -6662,6 +6795,308 @@ function validateImageRef(ref) {
 	return ref;
 }
 //#endregion
+//#region src/providers/processorOrigin.ts
+/**
+* A file server's processors as a CDN origin: the names both sides agree on.
+*
+* On a compose stage whose bucket is on S3, the CDN serves the bucket and
+* sends each processor pattern to the stack's processor unit, at a host of
+* its own. That host is public — a CDN reaches its origin over the internet —
+* so the CDN adds a secret header and the edge refuses any request without
+* it. One definition, read by the CDN that sends the header and by the stack
+* whose edge checks it, so the two cannot drift.
+*/
+/** The header the CDN adds to every request it sends a processor. */
+const ORIGIN_VERIFY_HEADER = "X-Gkm-Origin-Verify";
+/** Where a file server's processors answer the CDN: `<fileserver>-processors.<domain>`. */
+function processorOriginHost(serverId, domain) {
+	return `${require_derive.appKey(serverId)}-processors.${domain}`.toLowerCase();
+}
+/** The stage secret holding the header's value: `ASSETS_SERVER_ORIGIN_SECRET`. */
+function originSecretKey(serverId) {
+	return (0, _geekmidas_manifest.provideKey)(serverId, "originSecret");
+}
+/**
+* What the processor unit reads that secret from. Set wherever the CDN fronts
+* it, so the unit refuses a request without the header itself — on Dokploy,
+* whose edge cannot match a header, the only check; behind the stack's own
+* edge, a second one.
+*/
+const PROCESSOR_ORIGIN_SECRET_ENV = "GKM_PROCESSOR_ORIGIN_SECRET";
+/** A new value for that secret: random, generated once, kept in the stage. */
+function newOriginSecret() {
+	return (0, node_crypto.randomBytes)(32).toString("base64url");
+}
+//#endregion
+//#region src/generators/ProcessorGenerator.ts
+/** Where a file server's processor entry lives, under an app's `.gkm/server`. */
+function processorEntryDir(serverDir, fileServerId) {
+	return (0, node_path.join)(serverDir, "processors", processorUnitName(fileServerId));
+}
+/** The file its bundle is written to, beside the server's. */
+function processorBundleName(fileServerId) {
+	return `${processorUnitName(fileServerId)}.mjs`;
+}
+/**
+* A file server's processors, as the build generates them.
+*
+* On AWS each is a Lambda behind a function URL — the CDN's origin for its
+* pattern. On a server they are one process per file server, the processor
+* unit (see {@link ProcessorGenerator.buildEntry}), so the `server` target
+* generates nothing per processor here.
+*/
+var ProcessorGenerator = class extends require_discover.ConstructGenerator {
+	isConstruct(value) {
+		return _geekmidas_constructs_processors.Processor.isProcessor(value);
+	}
+	async build(context, constructs, outputDir, options) {
+		if ((options?.target ?? "aws") !== "aws" || constructs.length === 0) return [];
+		const dir = (0, node_path.join)(outputDir, "processors");
+		await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+		const infos = [];
+		for (const { key, construct, path } of constructs) {
+			const file = (0, node_path.join)(dir, `${key}.ts`);
+			const importPath = (0, node_path.relative)((0, node_path.dirname)(file), path.relative).replace(/\.ts$/, ".js");
+			await (0, node_fs_promises.writeFile)(file, `import { AWSLambdaProcessor } from '@geekmidas/constructs/processors';
+import { ${key} } from '${importPath}';
+${context.storageDrivers?.imports ?? ""}
+${context.storageDrivers?.setup ? `\n// The handler registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
+const adapter = new AWSLambdaProcessor(${key});
+
+export const handler = adapter.handler;
+`);
+			infos.push(await processorInfo(key, construct, (0, node_path.relative)(options?.root ?? process.cwd(), file).replace(/\.ts$/, ".handler"), context));
+		}
+		return infos;
+	}
+	/**
+	* `gkm dev`'s half: `processors.ts` beside the dev server's app, mounting
+	* each file server's processors under `/__gkm/processors/<FileServer>`.
+	* The local edge sends each pattern on the file server's host there, so
+	* `processedUrl()` answers locally as it does deployed.
+	*
+	* In the dev server's own process rather than a unit of its own: locally
+	* there is no CPU to protect, and the dev server already reloads on change.
+	*/
+	async buildDev(outputDir, processors) {
+		await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
+		const file = (0, node_path.join)(outputDir, "processors.ts");
+		const imports = processors.map(({ key, path }) => {
+			const specifier = (0, node_path.relative)(outputDir, path.absolute).replace(/\.ts$/, ".js");
+			return `import { ${key} } from '${specifier.startsWith(".") ? specifier : `./${specifier}`}';`;
+		}).join("\n");
+		const byServer = /* @__PURE__ */ new Map();
+		for (const { key, construct } of processors) byServer.set(construct.surfaceId, [...byServer.get(construct.surfaceId) ?? [], key]);
+		const units = [...byServer.entries()].map(([id, keys]) => `    ${JSON.stringify(id)}: [${keys.join(", ")}],`).join("\n");
+		await (0, node_fs_promises.writeFile)(file, `/**
+ * Generated processors setup for \`gkm dev\`.
+ *
+ * Each file server's processors, under ${PROCESSORS_DEV_PREFIX}<FileServer>: the
+ * local edge rewrites each processor pattern on the file server's host here.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import { processorServer } from '@geekmidas/constructs/processors';
+${imports}
+
+export function setupProcessors(
+  app: { all: (path: string, handler: (c: any) => unknown) => unknown },
+  envParser: EnvironmentParser<any>,
+): void {
+  const units: Record<string, ReturnType<typeof processorServer>> = Object.fromEntries(
+    Object.entries({
+${units}
+    }).map(([id, processors]) => [id, processorServer(processors, envParser)]),
+  );
+
+  app.all('${PROCESSORS_DEV_PREFIX}:server/*', async (c: any) => {
+    const server = c.req.param('server') as string;
+    const serve = units[server];
+    if (!serve) return c.notFound();
+    const path = c.req.path.slice(\`${PROCESSORS_DEV_PREFIX}\${server}\`.length) || '/';
+    const response = await serve({ method: c.req.method, path });
+    if (!response) {
+      return new Response(null, {
+        status: 404,
+        headers: { 'cache-control': 'public, max-age=60' },
+      });
+    }
+    return new Response(c.req.method === 'HEAD' ? null : response.body, {
+      status: response.status,
+      headers: response.headers,
+    });
+  });
+}
+`);
+		return file;
+	}
+	/**
+	* A file server's processor unit: one process answering each of its
+	* processors' patterns, and `/health`. Returns its entry, `processors.ts`.
+	*
+	* Its own process because making a derivative is CPU-bound — a resize
+	* spike in the API's process would be every request's latency.
+	*/
+	async buildEntry(input) {
+		const { context, outputDir, processors } = input;
+		await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
+		await require_EndpointGenerator.writeTelemetryModule(outputDir, input.telemetry);
+		const healthCheck = context.production?.healthCheck ?? "/health";
+		const imports = processors.map(({ key, path }) => {
+			const specifier = (0, node_path.relative)(outputDir, path.absolute).replace(/\.ts$/, ".js");
+			return `import { ${key} } from '${specifier.startsWith(".") ? specifier : `./${specifier}`}';`;
+		}).join("\n");
+		const entry = (0, node_path.join)(outputDir, "processors.ts");
+		await (0, node_fs_promises.writeFile)(entry, `#!/usr/bin/env node
+/**
+ * Production entry for ${input.fileServerId}'s processors.
+ * Generated by 'gkm build --production'.
+ *
+ * Answers each processor's pattern, and ${healthCheck} on PORT. The edge
+ * routes only those patterns here; everything else on the file server's
+ * domain is the bucket.
+ */
+import { timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { runShutdownHooks } from '@geekmidas/constructs';
+import { processorServer } from '@geekmidas/constructs/processors';
+${context.storageDrivers?.imports ?? ""}
+${imports}
+
+${require_EndpointGenerator.startTelemetryCode([healthCheck])}
+${context.storageDrivers?.setup ? `// The entry point registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
+process.env.GKM_APP_NAME ??= ${JSON.stringify(processorUnitName(input.fileServerId))};
+
+const processors = [${processors.map(({ key }) => key).join(", ")}];
+const serve = processorServer(processors);
+const port = Number(process.env.PORT) || 3000;
+let stopping = false;
+
+${input.telemetry ? REQUEST_SPANS : NO_REQUEST_SPANS}
+// Where the CDN fronts this unit, the secret it adds to every request: one
+// without it is refused here, whatever the edge in front did or could not.
+const originSecret = process.env.${PROCESSOR_ORIGIN_SECRET_ENV}
+  ? Buffer.from(process.env.${PROCESSOR_ORIGIN_SECRET_ENV})
+  : undefined;
+const fromOrigin = (header: string | string[] | undefined) => {
+  if (!originSecret) return true;
+  const given = Buffer.from(typeof header === 'string' ? header : '');
+  return given.length === originSecret.length && timingSafeEqual(given, originSecret);
+};
+
+const server = createServer(async (req, res) => {
+  const method = req.method ?? 'GET';
+  const path = (req.url ?? '/').split('?')[0] ?? '/';
+  if (path === ${JSON.stringify(healthCheck)}) {
+    res.writeHead(stopping ? 503 : 200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ status: stopping ? 'stopping' : 'ok' }));
+    return;
+  }
+  if (!fromOrigin(req.headers[${JSON.stringify(ORIGIN_VERIFY_HEADER.toLowerCase())}])) {
+    res.writeHead(403, { 'cache-control': 'no-store' }).end();
+    return;
+  }
+  await traced(method, path, async () => {
+    try {
+      const response = await serve({ method, path });
+      if (!response) {
+        res.writeHead(404, { 'cache-control': 'public, max-age=60' }).end();
+        return 404;
+      }
+      res.writeHead(response.status, response.headers);
+      res.end(method === 'HEAD' ? undefined : response.body);
+      return response.status;
+    } catch (error) {
+      console.error(error);
+      res.writeHead(500, { 'cache-control': 'no-store' }).end();
+      return 500;
+    }
+  });
+});
+server.listen(port);
+
+const shutdown = async () => {
+  if (stopping) return;
+  stopping = true;
+  setTimeout(() => process.exit(1), Number(process.env.GKM_SHUTDOWN_TIMEOUT_MS) || 8000).unref();
+  server.close();
+  await runShutdownHooks((error) => console.error(error));
+  process.exit(0);
+};
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
+`);
+		return entry;
+	}
+};
+/**
+* A SERVER span per request, once telemetry has started — opened by the unit
+* rather than by hooking node:http, which sees nothing inside a bundle. Named
+* after the processor's pattern, never the key, which has no bound.
+*
+* Only in an entry whose file server has a `Telemetry` node: the bundle
+* follows the import, and an app without one need not install the API.
+*/
+const REQUEST_SPANS = `const tracing = requestSpans ? await import('@opentelemetry/api') : undefined;
+const routeOf = (path: string) =>
+  processors.find((processor) => path.startsWith(processor.prefix))?.pattern;
+
+async function traced(
+  method: string,
+  path: string,
+  run: () => Promise<number>,
+): Promise<void> {
+  if (!tracing) {
+    await run();
+    return;
+  }
+  const route = routeOf(path);
+  await tracing.trace.getTracer('@geekmidas/processors').startActiveSpan(
+    route ? \`\${method} \${route}\` : method,
+    {
+      kind: tracing.SpanKind.SERVER,
+      attributes: {
+        'http.request.method': method,
+        'url.path': path,
+        ...(route ? { 'http.route': route } : {}),
+      },
+    },
+    async (span) => {
+      try {
+        const status = await run();
+        span.setAttribute('http.response.status_code', status);
+        if (status >= 500) span.setStatus({ code: tracing.SpanStatusCode.ERROR });
+      } finally {
+        span.end();
+      }
+    },
+  );
+}
+`;
+/** The same shape without telemetry: each request just runs. */
+const NO_REQUEST_SPANS = `async function traced(
+  _method: string,
+  _path: string,
+  run: () => Promise<number>,
+): Promise<void> {
+  await run();
+}
+`;
+/** What the manifest records of one processor. */
+async function processorInfo(name, processor, handler, context) {
+	return {
+		name,
+		handler,
+		fileServer: processor.surfaceId,
+		path: processor.pattern,
+		prefix: processor.prefix,
+		...processor.native.length ? { native: [...processor.native] } : {},
+		...processor.timeout !== void 0 ? { timeout: processor.timeout } : {},
+		...processor.memorySize !== void 0 ? { memorySize: processor.memorySize } : {},
+		environment: await processor.getEnvironment({ markOptional: context.markOptional }),
+		dependencies: processor.constructs
+	};
+}
+//#endregion
 //#region src/generators/CronGenerator.ts
 var CronGenerator = class extends require_discover.ConstructGenerator {
 	async build(context, constructs, outputDir, options) {
@@ -7572,6 +8007,25 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 			imageName: imageNames[worker.name] ?? worker.name
 		});
 	}
+	for (const unit of manifest ? processorUnits(workspace, manifest) : []) {
+		logger$1.log(`\n   📄 Generating Dockerfile for ${unit.name} (processors of ${unit.id}, built from ${unit.app})`);
+		const dockerfile = processorDockerfile(unit, workspace.apps[unit.app], {
+			layout,
+			workspaceRoot: workspace.root,
+			native: processorNative(manifest, unit.id)
+		});
+		const path = workerDockerfileOf(unit.name);
+		const dockerfilePath = (0, node_path.join)(workspace.root, path);
+		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(dockerfilePath), { recursive: true });
+		await (0, node_fs_promises.writeFile)(dockerfilePath, dockerfile);
+		logger$1.log(`      Generated: ${path}`);
+		results.push({
+			appName: unit.name,
+			type: "backend",
+			dockerfile: dockerfilePath,
+			imageName: imageNames[unit.name] ?? unit.name
+		});
+	}
 	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
 	logger$1.log(`\n   Ensured: ${dockerignorePath}`);
 	const composePath = await writeConstructsCompose(workspace);
@@ -7631,6 +8085,29 @@ function workerDockerfile(worker, host, options) {
 		...options.cache ? { cache: options.cache } : {}
 	});
 }
+/** The native packages a file server's processors named, once each. */
+function processorNative(manifest, fileServerId) {
+	const server = manifest[fileServerId];
+	if (server?.kind !== "file-server") return [];
+	return [...new Set((server.processors ?? []).flatMap((p) => p.native ?? []))].sort();
+}
+/**
+* A file server's processor unit's Dockerfile: its host app's build, and the
+* unit's bundle as the runner, with its processors' native packages
+* installed beside it — see `generateProcessorDockerfile`.
+*/
+function processorDockerfile(unit, host, options) {
+	return generateProcessorDockerfile({
+		...appImageOptions(options.layout, unit.app, host, options.workspaceRoot),
+		imageName: unit.name,
+		port: PROCESSOR_PORT,
+		fileServer: unit.id,
+		bundle: processorBundleName(unit.id),
+		healthCheckPath: "/health",
+		...options.native.length ? { external: [...options.native] } : {},
+		...options.cache ? { cache: options.cache } : {}
+	});
+}
 /**
 * A site's Dockerfile, with an `ARG` for every key its bundler inlines.
 *
@@ -7808,7 +8285,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-0z5RAN1k.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-BTdtqhI_.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8795,12 +9272,36 @@ Object.defineProperty(exports, "NoDomainForStage", {
 		return NoDomainForStage;
 	}
 });
+Object.defineProperty(exports, "ORIGIN_VERIFY_HEADER", {
+	enumerable: true,
+	get: function() {
+		return ORIGIN_VERIFY_HEADER;
+	}
+});
+Object.defineProperty(exports, "PROCESSOR_ORIGIN_SECRET_ENV", {
+	enumerable: true,
+	get: function() {
+		return PROCESSOR_ORIGIN_SECRET_ENV;
+	}
+});
+Object.defineProperty(exports, "PROCESSOR_PORT", {
+	enumerable: true,
+	get: function() {
+		return PROCESSOR_PORT;
+	}
+});
 Object.defineProperty(exports, "PROVIDER_KINDS", {
 	enumerable: true,
 	get: function() {
 		return PROVIDER_KINDS;
 	}
 });
+Object.defineProperty(exports, "ProcessorGenerator", {
+	enumerable: true,
+	get: function() {
+		return ProcessorGenerator;
+	}
+});
 Object.defineProperty(exports, "QueueGenerator", {
 	enumerable: true,
 	get: function() {
@@ -9152,7 +9653,7 @@ Object.defineProperty(exports, "getKeyPath", {
 Object.defineProperty(exports, "hostFor", {
 	enumerable: true,
 	get: function() {
-		return hostFor;
+		return hostFor$1;
 	}
 });
 Object.defineProperty(exports, "imageBuildCredentials", {
@@ -9287,6 +9788,12 @@ Object.defineProperty(exports, "networkEnv", {
 		return networkEnv;
 	}
 });
+Object.defineProperty(exports, "newOriginSecret", {
+	enumerable: true,
+	get: function() {
+		return newOriginSecret;
+	}
+});
 Object.defineProperty(exports, "normalizeDnsConfig", {
 	enumerable: true,
 	get: function() {
@@ -9299,6 +9806,12 @@ Object.defineProperty(exports, "orchestrateDns", {
 		return orchestrateDns;
 	}
 });
+Object.defineProperty(exports, "originSecretKey", {
+	enumerable: true,
+	get: function() {
+		return originSecretKey;
+	}
+});
 Object.defineProperty(exports, "pgClient", {
 	enumerable: true,
 	get: function() {
@@ -9365,6 +9878,54 @@ Object.defineProperty(exports, "primaryPortKey", {
 		return primaryPortKey;
 	}
 });
+Object.defineProperty(exports, "processorBundleName", {
+	enumerable: true,
+	get: function() {
+		return processorBundleName;
+	}
+});
+Object.defineProperty(exports, "processorDockerfile", {
+	enumerable: true,
+	get: function() {
+		return processorDockerfile;
+	}
+});
+Object.defineProperty(exports, "processorEntryDir", {
+	enumerable: true,
+	get: function() {
+		return processorEntryDir;
+	}
+});
+Object.defineProperty(exports, "processorEnvKeys", {
+	enumerable: true,
+	get: function() {
+		return processorEnvKeys;
+	}
+});
+Object.defineProperty(exports, "processorInfo", {
+	enumerable: true,
+	get: function() {
+		return processorInfo;
+	}
+});
+Object.defineProperty(exports, "processorNative", {
+	enumerable: true,
+	get: function() {
+		return processorNative;
+	}
+});
+Object.defineProperty(exports, "processorOriginHost", {
+	enumerable: true,
+	get: function() {
+		return processorOriginHost;
+	}
+});
+Object.defineProperty(exports, "processorUnits", {
+	enumerable: true,
+	get: function() {
+		return processorUnits;
+	}
+});
 Object.defineProperty(exports, "projectKey", {
 	enumerable: true,
 	get: function() {
@@ -9678,4 +10239,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-DOfxmDRO.cjs.map
+//# sourceMappingURL=seeds-CPEcmoPn.cjs.map