@geekmidas/cli 10.0.0-alpha.31 → 10.0.0-alpha.33

package/dist/index.cjs

@@ -2,13 +2,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_discover = require("./discover-CroTIm0K.cjs");
-const require_config = require("./config-URVD4bTj.cjs");
-const require_workspace = require("./workspace-Bav3TVrP.cjs");
+const require_config = require("./config-DMpzmsQL.cjs");
+const require_workspace = require("./workspace-CAJk6UmC.cjs");
 const require_storage = require("./storage-C2JC31V9.cjs");
-const require_workspace$1 = require("./workspace-BhiMkRuA.cjs");
+const require_workspace$1 = require("./workspace-C8TbIWxO.cjs");
 const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-D1nhN98m.cjs");
 const require_openapi = require("./openapi.cjs");
-const require_ready = require("./ready-DXtNfk7v.cjs");
+const require_ready = require("./ready-CXhoutix.cjs");
 const require_emit = require("./emit-BdoPFjZf.cjs");
 const require_reconcile = require("./reconcile-BxZTV2vl.cjs");
 let commander = require("commander");
@@ -42,7 +42,7 @@ let _geekmidas_constructs_subscribers = require("@geekmidas/constructs/subscribe
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
 //#region package.json
-var version = "10.0.0-alpha.31";
+var version = "10.0.0-alpha.33";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1091,7 +1091,10 @@ async function workspaceDevCommand(workspace, options) {
 		...rawSecrets,
 		...reconciled.env
 	};
-	await Promise.resolve().then(() => require("./migrate-BuCx7tIv.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	if (options.migrate || options.seed) {
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs"));
+		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
+	} else await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$10.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -8304,7 +8307,7 @@ function layoutBlock(options, template) {
 	const { database } = options.constructs;
 	const isWorker = template.name === "worker";
 	if (monorepo) return `constructs/          # every construct: the surface, the database, topics
-${database ? "db/<construct>/      # migrations, one folder per database construct\n" : ""}${apiPath}/            # the API app
+${database ? "db/<construct>/      # migrations/ and seeds/, one folder per database construct\n" : ""}${apiPath}/            # the API app
 gkm.config.ts        # name, constructs glob, secrets`;
 	const lines = ["src/constructs/      # the surface, and anything it declares", "src/config/          # env parser, logger"];
 	if (!isWorker) lines.push("src/endpoints/       # HTTP handlers");
@@ -8312,7 +8315,7 @@ gkm.config.ts        # name, constructs glob, secrets`;
 		lines.push("src/crons/           # scheduled work");
 		lines.push("src/subscribers/     # topic consumers");
 	}
-	if (database) lines.push("db/<construct>/      # migrations, one folder per database construct");
+	if (database) lines.push("db/<construct>/      # migrations/ and seeds/, one folder per database construct");
 	lines.push("gkm.config.ts        # name, constructs glob, secrets");
 	return lines.join("\n");
 }
@@ -8441,32 +8444,52 @@ Queries go through Kysely. Never open your own connection pool — the one the
 construct provides is the one that gets credentials, pooling and shutdown.`;
 }
 function migrationsSection() {
-	return `## Migrations
+	return `## Migrations and seeds
 
 Each database construct has its own folder, named after the construct:
 \`Database\` is \`db/database/\`, a tenant \`AuthDatabase\` is
-\`db/auth-database/\`. Each keeps its own history, in its own schema, and is
-migrated as its own **owner** role — the role a handler runs as cannot create a
+\`db/auth-database/\`. It holds two folders and nothing else:
+
+\`\`\`
+db/database/
+  migrations/   # the schema's history, applied once each
+  seeds/        # the reference data the app needs, run on every pass
+\`\`\`
+
+Each construct keeps its own history, in its own schema, and is migrated and
+seeded as its own **owner** role — the role a handler runs as cannot create a
 table.
 
 \`\`\`bash
-gkm migration database add_workouts   # db/database/20260930143012_add_workouts.ts
+gkm migration database add_workouts   # db/database/migrations/20260930143012_add_workouts.ts
 gkm migration auth                    # Better Auth's schema change, as SQL
-gkm migrate                           # apply every folder, parents first
+gkm migrate                           # apply every construct's migrations, parents first
 gkm migrate database                  # apply one construct's
+gkm seed                              # migrate, then run every seed
+gkm dev --migrate                     # migrate before the apps start
+gkm dev --seed                        # migrate and seed before the apps start
 \`\`\`
 
-- Files are \`<UTC timestamp>_<name>.ts\` exporting \`up\` (and \`down\`), or
-  \`.sql\`, which runs whole. Never rename or edit one that has been applied —
-  it is recorded by name. Change the schema with a new migration.
+- Migrations are \`<UTC timestamp>_<name>.ts\` exporting \`up\` (and
+  \`down\`), or \`.sql\`, which runs whole. Never rename or edit one that has
+  been applied — it is recorded by name. Change the schema with a new
+  migration.
 - Write migrations with \`Kysely<unknown>\` and snake_case names: they are the
   SQL, and the camelCase plugin is the app's, not theirs.
 - \`gkm migration auth\` compares Better Auth's schema to its tenant and writes
   only the difference. Run it after adding a Better Auth plugin, and commit the
   file.
-- Tests migrate themselves: the root vitest config's
-  \`globalSetup: ['@geekmidas/cli/vitest']\` applies every folder to the test
-  stage before any test runs. \`gkm dev\` only reports what is pending.
+- Seeds always run after migrations, never instead of them. Each is a
+  \`.ts\` exporting \`seed(db, { stage })\`, or \`.sql\`, run in name
+  order, in a transaction of its own.
+- **Seeds run on every stage, production included.** Write them to be safe
+  there. A seed that belongs only somewhere checks the stage it is handed:
+  \`if (stage === 'production') return;\`. A \`.sql\` seed has no stage, so
+  it must be right everywhere.
+- Tests migrate and seed themselves: the root vitest config's
+  \`globalSetup: ['@geekmidas/cli/vitest']\` does both for the test stage
+  before any test runs. \`gkm dev\` without a flag only reports what is
+  pending.
 - A deploy migrates before the new version goes live, so the old version runs
   against the new schema until it is replaced. Keep each migration compatible
   with the code before it: add a column in one release, stop using the old one,
@@ -8475,29 +8498,26 @@ gkm migrate database                  # apply one construct's
 **Migrations hold schema, never data.** Tables, columns, constraints, indexes.
 No inserts, updates or deletes against the application's rows.
 
-- **Data the code defines lives in the code.** A permission catalogue, the
-  system roles, a list of statuses — if a constant in the source already says
-  what they are, a table holding them is a copy, and a copy drifts. Keep the
-  constant; store only what users create (a custom role, which permission keys
-  it grants), checked against the constant in code.
-- **Define it once, typed, where every app can import it.** A catalogue in
-  code belongs in a shared package (\`packages/models\`), declared \`as const\`
-  so its keys are a union type. The API's guards, the web app's gates and a
-  mobile app's gates then all name the same keys, and a typo — or a removed
+- **Reference data is a seed.** A permission catalogue, the roles and what
+  they grant, a list of statuses — rows the app needs in order to run — are
+  written by a seed in \`db/<construct>/seeds/\`, never by a migration.
+- **A seed is an upsert, run every time.** There is no history: every seed
+  runs on every \`gkm seed\`, so changing what it writes and running it again
+  is how the change is applied. Write \`onConflict(…).doUpdateSet(…)\` (or
+  \`doNothing()\`), never a bare insert.
+- **Define it once, typed, where every app can import it.** A catalogue
+  belongs in code, declared \`as const\` so its keys are a union type, and the
+  seed writes the table from that constant — so the two cannot drift, and no
+  test is needed to keep them in step. The API's guards, the web app's gates
+  and a mobile app's gates all name the same keys, and a typo — or a removed
   permission still checked somewhere — fails to compile instead of failing
   closed at runtime.
-- **A rule is not a row.** "Every user is a member", "a super admin has every
-  permission" are logic. A row per user, or a grant per permission, is a
-  snapshot of the rule that goes stale the moment the rule's inputs change.
-- **Nothing needs seeding to run.** If the app fails without some rows present,
-  those rows are code in the wrong place. Sample and demo data comes from test
-  factories — never a migration, never a deploy.
-- **A backfill is the one exception.** When a schema change needs existing rows
-  transformed — a new non-null column filled from an old one — do it in the
-  same migration, keyed on the rows it transforms. It never inserts rows that
-  were not there.
-- **A test that only keeps two copies in step is the smell.** Delete a copy,
-  and the test with it.`;
+- **Sample data is factories'.** Demo users, a tournament for a test — those
+  come from test factories, never a seed and never a migration.
+- **A backfill is the one data change a migration makes.** When a schema
+  change needs existing rows transformed — a new non-null column filled from
+  an old one — do it in the same migration, keyed on the rows it transforms.
+  It never inserts rows that were not there.`;
 }
 function queriesSection() {
 	return `## Writing queries and relations
@@ -8626,7 +8646,27 @@ functions it called on the way.
 ${database ? "gkm test       # starts services, injects secrets, then runs vitest" : "gkm test"}
 \`\`\`
 
-Run tests through \`gkm test\`, not \`vitest\` directly${database ? " — it is what starts the database and injects the secrets the suite needs" : ""}.`;
+Run tests through \`gkm test\`, not \`vitest\` directly${database ? " — it is what starts the database and injects the secrets the suite needs" : ""}.${database ? `
+
+**Factories, one per database.** \`test/factories/<construct>.ts\` at the
+project root — \`database.ts\` for \`Database\` — exports
+\`createFactory(db)\`. A feature test gets each by service name, on that
+test's transaction — the one \`db.get\` returns and its endpoints use — so
+ask for it rather than importing and building one. Sign in the way a person
+does, through \`browser.signIn\`:
+
+\`\`\`typescript
+it('reads a user', async ({ browser, db, factories }) => {
+  const factory = await factories.get('database');
+  const ada = await factory.insert('users', { email: 'ada@example.com' });
+
+  await browser.signIn(ada.email);
+  // … act through browser.api …
+
+  const app = await db.get('database');
+  // … assert on what was written …
+});
+\`\`\`` : ""}`;
 }
 //#endregion
 //#region src/init/dependencies.ts
@@ -8754,26 +8794,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.31",
-	"@geekmidas/auth": "~10.0.0-alpha.31",
-	"@geekmidas/cache": "~10.0.0-alpha.31",
-	"@geekmidas/client": "~10.0.0-alpha.31",
-	"@geekmidas/cloud": "~10.0.0-alpha.31",
-	"@geekmidas/constructs": "~10.0.0-alpha.31",
-	"@geekmidas/db": "~10.0.0-alpha.31",
-	"@geekmidas/emailkit": "~10.0.0-alpha.31",
-	"@geekmidas/envkit": "~10.0.0-alpha.31",
-	"@geekmidas/errors": "~10.0.0-alpha.31",
-	"@geekmidas/events": "~10.0.0-alpha.31",
-	"@geekmidas/logger": "~10.0.0-alpha.31",
-	"@geekmidas/manifest": "~10.0.0-alpha.31",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.31",
-	"@geekmidas/schema": "~10.0.0-alpha.31",
-	"@geekmidas/services": "~10.0.0-alpha.31",
-	"@geekmidas/storage": "~10.0.0-alpha.31",
-	"@geekmidas/studio": "~10.0.0-alpha.31",
-	"@geekmidas/telescope": "~10.0.0-alpha.31",
-	"@geekmidas/testkit": "~10.0.0-alpha.31",
+	"@geekmidas/audit": "~10.0.0-alpha.33",
+	"@geekmidas/auth": "~10.0.0-alpha.33",
+	"@geekmidas/cache": "~10.0.0-alpha.33",
+	"@geekmidas/client": "~10.0.0-alpha.33",
+	"@geekmidas/cloud": "~10.0.0-alpha.33",
+	"@geekmidas/constructs": "~10.0.0-alpha.33",
+	"@geekmidas/db": "~10.0.0-alpha.33",
+	"@geekmidas/emailkit": "~10.0.0-alpha.33",
+	"@geekmidas/envkit": "~10.0.0-alpha.33",
+	"@geekmidas/errors": "~10.0.0-alpha.33",
+	"@geekmidas/events": "~10.0.0-alpha.33",
+	"@geekmidas/logger": "~10.0.0-alpha.33",
+	"@geekmidas/manifest": "~10.0.0-alpha.33",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.33",
+	"@geekmidas/schema": "~10.0.0-alpha.33",
+	"@geekmidas/services": "~10.0.0-alpha.33",
+	"@geekmidas/storage": "~10.0.0-alpha.33",
+	"@geekmidas/studio": "~10.0.0-alpha.33",
+	"@geekmidas/telescope": "~10.0.0-alpha.33",
+	"@geekmidas/testkit": "~10.0.0-alpha.33",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -11967,9 +12007,9 @@ function generateSourceFiles(options, template) {
 //#endregion
 //#region src/init/generators/test.ts
 /**
-* Generate test infrastructure files when database is enabled.
-* Includes transaction-isolated test config,
-* factory system with builders/seeds, and an example spec.
+* Generate test infrastructure files when database is enabled: the
+* transaction-isolated test config and an example spec, in the app. The
+* factory is the project's — see {@link generateTestFactoryFiles}.
 */
 function generateTestFiles(options, _template) {
 	if (!options.constructs.database) return [];
@@ -11977,10 +12017,9 @@ function generateTestFiles(options, _template) {
 	const schema = !options.monorepo ? "../src/constructs/database.ts" : `@${options.name}/constructs/database.ts`;
 	db.urlKey;
 	db.ownerUrlKey;
-	return [
-		{
-			path: "test/config.ts",
-			content: `import { it as itVitest } from 'vitest';
+	return [{
+		path: "test/config.ts",
+		content: `import { it as itVitest } from 'vitest';
 import { wrapVitestKyselyTransaction } from '@geekmidas/testkit/kysely';
 import { type Database, database } from '${schema}';
 
@@ -11990,17 +12029,56 @@ export const it = wrapVitestKyselyTransaction<Database>(itVitest, {
   connection: database,
 });
 `
-		},
-		{
-			path: "test/factory/index.ts",
-			content: `import type { Kysely } from 'kysely';
+	}, {
+		path: "test/example.spec.ts",
+		content: `import { describe, expect } from 'vitest';
+import { it } from './config.ts';
+
+describe('example', () => {
+  it('should have a working test setup', async ({ trx }) => {
+    // trx is a Kysely transaction; everything in it is rolled back after the
+    // test
+    expect(trx).toBeDefined();
+  });
+});
+`
+	}];
+}
+/**
+* The database's test factory, at the project root:
+* `test/factories/<construct>.ts`.
+*
+* A factory belongs to a database, not to an app, so there is one per database
+* for the whole project. `gkm test` finds it by that name and hands every
+* feature test \`factories.get('database')\`, built on the test's transaction.
+*/
+function generateTestFactoryFiles(options) {
+	if (!options.constructs.database) return [];
+	const db = databaseFor();
+	const schema = options.monorepo ? `@${options.name}/constructs/database.ts` : "../../src/constructs/database.ts";
+	return [{
+		path: `test/factories/${(0, _geekmidas_manifest.kebabCase)(db.id)}.ts`,
+		content: `import type { Kysely } from 'kysely';
 import { KyselyFactory } from '@geekmidas/testkit/kysely';
 import type { Database } from '${schema}';
-import { usersBuilder } from './users.ts';
+
+const usersBuilder = KyselyFactory.createBuilder<Database, 'users'>(
+  'users',
+  ({ faker }) => ({
+    id: faker.string.uuid(),
+    name: faker.person.fullName(),
+    email: faker.internet.email(),
+    createdAt: new Date(),
+  }),
+);
 
 const builders = { users: usersBuilder };
 const seeds = {};
 
+/**
+ * This database's factory. \`gkm test\` builds it on each feature test's
+ * transaction and hands it over as \`factories.get('${(0, _geekmidas_manifest.serviceKey)(db.id)}')\`.
+ */
 export function createFactory(db: Kysely<Database>) {
   return new KyselyFactory<Database, typeof builders, typeof seeds>(
     builders,
@@ -12011,38 +12089,7 @@ export function createFactory(db: Kysely<Database>) {
 
 export type Factory = ReturnType<typeof createFactory>;
 `
-		},
-		{
-			path: "test/factory/users.ts",
-			content: `import { KyselyFactory } from '@geekmidas/testkit/kysely';
-import type { Database } from '${schema}';
-
-export const usersBuilder = KyselyFactory.createBuilder<Database, 'users'>(
-  'users',
-  ({ faker }) => ({
-    id: faker.string.uuid(),
-    name: faker.person.fullName(),
-    email: faker.internet.email(),
-    createdAt: new Date(),
-  }),
-);
-`
-		},
-		{
-			path: "test/example.spec.ts",
-			content: `import { describe, expect } from 'vitest';
-import { it } from './config.ts';
-
-describe('example', () => {
-  it('should have a working test setup', async ({ trx }) => {
-    // trx is a Kysely transaction; everything in it is rolled back after the
-    // test
-    expect(trx).toBeDefined();
-  });
-});
-`
-		}
-	];
+	}];
 }
 //#endregion
 //#region src/init/generators/ui.ts
@@ -14512,7 +14559,8 @@ async function initCommand(projectName, options = {}) {
 		...generateGithubFiles(templateOptions),
 		...generateMonorepoFiles(templateOptions, baseTemplate),
 		...generateRootConstructs(templateOptions),
-		...generateModelsPackage(templateOptions)
+		...generateModelsPackage(templateOptions),
+		...generateTestFactoryFiles(templateOptions)
 	] : [];
 	const webAppFiles = isFullstack ? frontendFramework === "tanstack-start" ? generateTanStackWebFiles(templateOptions) : frontendFramework === "expo" ? generateExpoAppFiles(templateOptions) : generateWebAppFiles(templateOptions) : [];
 	const authAppFiles = isFullstack ? generateAuthAppFiles(templateOptions) : [];
@@ -14975,7 +15023,7 @@ var NoStoredSecrets = class extends Error {
 	}
 };
 async function reconcile(secrets, workspace, stage) {
-	const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-BhiMkRuA.cjs")).then((n) => n.workspace_exports);
+	const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-C8TbIWxO.cjs")).then((n) => n.workspace_exports);
 	const result = require_reconcile.reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 	return result ? {
 		secrets: result.secrets,
@@ -15319,7 +15367,8 @@ async function testCommand(options = {}) {
 		patterns: require_workspace$1.constructGlobs(workspace),
 		cacheBackend: require_workspace$1.backendsOf(workspace).cache,
 		stage: require_workspace.TEST_STAGE,
-		env: finalCredentials
+		env: finalCredentials,
+		factories: (0, node_path.join)(workspace.root, workspace.test.factories ?? "test/factories")
 	}) : void 0;
 	if (options.prepare) {
 		console.log(manifestPath ? `  🧪 Test harness written beside ${manifestPath}` : "  🧪 Nothing to prepare: this project declares no constructs");
@@ -15368,9 +15417,12 @@ async function testCommand(options = {}) {
 		});
 	});
 }
-/** Apply every construct's migrations to the test stage just reconciled. */
+/**
+* Migrate the test stage just reconciled, then seed it: a test run never
+* starts without the reference data the app needs.
+*/
 async function migrateTestStage(workspace, env) {
-	const { migrateDatabases } = await Promise.resolve().then(() => require("./migrate-BuCx7tIv.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-CroTIm0K.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -15378,13 +15430,15 @@ async function migrateTestStage(workspace, env) {
 		cwd: workspace.root,
 		sources
 	});
-	const runs = await migrateDatabases({
+	const { migrations, seeds } = await migrateAndSeed({
 		root: workspace.root,
 		manifest,
 		sources,
-		env
+		env,
+		stage: require_workspace.TEST_STAGE
 	});
-	for (const { target, applied } of runs) if (applied.length > 0) console.log(`  🗄️  ${target.folder}: applied ${applied.join(", ")}`);
+	for (const { target, applied } of migrations) if (applied.length > 0) console.log(`  🗄️  ${target.migrations}: applied ${applied.join(", ")}`);
+	for (const { target, seeded } of seeds) if (seeded.length > 0) console.log(`  🌱 ${target.seeds}: ran ${seeded.join(", ")}`);
 }
 /** `gkm test` outside a project that declares stages, with none named. */
 var NoStageToTest = class extends Error {
@@ -15768,7 +15822,7 @@ program.command("build").description("Build handlers and the manifest from decla
 		process.exit(1);
 	}
 });
-program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).action(async (options) => {
+program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).option("--migrate", "Apply pending migrations before the apps start").option("--seed", "Migrate, then run the seeds, before the apps start").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15777,7 +15831,9 @@ program.command("dev").description("Reconcile constructs and start the dev serve
 			portExplicit: !!options.port,
 			enableOpenApi: options.enableOpenapi ?? true,
 			entry: options.entry,
-			watch: options.watch
+			watch: options.watch,
+			migrate: options.migrate,
+			seed: options.seed
 		});
 	} catch (error) {
 		console.error(formatError(error));
@@ -15794,7 +15850,7 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		process.exit(1);
 	}
 });
-program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile and migrate the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
+program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile, migrate and seed the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15807,11 +15863,11 @@ program.command("test").description("Run tests with secrets loaded from environm
 		process.exit(1);
 	}
 });
-program.command("migrate").description("Apply each database construct's migrations from db/<construct>/, as its owner").argument("[construct]", "Only this construct, by name").option("--stage <stage>", "The local stage (default) or test — a deploy migrates its own stage").action(async (construct, options) => {
+program.command("migrate").description("Apply each database construct's migrations from db/<construct>/migrations/, as its owner").argument("[construct]", "Only this construct, by name").option("--stage <stage>", "The local stage (default) or test — a deploy migrates its own stage").action(async (construct, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BuCx7tIv.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -15821,11 +15877,25 @@ program.command("migrate").description("Apply each database construct's migratio
 		process.exit(1);
 	}
 });
+program.command("seed").description("Migrate, then run each database construct's seeds from db/<construct>/seeds/, as its owner").argument("[construct]", "Only this construct, by name").option("--stage <stage>", "The local stage (default) or test — a deploy seeds its own stage").action(async (construct, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs"));
+		await seedCommand({
+			...options,
+			...construct ? { construct } : {}
+		});
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("migration").description("Write a construct's next migration: an empty one for a database, the schema change for an auth server").argument("<construct>", "The construct, by name").argument("[name]", "What the migration is called").action(async (construct, name) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BuCx7tIv.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -15993,7 +16063,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-BhiMkRuA.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-C8TbIWxO.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16052,7 +16122,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-B2fis34P.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-JhvrmjQp.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));