@geekmidas/cli 10.0.0-alpha.31 → 10.0.0-alpha.33

package/dist/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { c as isPartitionedRoutes, i as ConstructGenerator, t as discover } from "./discover-CMxesskG.mjs";
-import { a as loadConfig, c as parseModuleConfig, i as loadAppConfig, l as appKey, r as getAppNameFromCwd, s as loadWorkspaceConfig, u as derivedApps } from "./config-BH3Ki69F.mjs";
-import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-T4IVGSoB.mjs";
+import { a as loadConfig, c as parseModuleConfig, i as loadAppConfig, l as appKey, r as getAppNameFromCwd, s as loadWorkspaceConfig, u as derivedApps } from "./config-Du8AQJRK.mjs";
+import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-CsL76tpc.mjs";
 import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-BjTLjDDp.mjs";
-import { _ as findAvailablePort, b as loadSecretsForApp, c as applyPostgres, d as cacheBackendFor, f as eventsBackendFor, g as createEntryWrapper, h as createCredentialsPreload, i as reconcileWorkspace, l as resourceName, m as storageBackendFor, n as constructGlobs, o as COMPOSE_PATH, p as providerOf, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as rootSite, v as isPortAvailable, x as prepareEntryCredentials, y as loadEnvFiles } from "./workspace-C97QUCIf.mjs";
+import { _ as findAvailablePort, b as loadSecretsForApp, c as applyPostgres, d as cacheBackendFor, f as eventsBackendFor, g as createEntryWrapper, h as createCredentialsPreload, i as reconcileWorkspace, l as resourceName, m as storageBackendFor, n as constructGlobs, o as COMPOSE_PATH, p as providerOf, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as rootSite, v as isPortAvailable, x as prepareEntryCredentials, y as loadEnvFiles } from "./workspace-BNurJoFx.mjs";
 import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-hDINScnz.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { a as cacheBackendsIn, i as writeTestHarness, n as TEST_READY_FILE, o as driversFor, r as TEST_MANIFEST_ENV, t as TEST_READY_ENV } from "./ready-CvP3JVEw.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as cacheBackendsIn, s as driversFor, t as TEST_READY_ENV } from "./ready-D1BCiaYU.mjs";
 import { i as withRoutes, r as withCompute } from "./emit-Bzq7JsMP.mjs";
 import { a as createStageSecrets, c as generateServiceCredentials, i as writeDockerEnvFromSecrets, l as rotateServicePassword, o as generateConnectionUrls, r as generateFullstackCustomSecrets, s as generateSecurePassword, t as reconcileMissingSecrets } from "./reconcile-yNq6Shau.mjs";
 import { createRequire } from "node:module";
@@ -19,7 +19,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
 import { execFile, execSync, spawn } from "node:child_process";
-import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, migrationFolder, provideKey, provisionOrder, scopedName, serviceKey } from "@geekmidas/manifest";
+import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, kebabCase, migrationFolder, provideKey, provisionOrder, scopedName, serviceKey } from "@geekmidas/manifest";
 import fg from "fast-glob";
 import chokidar from "chokidar";
 import { createCipheriv, createHash, randomBytes } from "node:crypto";
@@ -37,7 +37,7 @@ import { Subscriber } from "@geekmidas/constructs/subscribers";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.31";
+var version = "10.0.0-alpha.33";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1086,7 +1086,10 @@ async function workspaceDevCommand(workspace, options) {
 		...rawSecrets,
 		...reconciled.env
 	};
-	await import("./migrate-CBICVMAi.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	if (options.migrate || options.seed) {
+		const { prepareDevDatabases } = await import("./migrate-D2rtGKYi.mjs");
+		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
+	} else await import("./migrate-D2rtGKYi.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$10.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -8293,7 +8296,7 @@ function layoutBlock(options, template) {
 	const { database } = options.constructs;
 	const isWorker = template.name === "worker";
 	if (monorepo) return `constructs/          # every construct: the surface, the database, topics
-${database ? "db/<construct>/      # migrations, one folder per database construct\n" : ""}${apiPath}/            # the API app
+${database ? "db/<construct>/      # migrations/ and seeds/, one folder per database construct\n" : ""}${apiPath}/            # the API app
 gkm.config.ts        # name, constructs glob, secrets`;
 	const lines = ["src/constructs/      # the surface, and anything it declares", "src/config/          # env parser, logger"];
 	if (!isWorker) lines.push("src/endpoints/       # HTTP handlers");
@@ -8301,7 +8304,7 @@ gkm.config.ts        # name, constructs glob, secrets`;
 		lines.push("src/crons/           # scheduled work");
 		lines.push("src/subscribers/     # topic consumers");
 	}
-	if (database) lines.push("db/<construct>/      # migrations, one folder per database construct");
+	if (database) lines.push("db/<construct>/      # migrations/ and seeds/, one folder per database construct");
 	lines.push("gkm.config.ts        # name, constructs glob, secrets");
 	return lines.join("\n");
 }
@@ -8430,32 +8433,52 @@ Queries go through Kysely. Never open your own connection pool — the one the
 construct provides is the one that gets credentials, pooling and shutdown.`;
 }
 function migrationsSection() {
-	return `## Migrations
+	return `## Migrations and seeds
 
 Each database construct has its own folder, named after the construct:
 \`Database\` is \`db/database/\`, a tenant \`AuthDatabase\` is
-\`db/auth-database/\`. Each keeps its own history, in its own schema, and is
-migrated as its own **owner** role — the role a handler runs as cannot create a
+\`db/auth-database/\`. It holds two folders and nothing else:
+
+\`\`\`
+db/database/
+  migrations/   # the schema's history, applied once each
+  seeds/        # the reference data the app needs, run on every pass
+\`\`\`
+
+Each construct keeps its own history, in its own schema, and is migrated and
+seeded as its own **owner** role — the role a handler runs as cannot create a
 table.
 
 \`\`\`bash
-gkm migration database add_workouts   # db/database/20260930143012_add_workouts.ts
+gkm migration database add_workouts   # db/database/migrations/20260930143012_add_workouts.ts
 gkm migration auth                    # Better Auth's schema change, as SQL
-gkm migrate                           # apply every folder, parents first
+gkm migrate                           # apply every construct's migrations, parents first
 gkm migrate database                  # apply one construct's
+gkm seed                              # migrate, then run every seed
+gkm dev --migrate                     # migrate before the apps start
+gkm dev --seed                        # migrate and seed before the apps start
 \`\`\`
 
-- Files are \`<UTC timestamp>_<name>.ts\` exporting \`up\` (and \`down\`), or
-  \`.sql\`, which runs whole. Never rename or edit one that has been applied —
-  it is recorded by name. Change the schema with a new migration.
+- Migrations are \`<UTC timestamp>_<name>.ts\` exporting \`up\` (and
+  \`down\`), or \`.sql\`, which runs whole. Never rename or edit one that has
+  been applied — it is recorded by name. Change the schema with a new
+  migration.
 - Write migrations with \`Kysely<unknown>\` and snake_case names: they are the
   SQL, and the camelCase plugin is the app's, not theirs.
 - \`gkm migration auth\` compares Better Auth's schema to its tenant and writes
   only the difference. Run it after adding a Better Auth plugin, and commit the
   file.
-- Tests migrate themselves: the root vitest config's
-  \`globalSetup: ['@geekmidas/cli/vitest']\` applies every folder to the test
-  stage before any test runs. \`gkm dev\` only reports what is pending.
+- Seeds always run after migrations, never instead of them. Each is a
+  \`.ts\` exporting \`seed(db, { stage })\`, or \`.sql\`, run in name
+  order, in a transaction of its own.
+- **Seeds run on every stage, production included.** Write them to be safe
+  there. A seed that belongs only somewhere checks the stage it is handed:
+  \`if (stage === 'production') return;\`. A \`.sql\` seed has no stage, so
+  it must be right everywhere.
+- Tests migrate and seed themselves: the root vitest config's
+  \`globalSetup: ['@geekmidas/cli/vitest']\` does both for the test stage
+  before any test runs. \`gkm dev\` without a flag only reports what is
+  pending.
 - A deploy migrates before the new version goes live, so the old version runs
   against the new schema until it is replaced. Keep each migration compatible
   with the code before it: add a column in one release, stop using the old one,
@@ -8464,29 +8487,26 @@ gkm migrate database                  # apply one construct's
 **Migrations hold schema, never data.** Tables, columns, constraints, indexes.
 No inserts, updates or deletes against the application's rows.
 
-- **Data the code defines lives in the code.** A permission catalogue, the
-  system roles, a list of statuses — if a constant in the source already says
-  what they are, a table holding them is a copy, and a copy drifts. Keep the
-  constant; store only what users create (a custom role, which permission keys
-  it grants), checked against the constant in code.
-- **Define it once, typed, where every app can import it.** A catalogue in
-  code belongs in a shared package (\`packages/models\`), declared \`as const\`
-  so its keys are a union type. The API's guards, the web app's gates and a
-  mobile app's gates then all name the same keys, and a typo — or a removed
+- **Reference data is a seed.** A permission catalogue, the roles and what
+  they grant, a list of statuses — rows the app needs in order to run — are
+  written by a seed in \`db/<construct>/seeds/\`, never by a migration.
+- **A seed is an upsert, run every time.** There is no history: every seed
+  runs on every \`gkm seed\`, so changing what it writes and running it again
+  is how the change is applied. Write \`onConflict(…).doUpdateSet(…)\` (or
+  \`doNothing()\`), never a bare insert.
+- **Define it once, typed, where every app can import it.** A catalogue
+  belongs in code, declared \`as const\` so its keys are a union type, and the
+  seed writes the table from that constant — so the two cannot drift, and no
+  test is needed to keep them in step. The API's guards, the web app's gates
+  and a mobile app's gates all name the same keys, and a typo — or a removed
   permission still checked somewhere — fails to compile instead of failing
   closed at runtime.
-- **A rule is not a row.** "Every user is a member", "a super admin has every
-  permission" are logic. A row per user, or a grant per permission, is a
-  snapshot of the rule that goes stale the moment the rule's inputs change.
-- **Nothing needs seeding to run.** If the app fails without some rows present,
-  those rows are code in the wrong place. Sample and demo data comes from test
-  factories — never a migration, never a deploy.
-- **A backfill is the one exception.** When a schema change needs existing rows
-  transformed — a new non-null column filled from an old one — do it in the
-  same migration, keyed on the rows it transforms. It never inserts rows that
-  were not there.
-- **A test that only keeps two copies in step is the smell.** Delete a copy,
-  and the test with it.`;
+- **Sample data is factories'.** Demo users, a tournament for a test — those
+  come from test factories, never a seed and never a migration.
+- **A backfill is the one data change a migration makes.** When a schema
+  change needs existing rows transformed — a new non-null column filled from
+  an old one — do it in the same migration, keyed on the rows it transforms.
+  It never inserts rows that were not there.`;
 }
 function queriesSection() {
 	return `## Writing queries and relations
@@ -8615,7 +8635,27 @@ functions it called on the way.
 ${database ? "gkm test       # starts services, injects secrets, then runs vitest" : "gkm test"}
 \`\`\`
 
-Run tests through \`gkm test\`, not \`vitest\` directly${database ? " — it is what starts the database and injects the secrets the suite needs" : ""}.`;
+Run tests through \`gkm test\`, not \`vitest\` directly${database ? " — it is what starts the database and injects the secrets the suite needs" : ""}.${database ? `
+
+**Factories, one per database.** \`test/factories/<construct>.ts\` at the
+project root — \`database.ts\` for \`Database\` — exports
+\`createFactory(db)\`. A feature test gets each by service name, on that
+test's transaction — the one \`db.get\` returns and its endpoints use — so
+ask for it rather than importing and building one. Sign in the way a person
+does, through \`browser.signIn\`:
+
+\`\`\`typescript
+it('reads a user', async ({ browser, db, factories }) => {
+  const factory = await factories.get('database');
+  const ada = await factory.insert('users', { email: 'ada@example.com' });
+
+  await browser.signIn(ada.email);
+  // … act through browser.api …
+
+  const app = await db.get('database');
+  // … assert on what was written …
+});
+\`\`\`` : ""}`;
 }
 //#endregion
 //#region src/init/dependencies.ts
@@ -8743,26 +8783,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.31",
-	"@geekmidas/auth": "~10.0.0-alpha.31",
-	"@geekmidas/cache": "~10.0.0-alpha.31",
-	"@geekmidas/client": "~10.0.0-alpha.31",
-	"@geekmidas/cloud": "~10.0.0-alpha.31",
-	"@geekmidas/constructs": "~10.0.0-alpha.31",
-	"@geekmidas/db": "~10.0.0-alpha.31",
-	"@geekmidas/emailkit": "~10.0.0-alpha.31",
-	"@geekmidas/envkit": "~10.0.0-alpha.31",
-	"@geekmidas/errors": "~10.0.0-alpha.31",
-	"@geekmidas/events": "~10.0.0-alpha.31",
-	"@geekmidas/logger": "~10.0.0-alpha.31",
-	"@geekmidas/manifest": "~10.0.0-alpha.31",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.31",
-	"@geekmidas/schema": "~10.0.0-alpha.31",
-	"@geekmidas/services": "~10.0.0-alpha.31",
-	"@geekmidas/storage": "~10.0.0-alpha.31",
-	"@geekmidas/studio": "~10.0.0-alpha.31",
-	"@geekmidas/telescope": "~10.0.0-alpha.31",
-	"@geekmidas/testkit": "~10.0.0-alpha.31",
+	"@geekmidas/audit": "~10.0.0-alpha.33",
+	"@geekmidas/auth": "~10.0.0-alpha.33",
+	"@geekmidas/cache": "~10.0.0-alpha.33",
+	"@geekmidas/client": "~10.0.0-alpha.33",
+	"@geekmidas/cloud": "~10.0.0-alpha.33",
+	"@geekmidas/constructs": "~10.0.0-alpha.33",
+	"@geekmidas/db": "~10.0.0-alpha.33",
+	"@geekmidas/emailkit": "~10.0.0-alpha.33",
+	"@geekmidas/envkit": "~10.0.0-alpha.33",
+	"@geekmidas/errors": "~10.0.0-alpha.33",
+	"@geekmidas/events": "~10.0.0-alpha.33",
+	"@geekmidas/logger": "~10.0.0-alpha.33",
+	"@geekmidas/manifest": "~10.0.0-alpha.33",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.33",
+	"@geekmidas/schema": "~10.0.0-alpha.33",
+	"@geekmidas/services": "~10.0.0-alpha.33",
+	"@geekmidas/storage": "~10.0.0-alpha.33",
+	"@geekmidas/studio": "~10.0.0-alpha.33",
+	"@geekmidas/telescope": "~10.0.0-alpha.33",
+	"@geekmidas/testkit": "~10.0.0-alpha.33",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -11956,9 +11996,9 @@ function generateSourceFiles(options, template) {
 //#endregion
 //#region src/init/generators/test.ts
 /**
-* Generate test infrastructure files when database is enabled.
-* Includes transaction-isolated test config,
-* factory system with builders/seeds, and an example spec.
+* Generate test infrastructure files when database is enabled: the
+* transaction-isolated test config and an example spec, in the app. The
+* factory is the project's — see {@link generateTestFactoryFiles}.
 */
 function generateTestFiles(options, _template) {
 	if (!options.constructs.database) return [];
@@ -11966,10 +12006,9 @@ function generateTestFiles(options, _template) {
 	const schema = !options.monorepo ? "../src/constructs/database.ts" : `@${options.name}/constructs/database.ts`;
 	db.urlKey;
 	db.ownerUrlKey;
-	return [
-		{
-			path: "test/config.ts",
-			content: `import { it as itVitest } from 'vitest';
+	return [{
+		path: "test/config.ts",
+		content: `import { it as itVitest } from 'vitest';
 import { wrapVitestKyselyTransaction } from '@geekmidas/testkit/kysely';
 import { type Database, database } from '${schema}';
 
@@ -11979,17 +12018,56 @@ export const it = wrapVitestKyselyTransaction<Database>(itVitest, {
   connection: database,
 });
 `
-		},
-		{
-			path: "test/factory/index.ts",
-			content: `import type { Kysely } from 'kysely';
+	}, {
+		path: "test/example.spec.ts",
+		content: `import { describe, expect } from 'vitest';
+import { it } from './config.ts';
+
+describe('example', () => {
+  it('should have a working test setup', async ({ trx }) => {
+    // trx is a Kysely transaction; everything in it is rolled back after the
+    // test
+    expect(trx).toBeDefined();
+  });
+});
+`
+	}];
+}
+/**
+* The database's test factory, at the project root:
+* `test/factories/<construct>.ts`.
+*
+* A factory belongs to a database, not to an app, so there is one per database
+* for the whole project. `gkm test` finds it by that name and hands every
+* feature test \`factories.get('database')\`, built on the test's transaction.
+*/
+function generateTestFactoryFiles(options) {
+	if (!options.constructs.database) return [];
+	const db = databaseFor();
+	const schema = options.monorepo ? `@${options.name}/constructs/database.ts` : "../../src/constructs/database.ts";
+	return [{
+		path: `test/factories/${kebabCase(db.id)}.ts`,
+		content: `import type { Kysely } from 'kysely';
 import { KyselyFactory } from '@geekmidas/testkit/kysely';
 import type { Database } from '${schema}';
-import { usersBuilder } from './users.ts';
+
+const usersBuilder = KyselyFactory.createBuilder<Database, 'users'>(
+  'users',
+  ({ faker }) => ({
+    id: faker.string.uuid(),
+    name: faker.person.fullName(),
+    email: faker.internet.email(),
+    createdAt: new Date(),
+  }),
+);
 
 const builders = { users: usersBuilder };
 const seeds = {};
 
+/**
+ * This database's factory. \`gkm test\` builds it on each feature test's
+ * transaction and hands it over as \`factories.get('${serviceKey(db.id)}')\`.
+ */
 export function createFactory(db: Kysely<Database>) {
   return new KyselyFactory<Database, typeof builders, typeof seeds>(
     builders,
@@ -12000,38 +12078,7 @@ export function createFactory(db: Kysely<Database>) {
 
 export type Factory = ReturnType<typeof createFactory>;
 `
-		},
-		{
-			path: "test/factory/users.ts",
-			content: `import { KyselyFactory } from '@geekmidas/testkit/kysely';
-import type { Database } from '${schema}';
-
-export const usersBuilder = KyselyFactory.createBuilder<Database, 'users'>(
-  'users',
-  ({ faker }) => ({
-    id: faker.string.uuid(),
-    name: faker.person.fullName(),
-    email: faker.internet.email(),
-    createdAt: new Date(),
-  }),
-);
-`
-		},
-		{
-			path: "test/example.spec.ts",
-			content: `import { describe, expect } from 'vitest';
-import { it } from './config.ts';
-
-describe('example', () => {
-  it('should have a working test setup', async ({ trx }) => {
-    // trx is a Kysely transaction; everything in it is rolled back after the
-    // test
-    expect(trx).toBeDefined();
-  });
-});
-`
-		}
-	];
+	}];
 }
 //#endregion
 //#region src/init/generators/ui.ts
@@ -14501,7 +14548,8 @@ async function initCommand(projectName, options = {}) {
 		...generateGithubFiles(templateOptions),
 		...generateMonorepoFiles(templateOptions, baseTemplate),
 		...generateRootConstructs(templateOptions),
-		...generateModelsPackage(templateOptions)
+		...generateModelsPackage(templateOptions),
+		...generateTestFactoryFiles(templateOptions)
 	] : [];
 	const webAppFiles = isFullstack ? frontendFramework === "tanstack-start" ? generateTanStackWebFiles(templateOptions) : frontendFramework === "expo" ? generateExpoAppFiles(templateOptions) : generateWebAppFiles(templateOptions) : [];
 	const authAppFiles = isFullstack ? generateAuthAppFiles(templateOptions) : [];
@@ -14964,7 +15012,7 @@ var NoStoredSecrets = class extends Error {
 	}
 };
 async function reconcile(secrets, workspace, stage) {
-	const { derivedContainers } = await import("./workspace-C97QUCIf.mjs").then((n) => n.a);
+	const { derivedContainers } = await import("./workspace-BNurJoFx.mjs").then((n) => n.a);
 	const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 	return result ? {
 		secrets: result.secrets,
@@ -15308,7 +15356,8 @@ async function testCommand(options = {}) {
 		patterns: constructGlobs(workspace),
 		cacheBackend: backendsOf(workspace).cache,
 		stage: TEST_STAGE,
-		env: finalCredentials
+		env: finalCredentials,
+		factories: join(workspace.root, workspace.test.factories ?? "test/factories")
 	}) : void 0;
 	if (options.prepare) {
 		console.log(manifestPath ? `  🧪 Test harness written beside ${manifestPath}` : "  🧪 Nothing to prepare: this project declares no constructs");
@@ -15357,9 +15406,12 @@ async function testCommand(options = {}) {
 		});
 	});
 }
-/** Apply every construct's migrations to the test stage just reconciled. */
+/**
+* Migrate the test stage just reconciled, then seed it: a test run never
+* starts without the reference data the app needs.
+*/
 async function migrateTestStage(workspace, env) {
-	const { migrateDatabases } = await import("./migrate-CBICVMAi.mjs");
+	const { migrateAndSeed } = await import("./migrate-D2rtGKYi.mjs");
 	const { discover } = await import("./discover-CMxesskG.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -15367,13 +15419,15 @@ async function migrateTestStage(workspace, env) {
 		cwd: workspace.root,
 		sources
 	});
-	const runs = await migrateDatabases({
+	const { migrations, seeds } = await migrateAndSeed({
 		root: workspace.root,
 		manifest,
 		sources,
-		env
+		env,
+		stage: TEST_STAGE
 	});
-	for (const { target, applied } of runs) if (applied.length > 0) console.log(`  🗄️  ${target.folder}: applied ${applied.join(", ")}`);
+	for (const { target, applied } of migrations) if (applied.length > 0) console.log(`  🗄️  ${target.migrations}: applied ${applied.join(", ")}`);
+	for (const { target, seeded } of seeds) if (seeded.length > 0) console.log(`  🌱 ${target.seeds}: ran ${seeded.join(", ")}`);
 }
 /** `gkm test` outside a project that declares stages, with none named. */
 var NoStageToTest = class extends Error {
@@ -15757,7 +15811,7 @@ program.command("build").description("Build handlers and the manifest from decla
 		process.exit(1);
 	}
 });
-program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).action(async (options) => {
+program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).option("--migrate", "Apply pending migrations before the apps start").option("--seed", "Migrate, then run the seeds, before the apps start").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15766,7 +15820,9 @@ program.command("dev").description("Reconcile constructs and start the dev serve
 			portExplicit: !!options.port,
 			enableOpenApi: options.enableOpenapi ?? true,
 			entry: options.entry,
-			watch: options.watch
+			watch: options.watch,
+			migrate: options.migrate,
+			seed: options.seed
 		});
 	} catch (error) {
 		console.error(formatError(error));
@@ -15783,7 +15839,7 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		process.exit(1);
 	}
 });
-program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile and migrate the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
+program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile, migrate and seed the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15796,11 +15852,11 @@ program.command("test").description("Run tests with secrets loaded from environm
 		process.exit(1);
 	}
 });
-program.command("migrate").description("Apply each database construct's migrations from db/<construct>/, as its owner").argument("[construct]", "Only this construct, by name").option("--stage <stage>", "The local stage (default) or test — a deploy migrates its own stage").action(async (construct, options) => {
+program.command("migrate").description("Apply each database construct's migrations from db/<construct>/migrations/, as its owner").argument("[construct]", "Only this construct, by name").option("--stage <stage>", "The local stage (default) or test — a deploy migrates its own stage").action(async (construct, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-CBICVMAi.mjs");
+		const { migrateCommand } = await import("./migrate-D2rtGKYi.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -15810,11 +15866,25 @@ program.command("migrate").description("Apply each database construct's migratio
 		process.exit(1);
 	}
 });
+program.command("seed").description("Migrate, then run each database construct's seeds from db/<construct>/seeds/, as its owner").argument("[construct]", "Only this construct, by name").option("--stage <stage>", "The local stage (default) or test — a deploy seeds its own stage").action(async (construct, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { seedCommand } = await import("./migrate-D2rtGKYi.mjs");
+		await seedCommand({
+			...options,
+			...construct ? { construct } : {}
+		});
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("migration").description("Write a construct's next migration: an empty one for a database, the schema change for an auth server").argument("<construct>", "The construct, by name").argument("[name]", "What the migration is called").action(async (construct, name) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-CBICVMAi.mjs");
+		const { migrationCommand } = await import("./migrate-D2rtGKYi.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -15982,7 +16052,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-C97QUCIf.mjs").then((n) => n.a);
+		const { derivedContainers } = await import("./workspace-BNurJoFx.mjs").then((n) => n.a);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16041,7 +16111,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-BrDmlm1x.mjs");
+		const { deployGithubCommand } = await import("./github-DN-92LWP.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));