@geekmidas/cli 10.0.0-alpha.78 → 10.0.0-alpha.80

package/dist/{engine-CoCsNoW_.cjs → engine-DzBZR5D0.cjs}

@@ -5,9 +5,9 @@ const require_discover = require("./discover-D1It5r_h.cjs");
 const require_sandbox = require("./sandbox-CL--ZDui.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-Bp8FEkF-.cjs");
-const require_stale = require("./stale-BsiPJI7Y.cjs");
+const require_seeds = require("./seeds-ZljwYV_p.cjs");
 const require_sniffer = require("./sniffer-BjG-1mlD.cjs");
-const require_provider = require("./provider-B3Sv_a74.cjs");
+const require_databases = require("./databases-BY-pEImp.cjs");
 const require_credentialSchemas = require("./credentialSchemas-DCR4Wd1W.cjs");
 let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
@@ -97,7 +97,7 @@ async function writeCredentialsFile(credentials) {
 async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
 	logger$3.log(`\n🔨 Building Docker image: ${imageRef}`);
 	logger$3.log("   Generating Dockerfile...");
-	const { buildRoot } = await require_stale.dockerCommand({ cwd });
+	const { buildRoot } = await require_seeds.dockerCommand({ cwd });
 	const dockerfilePath = (0, node_path.relative)(buildRoot, dockerfile);
 	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
 	try {
@@ -117,7 +117,7 @@ async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, s
 		});
 		logger$3.log(`✅ Image built: ${imageRef}`);
 	} catch (error) {
-		throw new require_stale.DockerBuildFailed(imageRef, error);
+		throw new require_seeds.DockerBuildFailed(imageRef, error);
 	} finally {
 		await secret?.cleanup();
 	}
@@ -135,7 +135,7 @@ async function pushImage(imageRef, { cwd, signal, stdio }) {
 		});
 		logger$3.log(`✅ Image pushed: ${imageRef}`);
 	} catch (error) {
-		throw new require_stale.DockerPushFailed(imageRef, error);
+		throw new require_seeds.DockerPushFailed(imageRef, error);
 	}
 }
 /**
@@ -174,11 +174,11 @@ async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() })
 async function deployDocker(options) {
 	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
 	const imageName = config.imageName;
-	const imageRef = require_stale.validateImageRef(getImageRef(config.registry, imageName, tag));
+	const imageRef = require_seeds.validateImageRef(getImageRef(config.registry, imageName, tag));
 	const cwd = options.cwd ?? process.cwd();
 	const docker = {
 		cwd,
-		dockerfile: (0, node_path.join)(cwd, options.dockerfile ?? require_stale.dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
+		dockerfile: (0, node_path.join)(cwd, options.dockerfile ?? require_seeds.dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
 		...options.signal ? { signal: options.signal } : {},
 		...options.stdio ? { stdio: options.stdio } : {}
 	};
@@ -258,12 +258,12 @@ async function projectById(api, projectId) {
 * another identity's, raises `ProjectNotOwned` — it is never adopted.
 */
 async function findProject(api, identity, stateProjectId) {
-	const name = require_stale.projectName(identity);
-	const marker = require_stale.ownershipMarker(identity);
+	const name = require_seeds.projectName(identity);
+	const marker = require_seeds.ownershipMarker(identity);
 	if (stateProjectId) {
 		const known = await projectById(api, stateProjectId);
 		if (known) {
-			const claimed = require_stale.markerOf(known.description);
+			const claimed = require_seeds.markerOf(known.description);
 			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
 			return {
 				projectId: known.projectId,
@@ -276,7 +276,7 @@ async function findProject(api, identity, stateProjectId) {
 		}
 	}
 	const projects = await api.listProjects();
-	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && require_stale.isOwnedBy(p.description, identity));
+	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && require_seeds.isOwnedBy(p.description, identity));
 	if (owned) {
 		const details = await api.getProject(owned.projectId);
 		return {
@@ -289,7 +289,7 @@ async function findProject(api, identity, stateProjectId) {
 		};
 	}
 	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
-	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, require_stale.markerOf(clash.description));
+	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, require_seeds.markerOf(clash.description));
 	return null;
 }
 /**
@@ -298,7 +298,7 @@ async function findProject(api, identity, stateProjectId) {
 * deploy without state still finds it — or a new one, marked.
 */
 async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
-	const marker = require_stale.ownershipMarker(identity);
+	const marker = require_seeds.ownershipMarker(identity);
 	const found = await findProject(api, identity, stateProjectId);
 	if (found) {
 		if (found.needsClaim) {
@@ -316,7 +316,7 @@ async function resolveProject(api, identity, stateProjectId, log = () => {}, hoo
 		};
 	}
 	await hooks.beforeCreate?.();
-	const created = await api.createProject(require_stale.projectName(identity), withMarker("Deployed by gkm.", marker));
+	const created = await api.createProject(require_seeds.projectName(identity), withMarker("Deployed by gkm.", marker));
 	return {
 		projectId: created.project.projectId,
 		name: created.project.name,
@@ -427,7 +427,7 @@ async function resolveRegistry(api, options) {
 * @returns Filtered secrets with found/missing tracking
 */
 function filterSecretsForApp(stageSecrets, sniffedEnv) {
-	const allSecrets = require_stale.toEmbeddableSecrets(stageSecrets);
+	const allSecrets = require_seeds.toEmbeddableSecrets(stageSecrets);
 	const filtered = {};
 	const found = [];
 	const missing = [];
@@ -582,7 +582,7 @@ const PROVISIONERS = {
 	*/
 	database: async (declaration, context) => {
 		if (declaration.kind !== "database") throw new WrongKind(declaration.kind);
-		const name = require_stale.resourceName(declaration.id, declaration.kind, context.stage);
+		const name = require_seeds.resourceName(declaration.id, declaration.kind, context.stage);
 		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
 			stage: context.stage,
 			app: context.scope ?? context.project
@@ -619,7 +619,7 @@ const PROVISIONERS = {
 		if (declaration.kind !== "database-schema") throw new WrongKind(declaration.kind);
 		const parent = context.provisioned[declaration.of];
 		if (!parent) throw new UnresolvedParent(declaration.id, declaration.of);
-		const runtime = require_stale.resourceName(declaration.id, declaration.kind, context.stage);
+		const runtime = require_seeds.resourceName(declaration.id, declaration.kind, context.stage);
 		const owner = (0, _geekmidas_db_pg_roles.ownerRole)(runtime);
 		const reads = readsFrom(context.manifest, declaration.id);
 		const parentUrl = new URL(parent.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")] ?? "");
@@ -734,7 +734,7 @@ const PROVISIONERS = {
 			stage: context.stage,
 			app: context.scope ?? context.project
 		}, declaration.id);
-		const bucket = require_stale.resourceName(declaration.id, declaration.kind, context.stage);
+		const bucket = require_seeds.resourceName(declaration.id, declaration.kind, context.stage);
 		const user = context.supplied?.AWS_ACCESS_KEY_ID ?? `${bucket}-root`;
 		const password = context.supplied?.AWS_SECRET_ACCESS_KEY ?? derivedPassword(context, `objects:${declaration.id}`);
 		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
@@ -1070,7 +1070,7 @@ function mailpitCompose(service) {
 */
 function storageKeys(values) {
 	const keys = {};
-	for (const key of [...require_stale.STORAGE_KEY_PAIR, "AWS_REGION"]) {
+	for (const key of [...require_seeds.STORAGE_KEY_PAIR, "AWS_REGION"]) {
 		const value = values?.[key];
 		if (value !== void 0) keys[key] = value;
 	}
@@ -1081,7 +1081,7 @@ function storageKeys(values) {
 * `validate` already refused, should a provisioner be reached without it.
 */
 function notConfigured(id, kind, context) {
-	const { missing } = require_stale.externalServices({
+	const { missing } = require_seeds.externalServices({
 		stage: context.stage,
 		declarations: [{
 			id,
@@ -1091,7 +1091,7 @@ function notConfigured(id, kind, context) {
 		allow: [],
 		...context.domain ? { domain: context.domain } : {}
 	});
-	return new require_stale.ExternalServicesNotConfigured(context.stage, missing);
+	return new require_seeds.ExternalServicesNotConfigured(context.stage, missing);
 }
 /** Whether anything reads through a reader on this construct. */
 function readsFrom(manifest, id) {
@@ -1265,7 +1265,7 @@ async function provisionDeclared(options) {
 		clusters: {}
 	};
 	const manifest = options.manifest ?? await require_discover.discover({
-		patterns: require_stale.constructGlobs(workspace),
+		patterns: require_seeds.constructGlobs(workspace),
 		cwd: workspace.root
 	});
 	if (Object.keys(manifest).length === 0) return empty;
@@ -1278,9 +1278,9 @@ async function provisionDeclared(options) {
 		stage: options.stage,
 		project: workspace.name,
 		scope: options.scope ?? workspace.name,
-		cache: require_stale.cacheBackendFor(require_stale.providerOf(workspace)),
-		events: require_stale.eventsBackendFor(require_stale.providerOf(workspace)),
-		storage: require_stale.storageBackendFor(require_stale.providerOf(workspace)),
+		cache: require_seeds.cacheBackendFor(require_seeds.providerOf(workspace)),
+		events: require_seeds.eventsBackendFor(require_seeds.providerOf(workspace)),
+		storage: require_seeds.storageBackendFor(require_seeds.providerOf(workspace)),
 		...options.devServices ? { devServices: options.devServices } : {},
 		...workspace.deploy?.domains?.[options.stage] ? { domain: workspace.deploy.domains[options.stage] } : {},
 		addresses: surfaceAddresses(manifest, options.appUrls),
@@ -1320,7 +1320,7 @@ async function provisionDeclared(options) {
 * run again.
 */
 async function applyDeclared(client, statements) {
-	return (await require_stale.applyPostgres(client, statements)).filter((entry) => entry.created).length;
+	return (await require_seeds.applyPostgres(client, statements)).filter((entry) => entry.created).length;
 }
 /**
 * The provisioning order, with queues and topics moved to the end.
@@ -1653,7 +1653,7 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 			hasFailures = true;
 		}
 		if (state) {
-			for (const record of domainRecords) if (record.created || record.existed) require_stale.setDnsRecord(state, {
+			for (const record of domainRecords) if (record.created || record.existed) require_seeds.setDnsRecord(state, {
 				domain: rootDomain,
 				name: record.subdomain,
 				type: record.type,
@@ -1688,7 +1688,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const results = [];
 	logger$2.log("\n🔍 Verifying DNS records...");
 	for (const [appName, hostname] of appHostnames) {
-		if (require_stale.isDnsVerified(state, hostname, serverIp)) {
+		if (require_seeds.isDnsVerified(state, hostname, serverIp)) {
 			logger$2.log(`   ✓ ${hostname} (previously verified)`);
 			results.push({
 				hostname,
@@ -1702,7 +1702,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 		try {
 			const resolvedIp = await resolveHostnameToIp(hostname);
 			if (resolvedIp === serverIp) {
-				require_stale.setDnsVerification(state, hostname, serverIp);
+				require_seeds.setDnsVerification(state, hostname, serverIp);
 				logger$2.log(`   ✓ ${hostname} → ${resolvedIp}`);
 				results.push({
 					hostname,
@@ -1763,10 +1763,10 @@ function generateSecret() {
 * Otherwise generates a new one and stores it.
 */
 function getOrGenerateSecret(state, appName, secretName) {
-	const existing = require_stale.getGeneratedSecret(state, appName, secretName);
+	const existing = require_seeds.getGeneratedSecret(state, appName, secretName);
 	if (existing) return existing;
 	const generated = generateSecret();
-	require_stale.setGeneratedSecret(state, appName, secretName, generated);
+	require_seeds.setGeneratedSecret(state, appName, secretName, generated);
 	return generated;
 }
 /**
@@ -1914,15 +1914,17 @@ var DeployMigrationsFailed = class extends Error {
 	}
 };
 /**
-* The URLs a stage's migrations connect with, keyed as the migrator reads
-* them, grouped by the database their cluster serves — for the targets that
-* have a migration to apply. Empty when none does, so a deploy publishes
-* nothing for a project that has not written one.
+* The URLs a stage's migrations and seeds connect with, keyed as the migrator
+* reads them, grouped by the database their cluster serves — for the targets
+* that have a migration or a seed to run. Empty when none does, so a deploy
+* publishes nothing for a project that has written neither.
 */
 async function migrationUrls(root, manifest, env) {
 	const byDatabase = /* @__PURE__ */ new Map();
 	for (const target of (0, _geekmidas_manifest.migrationTargets)(manifest)) {
-		if ((await require_provider.migrationFiles((0, node_path.join)(root, target.migrations))).size === 0) continue;
+		const migrations = await require_databases.migrationFiles((0, node_path.join)(root, target.migrations));
+		const seeds = await require_databases.migrationFiles((0, node_path.join)(root, target.seeds));
+		if (migrations.size === 0 && seeds.size === 0) continue;
 		for (const role of ["ownerUrl", "url"]) {
 			const key = (0, _geekmidas_manifest.provideKey)(target.id, role);
 			const url = env[key];
@@ -1939,8 +1941,14 @@ async function migrationUrls(root, manifest, env) {
 const answer = require_schemas.discriminatedUnion("reason", [require_schemas.object({
 	reason: require_schemas.literal("migrated"),
 	runs: require_schemas.array(require_schemas.object({
+		construct: require_schemas.string(),
 		migrations: require_schemas.string(),
 		applied: require_schemas.array(require_schemas.string())
+	})),
+	seeds: require_schemas.array(require_schemas.object({
+		construct: require_schemas.string(),
+		seeds: require_schemas.string(),
+		seeded: require_schemas.array(require_schemas.string())
 	}))
 }), require_schemas.object({
 	reason: require_schemas.literal("failed"),
@@ -1949,13 +1957,18 @@ const answer = require_schemas.discriminatedUnion("reason", [require_schemas.obj
 		message: require_schemas.string()
 	})
 })]);
-/** Apply every pending migration, in the sandbox, as each construct's owner. */
+/**
+* Apply every pending migration, then run every seed, in the sandbox, as each
+* construct's owner. A failing migration throws `DeployMigrationsFailed`, a
+* failing seed `DeploySeedsFailed` — either before any app is released.
+*/
 async function runMigrations(options) {
 	const sandbox = options.sandbox ?? require_sandbox.activeSandbox() ?? new require_credentials.LocalSandbox({ root: options.root });
 	const { value } = await require_discover.runWorker(sandbox, "migrations", {
 		name: "migrate-worker",
 		args: [JSON.stringify({
 			root: options.root,
+			stage: options.stage,
 			manifest: options.manifest,
 			patterns: options.patterns
 		})],
@@ -1965,8 +1978,15 @@ async function runMigrations(options) {
 		signal: options.signal,
 		schema: answer
 	});
-	if (value.reason === "failed") throw new DeployMigrationsFailed(options.stage, value.error.name, value.error.message);
-	return value.runs;
+	if (value.reason === "failed") {
+		const { error } = value;
+		if (error.name === "SeedFailed") throw new require_seeds.DeploySeedsFailed(options.stage, String(error.construct ?? "unknown"), String(error.seed ?? "unknown"), error);
+		throw new DeployMigrationsFailed(options.stage, error.name, error.message);
+	}
+	return {
+		migrations: value.runs,
+		seeds: value.seeds
+	};
 }
 //#endregion
 //#region src/target/dokploy/postgres.ts
@@ -2275,29 +2295,29 @@ async function validateDokploy(phase) {
 		ctx
 	};
 	const stored = await phase.secrets.read();
-	const services = require_stale.assertExternalServices({
+	const services = require_seeds.assertExternalServices({
 		stage,
-		declarations: require_stale.manifestServiceDeclarations(phase.manifest),
+		declarations: require_seeds.manifestServiceDeclarations(phase.manifest),
 		supplied: stored?.custom ?? {},
 		allow: phase.allowDevServices,
 		...workspace.deploy?.domains?.[stage] ? { domain: workspace.deploy.domains[stage] } : {}
 	});
-	require_stale.reportDevServices(phase, require_stale.devServicesUsed(services));
-	require_stale.assertNoStaleSecrets({
+	require_seeds.reportDevServices(phase, require_seeds.devServicesUsed(services));
+	require_seeds.assertNoStaleSecrets({
 		manifest: phase.manifest,
 		stage,
 		supplied: stored?.custom ?? {}
 	});
 	await require_credentialSchemas.assertStageCredentials({
 		root: workspace.root,
-		patterns: require_stale.constructGlobs(workspace),
+		patterns: require_seeds.constructGlobs(workspace),
 		manifest: phase.manifest,
 		stage,
 		supplied: stored?.custom ?? {}
 	});
 	const runnables = phase.runnables ?? {};
 	const background = phase.background ?? {};
-	const workers = require_stale.workerUnits(workspace, phase.manifest, background).filter((worker) => appsToDeployNames.includes(worker.app));
+	const workers = require_seeds.workerUnits(workspace, phase.manifest, background).filter((worker) => appsToDeployNames.includes(worker.app));
 	if (workers.length > 0) logger.log(`   Deploying workers: ${workers.map((w) => `${w.name} (from ${w.app})`).join(", ")}`);
 	return {
 		...run,
@@ -2322,7 +2342,7 @@ async function preflight({ workspace, manifest, stage, secrets: secretsStore, ct
 	logger.log("\n🔐 Loading secrets and analyzing environment requirements...");
 	const stored = await secretsStore.read();
 	if (!stored) logger.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
-	const { secrets: stageSecrets, generated } = require_stale.withGeneratedSecrets(stored ?? require_stale.initStageSecrets(stage), manifest);
+	const { secrets: stageSecrets, generated } = require_seeds.withGeneratedSecrets(stored ?? require_seeds.initStageSecrets(stage), manifest);
 	if (generated.length > 0) {
 		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.store}): ${generated.join(", ")}`);
 		else {
@@ -2375,7 +2395,7 @@ async function provision(run) {
 	};
 	const { api, endpoint } = await dokployApi(workspace, ctx);
 	logger.log("\n📋 Loading deploy state...");
-	const journal = await require_stale.DeployJournal.open(store, stage, () => require_stale.createEmptyState(stage, "", ""));
+	const journal = await require_seeds.DeployJournal.open(store, stage, () => require_seeds.createEmptyState(stage, "", ""));
 	const state = journal.state;
 	if (journal.existed) logger.log(`   Found existing state for stage "${stage}"`);
 	else logger.log(`   Creating new state for stage "${stage}"`);
@@ -2387,7 +2407,7 @@ async function provision(run) {
 		key: "project",
 		type: "project",
 		data: {
-			name: require_stale.projectName(identity),
+			name: require_seeds.projectName(identity),
 			identity: identity.key
 		}
 	};
@@ -2514,10 +2534,10 @@ async function provision(run) {
 			projectName: identity.scope,
 			stage,
 			config: workspace.deploy.backups,
-			existingState: require_stale.getBackupState(state),
+			existingState: require_seeds.getBackupState(state),
 			logger
 		});
-		require_stale.setBackupState(state, backupState);
+		require_seeds.setBackupState(state, backupState);
 		if (!backupState.postgresBackupId) {
 			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
 			const backupRetention = workspace.deploy.backups.retention ?? 30;
@@ -2531,7 +2551,7 @@ async function provision(run) {
 				enabled: true,
 				keepLatestCount: backupRetention
 			});
-			require_stale.setPostgresBackupId(state, backup.backupId);
+			require_seeds.setPostgresBackupId(state, backup.backupId);
 			logger.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
 		} else logger.log("   ✓ Using existing postgres backup schedule");
 	}
@@ -2650,7 +2670,7 @@ async function releaseDokploy(run) {
 			intervalMs: run.verify.intervalMs,
 			signal: ctx.signal
 		});
-		require_stale.recordRelease(state, appName, {
+		require_seeds.recordRelease(state, appName, {
 			...image,
 			tag: imageTag
 		});
@@ -2666,14 +2686,14 @@ async function releaseDokploy(run) {
 			const app = workspace.apps[appName];
 			logger.log(`\n   ⚙️  Deploying ${appName}...`);
 			try {
-				const application = await ensureApplication(api, journal, appName, require_stale.applicationName(identity, appName), project.projectId, environmentId, applied);
+				const application = await ensureApplication(api, journal, appName, require_seeds.applicationName(identity, appName), project.projectId, environmentId, applied);
 				const appSecrets = encryptedSecrets.get(appName);
 				const credentials = appSecrets && appSecrets.secretCount > 0 ? {
 					encrypted: appSecrets.payload.encrypted,
 					iv: appSecrets.payload.iv
 				} : void 0;
 				if (appSecrets && credentials) logger.log(`      Encrypted ${appSecrets.secretCount} secrets`);
-				const imageRef$1 = require_stale.imageRef(identity, appName, registry, imageTag);
+				const imageRef$1 = require_seeds.imageRef(identity, appName, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$1}`);
 				const image = await deployDocker({
 					stage,
@@ -2681,7 +2701,7 @@ async function releaseDokploy(run) {
 					skipPush: false,
 					config: {
 						registry,
-						imageName: require_stale.imageName(identity, appName),
+						imageName: require_seeds.imageName(identity, appName),
 						appName
 					},
 					credentials,
@@ -2715,7 +2735,7 @@ async function releaseDokploy(run) {
 				const withDeclared = {
 					...resolved,
 					...declaredEnv,
-					...require_stale.otelEnv(stageSecrets?.custom ?? {}, appName)
+					...require_seeds.otelEnv(stageSecrets?.custom ?? {}, appName)
 				};
 				const envVars = Object.entries(withDeclared).map(([key, value]) => `${key}=${value}`);
 				if (Object.keys(withDeclared).length > 0) logger.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
@@ -2752,8 +2772,8 @@ async function releaseDokploy(run) {
 			ctx.signal?.throwIfAborted();
 			logger.log(`\n   🧵 Deploying ${worker.name} (worker ${worker.id})...`);
 			try {
-				const application = await ensureApplication(api, journal, worker.name, require_stale.applicationName(identity, worker.name), project.projectId, environmentId, applied);
-				const keys = [...require_stale.workerEnvKeys(run.manifest, worker.id, run.runnables) ?? []].sort();
+				const application = await ensureApplication(api, journal, worker.name, require_seeds.applicationName(identity, worker.name), project.projectId, environmentId, applied);
+				const keys = [...require_seeds.workerEnvKeys(run.manifest, worker.id, run.runnables) ?? []].sort();
 				const secrets = prepareSecretsForApp(stageSecrets, {
 					appName: worker.name,
 					requiredEnvVars: keys,
@@ -2763,7 +2783,7 @@ async function releaseDokploy(run) {
 					encrypted: secrets.payload.encrypted,
 					iv: secrets.payload.iv
 				} : void 0;
-				const imageRef$2 = require_stale.imageRef(identity, worker.name, registry, imageTag);
+				const imageRef$2 = require_seeds.imageRef(identity, worker.name, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$2}`);
 				const image = await deployDocker({
 					stage,
@@ -2771,22 +2791,22 @@ async function releaseDokploy(run) {
 					skipPush: false,
 					config: {
 						registry,
-						imageName: require_stale.imageName(identity, worker.name),
+						imageName: require_seeds.imageName(identity, worker.name),
 						appName: worker.name
 					},
 					credentials,
 					cwd: workspace.root,
-					dockerfile: require_stale.workerDockerfileOf(worker.name),
+					dockerfile: require_seeds.workerDockerfileOf(worker.name),
 					...ctx.signal ? { signal: ctx.signal } : {},
 					...ctx.stdio ? { stdio: ctx.stdio } : {}
 				});
 				built(worker.name, image, imageRef$2);
 				const env = {
 					...Object.fromEntries(Object.entries(declaredEnv).filter(([key]) => keys.includes(key))),
-					...require_stale.otelEnv(stageSecrets?.custom ?? {}, worker.name),
+					...require_seeds.otelEnv(stageSecrets?.custom ?? {}, worker.name),
 					...credentials ? { GKM_MASTER_KEY: secrets.masterKey } : {},
 					NODE_ENV: "production",
-					PORT: String(require_stale.WORKER_PORT),
+					PORT: String(require_seeds.WORKER_PORT),
 					STAGE: stage
 				};
 				logger.log(`      Resolved ${Object.keys(env).length} env vars: ${Object.keys(env).sort().join(", ")}`);
@@ -2819,7 +2839,7 @@ async function releaseDokploy(run) {
 			const app = workspace.apps[appName];
 			logger.log(`\n   🌐 Deploying ${appName}...`);
 			try {
-				const application = await ensureApplication(api, journal, appName, require_stale.applicationName(identity, appName), project.projectId, environmentId, applied);
+				const application = await ensureApplication(api, journal, appName, require_seeds.applicationName(identity, appName), project.projectId, environmentId, applied);
 				const dependencyUrls = {};
 				if (app.dependencies) {
 					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
@@ -2848,7 +2868,7 @@ async function releaseDokploy(run) {
 					}
 				}
 				if (buildArgs.length > 0) logger.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
-				const imageRef$3 = require_stale.imageRef(identity, appName, registry, imageTag);
+				const imageRef$3 = require_seeds.imageRef(identity, appName, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$3}`);
 				const image = await deployDocker({
 					stage,
@@ -2856,7 +2876,7 @@ async function releaseDokploy(run) {
 					skipPush: false,
 					config: {
 						registry,
-						imageName: require_stale.imageName(identity, appName),
+						imageName: require_seeds.imageName(identity, appName),
 						appName
 					},
 					buildArgs,
@@ -2938,15 +2958,15 @@ function failed(run, appName, error) {
 	});
 }
 /**
-* The stage's pending migrations, applied in the deploy's sandbox against
-* each cluster published for them. Nothing is published, and nothing runs,
-* for a project with no migration to apply.
+* The stage's pending migrations applied, then every seed run, in the
+* deploy's sandbox against each cluster published for them. Nothing is
+* published, and nothing runs, for a project with neither.
 */
 async function migrate(run) {
 	const { workspace, manifest, stage, ctx } = run;
 	const { api, endpoint, migrations, declaredClusters } = run.provisioned;
 	if (migrations.size === 0) return;
-	logger.log("\n🗄️  Applying migrations...");
+	logger.log("\n🗄️  Applying migrations and seeds...");
 	const host = serverHostname(endpoint);
 	const urls = {};
 	for (const [database, keys] of migrations) {
@@ -2959,15 +2979,24 @@ async function migrate(run) {
 		}
 		for (const [key, url] of Object.entries(keys)) urls[key] = publishedUrl(url, published);
 	}
-	const runs = await runMigrations({
+	const ran = await runMigrations({
 		root: workspace.root,
 		stage,
 		manifest,
-		patterns: require_stale.constructGlobs(workspace),
+		patterns: require_seeds.constructGlobs(workspace),
 		urls,
 		signal: ctx.signal
 	});
-	for (const { migrations: folder, applied } of runs) logger.log(applied.length === 0 ? `   ✓ ${folder}: up to date` : `   ✓ ${folder}: applied ${applied.join(", ")}`);
+	for (const { migrations: folder, applied } of ran.migrations) if (applied.length === 0) logger.log(`   ✓ ${folder}: up to date`);
+	require_seeds.reportDatabaseRuns(ran.migrations.map(({ construct, migrations: folder, applied }) => ({
+		construct,
+		folder,
+		applied
+	})), ran.seeds.map(({ construct, seeds: folder, seeded }) => ({
+		construct,
+		folder,
+		seeded
+	})), (line) => logger.log(`   ${line}`), (event) => ctx.emit(event));
 }
 /**
 * DNS records for `apps`' hosts, their propagation, and Dokploy's validation
@@ -3074,7 +3103,7 @@ async function rollbackDokploy(run, failure) {
 			verify: run.verify,
 			signal: run.ctx.signal
 		});
-		require_stale.recordRollback(state, appName, before);
+		require_seeds.recordRollback(state, appName, before);
 		await journal.save();
 		logger.log(`   ✓ ${appName} rolled back to ${before.ref}`);
 	}
@@ -3143,7 +3172,7 @@ async function ensureApplication(api, journal, appName, dokployAppName, projectI
 		action: via === "created" ? "create" : "reuse",
 		id: resource.applicationId
 	}, via);
-	require_stale.setApplicationId(journal.state, appName, resource.applicationId);
+	require_seeds.setApplicationId(journal.state, appName, resource.applicationId);
 	return resource;
 }
 /**
@@ -3225,7 +3254,7 @@ async function dokployApi(workspace, ctx) {
 /** Each app's public host, the same way the deploy resolves it. */
 function hostOf(workspace, appName, stage) {
 	const app = workspace.apps[appName];
-	return require_stale.resolveHost(appName, app, stage, workspace.deploy?.domains, app.type === "web" && require_stale.isMainFrontendApp(appName, app, workspace.apps));
+	return require_seeds.resolveHost(appName, app, stage, workspace.deploy?.domains, app.type === "web" && require_seeds.isMainFrontendApp(appName, app, workspace.apps));
 }
 /**
 * What a deploy would do, from the same lookups it starts with — and nothing
@@ -3259,7 +3288,7 @@ async function planDokploy(run) {
 		key: "project",
 		resourceType: "project",
 		action: "create"
-	}, require_stale.projectName(identity));
+	}, require_seeds.projectName(identity));
 	const environment = project?.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
 	plan(environment ? {
 		key: "environment",
@@ -3301,12 +3330,19 @@ async function planDokploy(run) {
 		resourceType: declaration.kind,
 		action: "ensure"
 	}, declaration.kind);
+	require_seeds.reportPlannedSeeds((await require_databases.plannedSeeds({
+		root: workspace.root,
+		manifest
+	})).map(({ target, seeds }) => ({
+		folder: target.seeds,
+		seeds
+	})), (line) => logger.log(`   ${line}`));
 	const apps = [];
 	const urls = {};
 	for (const appName of appsToDeployNames) {
 		const app = workspace.apps[appName];
 		if (app.type === "mobile") continue;
-		const dokployAppName = require_stale.applicationName(identity, appName);
+		const dokployAppName = require_seeds.applicationName(identity, appName);
 		const recordedId = state?.applications?.[appName];
 		const existing = project && environment ? (recordedId ? await api.getApplication(recordedId).catch(() => null) : null) ?? await api.findApplicationByName(project.projectId, dokployAppName, environment.environmentId) : null;
 		plan(existing ? {
@@ -3319,7 +3355,7 @@ async function planDokploy(run) {
 			resourceType: "application",
 			action: "create"
 		}, dokployAppName);
-		const ref = require_stale.imageRef(identity, appName, workspace.deploy.registry, imageTag);
+		const ref = require_seeds.imageRef(identity, appName, workspace.deploy.registry, imageTag);
 		plan({
 			key: `image:${appName}`,
 			resourceType: "image",
@@ -3348,7 +3384,7 @@ async function planDokploy(run) {
 		});
 	}
 	for (const worker of run.workers) {
-		const dokployAppName = require_stale.applicationName(identity, worker.name);
+		const dokployAppName = require_seeds.applicationName(identity, worker.name);
 		const recordedId = state?.applications?.[worker.name];
 		const existing = project && environment ? (recordedId ? await api.getApplication(recordedId).catch(() => null) : null) ?? await api.findApplicationByName(project.projectId, dokployAppName, environment.environmentId) : null;
 		plan(existing ? {
@@ -3361,7 +3397,7 @@ async function planDokploy(run) {
 			resourceType: "application",
 			action: "create"
 		}, `${dokployAppName}, worker ${worker.id} — no domain`);
-		const ref = require_stale.imageRef(identity, worker.name, workspace.deploy.registry, imageTag);
+		const ref = require_seeds.imageRef(identity, worker.name, workspace.deploy.registry, imageTag);
 		plan({
 			key: `image:${worker.name}`,
 			resourceType: "image",
@@ -3510,4 +3546,4 @@ Object.defineProperty(exports, "verifySettings", {
 	}
 });
 
-//# sourceMappingURL=engine-CoCsNoW_.cjs.map
+//# sourceMappingURL=engine-DzBZR5D0.cjs.map