@geekmidas/cli 10.0.0-alpha.122 → 10.0.0-alpha.124

package/dist/{compose-CgBPA44v.mjs → compose-DJvvmF3X.mjs}

@@ -1,15 +1,15 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
-import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-D1QbNd55.mjs";
-import { a as serverAddressHint, h as stackBackups, i as requiredServerAddress, l as systemLookup, m as backupsService, o as stackHosts, p as backupsRoleStatements, r as isLocalHost, s as stageDns, t as HostNotPointingAtServer, u as BACKUPS_SERVICE, x as stageBackups } from "./dns-BgxvvcQa.mjs";
+import { c as runOutput, s as run } from "./credentials-DpfnUvIR.mjs";
+import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-DUnnVjqC.mjs";
+import { A as stackBackups, C as siteNames, I as stageBackups, O as backupsRoleStatements, S as siteAuth, T as BACKUPS_SERVICE, a as subscriptionKey, c as HostNotPointingAtServer, d as requiredServerAddress, f as serverAddressHint, g as systemLookup, i as recordedPushSubscriptions, k as backupsService, m as stageDns, n as SUBSCRIPTION_TYPE, o as subscriptionResource, p as stackHosts, r as confirmPendingSubscriptions, s as topicConnection, t as PushSubscriptionsUnconfirmed, u as isLocalHost, w as withSitePasswords, x as passwordSites } from "./snsSubscriptions-CvBIGGp0.mjs";
 import { t as defineTarget } from "./define-6poNqm5O.mjs";
-import { $n as stackLogs, $t as publicBuildValues, An as localRolePassword, B as workerDockerfile, Bn as EMULATOR_ACCESS_KEY_ID, Bt as initStageSecrets, Cn as REDIS_SERVICE, Ct as composeFor, Dn as stackRedis, En as runsRedis, Fn as isTelemetryKey, Gn as portKeys, Gt as composeBuildPaths, Hn as DEFAULT_IMAGES, In as scopeTelemetryEnv, Jn as primaryPortKey, Jt as WORKER_PORT, Kt as imageLayout, L as appDockerfile, Mn as planFor, N as stageProviderNotes, On as withRedisPassword, Qn as logsService, Rn as telemetryOf, S as recordRelease, Sn as withGeneratedSecrets, Tn as redisService, Vn as hostFor, Xn as LOGS_SERVICE, Xt as findBuildRoot, Zn as logsAccess, a as dnsResources, an as applyPostgres, at as suppliedOnly, bt as bucketClient, c as currentActor, ct as networkEnv, d as DeployJournal, er as withLogsPassword, et as devServicesUsed, fn as LOCAL_RABBITMQ_USER, ft as constructGlobs, hn as postgresSuperuser, in as applyPolicies, it as stageServiceDeclarations, kn as envFor, ln as postgresStatements, lt as workerEnvKeys, n as reportDatabaseRuns, nn as applyBuckets, nr as isMainFrontendApp, o as forgetDnsResource, on as bucketLifecycles, ot as appEnvKeys, pn as loadLocalCredentials, q as validateImageRef, qt as TURBO_VERSION, r as reportPlannedSeeds, rn as applyLifecycles, rr as resolveHost, s as recordDnsChanges, sn as bucketPolicies, t as DeploySeedsFailed, tn as workerUnits, tr as NoDomainForStage, tt as externalServices, v as createComposeState, vt as LEGACY_LOCAL_LOGIN, wn as STACK_CACHE, xt as pgClient, yt as ensurePostgresLogin, z as ensureDockerignore, zn as usesTelemetry } from "./seeds-oY0qDqui.mjs";
+import { $n as LOGS_SERVICE, $t as publicBuildValues, An as envFor, B as workerDockerfile, Bn as usesTelemetry, Bt as initStageSecrets, Cn as withGeneratedSecrets, Ct as composeFor, Dn as runsRedis, En as redisService, Gn as DEFAULT_IMAGES, Gt as composeBuildPaths, Hn as watchedBuckets, In as isTelemetryKey, Jn as portKeys, Jt as WORKER_PORT, Kt as imageLayout, L as appDockerfile, Ln as scopeTelemetryEnv, N as stageProviderNotes, Nn as planFor, On as stackRedis, S as recordRelease, Tn as STACK_CACHE, Un as EMULATOR_ACCESS_KEY_ID, Vn as minioWebhookEnv, Wn as hostFor, Xt as findBuildRoot, Zn as primaryPortKey, a as dnsResources, an as applyPolicies, ar as isMainFrontendApp, at as suppliedOnly, bt as bucketClient, c as currentActor, cn as bucketPolicies, ct as networkEnv, d as DeployJournal, er as logsAccess, et as devServicesUsed, ft as constructGlobs, gn as postgresSuperuser, in as applyNotifications, ir as NoDomainForStage, it as stageServiceDeclarations, jn as localRolePassword, kn as withRedisPassword, lt as workerEnvKeys, mn as loadLocalCredentials, n as reportDatabaseRuns, nn as applyBuckets, nr as stackLogs, o as forgetDnsResource, on as applyPostgres, or as resolveHost, ot as appEnvKeys, pn as LOCAL_RABBITMQ_USER, q as validateImageRef, qt as TURBO_VERSION, r as reportPlannedSeeds, rn as applyLifecycles, rr as withLogsPassword, s as recordDnsChanges, sn as bucketLifecycles, t as DeploySeedsFailed, tn as workerUnits, tr as logsService, tt as externalServices, un as postgresStatements, v as createComposeState, vt as LEGACY_LOCAL_LOGIN, wn as REDIS_SERVICE, xt as pgClient, yt as ensurePostgresLogin, z as ensureDockerignore, zn as telemetryOf } from "./seeds-rG-Evfz9.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { n as subscriberRoute, s as DEFAULT_EVENTS } from "./SubscriberGenerator-y3pncae_.mjs";
+import { a as SNS_SUBSCRIPTIONS_KEY, l as DEFAULT_EVENTS, o as objectsRoute, s as subscriberRoute } from "./SubscriberGenerator-COAVPgM-.mjs";
 import { a as imageRef } from "./identity-CBXr4wNi.mjs";
-import { i as discover } from "./discover-C5roJuc9.mjs";
-import { i as installedFrom } from "./drivers-BjGDYfnC.mjs";
+import { i as discover } from "./discover-BvJOVsYG.mjs";
+import { i as installedFrom } from "./drivers-Chb5Akov.mjs";
 import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-BPOgTn1u.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
@@ -684,7 +684,7 @@ function edgeCaddyfile(routes, options) {
 ` : tls.kind === "files" ? `
 	tls ${tls.certFile} ${tls.keyFile}
 ` : "";
-	const blocks = routes.map(({ host, upstreams, prefix, allow, paths, streaming }) => `https://${host} {${certificate}
+	const blocks = routes.map(({ host, upstreams, prefix, allow, auth, paths, streaming }) => `https://${host} {${certificate}
 	# gkm's own header, which only a service of this stack may send: the auth
 	# server rate-limits by the client address it carries.
 	request_header -${CLIENT_IP_HEADER}
@@ -693,6 +693,11 @@ ${allow ? `
 	# could set. Everything else is refused before it reaches the upstream.
 	@denied not remote_ip ${allow.join(" ")}
 	respond @denied 403
+` : ""}${auth ? `
+	# The stage's login, asked for before anything reaches the upstream.
+	basic_auth {
+		${auth.user} ${auth.hash}
+	}
 ` : ""}${paths ? `
 	# Only these paths answer. Everything else on this host is refused before
 	# it reaches the upstream.
@@ -720,7 +725,8 @@ const HEADER = `# Generated by gkm compose from the construct manifest — do no
 # One host per API and site, each in front of its own container, one per
 # file server in front of the stack's MinIO, one per worker SNS pushes to,
 # answering only those routes, and — when its logs are served publicly — one
-# for OpenObserve, to the addresses it allows.
+# for OpenObserve, to the addresses it allows. A site the stage puts behind a
+# password asks for its login first.
 `;
 //#endregion
 //#region src/compose/images.ts
@@ -1015,6 +1021,10 @@ function traefikDynamic(routes, options) {
 			middlewares[name(route, "allow")] = { ipAllowList: { sourceRange: [...route.allow] } };
 			chain.push(name(route, "allow"));
 		}
+		if (route.auth) {
+			middlewares[name(route, "auth")] = { basicAuth: { users: [`${route.auth.user}:${route.auth.hash}`] } };
+			chain.push(name(route, "auth"));
+		}
 		if (route.prefix) {
 			middlewares[name(route, "prefix")] = { addPrefix: { prefix: route.prefix } };
 			chain.push(name(route, "prefix"));
@@ -1433,9 +1443,20 @@ function composeStack(input) {
 			...credential.containers.minio,
 			buckets,
 			policies: bucketPolicies(plan).filter((p) => buckets.includes(p.bucket)),
+			objects: services.minio.map((id) => ({
+				id,
+				name: byId.get(id)?.name
+			})).filter((b) => Boolean(b.name)).sort((a, b) => a.name.localeCompare(b.name)),
+			webhooks: [],
 			lifecycles: bucketLifecycles(plan).filter((l) => buckets.includes(l.bucket))
 		};
 	})() : void 0;
+	const bucketEventKeys = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		if (resource.kind !== "objects") continue;
+		bucketEventKeys.set(provideKey(resource.id, "eventsConnectionString"), resource.id);
+		bucketEventKeys.set(provideKey(resource.id, "eventsToken"), resource.id);
+	}
 	const fileServers = /* @__PURE__ */ new Map();
 	if (storage) for (const resource of plan.resources) {
 		if (resource.kind !== "file-server" || !resource.of) continue;
@@ -1480,7 +1501,8 @@ function composeStack(input) {
 		project: workspace.name,
 		credentials: credential.containers,
 		seed: credential.seed,
-		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
+		...!local && domain ? { mailFrom: `noreply@${domain}` } : {},
+		relayedBuckets: [...watchedBuckets(manifest, input.subscribers ?? {}).keys()].filter((bucket) => services.minio.includes(bucket))
 	};
 	const outside = networkEnv(plan, {
 		...derivation,
@@ -1498,6 +1520,11 @@ function composeStack(input) {
 	*/
 	const valueFor = (app, key, owner) => {
 		if (isReservedStageKey(key)) return void 0;
+		const watching = bucketEventKeys.get(key);
+		if (watching) {
+			if (custom[key] !== void 0) return custom[key];
+			return services.minio.includes(watching) ? outside[key] : void 0;
+		}
 		if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) return;
 		if (owner && SERVICE_KINDS[owner.kind]) {
 			if (custom[key] !== void 0) return custom[key];
@@ -1599,13 +1626,28 @@ function composeStack(input) {
 				serviceName: worker.name,
 				...telemetryValues ? { telemetry: telemetryValues } : {}
 			}),
-			...push ? { [SUBSCRIBER_PUSH_URL_KEY]: push.url } : {},
+			...push && !input.recordingSubscriptions ? { [SNS_SUBSCRIPTIONS_KEY]: recordedSubscriptions(worker, push, input.pushSubscriptions?.[worker.id]) } : {},
 			NODE_ENV: "production",
 			PORT: String(worker.port),
 			STAGE: stage
 		};
 		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
 	}
+	if (storage && !input.buildOnly) {
+		const watched = watchedBuckets(manifest, input.subscribers ?? {});
+		for (const [bucket, workerId] of watched) {
+			if (!services.minio.includes(bucket)) continue;
+			const worker = workers.find((w) => w.id === workerId);
+			const relay = worker?.env?.[provideKey(bucket, "eventsConnectionString")];
+			const token = worker?.env?.[provideKey(bucket, "eventsToken")];
+			if (!worker || !relay || relay.startsWith("sns:") || !token) continue;
+			storage.webhooks.push({
+				bucket,
+				endpoint: `http://${hostOf(worker.name)}:${worker.port}${objectsRoute(bucket)}`,
+				token
+			});
+		}
+	}
 	const deployedTls = certificate ? {
 		kind: "files",
 		...proxy === "caddy" ? {
@@ -1647,6 +1689,11 @@ function composeStack(input) {
 		proxy,
 		edge: new Map([...edgeServices].map((service) => [service, hostOf(service)]))
 	});
+	if (!local) {
+		const sites = apps.filter((app) => app.kind === "site");
+		const chosen = passwordSites(workspace, stage, sites.map((app) => app.name));
+		for (const app of sites) if (chosen.includes(app.name)) app.auth = siteAuth(stage, app.name, custom);
+	}
 	const routes = [
 		...apps.map((app) => ({
 			name: app.name,
@@ -1656,6 +1703,10 @@ function composeStack(input) {
 				port: app.port
 			}],
 			streaming: true,
+			...app.auth ? { auth: {
+				user: app.auth.user,
+				hash: app.auth.hash
+			} } : {},
 			health: app.kind === "site" ? "/" : "/health"
 		})),
 		...[...fileServers.values()].map(({ route }) => route),
@@ -1776,29 +1827,61 @@ function stackApps(workspace, manifest, plan, options) {
 	}
 	return apps.sort((a, b) => a.name.localeCompare(b.name));
 }
-/** What the worker reads the public base of its push routes from. */
-const SUBSCRIBER_PUSH_URL_KEY = "GKM_SUBSCRIBER_PUSH_URL";
 /**
 * Where SNS pushes to a worker on a deployed stage, or nothing when it pushes
 * to none of its subscribers.
 *
-* A subscriber is pushed to when its topic's connection string, as this stage
-* resolved it for the worker, is an SNS one — the same test the worker's own
+* A subscriber is pushed to when the connection string its deliveries come
+* from — its topic's, or its bucket's events — as this stage resolved it for
+* the worker, is an SNS one — the same test the worker's own
 * startup makes, so the edge exposes a route exactly when the worker mounts
 * it. Each such route, and nothing else the worker serves, answers on
 * `<worker>.<domain>`.
 */
 function workerPush(worker, subscribers, env, options) {
-	const paths = subscribers.filter(({ topic }) => env[provideKey(topic, "publisherConnectionString")]?.startsWith("sns:")).map(({ name }) => subscriberRoute(name)).sort();
-	if (paths.length === 0) return void 0;
+	const pushed = subscribers.filter(({ connectionKey }) => env[connectionKey]?.startsWith("sns:")).filter((subscriber, index, all) => all.findIndex((s) => s.name === subscriber.name) === index).sort((a, b) => a.name.localeCompare(b.name));
+	if (pushed.length === 0) return void 0;
 	if (!options.domain) throw new NoDomainForStage(options.stage);
 	const host = `${worker.name}.${options.domain}`;
+	const url = `https://${host}`;
 	return {
 		host,
-		url: `https://${host}`,
-		paths: [...new Set(paths)]
+		url,
+		paths: pushed.map(({ name }) => subscriberRoute(name)),
+		subscribers: pushed.map(({ name, connectionKey, events }) => ({
+			name,
+			connectionKey,
+			endpoint: `${url}${subscriberRoute(name)}`,
+			...events ? { events } : {}
+		}))
 	};
 }
+/** A pushed subscriber the deploy recorded no SNS subscription for. */
+var PushSubscriptionMissing = class extends GkmError {
+	worker;
+	subscriber;
+	constructor(worker, subscriber) {
+		super(`SNS pushes to '${subscriber}' on the worker '${worker}', and the deploy recorded no subscription for it, so the worker would mount no route and SNS would deliver nowhere. Deploy the stage, which subscribes each pushed subscriber and records its ARN.`);
+		this.worker = worker;
+		this.subscriber = subscriber;
+		this.name = "PushSubscriptionMissing";
+	}
+};
+/**
+* The worker's `GKM_SNS_SUBSCRIPTIONS`: each pushed subscriber's recorded
+* subscription ARN, and nothing for a subscriber it does not run.
+*
+* @throws {PushSubscriptionMissing} when one has none
+*/
+function recordedSubscriptions(worker, push, recorded = {}) {
+	const arns = {};
+	for (const { name } of push.subscribers) {
+		const arn = recorded[name];
+		if (!arn) throw new PushSubscriptionMissing(worker.name, name);
+		arns[name] = arn;
+	}
+	return JSON.stringify(arns);
+}
 /** Two constructs the edge would answer on one host. */
 var EdgeHostTaken = class extends GkmError {
 	host;
@@ -1878,7 +1961,8 @@ function stackFile(options) {
 		minio.environment = {
 			...minio.environment,
 			MINIO_ROOT_USER: options.storage.user,
-			MINIO_ROOT_PASSWORD: options.storage.password
+			MINIO_ROOT_PASSWORD: options.storage.password,
+			...minioWebhookEnv(options.storage.webhooks)
 		};
 		minio.ports = ["127.0.0.1::9000"];
 	}
@@ -2166,12 +2250,14 @@ function deployedStackSecrets(workspace, stage, stored, manifest) {
 		secrets: withLogs.secrets,
 		generated: []
 	};
+	const withSites = withSitePasswords(withRedis.secrets, passwordSites(workspace, stage, siteNames(manifest)));
 	return {
-		secrets: withRedis.secrets,
+		secrets: withSites.secrets,
 		generated: [
 			...withSeed.generated,
 			...withLogs.generated,
-			...withRedis.generated
+			...withRedis.generated,
+			...withSites.generated
 		]
 	};
 }
@@ -2199,7 +2285,7 @@ var HealthRequestTimedOut = class extends GkmError {
 	}
 };
 /** The real probe: one HTTPS GET, the certificate verified. */
-const httpsProbe = ({ url, ca, connectTo, connectPort, timeoutMs, signal }) => {
+const httpsProbe = ({ url, ca, connectTo, connectPort, authorization, timeoutMs, signal }) => {
 	const target = new URL(url);
 	return new Promise((resolve, reject) => {
 		const req = request({
@@ -2208,7 +2294,10 @@ const httpsProbe = ({ url, ca, connectTo, connectPort, timeoutMs, signal }) => {
 			servername: target.hostname,
 			path: `${target.pathname}${target.search}`,
 			method: "GET",
-			headers: { host: target.host },
+			headers: {
+				host: target.host,
+				...authorization ? { authorization } : {}
+			},
 			...ca ? { ca } : {},
 			...signal ? { signal } : {},
 			timeout: timeoutMs
@@ -2241,6 +2330,119 @@ var ComposeAppsUnhealthy = class extends GkmError {
 	}
 };
 //#endregion
+//#region src/target/compose/topicSubscriptions.ts
+/**
+* Every topic subscriber the stack pushes to: a subscriber whose connection
+* key is a topic's publisher string — a bucket's events key is not — and
+* whose value on this stage is an SNS one.
+*/
+function topicPushes(stack, manifest) {
+	const topicKeys = new Set(Object.values(manifest).filter((declaration) => declaration.kind === "topic").map((topic) => provideKey(topic.id, "publisherConnectionString")));
+	const pushes = [];
+	for (const worker of stack.workers) for (const subscriber of worker.push?.subscribers ?? []) {
+		if (!topicKeys.has(subscriber.connectionKey)) continue;
+		const connectionString = worker.env?.[subscriber.connectionKey];
+		if (!connectionString?.startsWith("sns:")) continue;
+		pushes.push({
+			worker: worker.id,
+			name: subscriber.name,
+			endpoint: subscriber.endpoint,
+			connectionKey: subscriber.connectionKey,
+			connectionString,
+			...subscriber.events ? { events: subscriber.events } : {}
+		});
+	}
+	return pushes;
+}
+/** The subscriptions recorded for hand-set topics: those with a key. */
+function recordedTopicSubscriptions(resources) {
+	return Object.values(resources ?? {}).filter((record) => record.type === "sns-subscription" && typeof record.data?.connectionKey === "string");
+}
+/**
+* Converge each hand-set topic's subscriptions on the subscribers pushed to:
+* subscribe, bring filters up to date, unsubscribe a route on the worker's
+* host no subscriber wants any more — and record each ARN, forgetting what
+* was removed.
+*
+* @returns each worker's subscriptions, by export — what it is handed
+*/
+async function ensureTopicSubscriptions(input) {
+	const { snsUrl, reconcileHttpSubscriptions } = await import("@geekmidas/events/sns");
+	const groups = /* @__PURE__ */ new Map();
+	const group = (topicArn, host, connectionKey) => {
+		const id = `${topicArn}|${host}`;
+		const found = groups.get(id);
+		if (found) return found;
+		const created = {
+			topicArn,
+			host,
+			connectionKey,
+			pushes: [],
+			recorded: []
+		};
+		groups.set(id, created);
+		return created;
+	};
+	for (const push of input.pushes) {
+		const { topicArn } = snsUrl.parse(push.connectionString);
+		const into = group(topicArn, new URL(push.endpoint).host, push.connectionKey);
+		into.connectionString = push.connectionString;
+		into.pushes.push(push);
+	}
+	for (const record of recordedTopicSubscriptions(input.recorded)) group(String(record.data?.topicArn), new URL(String(record.data?.endpoint)).host, String(record.data?.connectionKey)).recorded.push(record);
+	const wanted = new Set(input.pushes.map(({ worker, name }) => subscriptionKey(worker, name)));
+	const arns = {};
+	for (const { topicArn, host, connectionKey, ...members } of groups.values()) {
+		const stale = members.recorded.filter((r) => !wanted.has(r.key));
+		const named = members.connectionString ?? input.secrets[connectionKey];
+		if (!named?.startsWith("sns:")) {
+			for (const record of stale) {
+				input.log(`   – forgot ${record.data?.endpoint}: '${connectionKey}' no longer names an SNS topic to unsubscribe it from`);
+				await input.forget(record.key);
+			}
+			continue;
+		}
+		const address = new URL(named);
+		address.searchParams.set("topicArn", topicArn);
+		const connection = await topicConnection({
+			connectionKey,
+			connectionString: address.toString(),
+			stage: input.stage,
+			env: input.env
+		});
+		const result = await reconcileHttpSubscriptions(connection, {
+			endpoints: members.pushes.map((push) => ({
+				name: push.name,
+				endpoint: push.endpoint,
+				...push.events ? { events: push.events } : {}
+			})),
+			ownedHost: host
+		});
+		await connection.close();
+		for (const push of members.pushes) {
+			const arn = result.subscriptions[push.name];
+			const key = subscriptionKey(push.worker, push.name);
+			if (input.recorded?.[key]?.id !== arn) input.log(`   ✓ '${push.name}' subscribed to ${topicArn.split(":").pop()} at ${push.endpoint}`);
+			await input.record(subscriptionResource({
+				worker: push.worker,
+				name: push.name,
+				topicArn,
+				endpoint: push.endpoint,
+				connectionKey: push.connectionKey,
+				pending: result.pending.includes(push.name),
+				...push.events ? { events: push.events } : {}
+			}, arn));
+			arns[push.worker] = {
+				...arns[push.worker],
+				[push.name]: arn
+			};
+		}
+		for (const arn of result.removed) input.log(`   – unsubscribed ${arn}: no subscriber wants it any more`);
+		for (const record of stale) await input.forget(record.key);
+	}
+	return arns;
+}
+//#endregion
 //#region src/target/compose/phases.ts
 /**
 * The compose target's phases: a stage as one Docker Compose stack behind
@@ -2391,8 +2593,9 @@ async function validateCompose(ctx, deps, options = {}) {
 		subscribers
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const recorded = push ? void 0 : await ctx.state.read(stage);
 	const layout = mode === "build" ? imageLayout(workspace) : void 0;
-	const composed = composeStack({
+	const input = {
 		workspace,
 		manifest,
 		runnables,
@@ -2411,9 +2614,24 @@ async function validateCompose(ctx, deps, options = {}) {
 		ports: edgePorts(deps.env),
 		...layout ? { layout } : {},
 		...push ? { buildOnly: true } : {}
+	};
+	const recordedArns = recordedPushSubscriptions(recorded?.resources);
+	const planned = push ? void 0 : composeStack({
+		...input,
+		recordingSubscriptions: true
+	});
+	const pushes = planned ? topicPushes(planned, manifest) : [];
+	const topics = planned && (pushes.length > 0 || recordedTopicSubscriptions(recorded?.resources).length > 0) ? {
+		pushes,
+		recorded: recorded?.resources
+	} : void 0;
+	const composed = topics && planned ? planned : composeStack({
+		...input,
+		pushSubscriptions: recordedArns
 	});
 	if (mode === "build") assertRedisClient(workspace, composed, manifest, runnables);
-	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
+	const pinned = (unpinned) => options.pin ? withPinnedImages(unpinned, options.pin.file, options.pin.digests) : unpinned;
+	const stack = pinned(composed);
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
 	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
@@ -2431,7 +2649,6 @@ async function validateCompose(ctx, deps, options = {}) {
 	const override = stackOverrideFile(root, stage);
 	const overrides = existsSync(override) ? [override] : [];
 	if (overrides.length > 0) ctx.logger.info(`🧩 Merging docker-compose.${stage}.yml over the generated stack`);
-	const recorded = push ? void 0 : await ctx.state.read(stage);
 	const previous = Object.fromEntries(Object.entries(recorded?.state.releases ?? {}).map(([name, releases]) => {
 		const { ref, tag, digest } = releases.current;
 		return [name, {
@@ -2444,6 +2661,20 @@ async function validateCompose(ctx, deps, options = {}) {
 		mode,
 		push,
 		stack,
+		...topics ? { topicSubscriptions: {
+			...topics,
+			restack: (arns) => {
+				const merged = { ...recordedArns };
+				for (const [worker, own] of Object.entries(arns)) merged[worker] = {
+					...merged[worker],
+					...own
+				};
+				return pinned(composeStack({
+					...input,
+					pushSubscriptions: merged
+				}));
+			}
+		} } : {},
 		...server ? { server } : {},
 		dir,
 		ref: {
@@ -2678,6 +2909,16 @@ async function planCompose(ctx, run) {
 			action: run.previous[worker.name] ? "reuse" : "create"
 		});
 	}
+	for (const push of run.topicSubscriptions?.pushes ?? []) {
+		const key = subscriptionKey(push.worker, push.name);
+		const id = run.topicSubscriptions?.recorded?.[key]?.id;
+		planned({
+			key,
+			resourceType: SUBSCRIPTION_TYPE,
+			action: id ? "reuse" : "create",
+			...id ? { id } : {}
+		});
+	}
 	if (!run.push) planned({
 		key: run.stack.proxy === "caddy" ? "service:caddy" : `service:${EDGE_PROJECT}/${EDGE_SERVICE}`,
 		resourceType: "service",
@@ -2690,7 +2931,7 @@ async function planCompose(ctx, run) {
 * migrations applied.
 */
 async function provisionCompose(ctx, run, deps) {
-	const { stack, ref } = run;
+	const { ref } = run;
 	if (run.push) return;
 	if (run.generated.length > 0 && run.secrets) {
 		await ctx.secrets.write(run.secrets);
@@ -2698,11 +2939,13 @@ async function provisionCompose(ctx, run, deps) {
 	}
 	const ports = edgePorts(deps.env);
 	await assertEdgePorts(deps.docker, {
-		project: stack.project,
-		proxy: stack.proxy,
+		project: run.stack.project,
+		proxy: run.stack.proxy,
 		ports,
 		engine: ref
 	});
+	if (run.topicSubscriptions) await subscribeTopics(ctx, run, deps);
+	const { stack } = run;
 	run.files = await writeStack(ctx.cwd, run.dir, stack);
 	printPlan(ctx, run);
 	if (stack.proxy === "traefik") {
@@ -2741,6 +2984,36 @@ async function provisionCompose(ctx, run, deps) {
 	if (stack.storage && stack.infra.includes("minio")) await prepareBuckets(ctx, run, deps);
 }
 /**
+* Subscribe each topic subscriber SNS pushes to — for a topic the stage set
+* to SNS by hand — record the ARNs, and compose the stack again with them,
+* before a file is written.
+*/
+async function subscribeTopics(ctx, run, deps) {
+	const { pushes, recorded, restack } = run.topicSubscriptions;
+	if (pushes.length > 0) ctx.logger.info("\n📮 SNS subscriptions for the stage's own topics");
+	run.stack = restack(await ensureTopicSubscriptions({
+		pushes,
+		recorded,
+		secrets: run.secrets?.custom ?? {},
+		stage: ctx.stage,
+		env: deps.env,
+		record: async (resource) => {
+			await ctx.state.putResource(ctx.stage, resource);
+			applied(ctx, run, {
+				key: resource.key,
+				resourceType: SUBSCRIPTION_TYPE,
+				action: "ensure",
+				id: resource.id,
+				via: recorded?.[resource.key]?.id === resource.id ? "recorded" : "created"
+			});
+		},
+		forget: async (key) => {
+			await ctx.state.deleteResource(ctx.stage, key);
+		},
+		log: (line) => ctx.logger.info(line)
+	}));
+}
+/**
 * Create each bucket the stack's MinIO serves, and the open paths of each
 * one a file server fronts — from this machine, on MinIO's loopback port,
 * the way `gkm dev` creates them.
@@ -2755,7 +3028,8 @@ async function prepareBuckets(ctx, run, deps) {
 		done = [
 			...await applyBuckets(client, storage.buckets),
 			...await applyPolicies(client, storage.policies),
-			...await applyLifecycles(client, storage.lifecycles)
+			...await applyLifecycles(client, storage.lifecycles),
+			...await applyNotifications(client, storage.objects, new Set(storage.webhooks.map((hook) => hook.bucket)))
 		];
 	} finally {
 		await tunnel.close();
@@ -2937,7 +3211,7 @@ async function releaseCompose(ctx, run, deps) {
 		via: run.previous[worker.name] ? "recorded" : "created"
 	});
 	ctx.logger.info(`\n✅ ${stack.project} is running:`);
-	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}${app.auth ? `  🔒 user: ${app.auth.user}, password: gkm secrets:show --stage ${ctx.stage} --reveal → ${app.auth.key}` : ""}`);
 	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} worker ${worker.id}`);
 	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
 }
@@ -2987,9 +3261,33 @@ async function verifyCompose(ctx, run, deps) {
 	}));
 	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down, stack.proxy);
 	await pruneStageDns(ctx, run);
+	await confirmSubscriptions(ctx, run, deps);
 	if (stack.logs) reportLogs(ctx, stack.logs, stack.local, run.server);
 }
 /**
+* The SNS subscriptions the stage's providers made before the workers were
+* up: each still pending is subscribed again, so SNS resends its
+* confirmation to a worker now there to answer it, and waited on. One still
+* pending after that is said, not failed on — every app is healthy, and
+* rolling them back would not confirm it.
+*/
+async function confirmSubscriptions(ctx, run, deps) {
+	const stored = await ctx.state.read(ctx.stage);
+	const left = await (deps.confirmSubscriptions ?? confirmPendingSubscriptions)({
+		workspace: ctx.workspace,
+		stage: ctx.stage,
+		secrets: run.secrets?.custom ?? {},
+		resources: stored?.resources,
+		env: deps.env,
+		log: (line) => ctx.logger.info(line),
+		record: async (record) => {
+			const { updatedAt: _, updatedBy: __, ...input } = record;
+			await ctx.state.putResource(ctx.stage, input);
+		}
+	});
+	if (left.length > 0) ctx.logger.warn(`⚠ ${new PushSubscriptionsUnconfirmed(left).message}`);
+}
+/**
 * A container's own health check, as Docker reports it: a worker's, which
 * has no route through the edge, and OpenObserve's — by default it has no
 * host there, and served publicly it answers only the addresses it allows,
@@ -3029,6 +3327,10 @@ async function checkContainer(ctx, run, deps, service) {
 		healthy: false
 	};
 }
+/** A login, as the `Authorization` header that carries it. */
+function basicAuthorization(auth) {
+	return `Basic ${Buffer.from(`${auth.user}:${auth.password}`).toString("base64")}`;
+}
 /** How to open the logs, printed — and as an event, for a headless caller. */
 function reportLogs(ctx, logs, local, server) {
 	const lines = logsAccess(logs, {
@@ -3066,6 +3368,7 @@ async function checkApp(ctx, app, deps, options) {
 			status = await deps.probe({
 				url,
 				...options.ca ? { ca: options.ca } : {},
+				...app.auth ? { authorization: basicAuthorization(app.auth) } : {},
 				...options.edge,
 				timeoutMs: 1e4,
 				signal: ctx.signal
@@ -3304,4 +3607,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { dockerCompose as C, sshTarget as S, parseDigests as _, edgePorts as a, dockerHost as b, edgeRef as c, composeStack as d, derivedCredentials as f, edgeAlias as g, EDGE_PROJECT as h, ComposePushNeedsBuild as i, removeEdgeRoutes as l, stackPlan as m, compose_exports as n, stackOverrideFile as o, stackDir as p, ComposePinNeedsPull as r, deployedStackSecrets as s, composeTarget as t, composeProject as u, pinnedRef as v, projectNetwork as w, sshAccess as x, composeServer as y };
 
-//# sourceMappingURL=compose-CgBPA44v.mjs.map
+//# sourceMappingURL=compose-DJvvmF3X.mjs.map