@geekmidas/cli 10.0.0-alpha.122 → 10.0.0-alpha.124

package/dist/{deploy-CI85F6dr.cjs → deploy-BbI1UMh3.cjs}

@@ -1,99 +1,26 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_run = require("./run-fVZ-rLnc.cjs");
-const require_credentials = require("./credentials-Zqr3QQYB.cjs");
-const require_workspace = require("./workspace-BwqQnool.cjs");
-const require_dns = require("./dns-CfEZHt7r.cjs");
+const require_credentials = require("./credentials-D7XJypNd.cjs");
+const require_workspace = require("./workspace-C82GLPnf.cjs");
+const require_snsSubscriptions = require("./snsSubscriptions-CSkteK2J.cjs");
 const require_define = require("./define-crmMcXFS.cjs");
-const require_seeds = require("./seeds-CFG-f24B.cjs");
+const require_seeds = require("./seeds-DOfxmDRO.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-C3QTae-R.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_discover = require("./discover-DozUKs8f.cjs");
+const require_discover = require("./discover-ojkcbxHw.cjs");
 const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-CyprRcQo.cjs");
-const require_local = require("./local-DNhnkugT.cjs");
-const require_sniffer = require("./sniffer-BAmtXzou.cjs");
+const require_resolve = require("./resolve-C7GKQcE4.cjs");
+const require_local = require("./local-OPC9BCZt.cjs");
+const require_sniffer = require("./sniffer-C7O9Pna_.cjs");
 const require_projectBucket = require("./projectBucket-BBbQ1lHF.cjs");
-const require_credentialSchemas = require("./credentialSchemas-B67WJOOm.cjs");
+const require_credentialSchemas = require("./credentialSchemas-AhIBuQxQ.cjs");
 let node_path = require("node:path");
 let node_crypto = require("node:crypto");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let _geekmidas_storage_s3_url = require("@geekmidas/storage/s3-url");
 _geekmidas_storage_s3_url = require_rolldown_runtime.__toESM(_geekmidas_storage_s3_url, 1);
-//#region src/providers/aws.ts
-/**
-* The AWS account a provider provisions in — the stage's, found the way the
-* SSM and Secrets Manager stores find it.
-*
-* 1. `--profile`, resolved on its own: exported keys left over from another
-*    account never win over a profile someone named.
-* 2. `AWS_PROFILE`, else `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` — the
-*    deploy's own `aws` credential kind (`storedCredentials`).
-* 3. The SDK's default chain: `~/.aws` default profile, SSO, a role. In CI,
-*    whatever `aws-actions/configure-aws-credentials` exported.
-*
-* None of them: the provider has no provisioning credentials, and the stage
-* is treated as `external`.
-*/
-async function awsProvisioningCredentials(lookup) {
-	const region = lookup.env.AWS_REGION ?? lookup.env.AWS_DEFAULT_REGION;
-	const where = region ? { region } : {};
-	if (lookup.profile) return {
-		profile: lookup.profile,
-		...where
-	};
-	const stored = await require_credentials.storedCredentials({
-		env: lookup.env,
-		...lookup.home ? { home: lookup.home } : {}
-	}).get({
-		kind: "aws",
-		stage: lookup.stage
-	});
-	if (stored) return stored;
-	try {
-		const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
-		await fromNodeProviderChain({
-			timeout: 1e3,
-			maxRetries: 0
-		})();
-		return {
-			chain: true,
-			...where
-		};
-	} catch {
-		return;
-	}
-}
-/**
-* An S3-compatible endpoint the environment points the SDK at — the AWS
-* emulator in tests. The SDK reads it itself; it is read here too, because
-* an emulator takes path-style requests, and a key written for one has to
-* say where it is.
-*/
-function awsEndpoint(env, service) {
-	return env[`AWS_ENDPOINT_URL_${service}`] ?? env.AWS_ENDPOINT_URL;
-}
-/** An SDK client's config for a provisioning credential. */
-async function awsClientConfig(credential, region) {
-	if ("profile" in credential) {
-		const { fromIni } = await import("@aws-sdk/credential-providers");
-		return {
-			region,
-			credentials: fromIni({ profile: credential.profile })
-		};
-	}
-	if ("accessKeyId" in credential) return {
-		region,
-		credentials: {
-			accessKeyId: credential.accessKeyId,
-			secretAccessKey: credential.secretAccessKey,
-			...credential.sessionToken ? { sessionToken: credential.sessionToken } : {}
-		}
-	};
-	return { region };
-}
-//#endregion
 //#region src/target/secrets.ts
 /**
 * A stage's secrets as a target sees them: read and written through the
@@ -249,28 +176,37 @@ const bucketArn = (bucket) => `arn:aws:s3:::${bucket}`;
 function userPolicy(bucket, options = {}) {
 	return {
 		Version: "2012-10-17",
-		Statement: [{
-			Sid: "GkmObjects",
-			Effect: "Allow",
-			Action: [
-				"s3:GetObject",
-				"s3:PutObject",
-				"s3:DeleteObject",
-				"s3:AbortMultipartUpload",
-				"s3:ListMultipartUploadParts",
-				...options.versioning ? ["s3:GetObjectVersion"] : []
-			],
-			Resource: `${bucketArn(bucket)}/*`
-		}, {
-			Sid: "GkmBucket",
-			Effect: "Allow",
-			Action: [
-				"s3:ListBucket",
-				"s3:GetBucketLocation",
-				"s3:ListBucketMultipartUploads"
-			],
-			Resource: bucketArn(bucket)
-		}]
+		Statement: [
+			{
+				Sid: "GkmObjects",
+				Effect: "Allow",
+				Action: [
+					"s3:GetObject",
+					"s3:PutObject",
+					"s3:DeleteObject",
+					"s3:AbortMultipartUpload",
+					"s3:ListMultipartUploadParts",
+					...options.versioning ? ["s3:GetObjectVersion"] : []
+				],
+				Resource: `${bucketArn(bucket)}/*`
+			},
+			{
+				Sid: "GkmBucket",
+				Effect: "Allow",
+				Action: [
+					"s3:ListBucket",
+					"s3:GetBucketLocation",
+					"s3:ListBucketMultipartUploads"
+				],
+				Resource: bucketArn(bucket)
+			},
+			...options.eventsTopicArn ? [{
+				Sid: "GkmEvents",
+				Effect: "Allow",
+				Action: "sns:ConfirmSubscription",
+				Resource: options.eventsTopicArn
+			}] : []
+		]
 	};
 }
 /**
@@ -397,7 +333,7 @@ function identityTags(ctx, id) {
 	];
 }
 /** A read whose "there is none" answer is one of `missing`. */
-async function readOr$1(read, missing) {
+async function readOr$2(read, missing) {
 	try {
 		return await read();
 	} catch (error) {
@@ -427,7 +363,7 @@ async function ensureIamUser(ctx, clients, input) {
 		key: `iam-user:${id}`,
 		type: "iam-user"
 	};
-	const found = await readOr$1(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
+	const found = await readOr$2(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
 	if (found?.User) {
 		const tags = await iam.send(new IAM.ListUserTagsCommand({ UserName: user }));
 		const tag = (key) => tags.Tags?.find((t) => t.Key === key)?.Value;
@@ -447,7 +383,7 @@ async function ensureIamUser(ctx, clients, input) {
 		await ctx.state.ready(entry, user);
 	});
 	const exists = Boolean(found?.User) || !ctx.dryRun;
-	const current = exists ? await readOr$1(() => iam.send(new IAM.GetUserPolicyCommand({
+	const current = exists ? await readOr$2(() => iam.send(new IAM.GetUserPolicyCommand({
 		UserName: user,
 		PolicyName: input.policyName
 	})), ["NoSuchEntity", "NoSuchEntityException"]) : void 0;
@@ -692,7 +628,7 @@ var BackupsKeyRefused = class extends require_errors.GkmError {
 	key;
 	said;
 	constructor(stage, bucket, key, said) {
-		super(`The ${require_dns.BACKUPS_URL_KEY} key of '${stage}' could not put s3://${bucket}/${key} (${said}), so its backups would fail the same way. Run the deploy with the stage's AWS credentials to put its user and policy back, or --rotate-keys to issue it a new key.`);
+		super(`The ${require_snsSubscriptions.BACKUPS_URL_KEY} key of '${stage}' could not put s3://${bucket}/${key} (${said}), so its backups would fail the same way. Run the deploy with the stage's AWS credentials to put its user and policy back, or --rotate-keys to issue it a new key.`);
 		this.stage = stage;
 		this.bucket = bucket;
 		this.key = key;
@@ -721,7 +657,7 @@ function backupsRegion(workspace, stage, credential, env = process.env) {
 async function ensureStageBackups(input) {
 	const { workspace, manifest, stage, ctx } = input;
 	const env = input.env ?? process.env;
-	const choice = require_dns.stageBackups(workspace, manifest, stage);
+	const choice = require_snsSubscriptions.stageBackups(workspace, manifest, stage);
 	if (choice.mode === "disabled") {
 		ctx.log(`💾 backups: off — deploy.backups.${stage} is false. Nothing is backed up, and nothing already backed up is deleted.`);
 		return choice;
@@ -731,7 +667,7 @@ async function ensureStageBackups(input) {
 		const clash = Object.entries(manifest).find(([id, d]) => d.kind === "objects" && require_derive.appKey(id) === "backups");
 		if (clash) throw new BackupsUserNameTaken(stage, clash[0]);
 	}
-	const credential = await awsProvisioningCredentials({
+	const credential = await require_snsSubscriptions.awsProvisioningCredentials({
 		stage,
 		env,
 		...input.profile ? { profile: input.profile } : {},
@@ -741,11 +677,11 @@ async function ensureStageBackups(input) {
 	const region = backupsRegion(workspace, stage, credential, env);
 	const clients = await backupsClients(credential, region, env);
 	const bucket = require_projectBucket.projectBucketName(ctx.identity.scope, await require_projectBucket.callerAccountId(clients.sts));
-	const prefix = require_dns.backupsPrefix(workspace, stage);
-	const expiries = require_dns.backupExpiries(workspace, manifest);
+	const prefix = require_snsSubscriptions.backupsPrefix(workspace, stage);
+	const expiries = require_snsSubscriptions.backupExpiries(workspace, manifest);
 	ctx.log(`💾 backups: ${choice.backups.describe}, to s3://${bucket}/${prefix}/${ctx.dryRun ? " (dry run)" : ""}`);
 	if (await require_projectBucket.findProjectBucket(clients.s3, bucket) === "none") await ctx.change({
-		construct: require_dns.BACKUPS_SERVICE,
+		construct: require_snsSubscriptions.BACKUPS_SERVICE,
 		resource: `bucket ${bucket}`,
 		change: `create in ${region}, expiring each stage's backups`
 	}, async () => {
@@ -757,7 +693,7 @@ async function ensureStageBackups(input) {
 		});
 	});
 	else if (await require_projectBucket.reconcileProjectBucketLifecycle(clients.s3, bucket, expiries, { dryRun: true })) await ctx.change({
-		construct: require_dns.BACKUPS_SERVICE,
+		construct: require_snsSubscriptions.BACKUPS_SERVICE,
 		resource: `bucket ${bucket}`,
 		change: `lifecycle: ${expiries.map((e) => `${e.prefix} after ${e.days} days`).join(", ")}`
 	}, async () => {
@@ -773,7 +709,7 @@ async function ensureStageBackups(input) {
 	await ensureAccessKey(ctx, clients, {
 		id: BACKUPS_ID,
 		bucket,
-		urlKey: require_dns.BACKUPS_URL_KEY,
+		urlKey: require_snsSubscriptions.BACKUPS_URL_KEY,
 		...user
 	});
 	return choice;
@@ -783,8 +719,8 @@ async function backupsClients(credential, region, env) {
 	const S3 = await import("@aws-sdk/client-s3");
 	const IAM = await import("@aws-sdk/client-iam");
 	const { STSClient } = await import("@aws-sdk/client-sts");
-	const config = await awsClientConfig(credential, region);
-	const endpoint = awsEndpoint(env, "S3");
+	const config = await require_snsSubscriptions.awsClientConfig(credential, region);
+	const endpoint = require_snsSubscriptions.awsEndpoint(env, "S3");
 	return {
 		IAM,
 		iam: new IAM.IAMClient(config),
@@ -809,8 +745,8 @@ async function backupsClients(credential, region, env) {
 */
 async function verifyStageBackups(input) {
 	const { stage } = input;
-	if (require_dns.stageBackups(input.workspace, input.manifest, stage).mode !== "on") return false;
-	const url = input.secrets[require_dns.BACKUPS_URL_KEY];
+	if (require_snsSubscriptions.stageBackups(input.workspace, input.manifest, stage).mode !== "on") return false;
+	const url = input.secrets[require_snsSubscriptions.BACKUPS_URL_KEY];
 	if (!url) return false;
 	const address = (await import("@geekmidas/storage/s3-url")).parse(url);
 	if (!address.accessKeyId || !address.secretAccessKey) return false;
@@ -824,7 +760,7 @@ async function verifyStageBackups(input) {
 		...address.endpoint ? { endpoint: address.endpoint } : {},
 		...address.forcePathStyle ? { forcePathStyle: true } : {}
 	});
-	const Key = `${require_dns.backupsPrefix(input.workspace, stage)}/${VERIFY_MARKER}`;
+	const Key = `${require_snsSubscriptions.backupsPrefix(input.workspace, stage)}/${VERIFY_MARKER}`;
 	const put = async () => {
 		try {
 			await client.send(new S3.PutObjectCommand({
@@ -861,6 +797,376 @@ async function verifyStageBackups(input) {
 	}
 }
 //#endregion
+//#region src/providers/s3/events.ts
+/** What S3 tells the topic about: every object written, and every removed. */
+const BUCKET_EVENTS = ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"];
+/**
+* Each bucket a subscriber watches, with the subscribers discovery could name.
+*
+* A bucket is watched when a process consumes its events — discovery records
+* the edge, and the subscriber by its export — or when a build put a
+* subscriber in its declaration. Only a named subscriber can be subscribed: a
+* route is named after its export.
+*/
+function bucketWatchers(manifest, runnables, subscribers = {}) {
+	const watched = /* @__PURE__ */ new Map();
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "objects") continue;
+		const key = (0, _geekmidas_manifest.provideKey)(id, "eventsConnectionString");
+		const named = Object.entries(subscribers).flatMap(([worker, bound]) => bound.filter((s) => s.connectionKey === key).map((s) => ({
+			worker,
+			name: s.name
+		}))).sort((a, b) => `${a.worker}/${a.name}`.localeCompare(`${b.worker}/${b.name}`));
+		const edged = Object.values(runnables).some((edges) => edges.includes(require_discover.eventsEdge(id)));
+		const declared = (declaration.subscribers?.length ?? 0) > 0;
+		if (named.length > 0 || edged || declared) watched.set(id, named);
+	}
+	return watched;
+}
+/** The topic a bucket's changes are published to. */
+function eventsTopicName(bucket) {
+	return `${bucket.replaceAll(".", "-")}-events`;
+}
+/** What SNS gives up delivering, kept. */
+function eventsDeadLetterName(bucket) {
+	return `${eventsTopicName(bucket)}-dlq`;
+}
+/** Only this bucket, in this account, may publish to its topic. */
+function eventsTopicPolicy(topicArn, bucket, account) {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "GkmBucketPublishes",
+			Effect: "Allow",
+			Principal: { Service: "s3.amazonaws.com" },
+			Action: "sns:Publish",
+			Resource: topicArn,
+			Condition: {
+				ArnLike: { "aws:SourceArn": `arn:aws:s3:::${bucket}` },
+				StringEquals: { "aws:SourceAccount": account }
+			}
+		}]
+	};
+}
+/** Only the bucket's topic may send to its dead-letter queue. */
+function eventsDeadLetterPolicy(queueArn, topicArn) {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "GkmTopicDeadLetters",
+			Effect: "Allow",
+			Principal: { Service: "sns.amazonaws.com" },
+			Action: "sqs:SendMessage",
+			Resource: queueArn,
+			Condition: { ArnEquals: { "aws:SourceArn": topicArn } }
+		}]
+	};
+}
+/** The id this provider's notification entry goes under. */
+const notificationId = (id) => `gkm-${id}`;
+/**
+* The bucket's notifications with this provider's entry put back, and whether
+* that changed anything. Every other entry — a queue, a function, a topic
+* somebody added by hand — is kept exactly as it was.
+*/
+function mergedNotifications(current, id, topicArn) {
+	const own = notificationId(id);
+	const wanted = {
+		Id: own,
+		TopicArn: topicArn,
+		Events: [...BUCKET_EVENTS]
+	};
+	const topics = current.TopicConfigurations ?? [];
+	const existing = topics.find((t) => t.Id === own);
+	const same = existing !== void 0 && existing.TopicArn === topicArn && JSON.stringify([...existing.Events ?? []].sort()) === JSON.stringify([...BUCKET_EVENTS].sort()) && existing.Filter === void 0;
+	const { ResponseMetadata: _, ...rest } = current;
+	return {
+		config: {
+			...rest,
+			TopicConfigurations: [...topics.filter((t) => t.Id !== own), wanted]
+		},
+		changed: !same
+	};
+}
+/** S3 refused the entry because another one already covers these events. */
+var BucketNotificationsOverlap = class extends require_errors.GkmError {
+	bucket;
+	detail;
+	constructor(bucket, detail) {
+		super(`'${bucket}' already sends object creates or deletes somewhere else, and S3 sends each event to one place only, so the deploy cannot add its own entry. Remove the other notification from the bucket, or give it a prefix, and deploy again. S3 said: ${detail}`);
+		this.bucket = bucket;
+		this.detail = detail;
+		this.name = "BucketNotificationsOverlap";
+	}
+};
+const defaultEventsClients = async (credential, region) => {
+	const SNS = await import("@aws-sdk/client-sns");
+	const SQS = await import("@aws-sdk/client-sqs");
+	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+	const config = await require_snsSubscriptions.awsClientConfig(credential, region);
+	const endpoint = require_snsSubscriptions.awsEndpoint(process.env, "SNS");
+	const sts = new STSClient({
+		...config,
+		...require_snsSubscriptions.awsEndpoint(process.env, "STS") ? { endpoint: require_snsSubscriptions.awsEndpoint(process.env, "STS") } : {}
+	});
+	const { Account } = await sts.send(new GetCallerIdentityCommand({}));
+	sts.destroy();
+	return {
+		SNS,
+		SQS,
+		sns: new SNS.SNSClient({
+			...config,
+			...endpoint ? { endpoint } : {}
+		}),
+		sqs: new SQS.SQSClient({
+			...config,
+			...require_snsSubscriptions.awsEndpoint(process.env, "SQS") ? { endpoint: require_snsSubscriptions.awsEndpoint(process.env, "SQS") } : {}
+		}),
+		account: Account,
+		region,
+		...endpoint ? { endpoint } : {}
+	};
+};
+let makeEventsClients = defaultEventsClients;
+function errorName$1(error) {
+	const e = error;
+	return e?.name ?? e?.Code ?? e?.code ?? "";
+}
+async function readOr$1(read, missing) {
+	try {
+		return await read();
+	} catch (error) {
+		if (missing.includes(errorName$1(error))) return void 0;
+		throw error;
+	}
+}
+/**
+* The topic, its policy, the dead-letter queue and the bucket's notification
+* entry for one watched bucket — created where missing, put back where they
+* drifted.
+*/
+async function ensureBucketEvents(ctx, s3, input) {
+	const { id, bucket, region } = input;
+	const { SNS, SQS, sns, sqs, account } = await makeEventsClients(ctx.credential, region);
+	const topicName = eventsTopicName(bucket);
+	const topicArn = `arn:aws:sns:${region}:${account}:${topicName}`;
+	const topicEntry = {
+		key: `sns-topic:${id}`,
+		type: "sns-topic"
+	};
+	const topic = await readOr$1(() => sns.send(new SNS.GetTopicAttributesCommand({ TopicArn: topicArn })), ["NotFound", "NotFoundException"]);
+	if (topic) await ctx.state.ready(topicEntry, topicArn);
+	else await ctx.change({
+		construct: id,
+		resource: `SNS topic ${topicName}`,
+		change: "create"
+	}, async () => {
+		await ctx.state.pending(topicEntry);
+		await sns.send(new SNS.CreateTopicCommand({
+			Name: topicName,
+			Tags: identityTags(ctx, id)
+		}));
+		await ctx.state.ready(topicEntry, topicArn);
+	});
+	const topicPolicy = eventsTopicPolicy(topicArn, bucket, account);
+	const currentTopicPolicy = topic?.Attributes?.Policy;
+	if (!currentTopicPolicy || canonicalPolicy(JSON.parse(currentTopicPolicy)) !== canonicalPolicy(topicPolicy)) await ctx.change({
+		construct: id,
+		resource: `SNS topic ${topicName}`,
+		change: `publishable by '${bucket}' only`
+	}, async () => {
+		await sns.send(new SNS.SetTopicAttributesCommand({
+			TopicArn: topicArn,
+			AttributeName: "Policy",
+			AttributeValue: JSON.stringify(topicPolicy)
+		}));
+	});
+	const queueName = eventsDeadLetterName(bucket);
+	const deadLetterArn = `arn:aws:sqs:${region}:${account}:${queueName}`;
+	const queueEntry = {
+		key: `sqs-queue:${id}-events-dlq`,
+		type: "sqs-queue"
+	};
+	const queue = await readOr$1(() => sqs.send(new SQS.GetQueueUrlCommand({ QueueName: queueName })), ["QueueDoesNotExist", "AWS.SimpleQueueService.NonExistentQueue"]);
+	let queueUrl = queue?.QueueUrl;
+	if (queueUrl) await ctx.state.ready(queueEntry, deadLetterArn);
+	else await ctx.change({
+		construct: id,
+		resource: `SQS queue ${queueName}`,
+		change: "create"
+	}, async () => {
+		await ctx.state.pending(queueEntry);
+		queueUrl = (await sqs.send(new SQS.CreateQueueCommand({
+			QueueName: queueName,
+			Attributes: { MessageRetentionPeriod: "1209600" },
+			tags: Object.fromEntries(identityTags(ctx, id).map((t) => [t.Key, t.Value]))
+		}))).QueueUrl;
+		await ctx.state.ready(queueEntry, deadLetterArn);
+	});
+	const queuePolicy = eventsDeadLetterPolicy(deadLetterArn, topicArn);
+	const currentQueuePolicy = queue?.QueueUrl ? (await sqs.send(new SQS.GetQueueAttributesCommand({
+		QueueUrl: queue.QueueUrl,
+		AttributeNames: ["Policy"]
+	}))).Attributes?.Policy : void 0;
+	if (!currentQueuePolicy || canonicalPolicy(JSON.parse(currentQueuePolicy)) !== canonicalPolicy(queuePolicy)) await ctx.change({
+		construct: id,
+		resource: `SQS queue ${queueName}`,
+		change: `receives what ${topicName} cannot deliver`
+	}, async () => {
+		await sqs.send(new SQS.SetQueueAttributesCommand({
+			QueueUrl: queueUrl,
+			Attributes: { Policy: JSON.stringify(queuePolicy) }
+		}));
+	});
+	const merged = mergedNotifications(await readOr$1(() => s3.s3.send(new s3.S3.GetBucketNotificationConfigurationCommand({ Bucket: bucket })), ["NoSuchBucket"]) ?? {}, id, topicArn);
+	if (merged.changed) await ctx.change({
+		construct: id,
+		resource: `bucket ${bucket}`,
+		change: `send object creates and deletes to ${topicName}`
+	}, async () => {
+		try {
+			await s3.s3.send(new s3.S3.PutBucketNotificationConfigurationCommand({
+				Bucket: bucket,
+				NotificationConfiguration: merged.config
+			}));
+		} catch (error) {
+			const message = error.message ?? "";
+			if (/overlap/i.test(message)) throw new BucketNotificationsOverlap(bucket, message);
+			throw error;
+		}
+	});
+	sns.destroy();
+	sqs.destroy();
+	return {
+		topicArn,
+		deadLetterArn
+	};
+}
+/**
+* The events key: the topic's address, signed by the bucket's own access key
+* — read off the bucket's URL, so a rotated key rotates this one with it.
+*/
+async function ensureEventsKey(ctx, input) {
+	const { id, topicArn, region } = input;
+	const key = (0, _geekmidas_manifest.provideKey)(id, "eventsConnectionString");
+	const url = ctx.secrets[(0, _geekmidas_manifest.provideKey)(id, "url")];
+	let parsed;
+	try {
+		parsed = url ? _geekmidas_storage_s3_url.parse(url) : void 0;
+	} catch {
+		parsed = void 0;
+	}
+	if (!parsed?.accessKeyId || !parsed.secretAccessKey) {
+		await ctx.change({
+			construct: id,
+			resource: key,
+			change: "set to the topic’s address"
+		}, async () => {});
+		return;
+	}
+	const { snsUrl } = await import("@geekmidas/events/sns");
+	const endpoint = require_snsSubscriptions.awsEndpoint(process.env, "SNS");
+	const address = new URL(snsUrl.build({
+		topicArn,
+		region,
+		...endpoint ? { endpoint } : {}
+	}));
+	address.searchParams.set("accessKeyId", parsed.accessKeyId);
+	address.searchParams.set("secretAccessKey", parsed.secretAccessKey);
+	const value = address.toString();
+	const entry = {
+		key: `events-key:${id}`,
+		type: "url"
+	};
+	if (ctx.secrets[key] === value) {
+		await ctx.state.ready(entry, topicArn);
+		return;
+	}
+	await ctx.change({
+		construct: id,
+		resource: key,
+		change: `set to ${topicArn}`
+	}, async () => {
+		await ctx.writeSecrets({ [key]: value });
+		await ctx.state.ready(entry, topicArn);
+	});
+}
+/** Where SNS pushes to a worker: its own host on the stage's domain. */
+function workerPushHost(worker, domain) {
+	return `${require_derive.appKey(worker)}.${domain}`;
+}
+/**
+* One HTTP subscription per subscriber to the bucket's topic, at its route on
+* its worker's host, with the bucket's dead-letter queue — and each ARN
+* recorded, which is what the worker accepts deliveries under.
+*
+* Unfiltered: a bucket's notifications carry no `type` attribute, and the
+* subscriber's own filter — events, prefix, suffix — is what decides. Only a
+* compose stage pushes to a worker; any other is told so and left alone.
+*/
+async function ensurePushSubscriptions(ctx, input) {
+	const { id, events, region, watchers } = input;
+	if (!require_snsSubscriptions.deploysWithCompose(ctx.workspace)) {
+		ctx.log(`   '${id}' is watched, and only a compose stage pushes a bucket's changes to a worker: its subscribers receive nothing on '${ctx.stage}'`);
+		return;
+	}
+	if (watchers.length === 0) return;
+	const domain = ctx.workspace.domains?.[ctx.stage];
+	if (!domain) throw new require_seeds.NoDomainForStage(ctx.stage);
+	const { SNSConnection, reconcileHttpSubscriptions } = await import("@geekmidas/events/sns");
+	const { credentials } = await require_snsSubscriptions.awsClientConfig(ctx.credential, region);
+	const endpoint = require_snsSubscriptions.awsEndpoint(process.env, "SNS");
+	const byWorker = /* @__PURE__ */ new Map();
+	for (const watcher of watchers) byWorker.set(watcher.worker, [...byWorker.get(watcher.worker) ?? [], watcher]);
+	for (const [worker, own] of byWorker) {
+		const host = workerPushHost(worker, domain);
+		const endpoints = own.map(({ name }) => ({
+			name,
+			endpoint: `https://${host}${require_SubscriberGenerator.subscriberRoute(name)}`,
+			deadLetterQueueArn: events.deadLetterArn
+		}));
+		const unrecorded = own.filter(({ name }) => ctx.state.record(require_snsSubscriptions.subscriptionKey(worker, name))?.status !== "ready");
+		if (ctx.dryRun) {
+			if (unrecorded.length > 0) await ctx.change({
+				construct: id,
+				resource: `SNS subscriptions on ${host}`,
+				change: `subscribe ${unrecorded.map((w) => w.name).join(", ")}`
+			}, async () => {});
+			continue;
+		}
+		const connection = new SNSConnection({
+			topicArn: events.topicArn,
+			region,
+			...endpoint ? { endpoint } : {},
+			...credentials ? { credentials } : {}
+		});
+		const result = await reconcileHttpSubscriptions(connection, {
+			endpoints,
+			ownedHost: host
+		});
+		await connection.close();
+		for (const spec of endpoints) {
+			const arn = result.subscriptions[spec.name];
+			const pending = result.pending.includes(spec.name);
+			if (ctx.state.record(require_snsSubscriptions.subscriptionKey(worker, spec.name))?.id !== arn) ctx.log(`   ✓ '${spec.name}' subscribed to ${events.topicArn.split(":").pop()} at ${spec.endpoint}`);
+			const { key, type, data } = require_snsSubscriptions.subscriptionResource({
+				worker,
+				name: spec.name,
+				topicArn: events.topicArn,
+				endpoint: spec.endpoint,
+				deadLetterQueueArn: events.deadLetterArn,
+				pending
+			}, arn);
+			await ctx.state.ready({
+				key,
+				type,
+				...data ? { data } : {}
+			}, arn);
+		}
+		for (const arn of result.removed) ctx.log(`   – unsubscribed ${arn}: no subscriber wants it any more`);
+	}
+}
+//#endregion
 //#region src/providers/s3/origins.ts
 /**
 * Which browser origins may call a bucket: the stage's sites that depend on
@@ -1032,8 +1338,8 @@ async function readOr(read, missing) {
 const defaultClients = async (credential, region) => {
 	const S3 = await import("@aws-sdk/client-s3");
 	const IAM = await import("@aws-sdk/client-iam");
-	const config = await awsClientConfig(credential, region);
-	const endpoint = awsEndpoint(process.env, "S3");
+	const config = await require_snsSubscriptions.awsClientConfig(credential, region);
+	const endpoint = require_snsSubscriptions.awsEndpoint(process.env, "S3");
 	return {
 		S3,
 		IAM,
@@ -1054,9 +1360,10 @@ let makeClients = defaultClients;
 async function ensureS3(ctx) {
 	const region = s3Region(ctx);
 	const clients = await makeClients(ctx.credential, region);
-	for (const construct of bucketConstructs(ctx.manifest)) await ensureBucket(ctx, clients, construct);
+	const watched = bucketWatchers(ctx.manifest, ctx.runnables, ctx.subscribers);
+	for (const construct of bucketConstructs(ctx.manifest)) await ensureBucket(ctx, clients, construct, watched.get(construct.id));
 }
-async function ensureBucket(ctx, stageClients, construct) {
+async function ensureBucket(ctx, stageClients, construct, watchers) {
 	const { id } = construct;
 	const nameInput = {
 		scope: ctx.identity.scope,
@@ -1080,11 +1387,19 @@ async function ensureBucket(ctx, stageClients, construct) {
 		open,
 		...construct.expire ? { expire: construct.expire } : {}
 	});
+	const events = watchers ? await ensureBucketEvents(ctx, clients, {
+		id,
+		bucket,
+		region: clients.region
+	}) : void 0;
 	const user = await ensureIamUser(ctx, clients, {
 		id,
 		user: iamUserName(nameInput),
 		policyName: IAM_POLICY_NAME,
-		policy: userPolicy(bucket, { versioning }),
+		policy: userPolicy(bucket, {
+			versioning,
+			...events ? { eventsTopicArn: events.topicArn } : {}
+		}),
 		describe: "this bucket only"
 	});
 	await ensureAccessKey(ctx, clients, {
@@ -1093,6 +1408,19 @@ async function ensureBucket(ctx, stageClients, construct) {
 		urlKey: (0, _geekmidas_manifest.provideKey)(id, "url"),
 		...user
 	});
+	if (events && watchers) {
+		await ensureEventsKey(ctx, {
+			id,
+			topicArn: events.topicArn,
+			region: clients.region
+		});
+		await ensurePushSubscriptions(ctx, {
+			id,
+			events,
+			region: clients.region,
+			watchers
+		});
+	}
 	const publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
 	for (const server of construct.servers) {
 		const key = (0, _geekmidas_manifest.provideKey)(server.id, "url");
@@ -1394,9 +1722,14 @@ const BUILTIN_PROVIDERS = { objects: { s3: {
 	name: "s3",
 	check: require_workspace.checkS3Config,
 	provisioning: require_workspace.S3_PROVISIONING,
-	credentials: awsProvisioningCredentials,
-	runtimeKeys(manifest) {
-		return bucketConstructs(manifest).flatMap((b) => [(0, _geekmidas_manifest.provideKey)(b.id, "url"), ...b.servers.map((s) => (0, _geekmidas_manifest.provideKey)(s.id, "url"))]);
+	credentials: require_snsSubscriptions.awsProvisioningCredentials,
+	runtimeKeys(manifest, runnables = {}) {
+		const watched = bucketWatchers(manifest, runnables);
+		return bucketConstructs(manifest).flatMap((b) => [
+			(0, _geekmidas_manifest.provideKey)(b.id, "url"),
+			...watched.has(b.id) ? [(0, _geekmidas_manifest.provideKey)(b.id, "eventsConnectionString")] : [],
+			...b.servers.map((s) => (0, _geekmidas_manifest.provideKey)(s.id, "url"))
+		]);
 	},
 	ensure: ensureS3,
 	verify: verifyS3
@@ -1514,15 +1847,15 @@ async function provisionStage(options) {
 			report
 		});
 	}
-	const backups = require_dns.stageBackups(workspace, manifest, stage);
+	const backups = require_snsSubscriptions.stageBackups(workspace, manifest, stage);
 	if (configured.length === 0 && backups.mode !== "on") {
 		if (backups.mode === "disabled") log(`💾 backups: off — deploy.backups.${stage} is false. Nothing is backed up, and nothing already backed up is deleted.`);
 		return reports;
 	}
 	const identity = require_identity.deployIdentity(workspace, stage);
 	let secrets = (await options.secrets.read())?.custom ?? {};
-	for (const entry of configured) entry.report.planned = entry.provider.runtimeKeys(manifest).filter((key) => secrets[key] === void 0);
-	const state = dryRun ? await readOnlyState(options.state, stage) : journalState(await require_seeds.DeployJournal.open(options.state, stage, () => require_dns.deploysWithCompose(workspace) ? require_seeds.createComposeState(stage) : require_seeds.createEmptyState(stage, "", "")));
+	for (const entry of configured) entry.report.planned = entry.provider.runtimeKeys(manifest, runnables).filter((key) => secrets[key] === void 0);
+	const state = dryRun ? await readOnlyState(options.state, stage) : journalState(await require_seeds.DeployJournal.open(options.state, stage, () => require_snsSubscriptions.deploysWithCompose(workspace) ? require_seeds.createComposeState(stage) : require_seeds.createEmptyState(stage, "", "")));
 	const writeSecrets = async (values) => {
 		if (dryRun) return;
 		const stored = await options.secrets.read() ?? require_seeds.initStageSecrets(stage);
@@ -1543,6 +1876,7 @@ async function provisionStage(options) {
 			workspace,
 			manifest,
 			runnables,
+			...options.subscribers ? { subscribers: options.subscribers } : {},
 			stage,
 			identity,
 			config: entry.config,
@@ -1569,7 +1903,7 @@ async function provisionStage(options) {
 			kind: "backups",
 			mode: backups.mode === "on" ? "provider" : "none",
 			actions: [],
-			planned: backups.mode === "on" && secrets["BACKUPS_URL"] === void 0 ? [require_dns.BACKUPS_URL_KEY] : []
+			planned: backups.mode === "on" && secrets["BACKUPS_URL"] === void 0 ? [require_snsSubscriptions.BACKUPS_URL_KEY] : []
 		};
 		reports.push(report);
 		await ensureStageBackups({
@@ -1910,7 +2244,7 @@ async function runDeploy(source, request, ctx) {
 	const resources = !ctx.buildOnly && phaseCtx.stage !== phaseCtx.workspace.stages.local;
 	const provision = async () => {
 		if (!request.skipDns && resolved.target.runtime === "server") try {
-			await require_dns.dnsCredentials(phaseCtx.stage, require_dns.stageDnsDomains(phaseCtx.stage, phaseCtx.workspace.domains, phaseCtx.workspace.dns), ctx.credentials);
+			await require_snsSubscriptions.dnsCredentials(phaseCtx.stage, require_snsSubscriptions.stageDnsDomains(phaseCtx.stage, phaseCtx.workspace.domains, phaseCtx.workspace.dns), ctx.credentials);
 		} catch (error) {
 			emit({
 				type: "phase.failed",
@@ -1995,6 +2329,7 @@ async function provisionResources(phaseCtx, request, ctx, store, emit) {
 			stage: phaseCtx.stage,
 			manifest: phaseCtx.manifest,
 			runnables: phaseCtx.runnables ?? {},
+			...phaseCtx.subscribers ? { subscribers: phaseCtx.subscribers } : {},
 			secrets: phaseCtx.secrets,
 			state: store,
 			dryRun: ctx.dryRun,
@@ -2086,13 +2421,16 @@ async function prepare(source, request, ctx, emit, redactor) {
 	const options = await require_resolve.parseTargetOptions(resolved);
 	const allowDevServices = request.allowDevServices === true;
 	if (allowDevServices && resolved.target.runtime === "aws") throw new require_seeds.DevServicesNeedServerTarget(targetName);
+	require_snsSubscriptions.assertSitePasswordTarget(configured, stage, resolved.target.name);
 	const runnables = {};
 	const background = {};
+	const subscribers = {};
 	const manifest = await require_discover.discover({
 		patterns: require_seeds.constructGlobs(configured),
 		cwd: configured.root,
 		runnables,
-		background
+		background,
+		subscribers
 	});
 	require_workspace.resolveStageTelemetry({
 		...configured.deploy?.telemetry ? { telemetry: configured.deploy.telemetry } : {},
@@ -2173,6 +2511,7 @@ async function prepare(source, request, ctx, emit, redactor) {
 			manifest,
 			runnables,
 			background,
+			subscribers,
 			options,
 			dryRun: ctx.dryRun,
 			atomic: request.atomic ?? false,
@@ -2267,10 +2606,10 @@ function deploy(input) {
 	};
 	const ctx = {
 		emit,
-		credentials: input.credentials ?? require_credentials.storedCredentials({ home: input.home ?? require_run.gkmHome() }),
+		credentials: input.credentials ?? require_credentials.storedCredentials({ home: input.home ?? require_credentials.gkmHome() }),
 		dryRun: input.dryRun ?? false,
 		...input.buildOnly ? { buildOnly: true } : {},
-		home: input.home ?? require_run.gkmHome(),
+		home: input.home ?? require_credentials.gkmHome(),
 		redactor,
 		...input.signal ? { signal: input.signal } : {},
 		...input.childOutput ? { childOutput: input.childOutput } : {},
@@ -2355,24 +2694,6 @@ Object.defineProperty(exports, "UnknownDeployApps", {
 		return UnknownDeployApps;
 	}
 });
-Object.defineProperty(exports, "awsClientConfig", {
-	enumerable: true,
-	get: function() {
-		return awsClientConfig;
-	}
-});
-Object.defineProperty(exports, "awsEndpoint", {
-	enumerable: true,
-	get: function() {
-		return awsEndpoint;
-	}
-});
-Object.defineProperty(exports, "awsProvisioningCredentials", {
-	enumerable: true,
-	get: function() {
-		return awsProvisioningCredentials;
-	}
-});
 Object.defineProperty(exports, "backupsUserName", {
 	enumerable: true,
 	get: function() {
@@ -2398,4 +2719,4 @@ Object.defineProperty(exports, "iamUserName", {
 	}
 });
 
-//# sourceMappingURL=deploy-CI85F6dr.cjs.map
+//# sourceMappingURL=deploy-BbI1UMh3.cjs.map