@geekmidas/cli 10.0.0-alpha.122 → 10.0.0-alpha.124

package/dist/{deploy-Ddy8UBoE.mjs → deploy-CiRYwFmr.mjs}

@@ -1,97 +1,24 @@
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { s as gkmHome } from "./run-BJLIerMM.mjs";
-import { r as storedCredentials } from "./credentials-B5N5yKk6.mjs";
-import { $ as IamUserNotOwned, G as checkS3Config, J as BucketNameUnavailable, K as AccessKeyLimit, L as resolveStageTelemetry, N as assertDeployedStage, Q as BucketRegionUnknown, U as stageProvider, W as S3_PROVISIONING, X as BucketProbeFailed, Y as BucketOwnedByAnotherProject, Z as BucketRegionMismatch, et as ProvisionedBucketUnreachable, ht as isReservedStageKey, nt as RotationInProgress, q as BucketKeySetElsewhere, rt as S3RegionRequired, tt as RecordedBucketUnreachable, u as getAppBuildOrder } from "./workspace-D1QbNd55.mjs";
-import { S as deploysWithCompose, _ as backupExpiries, c as stageDnsDomains, d as BACKUPS_URL_KEY, n as dnsCredentials, u as BACKUPS_SERVICE, x as stageBackups, y as backupsPrefix } from "./dns-BgxvvcQa.mjs";
+import { r as storedCredentials, x as gkmHome } from "./credentials-DpfnUvIR.mjs";
+import { $ as IamUserNotOwned, G as checkS3Config, J as BucketNameUnavailable, K as AccessKeyLimit, L as resolveStageTelemetry, N as assertDeployedStage, Q as BucketRegionUnknown, U as stageProvider, W as S3_PROVISIONING, X as BucketProbeFailed, Y as BucketOwnedByAnotherProject, Z as BucketRegionMismatch, et as ProvisionedBucketUnreachable, ht as isReservedStageKey, nt as RotationInProgress, q as BucketKeySetElsewhere, rt as S3RegionRequired, tt as RecordedBucketUnreachable, u as getAppBuildOrder } from "./workspace-DUnnVjqC.mjs";
+import { E as BACKUPS_URL_KEY, I as stageBackups, L as deploysWithCompose, M as backupExpiries, P as backupsPrefix, T as BACKUPS_SERVICE, _ as awsClientConfig, a as subscriptionKey, b as assertSitePasswordTarget, h as stageDnsDomains, l as dnsCredentials, o as subscriptionResource, v as awsEndpoint, y as awsProvisioningCredentials } from "./snsSubscriptions-CvBIGGp0.mjs";
 import { o as builtinTarget } from "./define-6poNqm5O.mjs";
-import { Bt as initStageSecrets, Lt as secretsStoreFor, N as stageProviderNotes, P as PROVIDER_KINDS, X as DevServicesNeedServerTarget, Z as ExternalServicesNotConfigured, d as DeployJournal, dn as mergeLifecycle, et as devServicesUsed, ft as constructGlobs, it as stageServiceDeclarations, j as assertStageProvidersEnabled, nr as isMainFrontendApp, nt as reportDevServices, ot as appEnvKeys, rr as resolveHost, tr as NoDomainForStage, tt as externalServices, v as createComposeState, y as createEmptyState, zn as usesTelemetry } from "./seeds-oY0qDqui.mjs";
+import { Bn as usesTelemetry, Bt as initStageSecrets, Lt as secretsStoreFor, N as stageProviderNotes, P as PROVIDER_KINDS, X as DevServicesNeedServerTarget, Z as ExternalServicesNotConfigured, ar as isMainFrontendApp, d as DeployJournal, et as devServicesUsed, fn as mergeLifecycle, ft as constructGlobs, ir as NoDomainForStage, it as stageServiceDeclarations, j as assertStageProvidersEnabled, nt as reportDevServices, or as resolveHost, ot as appEnvKeys, tt as externalServices, v as createComposeState, y as createEmptyState } from "./seeds-rG-Evfz9.mjs";
 import { n as derivedApps, t as appKey } from "./derive-B4vDpzgP.mjs";
+import { s as subscriberRoute } from "./SubscriberGenerator-COAVPgM-.mjs";
 import { n as deployIdentity, t as applicationName } from "./identity-CBXr4wNi.mjs";
-import { i as discover, p as withOutput } from "./discover-C5roJuc9.mjs";
+import { i as discover, m as eventsEdge, p as withOutput } from "./discover-BvJOVsYG.mjs";
 import { c as withSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { findWorkspaceRoot, loadWorkspaceConfig } from "./config.mjs";
-import { a as parseTargetOptions, o as resolveTarget } from "./resolve-DSilYpzm.mjs";
-import { t as LocalSandbox } from "./local-BwC2v2Y8.mjs";
-import { E as eventError, S as createStateStore, v as assertStateOutlivesRun, y as assertStateRoom } from "./sniffer-Cgx608Tl.mjs";
+import { a as parseTargetOptions, o as resolveTarget } from "./resolve-BT7fkPN5.mjs";
+import { t as LocalSandbox } from "./local-B7Zv1NoA.mjs";
+import { E as eventError, S as createStateStore, v as assertStateOutlivesRun, y as assertStateRoom } from "./sniffer-DVPgfyHr.mjs";
 import { a as findProjectBucket, i as ensureProjectBucket, o as projectBucketName, r as callerAccountId, s as reconcileProjectBucketLifecycle } from "./projectBucket-C_DN4WzF.mjs";
-import { n as assertStageCredentials } from "./credentialSchemas-DDOLRCLF.mjs";
+import { n as assertStageCredentials } from "./credentialSchemas-DLKbxYBy.mjs";
 import { resolve } from "node:path";
 import { randomInt } from "node:crypto";
 import { dependentsOf, kebabCase, provideKey, providedKeyFor } from "@geekmidas/manifest";
 import * as s3Url from "@geekmidas/storage/s3-url";
-//#region src/providers/aws.ts
-/**
-* The AWS account a provider provisions in — the stage's, found the way the
-* SSM and Secrets Manager stores find it.
-*
-* 1. `--profile`, resolved on its own: exported keys left over from another
-*    account never win over a profile someone named.
-* 2. `AWS_PROFILE`, else `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` — the
-*    deploy's own `aws` credential kind (`storedCredentials`).
-* 3. The SDK's default chain: `~/.aws` default profile, SSO, a role. In CI,
-*    whatever `aws-actions/configure-aws-credentials` exported.
-*
-* None of them: the provider has no provisioning credentials, and the stage
-* is treated as `external`.
-*/
-async function awsProvisioningCredentials(lookup) {
-	const region = lookup.env.AWS_REGION ?? lookup.env.AWS_DEFAULT_REGION;
-	const where = region ? { region } : {};
-	if (lookup.profile) return {
-		profile: lookup.profile,
-		...where
-	};
-	const stored = await storedCredentials({
-		env: lookup.env,
-		...lookup.home ? { home: lookup.home } : {}
-	}).get({
-		kind: "aws",
-		stage: lookup.stage
-	});
-	if (stored) return stored;
-	try {
-		const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
-		await fromNodeProviderChain({
-			timeout: 1e3,
-			maxRetries: 0
-		})();
-		return {
-			chain: true,
-			...where
-		};
-	} catch {
-		return;
-	}
-}
-/**
-* An S3-compatible endpoint the environment points the SDK at — the AWS
-* emulator in tests. The SDK reads it itself; it is read here too, because
-* an emulator takes path-style requests, and a key written for one has to
-* say where it is.
-*/
-function awsEndpoint(env, service) {
-	return env[`AWS_ENDPOINT_URL_${service}`] ?? env.AWS_ENDPOINT_URL;
-}
-/** An SDK client's config for a provisioning credential. */
-async function awsClientConfig(credential, region) {
-	if ("profile" in credential) {
-		const { fromIni } = await import("@aws-sdk/credential-providers");
-		return {
-			region,
-			credentials: fromIni({ profile: credential.profile })
-		};
-	}
-	if ("accessKeyId" in credential) return {
-		region,
-		credentials: {
-			accessKeyId: credential.accessKeyId,
-			secretAccessKey: credential.secretAccessKey,
-			...credential.sessionToken ? { sessionToken: credential.sessionToken } : {}
-		}
-	};
-	return { region };
-}
-//#endregion
 //#region src/target/secrets.ts
 /**
 * A stage's secrets as a target sees them: read and written through the
@@ -247,28 +174,37 @@ const bucketArn = (bucket) => `arn:aws:s3:::${bucket}`;
 function userPolicy(bucket, options = {}) {
 	return {
 		Version: "2012-10-17",
-		Statement: [{
-			Sid: "GkmObjects",
-			Effect: "Allow",
-			Action: [
-				"s3:GetObject",
-				"s3:PutObject",
-				"s3:DeleteObject",
-				"s3:AbortMultipartUpload",
-				"s3:ListMultipartUploadParts",
-				...options.versioning ? ["s3:GetObjectVersion"] : []
-			],
-			Resource: `${bucketArn(bucket)}/*`
-		}, {
-			Sid: "GkmBucket",
-			Effect: "Allow",
-			Action: [
-				"s3:ListBucket",
-				"s3:GetBucketLocation",
-				"s3:ListBucketMultipartUploads"
-			],
-			Resource: bucketArn(bucket)
-		}]
+		Statement: [
+			{
+				Sid: "GkmObjects",
+				Effect: "Allow",
+				Action: [
+					"s3:GetObject",
+					"s3:PutObject",
+					"s3:DeleteObject",
+					"s3:AbortMultipartUpload",
+					"s3:ListMultipartUploadParts",
+					...options.versioning ? ["s3:GetObjectVersion"] : []
+				],
+				Resource: `${bucketArn(bucket)}/*`
+			},
+			{
+				Sid: "GkmBucket",
+				Effect: "Allow",
+				Action: [
+					"s3:ListBucket",
+					"s3:GetBucketLocation",
+					"s3:ListBucketMultipartUploads"
+				],
+				Resource: bucketArn(bucket)
+			},
+			...options.eventsTopicArn ? [{
+				Sid: "GkmEvents",
+				Effect: "Allow",
+				Action: "sns:ConfirmSubscription",
+				Resource: options.eventsTopicArn
+			}] : []
+		]
 	};
 }
 /**
@@ -395,7 +331,7 @@ function identityTags(ctx, id) {
 	];
 }
 /** A read whose "there is none" answer is one of `missing`. */
-async function readOr$1(read, missing) {
+async function readOr$2(read, missing) {
 	try {
 		return await read();
 	} catch (error) {
@@ -425,7 +361,7 @@ async function ensureIamUser(ctx, clients, input) {
 		key: `iam-user:${id}`,
 		type: "iam-user"
 	};
-	const found = await readOr$1(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
+	const found = await readOr$2(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
 	if (found?.User) {
 		const tags = await iam.send(new IAM.ListUserTagsCommand({ UserName: user }));
 		const tag = (key) => tags.Tags?.find((t) => t.Key === key)?.Value;
@@ -445,7 +381,7 @@ async function ensureIamUser(ctx, clients, input) {
 		await ctx.state.ready(entry, user);
 	});
 	const exists = Boolean(found?.User) || !ctx.dryRun;
-	const current = exists ? await readOr$1(() => iam.send(new IAM.GetUserPolicyCommand({
+	const current = exists ? await readOr$2(() => iam.send(new IAM.GetUserPolicyCommand({
 		UserName: user,
 		PolicyName: input.policyName
 	})), ["NoSuchEntity", "NoSuchEntityException"]) : void 0;
@@ -859,6 +795,376 @@ async function verifyStageBackups(input) {
 	}
 }
 //#endregion
+//#region src/providers/s3/events.ts
+/** What S3 tells the topic about: every object written, and every removed. */
+const BUCKET_EVENTS = ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"];
+/**
+* Each bucket a subscriber watches, with the subscribers discovery could name.
+*
+* A bucket is watched when a process consumes its events — discovery records
+* the edge, and the subscriber by its export — or when a build put a
+* subscriber in its declaration. Only a named subscriber can be subscribed: a
+* route is named after its export.
+*/
+function bucketWatchers(manifest, runnables, subscribers = {}) {
+	const watched = /* @__PURE__ */ new Map();
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "objects") continue;
+		const key = provideKey(id, "eventsConnectionString");
+		const named = Object.entries(subscribers).flatMap(([worker, bound]) => bound.filter((s) => s.connectionKey === key).map((s) => ({
+			worker,
+			name: s.name
+		}))).sort((a, b) => `${a.worker}/${a.name}`.localeCompare(`${b.worker}/${b.name}`));
+		const edged = Object.values(runnables).some((edges) => edges.includes(eventsEdge(id)));
+		const declared = (declaration.subscribers?.length ?? 0) > 0;
+		if (named.length > 0 || edged || declared) watched.set(id, named);
+	}
+	return watched;
+}
+/** The topic a bucket's changes are published to. */
+function eventsTopicName(bucket) {
+	return `${bucket.replaceAll(".", "-")}-events`;
+}
+/** What SNS gives up delivering, kept. */
+function eventsDeadLetterName(bucket) {
+	return `${eventsTopicName(bucket)}-dlq`;
+}
+/** Only this bucket, in this account, may publish to its topic. */
+function eventsTopicPolicy(topicArn, bucket, account) {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "GkmBucketPublishes",
+			Effect: "Allow",
+			Principal: { Service: "s3.amazonaws.com" },
+			Action: "sns:Publish",
+			Resource: topicArn,
+			Condition: {
+				ArnLike: { "aws:SourceArn": `arn:aws:s3:::${bucket}` },
+				StringEquals: { "aws:SourceAccount": account }
+			}
+		}]
+	};
+}
+/** Only the bucket's topic may send to its dead-letter queue. */
+function eventsDeadLetterPolicy(queueArn, topicArn) {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "GkmTopicDeadLetters",
+			Effect: "Allow",
+			Principal: { Service: "sns.amazonaws.com" },
+			Action: "sqs:SendMessage",
+			Resource: queueArn,
+			Condition: { ArnEquals: { "aws:SourceArn": topicArn } }
+		}]
+	};
+}
+/** The id this provider's notification entry goes under. */
+const notificationId = (id) => `gkm-${id}`;
+/**
+* The bucket's notifications with this provider's entry put back, and whether
+* that changed anything. Every other entry — a queue, a function, a topic
+* somebody added by hand — is kept exactly as it was.
+*/
+function mergedNotifications(current, id, topicArn) {
+	const own = notificationId(id);
+	const wanted = {
+		Id: own,
+		TopicArn: topicArn,
+		Events: [...BUCKET_EVENTS]
+	};
+	const topics = current.TopicConfigurations ?? [];
+	const existing = topics.find((t) => t.Id === own);
+	const same = existing !== void 0 && existing.TopicArn === topicArn && JSON.stringify([...existing.Events ?? []].sort()) === JSON.stringify([...BUCKET_EVENTS].sort()) && existing.Filter === void 0;
+	const { ResponseMetadata: _, ...rest } = current;
+	return {
+		config: {
+			...rest,
+			TopicConfigurations: [...topics.filter((t) => t.Id !== own), wanted]
+		},
+		changed: !same
+	};
+}
+/** S3 refused the entry because another one already covers these events. */
+var BucketNotificationsOverlap = class extends GkmError {
+	bucket;
+	detail;
+	constructor(bucket, detail) {
+		super(`'${bucket}' already sends object creates or deletes somewhere else, and S3 sends each event to one place only, so the deploy cannot add its own entry. Remove the other notification from the bucket, or give it a prefix, and deploy again. S3 said: ${detail}`);
+		this.bucket = bucket;
+		this.detail = detail;
+		this.name = "BucketNotificationsOverlap";
+	}
+};
+const defaultEventsClients = async (credential, region) => {
+	const SNS = await import("@aws-sdk/client-sns");
+	const SQS = await import("@aws-sdk/client-sqs");
+	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+	const config = await awsClientConfig(credential, region);
+	const endpoint = awsEndpoint(process.env, "SNS");
+	const sts = new STSClient({
+		...config,
+		...awsEndpoint(process.env, "STS") ? { endpoint: awsEndpoint(process.env, "STS") } : {}
+	});
+	const { Account } = await sts.send(new GetCallerIdentityCommand({}));
+	sts.destroy();
+	return {
+		SNS,
+		SQS,
+		sns: new SNS.SNSClient({
+			...config,
+			...endpoint ? { endpoint } : {}
+		}),
+		sqs: new SQS.SQSClient({
+			...config,
+			...awsEndpoint(process.env, "SQS") ? { endpoint: awsEndpoint(process.env, "SQS") } : {}
+		}),
+		account: Account,
+		region,
+		...endpoint ? { endpoint } : {}
+	};
+};
+let makeEventsClients = defaultEventsClients;
+function errorName$1(error) {
+	const e = error;
+	return e?.name ?? e?.Code ?? e?.code ?? "";
+}
+async function readOr$1(read, missing) {
+	try {
+		return await read();
+	} catch (error) {
+		if (missing.includes(errorName$1(error))) return void 0;
+		throw error;
+	}
+}
+/**
+* The topic, its policy, the dead-letter queue and the bucket's notification
+* entry for one watched bucket — created where missing, put back where they
+* drifted.
+*/
+async function ensureBucketEvents(ctx, s3, input) {
+	const { id, bucket, region } = input;
+	const { SNS, SQS, sns, sqs, account } = await makeEventsClients(ctx.credential, region);
+	const topicName = eventsTopicName(bucket);
+	const topicArn = `arn:aws:sns:${region}:${account}:${topicName}`;
+	const topicEntry = {
+		key: `sns-topic:${id}`,
+		type: "sns-topic"
+	};
+	const topic = await readOr$1(() => sns.send(new SNS.GetTopicAttributesCommand({ TopicArn: topicArn })), ["NotFound", "NotFoundException"]);
+	if (topic) await ctx.state.ready(topicEntry, topicArn);
+	else await ctx.change({
+		construct: id,
+		resource: `SNS topic ${topicName}`,
+		change: "create"
+	}, async () => {
+		await ctx.state.pending(topicEntry);
+		await sns.send(new SNS.CreateTopicCommand({
+			Name: topicName,
+			Tags: identityTags(ctx, id)
+		}));
+		await ctx.state.ready(topicEntry, topicArn);
+	});
+	const topicPolicy = eventsTopicPolicy(topicArn, bucket, account);
+	const currentTopicPolicy = topic?.Attributes?.Policy;
+	if (!currentTopicPolicy || canonicalPolicy(JSON.parse(currentTopicPolicy)) !== canonicalPolicy(topicPolicy)) await ctx.change({
+		construct: id,
+		resource: `SNS topic ${topicName}`,
+		change: `publishable by '${bucket}' only`
+	}, async () => {
+		await sns.send(new SNS.SetTopicAttributesCommand({
+			TopicArn: topicArn,
+			AttributeName: "Policy",
+			AttributeValue: JSON.stringify(topicPolicy)
+		}));
+	});
+	const queueName = eventsDeadLetterName(bucket);
+	const deadLetterArn = `arn:aws:sqs:${region}:${account}:${queueName}`;
+	const queueEntry = {
+		key: `sqs-queue:${id}-events-dlq`,
+		type: "sqs-queue"
+	};
+	const queue = await readOr$1(() => sqs.send(new SQS.GetQueueUrlCommand({ QueueName: queueName })), ["QueueDoesNotExist", "AWS.SimpleQueueService.NonExistentQueue"]);
+	let queueUrl = queue?.QueueUrl;
+	if (queueUrl) await ctx.state.ready(queueEntry, deadLetterArn);
+	else await ctx.change({
+		construct: id,
+		resource: `SQS queue ${queueName}`,
+		change: "create"
+	}, async () => {
+		await ctx.state.pending(queueEntry);
+		queueUrl = (await sqs.send(new SQS.CreateQueueCommand({
+			QueueName: queueName,
+			Attributes: { MessageRetentionPeriod: "1209600" },
+			tags: Object.fromEntries(identityTags(ctx, id).map((t) => [t.Key, t.Value]))
+		}))).QueueUrl;
+		await ctx.state.ready(queueEntry, deadLetterArn);
+	});
+	const queuePolicy = eventsDeadLetterPolicy(deadLetterArn, topicArn);
+	const currentQueuePolicy = queue?.QueueUrl ? (await sqs.send(new SQS.GetQueueAttributesCommand({
+		QueueUrl: queue.QueueUrl,
+		AttributeNames: ["Policy"]
+	}))).Attributes?.Policy : void 0;
+	if (!currentQueuePolicy || canonicalPolicy(JSON.parse(currentQueuePolicy)) !== canonicalPolicy(queuePolicy)) await ctx.change({
+		construct: id,
+		resource: `SQS queue ${queueName}`,
+		change: `receives what ${topicName} cannot deliver`
+	}, async () => {
+		await sqs.send(new SQS.SetQueueAttributesCommand({
+			QueueUrl: queueUrl,
+			Attributes: { Policy: JSON.stringify(queuePolicy) }
+		}));
+	});
+	const merged = mergedNotifications(await readOr$1(() => s3.s3.send(new s3.S3.GetBucketNotificationConfigurationCommand({ Bucket: bucket })), ["NoSuchBucket"]) ?? {}, id, topicArn);
+	if (merged.changed) await ctx.change({
+		construct: id,
+		resource: `bucket ${bucket}`,
+		change: `send object creates and deletes to ${topicName}`
+	}, async () => {
+		try {
+			await s3.s3.send(new s3.S3.PutBucketNotificationConfigurationCommand({
+				Bucket: bucket,
+				NotificationConfiguration: merged.config
+			}));
+		} catch (error) {
+			const message = error.message ?? "";
+			if (/overlap/i.test(message)) throw new BucketNotificationsOverlap(bucket, message);
+			throw error;
+		}
+	});
+	sns.destroy();
+	sqs.destroy();
+	return {
+		topicArn,
+		deadLetterArn
+	};
+}
+/**
+* The events key: the topic's address, signed by the bucket's own access key
+* — read off the bucket's URL, so a rotated key rotates this one with it.
+*/
+async function ensureEventsKey(ctx, input) {
+	const { id, topicArn, region } = input;
+	const key = provideKey(id, "eventsConnectionString");
+	const url = ctx.secrets[provideKey(id, "url")];
+	let parsed;
+	try {
+		parsed = url ? s3Url.parse(url) : void 0;
+	} catch {
+		parsed = void 0;
+	}
+	if (!parsed?.accessKeyId || !parsed.secretAccessKey) {
+		await ctx.change({
+			construct: id,
+			resource: key,
+			change: "set to the topic’s address"
+		}, async () => {});
+		return;
+	}
+	const { snsUrl } = await import("@geekmidas/events/sns");
+	const endpoint = awsEndpoint(process.env, "SNS");
+	const address = new URL(snsUrl.build({
+		topicArn,
+		region,
+		...endpoint ? { endpoint } : {}
+	}));
+	address.searchParams.set("accessKeyId", parsed.accessKeyId);
+	address.searchParams.set("secretAccessKey", parsed.secretAccessKey);
+	const value = address.toString();
+	const entry = {
+		key: `events-key:${id}`,
+		type: "url"
+	};
+	if (ctx.secrets[key] === value) {
+		await ctx.state.ready(entry, topicArn);
+		return;
+	}
+	await ctx.change({
+		construct: id,
+		resource: key,
+		change: `set to ${topicArn}`
+	}, async () => {
+		await ctx.writeSecrets({ [key]: value });
+		await ctx.state.ready(entry, topicArn);
+	});
+}
+/** Where SNS pushes to a worker: its own host on the stage's domain. */
+function workerPushHost(worker, domain) {
+	return `${appKey(worker)}.${domain}`;
+}
+/**
+* One HTTP subscription per subscriber to the bucket's topic, at its route on
+* its worker's host, with the bucket's dead-letter queue — and each ARN
+* recorded, which is what the worker accepts deliveries under.
+*
+* Unfiltered: a bucket's notifications carry no `type` attribute, and the
+* subscriber's own filter — events, prefix, suffix — is what decides. Only a
+* compose stage pushes to a worker; any other is told so and left alone.
+*/
+async function ensurePushSubscriptions(ctx, input) {
+	const { id, events, region, watchers } = input;
+	if (!deploysWithCompose(ctx.workspace)) {
+		ctx.log(`   '${id}' is watched, and only a compose stage pushes a bucket's changes to a worker: its subscribers receive nothing on '${ctx.stage}'`);
+		return;
+	}
+	if (watchers.length === 0) return;
+	const domain = ctx.workspace.domains?.[ctx.stage];
+	if (!domain) throw new NoDomainForStage(ctx.stage);
+	const { SNSConnection, reconcileHttpSubscriptions } = await import("@geekmidas/events/sns");
+	const { credentials } = await awsClientConfig(ctx.credential, region);
+	const endpoint = awsEndpoint(process.env, "SNS");
+	const byWorker = /* @__PURE__ */ new Map();
+	for (const watcher of watchers) byWorker.set(watcher.worker, [...byWorker.get(watcher.worker) ?? [], watcher]);
+	for (const [worker, own] of byWorker) {
+		const host = workerPushHost(worker, domain);
+		const endpoints = own.map(({ name }) => ({
+			name,
+			endpoint: `https://${host}${subscriberRoute(name)}`,
+			deadLetterQueueArn: events.deadLetterArn
+		}));
+		const unrecorded = own.filter(({ name }) => ctx.state.record(subscriptionKey(worker, name))?.status !== "ready");
+		if (ctx.dryRun) {
+			if (unrecorded.length > 0) await ctx.change({
+				construct: id,
+				resource: `SNS subscriptions on ${host}`,
+				change: `subscribe ${unrecorded.map((w) => w.name).join(", ")}`
+			}, async () => {});
+			continue;
+		}
+		const connection = new SNSConnection({
+			topicArn: events.topicArn,
+			region,
+			...endpoint ? { endpoint } : {},
+			...credentials ? { credentials } : {}
+		});
+		const result = await reconcileHttpSubscriptions(connection, {
+			endpoints,
+			ownedHost: host
+		});
+		await connection.close();
+		for (const spec of endpoints) {
+			const arn = result.subscriptions[spec.name];
+			const pending = result.pending.includes(spec.name);
+			if (ctx.state.record(subscriptionKey(worker, spec.name))?.id !== arn) ctx.log(`   ✓ '${spec.name}' subscribed to ${events.topicArn.split(":").pop()} at ${spec.endpoint}`);
+			const { key, type, data } = subscriptionResource({
+				worker,
+				name: spec.name,
+				topicArn: events.topicArn,
+				endpoint: spec.endpoint,
+				deadLetterQueueArn: events.deadLetterArn,
+				pending
+			}, arn);
+			await ctx.state.ready({
+				key,
+				type,
+				...data ? { data } : {}
+			}, arn);
+		}
+		for (const arn of result.removed) ctx.log(`   – unsubscribed ${arn}: no subscriber wants it any more`);
+	}
+}
+//#endregion
 //#region src/providers/s3/origins.ts
 /**
 * Which browser origins may call a bucket: the stage's sites that depend on
@@ -1052,9 +1358,10 @@ let makeClients = defaultClients;
 async function ensureS3(ctx) {
 	const region = s3Region(ctx);
 	const clients = await makeClients(ctx.credential, region);
-	for (const construct of bucketConstructs(ctx.manifest)) await ensureBucket(ctx, clients, construct);
+	const watched = bucketWatchers(ctx.manifest, ctx.runnables, ctx.subscribers);
+	for (const construct of bucketConstructs(ctx.manifest)) await ensureBucket(ctx, clients, construct, watched.get(construct.id));
 }
-async function ensureBucket(ctx, stageClients, construct) {
+async function ensureBucket(ctx, stageClients, construct, watchers) {
 	const { id } = construct;
 	const nameInput = {
 		scope: ctx.identity.scope,
@@ -1078,11 +1385,19 @@ async function ensureBucket(ctx, stageClients, construct) {
 		open,
 		...construct.expire ? { expire: construct.expire } : {}
 	});
+	const events = watchers ? await ensureBucketEvents(ctx, clients, {
+		id,
+		bucket,
+		region: clients.region
+	}) : void 0;
 	const user = await ensureIamUser(ctx, clients, {
 		id,
 		user: iamUserName(nameInput),
 		policyName: IAM_POLICY_NAME,
-		policy: userPolicy(bucket, { versioning }),
+		policy: userPolicy(bucket, {
+			versioning,
+			...events ? { eventsTopicArn: events.topicArn } : {}
+		}),
 		describe: "this bucket only"
 	});
 	await ensureAccessKey(ctx, clients, {
@@ -1091,6 +1406,19 @@ async function ensureBucket(ctx, stageClients, construct) {
 		urlKey: provideKey(id, "url"),
 		...user
 	});
+	if (events && watchers) {
+		await ensureEventsKey(ctx, {
+			id,
+			topicArn: events.topicArn,
+			region: clients.region
+		});
+		await ensurePushSubscriptions(ctx, {
+			id,
+			events,
+			region: clients.region,
+			watchers
+		});
+	}
 	const publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
 	for (const server of construct.servers) {
 		const key = provideKey(server.id, "url");
@@ -1393,8 +1721,13 @@ const BUILTIN_PROVIDERS = { objects: { s3: {
 	check: checkS3Config,
 	provisioning: S3_PROVISIONING,
 	credentials: awsProvisioningCredentials,
-	runtimeKeys(manifest) {
-		return bucketConstructs(manifest).flatMap((b) => [provideKey(b.id, "url"), ...b.servers.map((s) => provideKey(s.id, "url"))]);
+	runtimeKeys(manifest, runnables = {}) {
+		const watched = bucketWatchers(manifest, runnables);
+		return bucketConstructs(manifest).flatMap((b) => [
+			provideKey(b.id, "url"),
+			...watched.has(b.id) ? [provideKey(b.id, "eventsConnectionString")] : [],
+			...b.servers.map((s) => provideKey(s.id, "url"))
+		]);
 	},
 	ensure: ensureS3,
 	verify: verifyS3
@@ -1519,7 +1852,7 @@ async function provisionStage(options) {
 	}
 	const identity = deployIdentity(workspace, stage);
 	let secrets = (await options.secrets.read())?.custom ?? {};
-	for (const entry of configured) entry.report.planned = entry.provider.runtimeKeys(manifest).filter((key) => secrets[key] === void 0);
+	for (const entry of configured) entry.report.planned = entry.provider.runtimeKeys(manifest, runnables).filter((key) => secrets[key] === void 0);
 	const state = dryRun ? await readOnlyState(options.state, stage) : journalState(await DeployJournal.open(options.state, stage, () => deploysWithCompose(workspace) ? createComposeState(stage) : createEmptyState(stage, "", "")));
 	const writeSecrets = async (values) => {
 		if (dryRun) return;
@@ -1541,6 +1874,7 @@ async function provisionStage(options) {
 			workspace,
 			manifest,
 			runnables,
+			...options.subscribers ? { subscribers: options.subscribers } : {},
 			stage,
 			identity,
 			config: entry.config,
@@ -1993,6 +2327,7 @@ async function provisionResources(phaseCtx, request, ctx, store, emit) {
 			stage: phaseCtx.stage,
 			manifest: phaseCtx.manifest,
 			runnables: phaseCtx.runnables ?? {},
+			...phaseCtx.subscribers ? { subscribers: phaseCtx.subscribers } : {},
 			secrets: phaseCtx.secrets,
 			state: store,
 			dryRun: ctx.dryRun,
@@ -2084,13 +2419,16 @@ async function prepare(source, request, ctx, emit, redactor) {
 	const options = await parseTargetOptions(resolved);
 	const allowDevServices = request.allowDevServices === true;
 	if (allowDevServices && resolved.target.runtime === "aws") throw new DevServicesNeedServerTarget(targetName);
+	assertSitePasswordTarget(configured, stage, resolved.target.name);
 	const runnables = {};
 	const background = {};
+	const subscribers = {};
 	const manifest = await discover({
 		patterns: constructGlobs(configured),
 		cwd: configured.root,
 		runnables,
-		background
+		background,
+		subscribers
 	});
 	resolveStageTelemetry({
 		...configured.deploy?.telemetry ? { telemetry: configured.deploy.telemetry } : {},
@@ -2171,6 +2509,7 @@ async function prepare(source, request, ctx, emit, redactor) {
 			manifest,
 			runnables,
 			background,
+			subscribers,
 			options,
 			dryRun: ctx.dryRun,
 			atomic: request.atomic ?? false,
@@ -2323,6 +2662,6 @@ async function load(input, sandbox) {
 	return workspace;
 }
 //#endregion
-export { UnknownDeployApps as a, bucketName as c, awsEndpoint as d, awsProvisioningCredentials as f, TargetBuildsNothing as i, iamUserName as l, NoDeployableApps as n, backupsUserName as o, RollbackFailed as r, IAM_USER_PATH as s, deploy as t, awsClientConfig as u };
+export { UnknownDeployApps as a, bucketName as c, TargetBuildsNothing as i, iamUserName as l, NoDeployableApps as n, backupsUserName as o, RollbackFailed as r, IAM_USER_PATH as s, deploy as t };
 
-//# sourceMappingURL=deploy-Ddy8UBoE.mjs.map
+//# sourceMappingURL=deploy-CiRYwFmr.mjs.map