@geekmidas/cli 10.0.0-alpha.122 → 10.0.0-alpha.124

package/dist/{seeds-oY0qDqui.mjs → seeds-rG-Evfz9.mjs}

@@ -1,14 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
-import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as UnknownSecretsStoreProvider, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, j as TEST_STAGE, pt as SERVER_IPV6_KEY, ut as s3SecretsLocation, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-D1QbNd55.mjs";
+import { s as run$1, x as gkmHome } from "./credentials-DpfnUvIR.mjs";
+import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as UnknownSecretsStoreProvider, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, j as TEST_STAGE, pt as SERVER_IPV6_KEY, ut as s3SecretsLocation, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-DUnnVjqC.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { a as readFakes, c as DEFAULT_STORAGE, i as readCredentialFakes, l as holdsEveryCache, o as DEFAULT_CACHE, s as DEFAULT_EVENTS$1, t as SubscriberGenerator } from "./SubscriberGenerator-y3pncae_.mjs";
+import { c as DEFAULT_CACHE, d as holdsEveryCache, i as readFakes, l as DEFAULT_EVENTS$1, o as objectsRoute, r as readCredentialFakes, t as SubscriberGenerator, u as DEFAULT_STORAGE } from "./SubscriberGenerator-COAVPgM-.mjs";
 import { n as deployIdentity } from "./identity-CBXr4wNi.mjs";
-import { a as startTelemetryCode, n as runtimeFor, s as writeTelemetryModule, u as telemetryArgs } from "./EndpointGenerator-CP_z_E3e.mjs";
-import { d as ConstructGenerator, f as output, i as discover } from "./discover-C5roJuc9.mjs";
+import { a as startTelemetryCode, n as runtimeFor, s as writeTelemetryModule, u as telemetryArgs } from "./EndpointGenerator-Z_BUTocT.mjs";
+import { d as ConstructGenerator, f as output, h as eventsEdgeBucket, i as discover } from "./discover-BvJOVsYG.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { c as runtimeOf } from "./resolve-DSilYpzm.mjs";
+import { c as runtimeOf } from "./resolve-BT7fkPN5.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -26,7 +26,7 @@ import { config } from "dotenv";
 import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Queue } from "@geekmidas/constructs/queue";
-import { CreateBucketCommand, DeleteBucketLifecycleCommand, GetBucketLifecycleConfigurationCommand, GetBucketPolicyCommand, HeadBucketCommand, ListBucketsCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, DeleteBucketLifecycleCommand, GetBucketLifecycleConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, HeadBucketCommand, ListBucketsCommand, PutBucketLifecycleConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
 import { CreateTopicCommand, GetTopicAttributesCommand, SNSClient } from "@aws-sdk/client-sns";
 import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/client-sqs";
 import { Client } from "pg";
@@ -535,7 +535,7 @@ const EDGE_KINDS = {
 * Docker Desktop resolves this name already; on Linux the compose definition
 * maps it to the host gateway.
 */
-const HOST_GATEWAY = "host.docker.internal";
+const HOST_GATEWAY$1 = "host.docker.internal";
 /**
 * The suffix every local host shares.
 *
@@ -574,7 +574,7 @@ function sitesFor(plan, project, addresses = {}) {
 		if (!port) continue;
 		sites.push({
 			host,
-			upstream: `http://${HOST_GATEWAY}:${port}`
+			upstream: `http://${HOST_GATEWAY$1}:${port}`
 		});
 	}
 	return sites;
@@ -720,6 +720,108 @@ function emulatorQueueUrl(name, port) {
 	return `${emulatorEndpoint(port)}/${EMULATOR_ACCOUNT}/${name}`;
 }
 //#endregion
+//#region src/reconcile/objectEvents.ts
+/**
+* A bucket's object events, where the bucket is a local MinIO.
+*
+* S3 publishes a bucket's events to a topic the deploy creates; MinIO has no
+* topic to publish to, but it can post each event to a webhook. So where MinIO
+* holds a watched bucket, it posts the bucket's events to the process that
+* runs the bucket's subscribers, on a route only it can use, and that process
+* relays each one onto the events broker — under the bucket's name, as
+* `object.created` or `object.deleted` — where every subscriber drains a queue
+* of its own, as a topic's subscribers do.
+*
+* Declared to MinIO in two halves, both derived here so they cannot drift:
+*
+* - **a webhook target per bucket**, as container environment: where to post,
+*   the token to present, and a queue on disk, because MinIO starts before the
+*   process it posts to and must keep what it could not deliver;
+* - **the bucket's notification**, written through the S3 API once the bucket
+*   exists: every created and removed object, to that target. Unfiltered —
+*   two subscribers watching overlapping prefixes are two rules S3 refuses on
+*   one bucket, and each subscriber filters what it is handed anyway.
+*/
+/**
+* The token MinIO presents when it posts a bucket's events.
+*
+* Derived, never stored: the container and the process it posts to are handed
+* the same value by the same derivation — with the stage's random seed where a
+* deployed stage's stack has one, so the token is a secret there, and from the
+* project alone locally, where everything it would protect is on loopback.
+* Not salted by the stage: one MinIO serves `gkm dev` and `gkm test`, and a
+* target is declared once per container.
+*/
+function objectsWebhookToken(project, bucket, seed) {
+	return createHash("sha256").update(`${seed ? `${seed}:` : ""}${project}:objects-webhook:${bucket}`).digest("base64url").slice(0, 32);
+}
+/**
+* The target's id in MinIO's environment — `MINIO_NOTIFY_WEBHOOK_*_<ID>`.
+*
+* Upper-cased with nothing between words: a canonical id is letters and
+* digits, and an underscore inside the id would read as part of the setting's
+* name.
+*/
+function minioTargetId(bucket) {
+	return bucket.toUpperCase();
+}
+/** The target as a notification names it. */
+function minioTargetArn(bucket) {
+	return `arn:minio:sqs::${minioTargetId(bucket)}:webhook`;
+}
+/** How a container reaches a process on the host. */
+const HOST_GATEWAY = "host.docker.internal";
+/** Where MinIO keeps what it could not deliver yet, inside its container. */
+const QUEUE_ROOT = "/gkm-object-events";
+/** The id of the notification rule gkm owns on a bucket. */
+const NOTIFICATION_RULE_PREFIX = "gkm-";
+/**
+* MinIO's environment for each watched bucket's webhook target.
+*
+* Sorted, so the same buckets always render the same environment and a
+* reconcile that changed nothing does not recreate the container.
+*/
+function minioWebhookEnv(hooks) {
+	const env = {};
+	for (const hook of [...hooks].sort((a, b) => a.bucket.localeCompare(b.bucket))) {
+		const id = minioTargetId(hook.bucket);
+		env[`MINIO_NOTIFY_WEBHOOK_ENABLE_${id}`] = "on";
+		env[`MINIO_NOTIFY_WEBHOOK_ENDPOINT_${id}`] = hook.endpoint;
+		env[`MINIO_NOTIFY_WEBHOOK_AUTH_TOKEN_${id}`] = hook.token;
+		env[`MINIO_NOTIFY_WEBHOOK_QUEUE_DIR_${id}`] = `${QUEUE_ROOT}/${id.toLowerCase()}`;
+	}
+	return env;
+}
+/** The rule that sends every created and removed object to the bucket's target. */
+function minioNotificationRule(bucket) {
+	return {
+		Id: `${NOTIFICATION_RULE_PREFIX}${bucket}`,
+		QueueArn: minioTargetArn(bucket),
+		Events: ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"]
+	};
+}
+/**
+* Each watched bucket, and the workers that run one of its subscribers.
+*
+* A bucket is watched when a subscriber reads its events key. MinIO posts a
+* bucket's events to one place, and the relay fans them out to every
+* subscriber whichever worker received them — so one worker per bucket is
+* enough, and the first, by id, is the one chosen, so the choice is stable.
+*/
+function watchedBuckets(manifest, subscribers) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const declaration of Object.values(manifest)) {
+		if (declaration.kind !== "objects") continue;
+		byKey.set(provideKey(declaration.id, "eventsConnectionString"), declaration.id);
+	}
+	const watched = /* @__PURE__ */ new Map();
+	for (const worker of Object.keys(subscribers).sort()) for (const { connectionKey } of subscribers[worker] ?? []) {
+		const bucket = byKey.get(connectionKey);
+		if (bucket && !watched.has(bucket)) watched.set(bucket, worker);
+	}
+	return watched;
+}
+//#endregion
 //#region src/telemetry/edges.ts
 /**
 * Which processes use a `Telemetry` node — read off the manifest's edges.
@@ -1215,6 +1317,14 @@ function envFor(plan, options) {
 	}
 	Object.assign(env, publicEnv(plan, env, options.addresses));
 	Object.assign(env, brokerEnv(plan, options.ports, credential));
+	const relay = env.EVENT_PUBLISHER_CONNECTION_STRING;
+	if (relay && options.relayedBuckets?.length) for (const resource of plan.resources) {
+		if (resource.kind !== "objects" || resource.container !== "minio") continue;
+		if (!options.relayedBuckets.includes(resource.id)) continue;
+		if (!env[resource.envKey]) continue;
+		env[provideKey(resource.id, "eventsConnectionString")] = relay;
+		env[provideKey(resource.id, "eventsToken")] = objectsWebhookToken(options.project ?? "", resource.id, credential.seed);
+	}
 	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, storageCredentials(options.credentials));
 	return env;
 }
@@ -2582,6 +2692,56 @@ async function databasesExist(client, names) {
 	}
 }
 /**
+* Point each watched bucket's events at its webhook target, and stop sending
+* an unwatched one's.
+*
+* Merged rather than written whole: only the rule gkm owns on a bucket
+* (`gkm-<Bucket>`) is added or removed, and every other rule — one somebody
+* added by hand — is kept. Compared before writing, so a converged reconcile
+* changes nothing.
+*
+* @param buckets - each bucket the plan names, by construct id and name
+* @param watched - the construct ids whose events are relayed
+*/
+async function applyNotifications(client, buckets, watched) {
+	const applied = [];
+	for (const { id, name } of buckets) {
+		const current = await client.notification(name);
+		const queues = current.QueueConfigurations ?? [];
+		const others = queues.filter((rule) => !rule.Id?.startsWith(NOTIFICATION_RULE_PREFIX));
+		const wanted = watched.has(id) ? [...others, minioNotificationRule(id)] : others;
+		if (!watched.has(id) && others.length === queues.length) continue;
+		const describe = `object events from ${name}`;
+		const ours = queues.filter((rule) => rule.Id?.startsWith(NOTIFICATION_RULE_PREFIX));
+		if (watched.has(id) ? ours.length === 1 && sameRule(ours[0], minioNotificationRule(id)) : ours.length === 0) {
+			applied.push({
+				id: `${name}:events`,
+				describe,
+				created: false
+			});
+			continue;
+		}
+		await client.setNotification(name, {
+			...current,
+			QueueConfigurations: wanted
+		});
+		applied.push({
+			id: `${name}:events`,
+			describe,
+			created: true
+		});
+	}
+	return applied;
+}
+/**
+* Whether a rule read back says what gkm wrote: the same target, the same
+* events in any order, and no filter — the store may hand back an empty one.
+*/
+function sameRule(current, wanted) {
+	const filter = current.Filter;
+	return current.Id === wanted.Id && current.QueueArn === wanted.QueueArn && JSON.stringify([...current.Events ?? []].sort()) === JSON.stringify([...wanted.Events ?? []].sort()) && (filter?.Key?.FilterRules?.length ?? 0) === 0;
+}
+/**
 * Apply each bucket's expiry, beside whatever other rules it has, skipping
 * those already correct — the same merge the `s3` provider makes deployed.
 */
@@ -3915,7 +4075,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
 		case "s3": {
-			const { S3SecretsStore } = await import("./s3-DQXZdmCM.mjs");
+			const { S3SecretsStore } = await import("./s3-B4FTQQkV.mjs");
 			const { deployIdentity } = await import("./identity-CBXr4wNi.mjs").then((n) => n.r);
 			const location = s3SecretsLocation(config, workspace.state);
 			return new S3SecretsStore({
@@ -4289,6 +4449,14 @@ function composeFor(plan, options) {
 		const volume = volumeOf(container);
 		if (volume) volumes[volume] = {};
 	}
+	const minio = services.minio;
+	if (minio && options.objectWebhooks?.length) {
+		minio.environment = {
+			...minio.environment,
+			...minioWebhookEnv(options.objectWebhooks)
+		};
+		if (options.objectWebhooks.some((hook) => hook.endpoint.includes(`//host.docker.internal:`))) minio.extra_hosts = [`${HOST_GATEWAY}:host-gateway`];
+	}
 	return {
 		name: options.project,
 		services: {
@@ -4662,6 +4830,16 @@ function bucketClient(port, credentials) {
 				Bucket: bucket,
 				LifecycleConfiguration: { Rules: rules }
 			}));
+		},
+		async notification(bucket) {
+			const { $metadata: _, ...notification } = await s3.send(new GetBucketNotificationConfigurationCommand({ Bucket: bucket }));
+			return notification;
+		},
+		async setNotification(bucket, notification) {
+			await s3.send(new PutBucketNotificationConfigurationCommand({
+				Bucket: bucket,
+				NotificationConfiguration: notification
+			}));
 		}
 	};
 }
@@ -5498,7 +5676,8 @@ async function reconcile(options) {
 		project,
 		ports,
 		credentials: options.credentials,
-		...options.apps ? { apps: options.apps(plan.containers) } : {}
+		...options.apps ? { apps: options.apps(plan.containers) } : {},
+		...options.objectWebhooks?.length ? { objectWebhooks: options.objectWebhooks } : {}
 	});
 	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
 	const hash = planHash(plan, compose, {
@@ -5516,7 +5695,8 @@ async function reconcile(options) {
 			...options.mailFrom ? { mailFrom: options.mailFrom } : {},
 			...options.addresses ? { addresses: options.addresses } : {},
 			...lan ? { lanAddress: lan } : {},
-			...options.metroPorts ? { metroPorts: options.metroPorts } : {}
+			...options.metroPorts ? { metroPorts: options.metroPorts } : {},
+			...options.objectWebhooks?.length ? { relayedBuckets: options.objectWebhooks.map((hook) => hook.bucket) } : {}
 		});
 		const env = exports ? resolved : scopeTelemetryEnv(resolved, {
 			uses: false,
@@ -5573,7 +5753,7 @@ async function reconcile(options) {
 	};
 	const credentials = checked.credentials;
 	if (start && provision) options.progress?.("🗄️  Creating what the constructs declare — databases, roles, buckets, topics");
-	const provisioned = start && provision ? await create(plan, ports, credentials, sql, buckets, carriers, project) : [];
+	const provisioned = start && provision ? await create(plan, ports, credentials, sql, buckets, carriers, project, new Set(stage === (options.localStage ?? stage) ? (options.objectWebhooks ?? []).map((hook) => hook.bucket) : [])) : [];
 	await saveState(root, {
 		hash,
 		stage
@@ -5593,7 +5773,7 @@ async function reconcile(options) {
 * Idempotent throughout, so this runs on every non-converged reconcile rather
 * than being something to remember.
 */
-async function create(plan, ports, credentials, sql, buckets, emulatorCarriers, project) {
+async function create(plan, ports, credentials, sql, buckets, emulatorCarriers, project, watched) {
 	const applied = [];
 	const postgresPort = ports[primaryPortKey("postgres")];
 	const statements = postgresStatements(plan, project, credentials.seed);
@@ -5607,6 +5787,10 @@ async function create(plan, ports, credentials, sql, buckets, emulatorCarriers,
 		if (names.length > 0) applied.push(...await applyBuckets(client, names));
 		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
 		if (lifecycles.length > 0) applied.push(...await applyLifecycles(client, lifecycles));
+		if (names.length > 0) applied.push(...await applyNotifications(client, plan.resources.filter((r) => r.provisions && r.kind === "objects").map((r) => ({
+			id: r.id,
+			name: r.name
+		})), watched));
 	}
 	const emulatorPort = ports[primaryPortKey("localstack")];
 	const carriers = carrierNames(plan);
@@ -5672,6 +5856,7 @@ var workspace_exports = /* @__PURE__ */ __exportAll({
 	constructGlobs: () => constructGlobs,
 	derivedContainers: () => derivedContainers,
 	fakesApply: () => fakesApply,
+	localObjectWebhooks: () => localObjectWebhooks,
 	metroPorts: () => metroPorts,
 	reconcileWorkspace: () => reconcileWorkspace,
 	surfaceAddresses: () => surfaceAddresses
@@ -5735,16 +5920,25 @@ function fakesApply(stage, fake, env = process.env) {
 */
 async function reconcileWorkspace(workspace, options) {
 	const runnables = {};
+	const background = {};
+	const subscribers = {};
 	const discovered = await discover({
 		patterns: constructGlobs(workspace),
 		cwd: workspace.root,
-		runnables
+		runnables,
+		background,
+		subscribers
 	});
 	const manifest = options.manifest ?? discovered;
 	const faked = fakesApply(options.stage, options.fake);
 	const fakes = faked ? await readFakes(workspace.root, manifest) : {};
 	const credentialFakes = faked ? await readCredentialFakes(workspace.root, manifest) : {};
 	const { credentials } = await loadLocalCredentials(workspace);
+	const objectWebhooks = localObjectWebhooks(workspace, manifest, {
+		background,
+		subscribers,
+		seed: credentials.seed
+	});
 	const result = await reconcile({
 		credentials,
 		root: workspace.root,
@@ -5758,6 +5952,7 @@ async function reconcileWorkspace(workspace, options) {
 		metroPorts: metroPorts(workspace, manifest),
 		fakes,
 		credentialFakes,
+		...objectWebhooks.length > 0 ? { objectWebhooks } : {},
 		apps: (containers) => appServices(workspace, manifest, containers, credentials, runnables, fakes, credentialFakes),
 		...options.start === void 0 ? {} : { start: options.start },
 		...options.progress ? { progress: options.progress } : {}
@@ -5772,6 +5967,40 @@ async function reconcileWorkspace(workspace, options) {
 	};
 }
 /**
+* Where MinIO posts each watched bucket's events under `gkm dev`: the dev
+* server of the app that builds the worker running the bucket's subscribers,
+* on the host, on that app's port — the process that relays them onto the
+* broker.
+*
+* None where the broker is SNS: there a bucket's events come from a topic, and
+* nothing relays them. None for a worker no app can build — `gkm build` says
+* so; a dev loop has nothing to post to.
+*/
+function localObjectWebhooks(workspace, manifest, options) {
+	if (backendsOf(workspace).events === "sns") return [];
+	const watched = watchedBuckets(manifest, options.subscribers);
+	if (watched.size === 0) return [];
+	let units;
+	try {
+		units = workerUnits(workspace, manifest, options.background);
+	} catch (error) {
+		if (error instanceof WorkerHasNoApp) return [];
+		throw error;
+	}
+	const hooks = [];
+	for (const [bucket, worker] of watched) {
+		const app = units.find((unit) => unit.id === worker)?.app;
+		const port = app ? workspace.apps[app]?.port : void 0;
+		if (!port) continue;
+		hooks.push({
+			bucket,
+			endpoint: `http://${HOST_GATEWAY}:${port}${objectsRoute(bucket)}`,
+			token: objectsWebhookToken(workspace.name, bucket, options.seed)
+		});
+	}
+	return hooks;
+}
+/**
 * Where each mobile app's Metro runs: its app's port, which `gkm exec` hands
 * Expo as `RCT_METRO_PORT`. Kept apart from the surfaces' addresses — a phone
 * reaches Metro by `exp://`, not through the edge.
@@ -5966,6 +6195,14 @@ function workerEnvKeys(manifest, workerId, runnables = {}) {
 /** What each construct an edge reaches hands the process that reaches it. */
 function addEdgeKeys(manifest, edges, keys) {
 	for (const id of edges) {
+		const bucket = eventsEdgeBucket(id);
+		if (bucket) {
+			if (manifest[bucket]?.kind === "objects") {
+				keys.add(provideKey(bucket, "eventsConnectionString"));
+				keys.add(provideKey(bucket, "eventsToken"));
+			}
+			continue;
+		}
 		const target = manifest[id];
 		if (!target) continue;
 		if (target.kind === "rest-api") {
@@ -7001,17 +7238,59 @@ async function answers(connection: unknown): Promise<boolean> {
   }
 }
 
+/** A request to a route this worker mounted, and what it answered. */
+export interface WorkerRequest {
+  headers: Record<string, string | string[] | undefined>;
+  body: string;
+}
+export interface WorkerAnswer {
+  status: number;
+  body: unknown;
+}
+
+// The routes something pushes to: an SNS subscriber's, and the one a local
+// object store posts a bucket's events to. Mounted by the subscribers, served
+// by the entry's HTTP server beside the health check.
+const routes = new Map<string, (c: any) => unknown>();
+const app = {
+  post: (path: string, handler: (c: any) => unknown) => {
+    routes.set(path, handler);
+  },
+};
+
+/** Run one mounted route, as the subscribers' handlers expect to be called. */
+async function route(path: string, request: WorkerRequest): Promise<WorkerAnswer | undefined> {
+  const handler = routes.get(path);
+  if (!handler) return undefined;
+  let answer: WorkerAnswer | undefined;
+  const c = {
+    req: {
+      text: async () => request.body,
+      header: (name: string) => {
+        const value = request.headers[name.toLowerCase()];
+        return Array.isArray(value) ? value[0] : value;
+      },
+    },
+    json: (body: unknown, status = 200) => {
+      answer = { status, body };
+      return answer;
+    },
+  };
+  await handler(c);
+  return answer ?? { status: 204, body: null };
+}
+
 /** Start everything this worker runs. */
 export async function startWorker(): Promise<{
   health: () => Promise<WorkerHealth>;
   stop: () => Promise<void>;
+  route: typeof route;
+  /** Subscribe the pushed routes, once the server answers on \`port\`. */
+  subscribeForPush: (port: number) => Promise<void>;
 }> {
-  // An app object with no routes: on a server target nothing is pushed to a
-  // subscriber, so there is nothing to mount.
-  const noRoutes = { post: () => undefined };
-
-  await setupSubscribers(noRoutes, envParser, logger).catch((error) => {
+  const subscribeForPush = await setupSubscribers(app, envParser, logger).catch((error) => {
     logger.error({ err: error }, 'Failed to start subscribers');
+    return async (_port: number) => {};
   });
   await setupQueues(envParser, logger).catch((error) => {
     logger.error({ err: error }, 'Failed to start queue consumers');
@@ -7023,6 +7302,8 @@ export async function startWorker(): Promise<{
   const statuses = () => [subscribersStatus(), queuesStatus(), cronsStatus()];
 
   return {
+    route,
+    subscribeForPush,
     async health() {
       const all = statuses();
       const failed = all.flatMap((s) => s.failed);
@@ -7053,8 +7334,10 @@ function workerEntry(healthCheck) {
  * Generated by 'gkm build --production'.
  *
  * Runs this worker's crons, queue consumers and topic subscribers, and serves
- * one route: ${healthCheck}, on PORT — 200 when every consumer started and
- * every broker connection answers, 503 otherwise.
+ * its health check: ${healthCheck}, on PORT — 200 when every consumer started
+ * and every broker connection answers, 503 otherwise. Beside it, on the same
+ * port, the POST routes its subscribers mounted: where a local object store
+ * posts a bucket's events.
  *
  * On SIGTERM it stops pulling messages and scheduling crons, lets the handlers
  * in flight finish, closes its broker connections and database pools, and
@@ -7073,15 +7356,39 @@ let worker: Awaited<ReturnType<typeof startWorker>> | undefined;
 let stopping = false;
 
 const server = createServer((req, res) => {
-  const path = (req.url ?? '/').split('?')[0];
-  if (path !== ${JSON.stringify(healthCheck)} || (req.method !== 'GET' && req.method !== 'HEAD')) {
-    res.writeHead(404).end();
-    return;
-  }
+  const path = (req.url ?? '/').split('?')[0] ?? '/';
   const answer = (status: number, body: unknown) => {
     res.writeHead(status, { 'content-type': 'application/json' });
     res.end(JSON.stringify(body));
   };
+
+  // A route a subscriber mounted: what SNS pushes to, or what a local object
+  // store posts a bucket's events to. Refused while starting or stopping, so
+  // the sender keeps the message and sends it again.
+  if (req.method === 'POST') {
+    let body = '';
+    req.setEncoding('utf8');
+    req.on('data', (chunk) => {
+      body += chunk;
+    });
+    req.on('end', () => {
+      if (stopping) return answer(503, { status: 'stopping' });
+      if (!worker) return answer(503, { status: 'starting' });
+      worker.route(path, { headers: req.headers, body }).then(
+        (routed) => (routed ? answer(routed.status, routed.body) : answer(404, { status: 'not found' })),
+        (error) => {
+          logger.error({ err: error, path }, 'Route failed');
+          answer(500, { status: 'failed' });
+        },
+      );
+    });
+    return;
+  }
+
+  if (path !== ${JSON.stringify(healthCheck)} || (req.method !== 'GET' && req.method !== 'HEAD')) {
+    res.writeHead(404).end();
+    return;
+  }
   if (stopping) return answer(503, { status: 'stopping' });
   if (!worker) return answer(503, { status: 'starting' });
   worker.health().then(
@@ -7115,6 +7422,9 @@ process.on('SIGINT', shutdown);
 
 worker = await startWorker();
 logger.info({ port }, 'Worker started');
+await worker.subscribeForPush(port).catch((error) => {
+  logger.error({ err: error }, 'Failed to subscribe for push');
+});
 `;
 }
 //#endregion
@@ -7483,7 +7793,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-BNpS9aRJ.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-Cjh_2Ml6.mjs");
 		return new HostingerProvider(options.hostinger);
 	}
 	if (provider === "route53") {
@@ -7496,7 +7806,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-wIKYdm7V.mjs");
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-55x4o-4z.mjs");
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8345,6 +8655,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { assertDevServicesFlag as $, stackLogs as $n, publicBuildValues as $t, StageProviderDisabled as A, localRolePassword as An, findAvailablePort as At, workerDockerfile as B, EMULATOR_ACCESS_KEY_ID as Bn, initStageSecrets as Bt, recordRollback as C, REDIS_SERVICE as Cn, composeFor as Ct, setPostgresBackupId as D, stackRedis as Dn, storageBackendFor as Dt, setGeneratedSecret as E, runsRedis as En, providerOf as Et, DockerBuildFailed as F, isTelemetryKey as Fn, prepareEntryCredentials as Ft, QueueGenerator as G, portKeys as Gn, composeBuildPaths as Gt, WorkerGenerator as H, DEFAULT_IMAGES as Hn, storage_exports as Ht, DockerPushFailed as I, scopeTelemetryEnv as In, isRemoteStore as It, AllowDevServicesTakesNoValue as J, primaryPortKey as Jn, WORKER_PORT as Jt, CronGenerator as K, portsOf as Kn, imageLayout as Kt, appDockerfile as L, surfaceClientTraced as Ln, secretsStoreFor as Lt, provisionCommand as M, planFor as Mn, loadEnvFiles as Mt, stageProviderNotes as N, resourceName as Nn, loadPortState as Nt, DnsRecordsUnreadable as O, withRedisPassword as On, createCredentialsPreload as Ot, PROVIDER_KINDS as P, appTelemetry as Pn, loadSecretsForApp as Pt, STORAGE_KEY_PAIR as Q, logsService as Qn, isImageBuild as Qt, dockerCommand as R, telemetryOf as Rn, storeFromConfig as Rt, recordRelease as S, withGeneratedSecrets as Sn, CLUSTER_DATABASE as St, setBackupState as T, redisService as Tn, eventsBackendFor as Tt, workerBundleName as U, describeServices as Un, toEmbeddableSecrets as Ut, workerDockerfileOf as V, hostFor as Vn, maskPassword as Vt, workerEntryDir as W, fakeKey as Wn, withCustomSecret as Wt, DevServicesNeedServerTarget as X, LOGS_SERVICE as Xn, findBuildRoot as Xt, DEV_SERVICES as Y, LOCAL_LOGS_EMAIL as Yn, detectPackageManager as Yt, ExternalServicesNotConfigured as Z, logsAccess as Zn, imageBuildCredentials as Zt, asDokployState as _, FileSecretsStore as _n, forgetState as _t, dnsResources as a, applyPostgres as an, suppliedOnly as at, getBackupState as b, projectKey as bn, bucketClient as bt, currentActor as c, postgresDatabaseNames as cn, networkEnv as ct, DeployJournal as d, mergeLifecycle as dn, backendsOf as dt, isUnder as en, withLogsPassword as er, devServicesUsed as et, extractSubdomain as f, LOCAL_RABBITMQ_USER as fn, constructGlobs as ft, verifyDnsRecords as g, readLocalCredentials as gn, LOCAL_CA_PATH as gt, orchestrateDns as h, postgresSuperuser as hn, workspace_exports as ht, dnsRecordResource as i, applyPolicies as in, stageServiceDeclarations as it, assertStageProvidersEnabled as j, TELEMETRY_CONTAINER as jn, isPortAvailable as jt, createDnsProvider as k, envFor as kn, createEntryWrapper as kt, describeActor as l, postgresStatements as ln, workerEnvKeys as lt, normalizeDnsConfig as m, postgresRoleSlug as mn, reconcileWorkspace as mt, reportDatabaseRuns as n, applyBuckets as nn, isMainFrontendApp as nr, reportDevServices as nt, forgetDnsResource as o, bucketLifecycles as on, appEnvKeys as ot, findRootDomain as p, loadLocalCredentials as pn, derivedContainers as pt, validateImageRef as q, postgresImage as qn, TURBO_VERSION as qt, reportPlannedSeeds as r, applyLifecycles as rn, resolveHost as rr, requiredStageKeys as rt, recordDnsChanges as s, bucketPolicies as sn, dockerfileOf as st, DeploySeedsFailed as t, workerUnits as tn, NoDomainForStage as tr, externalServices as tt, isCi as u, quoteIdentifier as un, FAKE_ENV as ut, createComposeState as v, getKeyPath as vn, LEGACY_LOCAL_LOGIN as vt, setApplicationId as w, STACK_CACHE as wn, cacheBackendFor as wt, getGeneratedSecret as x, readKey as xn, pgClient as xt, createEmptyState as y, keystoreProject as yn, ensurePostgresLogin as yt, ensureDockerignore as z, usesTelemetry as zn, store_exports as zt };
+export { assertDevServicesFlag as $, LOGS_SERVICE as $n, publicBuildValues as $t, StageProviderDisabled as A, envFor as An, findAvailablePort as At, workerDockerfile as B, usesTelemetry as Bn, initStageSecrets as Bt, recordRollback as C, withGeneratedSecrets as Cn, composeFor as Ct, setPostgresBackupId as D, runsRedis as Dn, storageBackendFor as Dt, setGeneratedSecret as E, redisService as En, providerOf as Et, DockerBuildFailed as F, appTelemetry as Fn, prepareEntryCredentials as Ft, QueueGenerator as G, DEFAULT_IMAGES as Gn, composeBuildPaths as Gt, WorkerGenerator as H, watchedBuckets as Hn, storage_exports as Ht, DockerPushFailed as I, isTelemetryKey as In, isRemoteStore as It, AllowDevServicesTakesNoValue as J, portKeys as Jn, WORKER_PORT as Jt, CronGenerator as K, describeServices as Kn, imageLayout as Kt, appDockerfile as L, scopeTelemetryEnv as Ln, secretsStoreFor as Lt, provisionCommand as M, TELEMETRY_CONTAINER as Mn, loadEnvFiles as Mt, stageProviderNotes as N, planFor as Nn, loadPortState as Nt, DnsRecordsUnreadable as O, stackRedis as On, createCredentialsPreload as Ot, PROVIDER_KINDS as P, resourceName as Pn, loadSecretsForApp as Pt, STORAGE_KEY_PAIR as Q, LOCAL_LOGS_EMAIL as Qn, isImageBuild as Qt, dockerCommand as R, surfaceClientTraced as Rn, storeFromConfig as Rt, recordRelease as S, readKey as Sn, CLUSTER_DATABASE as St, setBackupState as T, STACK_CACHE as Tn, eventsBackendFor as Tt, workerBundleName as U, EMULATOR_ACCESS_KEY_ID as Un, toEmbeddableSecrets as Ut, workerDockerfileOf as V, minioWebhookEnv as Vn, maskPassword as Vt, workerEntryDir as W, hostFor as Wn, withCustomSecret as Wt, DevServicesNeedServerTarget as X, postgresImage as Xn, findBuildRoot as Xt, DEV_SERVICES as Y, portsOf as Yn, detectPackageManager as Yt, ExternalServicesNotConfigured as Z, primaryPortKey as Zn, imageBuildCredentials as Zt, asDokployState as _, readLocalCredentials as _n, forgetState as _t, dnsResources as a, applyPolicies as an, isMainFrontendApp as ar, suppliedOnly as at, getBackupState as b, keystoreProject as bn, bucketClient as bt, currentActor as c, bucketPolicies as cn, networkEnv as ct, DeployJournal as d, quoteIdentifier as dn, backendsOf as dt, isUnder as en, logsAccess as er, devServicesUsed as et, extractSubdomain as f, mergeLifecycle as fn, constructGlobs as ft, verifyDnsRecords as g, postgresSuperuser as gn, LOCAL_CA_PATH as gt, orchestrateDns as h, postgresRoleSlug as hn, workspace_exports as ht, dnsRecordResource as i, applyNotifications as in, NoDomainForStage as ir, stageServiceDeclarations as it, assertStageProvidersEnabled as j, localRolePassword as jn, isPortAvailable as jt, createDnsProvider as k, withRedisPassword as kn, createEntryWrapper as kt, describeActor as l, postgresDatabaseNames as ln, workerEnvKeys as lt, normalizeDnsConfig as m, loadLocalCredentials as mn, reconcileWorkspace as mt, reportDatabaseRuns as n, applyBuckets as nn, stackLogs as nr, reportDevServices as nt, forgetDnsResource as o, applyPostgres as on, resolveHost as or, appEnvKeys as ot, findRootDomain as p, LOCAL_RABBITMQ_USER as pn, derivedContainers as pt, validateImageRef as q, fakeKey as qn, TURBO_VERSION as qt, reportPlannedSeeds as r, applyLifecycles as rn, withLogsPassword as rr, requiredStageKeys as rt, recordDnsChanges as s, bucketLifecycles as sn, dockerfileOf as st, DeploySeedsFailed as t, workerUnits as tn, logsService as tr, externalServices as tt, isCi as u, postgresStatements as un, FAKE_ENV as ut, createComposeState as v, FileSecretsStore as vn, LEGACY_LOCAL_LOGIN as vt, setApplicationId as w, REDIS_SERVICE as wn, cacheBackendFor as wt, getGeneratedSecret as x, projectKey as xn, pgClient as xt, createEmptyState as y, getKeyPath as yn, ensurePostgresLogin as yt, ensureDockerignore as z, telemetryOf as zn, store_exports as zt };
 
-//# sourceMappingURL=seeds-oY0qDqui.mjs.map
+//# sourceMappingURL=seeds-rG-Evfz9.mjs.map