@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.124

package/dist/{compose-cHkF---f.mjs → compose-DJvvmF3X.mjs}

@@ -1,15 +1,15 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
+import { c as runOutput, s as run } from "./credentials-DpfnUvIR.mjs";
 import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-DUnnVjqC.mjs";
-import { E as stageBackups, a as serverAddressHint, b as stackBackups, d as passwordSites, f as siteAuth, h as BACKUPS_SERVICE, i as requiredServerAddress, l as systemLookup, m as withSitePasswords, o as stackHosts, p as siteNames, r as isLocalHost, s as stageDns, t as HostNotPointingAtServer, v as backupsRoleStatements, y as backupsService } from "./dns-DFvO5a53.mjs";
+import { A as stackBackups, C as siteNames, I as stageBackups, O as backupsRoleStatements, S as siteAuth, T as BACKUPS_SERVICE, a as subscriptionKey, c as HostNotPointingAtServer, d as requiredServerAddress, f as serverAddressHint, g as systemLookup, i as recordedPushSubscriptions, k as backupsService, m as stageDns, n as SUBSCRIPTION_TYPE, o as subscriptionResource, p as stackHosts, r as confirmPendingSubscriptions, s as topicConnection, t as PushSubscriptionsUnconfirmed, u as isLocalHost, w as withSitePasswords, x as passwordSites } from "./snsSubscriptions-CvBIGGp0.mjs";
 import { t as defineTarget } from "./define-6poNqm5O.mjs";
-import { $n as stackLogs, $t as publicBuildValues, An as localRolePassword, B as workerDockerfile, Bn as EMULATOR_ACCESS_KEY_ID, Bt as initStageSecrets, Cn as REDIS_SERVICE, Ct as composeFor, Dn as stackRedis, En as runsRedis, Fn as isTelemetryKey, Gn as portKeys, Gt as composeBuildPaths, Hn as DEFAULT_IMAGES, In as scopeTelemetryEnv, Jn as primaryPortKey, Jt as WORKER_PORT, Kt as imageLayout, L as appDockerfile, Mn as planFor, N as stageProviderNotes, On as withRedisPassword, Qn as logsService, Rn as telemetryOf, S as recordRelease, Sn as withGeneratedSecrets, Tn as redisService, Vn as hostFor, Xn as LOGS_SERVICE, Xt as findBuildRoot, Zn as logsAccess, a as dnsResources, an as applyPostgres, at as suppliedOnly, bt as bucketClient, c as currentActor, ct as networkEnv, d as DeployJournal, er as withLogsPassword, et as devServicesUsed, fn as LOCAL_RABBITMQ_USER, ft as constructGlobs, hn as postgresSuperuser, in as applyPolicies, it as stageServiceDeclarations, kn as envFor, ln as postgresStatements, lt as workerEnvKeys, n as reportDatabaseRuns, nn as applyBuckets, nr as isMainFrontendApp, o as forgetDnsResource, on as bucketLifecycles, ot as appEnvKeys, pn as loadLocalCredentials, q as validateImageRef, qt as TURBO_VERSION, r as reportPlannedSeeds, rn as applyLifecycles, rr as resolveHost, s as recordDnsChanges, sn as bucketPolicies, t as DeploySeedsFailed, tn as workerUnits, tr as NoDomainForStage, tt as externalServices, v as createComposeState, vt as LEGACY_LOCAL_LOGIN, wn as STACK_CACHE, xt as pgClient, yt as ensurePostgresLogin, z as ensureDockerignore, zn as usesTelemetry } from "./seeds-Dv78P9LS.mjs";
+import { $n as LOGS_SERVICE, $t as publicBuildValues, An as envFor, B as workerDockerfile, Bn as usesTelemetry, Bt as initStageSecrets, Cn as withGeneratedSecrets, Ct as composeFor, Dn as runsRedis, En as redisService, Gn as DEFAULT_IMAGES, Gt as composeBuildPaths, Hn as watchedBuckets, In as isTelemetryKey, Jn as portKeys, Jt as WORKER_PORT, Kt as imageLayout, L as appDockerfile, Ln as scopeTelemetryEnv, N as stageProviderNotes, Nn as planFor, On as stackRedis, S as recordRelease, Tn as STACK_CACHE, Un as EMULATOR_ACCESS_KEY_ID, Vn as minioWebhookEnv, Wn as hostFor, Xt as findBuildRoot, Zn as primaryPortKey, a as dnsResources, an as applyPolicies, ar as isMainFrontendApp, at as suppliedOnly, bt as bucketClient, c as currentActor, cn as bucketPolicies, ct as networkEnv, d as DeployJournal, er as logsAccess, et as devServicesUsed, ft as constructGlobs, gn as postgresSuperuser, in as applyNotifications, ir as NoDomainForStage, it as stageServiceDeclarations, jn as localRolePassword, kn as withRedisPassword, lt as workerEnvKeys, mn as loadLocalCredentials, n as reportDatabaseRuns, nn as applyBuckets, nr as stackLogs, o as forgetDnsResource, on as applyPostgres, or as resolveHost, ot as appEnvKeys, pn as LOCAL_RABBITMQ_USER, q as validateImageRef, qt as TURBO_VERSION, r as reportPlannedSeeds, rn as applyLifecycles, rr as withLogsPassword, s as recordDnsChanges, sn as bucketLifecycles, t as DeploySeedsFailed, tn as workerUnits, tr as logsService, tt as externalServices, un as postgresStatements, v as createComposeState, vt as LEGACY_LOCAL_LOGIN, wn as REDIS_SERVICE, xt as pgClient, yt as ensurePostgresLogin, z as ensureDockerignore, zn as telemetryOf } from "./seeds-rG-Evfz9.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { n as subscriberRoute, s as DEFAULT_EVENTS } from "./SubscriberGenerator-y3pncae_.mjs";
+import { a as SNS_SUBSCRIPTIONS_KEY, l as DEFAULT_EVENTS, o as objectsRoute, s as subscriberRoute } from "./SubscriberGenerator-COAVPgM-.mjs";
 import { a as imageRef } from "./identity-CBXr4wNi.mjs";
-import { i as discover } from "./discover-C5roJuc9.mjs";
-import { i as installedFrom } from "./drivers-BjGDYfnC.mjs";
+import { i as discover } from "./discover-BvJOVsYG.mjs";
+import { i as installedFrom } from "./drivers-Chb5Akov.mjs";
 import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-BPOgTn1u.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
@@ -1443,9 +1443,20 @@ function composeStack(input) {
 			...credential.containers.minio,
 			buckets,
 			policies: bucketPolicies(plan).filter((p) => buckets.includes(p.bucket)),
+			objects: services.minio.map((id) => ({
+				id,
+				name: byId.get(id)?.name
+			})).filter((b) => Boolean(b.name)).sort((a, b) => a.name.localeCompare(b.name)),
+			webhooks: [],
 			lifecycles: bucketLifecycles(plan).filter((l) => buckets.includes(l.bucket))
 		};
 	})() : void 0;
+	const bucketEventKeys = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		if (resource.kind !== "objects") continue;
+		bucketEventKeys.set(provideKey(resource.id, "eventsConnectionString"), resource.id);
+		bucketEventKeys.set(provideKey(resource.id, "eventsToken"), resource.id);
+	}
 	const fileServers = /* @__PURE__ */ new Map();
 	if (storage) for (const resource of plan.resources) {
 		if (resource.kind !== "file-server" || !resource.of) continue;
@@ -1490,7 +1501,8 @@ function composeStack(input) {
 		project: workspace.name,
 		credentials: credential.containers,
 		seed: credential.seed,
-		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
+		...!local && domain ? { mailFrom: `noreply@${domain}` } : {},
+		relayedBuckets: [...watchedBuckets(manifest, input.subscribers ?? {}).keys()].filter((bucket) => services.minio.includes(bucket))
 	};
 	const outside = networkEnv(plan, {
 		...derivation,
@@ -1508,6 +1520,11 @@ function composeStack(input) {
 	*/
 	const valueFor = (app, key, owner) => {
 		if (isReservedStageKey(key)) return void 0;
+		const watching = bucketEventKeys.get(key);
+		if (watching) {
+			if (custom[key] !== void 0) return custom[key];
+			return services.minio.includes(watching) ? outside[key] : void 0;
+		}
 		if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) return;
 		if (owner && SERVICE_KINDS[owner.kind]) {
 			if (custom[key] !== void 0) return custom[key];
@@ -1609,13 +1626,28 @@ function composeStack(input) {
 				serviceName: worker.name,
 				...telemetryValues ? { telemetry: telemetryValues } : {}
 			}),
-			...push ? { [SUBSCRIBER_PUSH_URL_KEY]: push.url } : {},
+			...push && !input.recordingSubscriptions ? { [SNS_SUBSCRIPTIONS_KEY]: recordedSubscriptions(worker, push, input.pushSubscriptions?.[worker.id]) } : {},
 			NODE_ENV: "production",
 			PORT: String(worker.port),
 			STAGE: stage
 		};
 		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
 	}
+	if (storage && !input.buildOnly) {
+		const watched = watchedBuckets(manifest, input.subscribers ?? {});
+		for (const [bucket, workerId] of watched) {
+			if (!services.minio.includes(bucket)) continue;
+			const worker = workers.find((w) => w.id === workerId);
+			const relay = worker?.env?.[provideKey(bucket, "eventsConnectionString")];
+			const token = worker?.env?.[provideKey(bucket, "eventsToken")];
+			if (!worker || !relay || relay.startsWith("sns:") || !token) continue;
+			storage.webhooks.push({
+				bucket,
+				endpoint: `http://${hostOf(worker.name)}:${worker.port}${objectsRoute(bucket)}`,
+				token
+			});
+		}
+	}
 	const deployedTls = certificate ? {
 		kind: "files",
 		...proxy === "caddy" ? {
@@ -1795,29 +1827,61 @@ function stackApps(workspace, manifest, plan, options) {
 	}
 	return apps.sort((a, b) => a.name.localeCompare(b.name));
 }
-/** What the worker reads the public base of its push routes from. */
-const SUBSCRIBER_PUSH_URL_KEY = "GKM_SUBSCRIBER_PUSH_URL";
 /**
 * Where SNS pushes to a worker on a deployed stage, or nothing when it pushes
 * to none of its subscribers.
 *
-* A subscriber is pushed to when its topic's connection string, as this stage
-* resolved it for the worker, is an SNS one — the same test the worker's own
+* A subscriber is pushed to when the connection string its deliveries come
+* from — its topic's, or its bucket's events — as this stage resolved it for
+* the worker, is an SNS one — the same test the worker's own
 * startup makes, so the edge exposes a route exactly when the worker mounts
 * it. Each such route, and nothing else the worker serves, answers on
 * `<worker>.<domain>`.
 */
 function workerPush(worker, subscribers, env, options) {
-	const paths = subscribers.filter(({ topic }) => env[provideKey(topic, "publisherConnectionString")]?.startsWith("sns:")).map(({ name }) => subscriberRoute(name)).sort();
-	if (paths.length === 0) return void 0;
+	const pushed = subscribers.filter(({ connectionKey }) => env[connectionKey]?.startsWith("sns:")).filter((subscriber, index, all) => all.findIndex((s) => s.name === subscriber.name) === index).sort((a, b) => a.name.localeCompare(b.name));
+	if (pushed.length === 0) return void 0;
 	if (!options.domain) throw new NoDomainForStage(options.stage);
 	const host = `${worker.name}.${options.domain}`;
+	const url = `https://${host}`;
 	return {
 		host,
-		url: `https://${host}`,
-		paths: [...new Set(paths)]
+		url,
+		paths: pushed.map(({ name }) => subscriberRoute(name)),
+		subscribers: pushed.map(({ name, connectionKey, events }) => ({
+			name,
+			connectionKey,
+			endpoint: `${url}${subscriberRoute(name)}`,
+			...events ? { events } : {}
+		}))
 	};
 }
+/** A pushed subscriber the deploy recorded no SNS subscription for. */
+var PushSubscriptionMissing = class extends GkmError {
+	worker;
+	subscriber;
+	constructor(worker, subscriber) {
+		super(`SNS pushes to '${subscriber}' on the worker '${worker}', and the deploy recorded no subscription for it, so the worker would mount no route and SNS would deliver nowhere. Deploy the stage, which subscribes each pushed subscriber and records its ARN.`);
+		this.worker = worker;
+		this.subscriber = subscriber;
+		this.name = "PushSubscriptionMissing";
+	}
+};
+/**
+* The worker's `GKM_SNS_SUBSCRIPTIONS`: each pushed subscriber's recorded
+* subscription ARN, and nothing for a subscriber it does not run.
+*
+* @throws {PushSubscriptionMissing} when one has none
+*/
+function recordedSubscriptions(worker, push, recorded = {}) {
+	const arns = {};
+	for (const { name } of push.subscribers) {
+		const arn = recorded[name];
+		if (!arn) throw new PushSubscriptionMissing(worker.name, name);
+		arns[name] = arn;
+	}
+	return JSON.stringify(arns);
+}
 /** Two constructs the edge would answer on one host. */
 var EdgeHostTaken = class extends GkmError {
 	host;
@@ -1897,7 +1961,8 @@ function stackFile(options) {
 		minio.environment = {
 			...minio.environment,
 			MINIO_ROOT_USER: options.storage.user,
-			MINIO_ROOT_PASSWORD: options.storage.password
+			MINIO_ROOT_PASSWORD: options.storage.password,
+			...minioWebhookEnv(options.storage.webhooks)
 		};
 		minio.ports = ["127.0.0.1::9000"];
 	}
@@ -2265,6 +2330,119 @@ var ComposeAppsUnhealthy = class extends GkmError {
 	}
 };
 //#endregion
+//#region src/target/compose/topicSubscriptions.ts
+/**
+* Every topic subscriber the stack pushes to: a subscriber whose connection
+* key is a topic's publisher string — a bucket's events key is not — and
+* whose value on this stage is an SNS one.
+*/
+function topicPushes(stack, manifest) {
+	const topicKeys = new Set(Object.values(manifest).filter((declaration) => declaration.kind === "topic").map((topic) => provideKey(topic.id, "publisherConnectionString")));
+	const pushes = [];
+	for (const worker of stack.workers) for (const subscriber of worker.push?.subscribers ?? []) {
+		if (!topicKeys.has(subscriber.connectionKey)) continue;
+		const connectionString = worker.env?.[subscriber.connectionKey];
+		if (!connectionString?.startsWith("sns:")) continue;
+		pushes.push({
+			worker: worker.id,
+			name: subscriber.name,
+			endpoint: subscriber.endpoint,
+			connectionKey: subscriber.connectionKey,
+			connectionString,
+			...subscriber.events ? { events: subscriber.events } : {}
+		});
+	}
+	return pushes;
+}
+/** The subscriptions recorded for hand-set topics: those with a key. */
+function recordedTopicSubscriptions(resources) {
+	return Object.values(resources ?? {}).filter((record) => record.type === "sns-subscription" && typeof record.data?.connectionKey === "string");
+}
+/**
+* Converge each hand-set topic's subscriptions on the subscribers pushed to:
+* subscribe, bring filters up to date, unsubscribe a route on the worker's
+* host no subscriber wants any more — and record each ARN, forgetting what
+* was removed.
+*
+* @returns each worker's subscriptions, by export — what it is handed
+*/
+async function ensureTopicSubscriptions(input) {
+	const { snsUrl, reconcileHttpSubscriptions } = await import("@geekmidas/events/sns");
+	const groups = /* @__PURE__ */ new Map();
+	const group = (topicArn, host, connectionKey) => {
+		const id = `${topicArn}|${host}`;
+		const found = groups.get(id);
+		if (found) return found;
+		const created = {
+			topicArn,
+			host,
+			connectionKey,
+			pushes: [],
+			recorded: []
+		};
+		groups.set(id, created);
+		return created;
+	};
+	for (const push of input.pushes) {
+		const { topicArn } = snsUrl.parse(push.connectionString);
+		const into = group(topicArn, new URL(push.endpoint).host, push.connectionKey);
+		into.connectionString = push.connectionString;
+		into.pushes.push(push);
+	}
+	for (const record of recordedTopicSubscriptions(input.recorded)) group(String(record.data?.topicArn), new URL(String(record.data?.endpoint)).host, String(record.data?.connectionKey)).recorded.push(record);
+	const wanted = new Set(input.pushes.map(({ worker, name }) => subscriptionKey(worker, name)));
+	const arns = {};
+	for (const { topicArn, host, connectionKey, ...members } of groups.values()) {
+		const stale = members.recorded.filter((r) => !wanted.has(r.key));
+		const named = members.connectionString ?? input.secrets[connectionKey];
+		if (!named?.startsWith("sns:")) {
+			for (const record of stale) {
+				input.log(`   – forgot ${record.data?.endpoint}: '${connectionKey}' no longer names an SNS topic to unsubscribe it from`);
+				await input.forget(record.key);
+			}
+			continue;
+		}
+		const address = new URL(named);
+		address.searchParams.set("topicArn", topicArn);
+		const connection = await topicConnection({
+			connectionKey,
+			connectionString: address.toString(),
+			stage: input.stage,
+			env: input.env
+		});
+		const result = await reconcileHttpSubscriptions(connection, {
+			endpoints: members.pushes.map((push) => ({
+				name: push.name,
+				endpoint: push.endpoint,
+				...push.events ? { events: push.events } : {}
+			})),
+			ownedHost: host
+		});
+		await connection.close();
+		for (const push of members.pushes) {
+			const arn = result.subscriptions[push.name];
+			const key = subscriptionKey(push.worker, push.name);
+			if (input.recorded?.[key]?.id !== arn) input.log(`   ✓ '${push.name}' subscribed to ${topicArn.split(":").pop()} at ${push.endpoint}`);
+			await input.record(subscriptionResource({
+				worker: push.worker,
+				name: push.name,
+				topicArn,
+				endpoint: push.endpoint,
+				connectionKey: push.connectionKey,
+				pending: result.pending.includes(push.name),
+				...push.events ? { events: push.events } : {}
+			}, arn));
+			arns[push.worker] = {
+				...arns[push.worker],
+				[push.name]: arn
+			};
+		}
+		for (const arn of result.removed) input.log(`   – unsubscribed ${arn}: no subscriber wants it any more`);
+		for (const record of stale) await input.forget(record.key);
+	}
+	return arns;
+}
+//#endregion
 //#region src/target/compose/phases.ts
 /**
 * The compose target's phases: a stage as one Docker Compose stack behind
@@ -2415,8 +2593,9 @@ async function validateCompose(ctx, deps, options = {}) {
 		subscribers
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const recorded = push ? void 0 : await ctx.state.read(stage);
 	const layout = mode === "build" ? imageLayout(workspace) : void 0;
-	const composed = composeStack({
+	const input = {
 		workspace,
 		manifest,
 		runnables,
@@ -2435,9 +2614,24 @@ async function validateCompose(ctx, deps, options = {}) {
 		ports: edgePorts(deps.env),
 		...layout ? { layout } : {},
 		...push ? { buildOnly: true } : {}
+	};
+	const recordedArns = recordedPushSubscriptions(recorded?.resources);
+	const planned = push ? void 0 : composeStack({
+		...input,
+		recordingSubscriptions: true
+	});
+	const pushes = planned ? topicPushes(planned, manifest) : [];
+	const topics = planned && (pushes.length > 0 || recordedTopicSubscriptions(recorded?.resources).length > 0) ? {
+		pushes,
+		recorded: recorded?.resources
+	} : void 0;
+	const composed = topics && planned ? planned : composeStack({
+		...input,
+		pushSubscriptions: recordedArns
 	});
 	if (mode === "build") assertRedisClient(workspace, composed, manifest, runnables);
-	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
+	const pinned = (unpinned) => options.pin ? withPinnedImages(unpinned, options.pin.file, options.pin.digests) : unpinned;
+	const stack = pinned(composed);
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
 	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
@@ -2455,7 +2649,6 @@ async function validateCompose(ctx, deps, options = {}) {
 	const override = stackOverrideFile(root, stage);
 	const overrides = existsSync(override) ? [override] : [];
 	if (overrides.length > 0) ctx.logger.info(`🧩 Merging docker-compose.${stage}.yml over the generated stack`);
-	const recorded = push ? void 0 : await ctx.state.read(stage);
 	const previous = Object.fromEntries(Object.entries(recorded?.state.releases ?? {}).map(([name, releases]) => {
 		const { ref, tag, digest } = releases.current;
 		return [name, {
@@ -2468,6 +2661,20 @@ async function validateCompose(ctx, deps, options = {}) {
 		mode,
 		push,
 		stack,
+		...topics ? { topicSubscriptions: {
+			...topics,
+			restack: (arns) => {
+				const merged = { ...recordedArns };
+				for (const [worker, own] of Object.entries(arns)) merged[worker] = {
+					...merged[worker],
+					...own
+				};
+				return pinned(composeStack({
+					...input,
+					pushSubscriptions: merged
+				}));
+			}
+		} } : {},
 		...server ? { server } : {},
 		dir,
 		ref: {
@@ -2702,6 +2909,16 @@ async function planCompose(ctx, run) {
 			action: run.previous[worker.name] ? "reuse" : "create"
 		});
 	}
+	for (const push of run.topicSubscriptions?.pushes ?? []) {
+		const key = subscriptionKey(push.worker, push.name);
+		const id = run.topicSubscriptions?.recorded?.[key]?.id;
+		planned({
+			key,
+			resourceType: SUBSCRIPTION_TYPE,
+			action: id ? "reuse" : "create",
+			...id ? { id } : {}
+		});
+	}
 	if (!run.push) planned({
 		key: run.stack.proxy === "caddy" ? "service:caddy" : `service:${EDGE_PROJECT}/${EDGE_SERVICE}`,
 		resourceType: "service",
@@ -2714,7 +2931,7 @@ async function planCompose(ctx, run) {
 * migrations applied.
 */
 async function provisionCompose(ctx, run, deps) {
-	const { stack, ref } = run;
+	const { ref } = run;
 	if (run.push) return;
 	if (run.generated.length > 0 && run.secrets) {
 		await ctx.secrets.write(run.secrets);
@@ -2722,11 +2939,13 @@ async function provisionCompose(ctx, run, deps) {
 	}
 	const ports = edgePorts(deps.env);
 	await assertEdgePorts(deps.docker, {
-		project: stack.project,
-		proxy: stack.proxy,
+		project: run.stack.project,
+		proxy: run.stack.proxy,
 		ports,
 		engine: ref
 	});
+	if (run.topicSubscriptions) await subscribeTopics(ctx, run, deps);
+	const { stack } = run;
 	run.files = await writeStack(ctx.cwd, run.dir, stack);
 	printPlan(ctx, run);
 	if (stack.proxy === "traefik") {
@@ -2765,6 +2984,36 @@ async function provisionCompose(ctx, run, deps) {
 	if (stack.storage && stack.infra.includes("minio")) await prepareBuckets(ctx, run, deps);
 }
 /**
+* Subscribe each topic subscriber SNS pushes to — for a topic the stage set
+* to SNS by hand — record the ARNs, and compose the stack again with them,
+* before a file is written.
+*/
+async function subscribeTopics(ctx, run, deps) {
+	const { pushes, recorded, restack } = run.topicSubscriptions;
+	if (pushes.length > 0) ctx.logger.info("\n📮 SNS subscriptions for the stage's own topics");
+	run.stack = restack(await ensureTopicSubscriptions({
+		pushes,
+		recorded,
+		secrets: run.secrets?.custom ?? {},
+		stage: ctx.stage,
+		env: deps.env,
+		record: async (resource) => {
+			await ctx.state.putResource(ctx.stage, resource);
+			applied(ctx, run, {
+				key: resource.key,
+				resourceType: SUBSCRIPTION_TYPE,
+				action: "ensure",
+				id: resource.id,
+				via: recorded?.[resource.key]?.id === resource.id ? "recorded" : "created"
+			});
+		},
+		forget: async (key) => {
+			await ctx.state.deleteResource(ctx.stage, key);
+		},
+		log: (line) => ctx.logger.info(line)
+	}));
+}
+/**
 * Create each bucket the stack's MinIO serves, and the open paths of each
 * one a file server fronts — from this machine, on MinIO's loopback port,
 * the way `gkm dev` creates them.
@@ -2779,7 +3028,8 @@ async function prepareBuckets(ctx, run, deps) {
 		done = [
 			...await applyBuckets(client, storage.buckets),
 			...await applyPolicies(client, storage.policies),
-			...await applyLifecycles(client, storage.lifecycles)
+			...await applyLifecycles(client, storage.lifecycles),
+			...await applyNotifications(client, storage.objects, new Set(storage.webhooks.map((hook) => hook.bucket)))
 		];
 	} finally {
 		await tunnel.close();
@@ -3011,9 +3261,33 @@ async function verifyCompose(ctx, run, deps) {
 	}));
 	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down, stack.proxy);
 	await pruneStageDns(ctx, run);
+	await confirmSubscriptions(ctx, run, deps);
 	if (stack.logs) reportLogs(ctx, stack.logs, stack.local, run.server);
 }
 /**
+* The SNS subscriptions the stage's providers made before the workers were
+* up: each still pending is subscribed again, so SNS resends its
+* confirmation to a worker now there to answer it, and waited on. One still
+* pending after that is said, not failed on — every app is healthy, and
+* rolling them back would not confirm it.
+*/
+async function confirmSubscriptions(ctx, run, deps) {
+	const stored = await ctx.state.read(ctx.stage);
+	const left = await (deps.confirmSubscriptions ?? confirmPendingSubscriptions)({
+		workspace: ctx.workspace,
+		stage: ctx.stage,
+		secrets: run.secrets?.custom ?? {},
+		resources: stored?.resources,
+		env: deps.env,
+		log: (line) => ctx.logger.info(line),
+		record: async (record) => {
+			const { updatedAt: _, updatedBy: __, ...input } = record;
+			await ctx.state.putResource(ctx.stage, input);
+		}
+	});
+	if (left.length > 0) ctx.logger.warn(`⚠ ${new PushSubscriptionsUnconfirmed(left).message}`);
+}
+/**
 * A container's own health check, as Docker reports it: a worker's, which
 * has no route through the edge, and OpenObserve's — by default it has no
 * host there, and served publicly it answers only the addresses it allows,
@@ -3333,4 +3607,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { dockerCompose as C, sshTarget as S, parseDigests as _, edgePorts as a, dockerHost as b, edgeRef as c, composeStack as d, derivedCredentials as f, edgeAlias as g, EDGE_PROJECT as h, ComposePushNeedsBuild as i, removeEdgeRoutes as l, stackPlan as m, compose_exports as n, stackOverrideFile as o, stackDir as p, ComposePinNeedsPull as r, deployedStackSecrets as s, composeTarget as t, composeProject as u, pinnedRef as v, projectNetwork as w, sshAccess as x, composeServer as y };
 
-//# sourceMappingURL=compose-cHkF---f.mjs.map
+//# sourceMappingURL=compose-DJvvmF3X.mjs.map