@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.124

package/dist/{seeds-BWC-qjSI.cjs → seeds-DOfxmDRO.cjs}

@@ -1,14 +1,14 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_run = require("./run-fVZ-rLnc.cjs");
+const require_credentials = require("./credentials-D7XJypNd.cjs");
 const require_workspace = require("./workspace-C82GLPnf.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-C8CPxrCK.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-C3QTae-R.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-BDa6pPgE.cjs");
-const require_discover = require("./discover-DozUKs8f.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-B2MUa4M2.cjs");
+const require_discover = require("./discover-ojkcbxHw.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-AsfohXd1.cjs");
+const require_resolve = require("./resolve-C7GKQcE4.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -537,7 +537,7 @@ const EDGE_KINDS = {
 * Docker Desktop resolves this name already; on Linux the compose definition
 * maps it to the host gateway.
 */
-const HOST_GATEWAY = "host.docker.internal";
+const HOST_GATEWAY$1 = "host.docker.internal";
 /**
 * The suffix every local host shares.
 *
@@ -576,7 +576,7 @@ function sitesFor(plan, project, addresses = {}) {
 		if (!port) continue;
 		sites.push({
 			host,
-			upstream: `http://${HOST_GATEWAY}:${port}`
+			upstream: `http://${HOST_GATEWAY$1}:${port}`
 		});
 	}
 	return sites;
@@ -722,6 +722,108 @@ function emulatorQueueUrl(name, port) {
 	return `${emulatorEndpoint(port)}/${EMULATOR_ACCOUNT}/${name}`;
 }
 //#endregion
+//#region src/reconcile/objectEvents.ts
+/**
+* A bucket's object events, where the bucket is a local MinIO.
+*
+* S3 publishes a bucket's events to a topic the deploy creates; MinIO has no
+* topic to publish to, but it can post each event to a webhook. So where MinIO
+* holds a watched bucket, it posts the bucket's events to the process that
+* runs the bucket's subscribers, on a route only it can use, and that process
+* relays each one onto the events broker — under the bucket's name, as
+* `object.created` or `object.deleted` — where every subscriber drains a queue
+* of its own, as a topic's subscribers do.
+*
+* Declared to MinIO in two halves, both derived here so they cannot drift:
+*
+* - **a webhook target per bucket**, as container environment: where to post,
+*   the token to present, and a queue on disk, because MinIO starts before the
+*   process it posts to and must keep what it could not deliver;
+* - **the bucket's notification**, written through the S3 API once the bucket
+*   exists: every created and removed object, to that target. Unfiltered —
+*   two subscribers watching overlapping prefixes are two rules S3 refuses on
+*   one bucket, and each subscriber filters what it is handed anyway.
+*/
+/**
+* The token MinIO presents when it posts a bucket's events.
+*
+* Derived, never stored: the container and the process it posts to are handed
+* the same value by the same derivation — with the stage's random seed where a
+* deployed stage's stack has one, so the token is a secret there, and from the
+* project alone locally, where everything it would protect is on loopback.
+* Not salted by the stage: one MinIO serves `gkm dev` and `gkm test`, and a
+* target is declared once per container.
+*/
+function objectsWebhookToken(project, bucket, seed) {
+	return (0, node_crypto.createHash)("sha256").update(`${seed ? `${seed}:` : ""}${project}:objects-webhook:${bucket}`).digest("base64url").slice(0, 32);
+}
+/**
+* The target's id in MinIO's environment — `MINIO_NOTIFY_WEBHOOK_*_<ID>`.
+*
+* Upper-cased with nothing between words: a canonical id is letters and
+* digits, and an underscore inside the id would read as part of the setting's
+* name.
+*/
+function minioTargetId(bucket) {
+	return bucket.toUpperCase();
+}
+/** The target as a notification names it. */
+function minioTargetArn(bucket) {
+	return `arn:minio:sqs::${minioTargetId(bucket)}:webhook`;
+}
+/** How a container reaches a process on the host. */
+const HOST_GATEWAY = "host.docker.internal";
+/** Where MinIO keeps what it could not deliver yet, inside its container. */
+const QUEUE_ROOT = "/gkm-object-events";
+/** The id of the notification rule gkm owns on a bucket. */
+const NOTIFICATION_RULE_PREFIX = "gkm-";
+/**
+* MinIO's environment for each watched bucket's webhook target.
+*
+* Sorted, so the same buckets always render the same environment and a
+* reconcile that changed nothing does not recreate the container.
+*/
+function minioWebhookEnv(hooks) {
+	const env = {};
+	for (const hook of [...hooks].sort((a, b) => a.bucket.localeCompare(b.bucket))) {
+		const id = minioTargetId(hook.bucket);
+		env[`MINIO_NOTIFY_WEBHOOK_ENABLE_${id}`] = "on";
+		env[`MINIO_NOTIFY_WEBHOOK_ENDPOINT_${id}`] = hook.endpoint;
+		env[`MINIO_NOTIFY_WEBHOOK_AUTH_TOKEN_${id}`] = hook.token;
+		env[`MINIO_NOTIFY_WEBHOOK_QUEUE_DIR_${id}`] = `${QUEUE_ROOT}/${id.toLowerCase()}`;
+	}
+	return env;
+}
+/** The rule that sends every created and removed object to the bucket's target. */
+function minioNotificationRule(bucket) {
+	return {
+		Id: `${NOTIFICATION_RULE_PREFIX}${bucket}`,
+		QueueArn: minioTargetArn(bucket),
+		Events: ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"]
+	};
+}
+/**
+* Each watched bucket, and the workers that run one of its subscribers.
+*
+* A bucket is watched when a subscriber reads its events key. MinIO posts a
+* bucket's events to one place, and the relay fans them out to every
+* subscriber whichever worker received them — so one worker per bucket is
+* enough, and the first, by id, is the one chosen, so the choice is stable.
+*/
+function watchedBuckets(manifest, subscribers) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const declaration of Object.values(manifest)) {
+		if (declaration.kind !== "objects") continue;
+		byKey.set((0, _geekmidas_manifest.provideKey)(declaration.id, "eventsConnectionString"), declaration.id);
+	}
+	const watched = /* @__PURE__ */ new Map();
+	for (const worker of Object.keys(subscribers).sort()) for (const { connectionKey } of subscribers[worker] ?? []) {
+		const bucket = byKey.get(connectionKey);
+		if (bucket && !watched.has(bucket)) watched.set(bucket, worker);
+	}
+	return watched;
+}
+//#endregion
 //#region src/telemetry/edges.ts
 /**
 * Which processes use a `Telemetry` node — read off the manifest's edges.
@@ -1217,6 +1319,14 @@ function envFor(plan, options) {
 	}
 	Object.assign(env, publicEnv(plan, env, options.addresses));
 	Object.assign(env, brokerEnv(plan, options.ports, credential));
+	const relay = env.EVENT_PUBLISHER_CONNECTION_STRING;
+	if (relay && options.relayedBuckets?.length) for (const resource of plan.resources) {
+		if (resource.kind !== "objects" || resource.container !== "minio") continue;
+		if (!options.relayedBuckets.includes(resource.id)) continue;
+		if (!env[resource.envKey]) continue;
+		env[(0, _geekmidas_manifest.provideKey)(resource.id, "eventsConnectionString")] = relay;
+		env[(0, _geekmidas_manifest.provideKey)(resource.id, "eventsToken")] = objectsWebhookToken(options.project ?? "", resource.id, credential.seed);
+	}
 	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, storageCredentials(options.credentials));
 	return env;
 }
@@ -1869,7 +1979,7 @@ function folderName(path) {
 function getKeystoreDir(project) {
 	if (!PROJECT_KEY.test(project.key)) throw new KeystoreProjectInvalid(project.key);
 	const [namespace, name] = project.key.split("/");
-	return (0, node_path.join)(project.home ?? require_run.gkmHome(), "keys", namespace, name);
+	return (0, node_path.join)(project.home ?? require_credentials.gkmHome(), "keys", namespace, name);
 }
 /** Get the path to a stage's encryption key. */
 function getKeyPath(stage, project) {
@@ -1886,7 +1996,7 @@ function legacyKeyPaths(stage, project) {
 		key,
 		home: project.home
 	}));
-	const homes = [.../* @__PURE__ */ new Set([project.home ?? require_run.gkmHome(), (0, node_path.join)((0, node_os.homedir)(), ".gkm")])];
+	const homes = [.../* @__PURE__ */ new Set([project.home ?? require_credentials.gkmHome(), (0, node_path.join)((0, node_os.homedir)(), ".gkm")])];
 	const names = (project.legacy ?? []).filter(isLegacyName);
 	return [...aliases, ...names.flatMap((name) => homes.map((home) => (0, node_path.join)(home, name, `${stage}.key`)))];
 }
@@ -2140,7 +2250,7 @@ function localCredentialsPath(project) {
 	const keys = getKeystoreDir(project);
 	const name = keys.split(/[\\/]/).at(-1);
 	const namespace = keys.split(/[\\/]/).at(-2);
-	return (0, node_path.join)(project.home ?? require_run.gkmHome(), "local", namespace, `${name}.json`);
+	return (0, node_path.join)(project.home ?? require_credentials.gkmHome(), "local", namespace, `${name}.json`);
 }
 /** The local stage's logins file is there, and its key is not. */
 var LocalCredentialsKeyMissing = class extends require_errors.GkmError {
@@ -2584,6 +2694,56 @@ async function databasesExist(client, names) {
 	}
 }
 /**
+* Point each watched bucket's events at its webhook target, and stop sending
+* an unwatched one's.
+*
+* Merged rather than written whole: only the rule gkm owns on a bucket
+* (`gkm-<Bucket>`) is added or removed, and every other rule — one somebody
+* added by hand — is kept. Compared before writing, so a converged reconcile
+* changes nothing.
+*
+* @param buckets - each bucket the plan names, by construct id and name
+* @param watched - the construct ids whose events are relayed
+*/
+async function applyNotifications(client, buckets, watched) {
+	const applied = [];
+	for (const { id, name } of buckets) {
+		const current = await client.notification(name);
+		const queues = current.QueueConfigurations ?? [];
+		const others = queues.filter((rule) => !rule.Id?.startsWith(NOTIFICATION_RULE_PREFIX));
+		const wanted = watched.has(id) ? [...others, minioNotificationRule(id)] : others;
+		if (!watched.has(id) && others.length === queues.length) continue;
+		const describe = `object events from ${name}`;
+		const ours = queues.filter((rule) => rule.Id?.startsWith(NOTIFICATION_RULE_PREFIX));
+		if (watched.has(id) ? ours.length === 1 && sameRule(ours[0], minioNotificationRule(id)) : ours.length === 0) {
+			applied.push({
+				id: `${name}:events`,
+				describe,
+				created: false
+			});
+			continue;
+		}
+		await client.setNotification(name, {
+			...current,
+			QueueConfigurations: wanted
+		});
+		applied.push({
+			id: `${name}:events`,
+			describe,
+			created: true
+		});
+	}
+	return applied;
+}
+/**
+* Whether a rule read back says what gkm wrote: the same target, the same
+* events in any order, and no filter — the store may hand back an empty one.
+*/
+function sameRule(current, wanted) {
+	const filter = current.Filter;
+	return current.Id === wanted.Id && current.QueueArn === wanted.QueueArn && JSON.stringify([...current.Events ?? []].sort()) === JSON.stringify([...wanted.Events ?? []].sort()) && (filter?.Key?.FilterRules?.length ?? 0) === 0;
+}
+/**
 * Apply each bucket's expiry, beside whatever other rules it has, skipping
 * those already correct — the same merge the `s3` provider makes deployed.
 */
@@ -4291,6 +4451,14 @@ function composeFor(plan, options) {
 		const volume = volumeOf(container);
 		if (volume) volumes[volume] = {};
 	}
+	const minio = services.minio;
+	if (minio && options.objectWebhooks?.length) {
+		minio.environment = {
+			...minio.environment,
+			...minioWebhookEnv(options.objectWebhooks)
+		};
+		if (options.objectWebhooks.some((hook) => hook.endpoint.includes(`//host.docker.internal:`))) minio.extra_hosts = [`${HOST_GATEWAY}:host-gateway`];
+	}
 	return {
 		name: options.project,
 		services: {
@@ -4664,6 +4832,16 @@ function bucketClient(port, credentials) {
 				Bucket: bucket,
 				LifecycleConfiguration: { Rules: rules }
 			}));
+		},
+		async notification(bucket) {
+			const { $metadata: _, ...notification } = await s3.send(new _aws_sdk_client_s3.GetBucketNotificationConfigurationCommand({ Bucket: bucket }));
+			return notification;
+		},
+		async setNotification(bucket, notification) {
+			await s3.send(new _aws_sdk_client_s3.PutBucketNotificationConfigurationCommand({
+				Bucket: bucket,
+				NotificationConfiguration: notification
+			}));
 		}
 	};
 }
@@ -5500,7 +5678,8 @@ async function reconcile(options) {
 		project,
 		ports,
 		credentials: options.credentials,
-		...options.apps ? { apps: options.apps(plan.containers) } : {}
+		...options.apps ? { apps: options.apps(plan.containers) } : {},
+		...options.objectWebhooks?.length ? { objectWebhooks: options.objectWebhooks } : {}
 	});
 	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
 	const hash = planHash(plan, compose, {
@@ -5518,7 +5697,8 @@ async function reconcile(options) {
 			...options.mailFrom ? { mailFrom: options.mailFrom } : {},
 			...options.addresses ? { addresses: options.addresses } : {},
 			...lan ? { lanAddress: lan } : {},
-			...options.metroPorts ? { metroPorts: options.metroPorts } : {}
+			...options.metroPorts ? { metroPorts: options.metroPorts } : {},
+			...options.objectWebhooks?.length ? { relayedBuckets: options.objectWebhooks.map((hook) => hook.bucket) } : {}
 		});
 		const env = exports ? resolved : scopeTelemetryEnv(resolved, {
 			uses: false,
@@ -5575,7 +5755,7 @@ async function reconcile(options) {
 	};
 	const credentials = checked.credentials;
 	if (start && provision) options.progress?.("🗄️  Creating what the constructs declare — databases, roles, buckets, topics");
-	const provisioned = start && provision ? await create(plan, ports, credentials, sql, buckets, carriers, project) : [];
+	const provisioned = start && provision ? await create(plan, ports, credentials, sql, buckets, carriers, project, new Set(stage === (options.localStage ?? stage) ? (options.objectWebhooks ?? []).map((hook) => hook.bucket) : [])) : [];
 	await saveState(root, {
 		hash,
 		stage
@@ -5595,7 +5775,7 @@ async function reconcile(options) {
 * Idempotent throughout, so this runs on every non-converged reconcile rather
 * than being something to remember.
 */
-async function create(plan, ports, credentials, sql, buckets, emulatorCarriers, project) {
+async function create(plan, ports, credentials, sql, buckets, emulatorCarriers, project, watched) {
 	const applied = [];
 	const postgresPort = ports[primaryPortKey("postgres")];
 	const statements = postgresStatements(plan, project, credentials.seed);
@@ -5609,6 +5789,10 @@ async function create(plan, ports, credentials, sql, buckets, emulatorCarriers,
 		if (names.length > 0) applied.push(...await applyBuckets(client, names));
 		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
 		if (lifecycles.length > 0) applied.push(...await applyLifecycles(client, lifecycles));
+		if (names.length > 0) applied.push(...await applyNotifications(client, plan.resources.filter((r) => r.provisions && r.kind === "objects").map((r) => ({
+			id: r.id,
+			name: r.name
+		})), watched));
 	}
 	const emulatorPort = ports[primaryPortKey("localstack")];
 	const carriers = carrierNames(plan);
@@ -5674,6 +5858,7 @@ var workspace_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	constructGlobs: () => constructGlobs,
 	derivedContainers: () => derivedContainers,
 	fakesApply: () => fakesApply,
+	localObjectWebhooks: () => localObjectWebhooks,
 	metroPorts: () => metroPorts,
 	reconcileWorkspace: () => reconcileWorkspace,
 	surfaceAddresses: () => surfaceAddresses
@@ -5737,16 +5922,25 @@ function fakesApply(stage, fake, env = process.env) {
 */
 async function reconcileWorkspace(workspace, options) {
 	const runnables = {};
+	const background = {};
+	const subscribers = {};
 	const discovered = await require_discover.discover({
 		patterns: constructGlobs(workspace),
 		cwd: workspace.root,
-		runnables
+		runnables,
+		background,
+		subscribers
 	});
 	const manifest = options.manifest ?? discovered;
 	const faked = fakesApply(options.stage, options.fake);
 	const fakes = faked ? await require_SubscriberGenerator.readFakes(workspace.root, manifest) : {};
 	const credentialFakes = faked ? await require_SubscriberGenerator.readCredentialFakes(workspace.root, manifest) : {};
 	const { credentials } = await loadLocalCredentials(workspace);
+	const objectWebhooks = localObjectWebhooks(workspace, manifest, {
+		background,
+		subscribers,
+		seed: credentials.seed
+	});
 	const result = await reconcile({
 		credentials,
 		root: workspace.root,
@@ -5760,6 +5954,7 @@ async function reconcileWorkspace(workspace, options) {
 		metroPorts: metroPorts(workspace, manifest),
 		fakes,
 		credentialFakes,
+		...objectWebhooks.length > 0 ? { objectWebhooks } : {},
 		apps: (containers) => appServices(workspace, manifest, containers, credentials, runnables, fakes, credentialFakes),
 		...options.start === void 0 ? {} : { start: options.start },
 		...options.progress ? { progress: options.progress } : {}
@@ -5774,6 +5969,40 @@ async function reconcileWorkspace(workspace, options) {
 	};
 }
 /**
+* Where MinIO posts each watched bucket's events under `gkm dev`: the dev
+* server of the app that builds the worker running the bucket's subscribers,
+* on the host, on that app's port — the process that relays them onto the
+* broker.
+*
+* None where the broker is SNS: there a bucket's events come from a topic, and
+* nothing relays them. None for a worker no app can build — `gkm build` says
+* so; a dev loop has nothing to post to.
+*/
+function localObjectWebhooks(workspace, manifest, options) {
+	if (backendsOf(workspace).events === "sns") return [];
+	const watched = watchedBuckets(manifest, options.subscribers);
+	if (watched.size === 0) return [];
+	let units;
+	try {
+		units = workerUnits(workspace, manifest, options.background);
+	} catch (error) {
+		if (error instanceof WorkerHasNoApp) return [];
+		throw error;
+	}
+	const hooks = [];
+	for (const [bucket, worker] of watched) {
+		const app = units.find((unit) => unit.id === worker)?.app;
+		const port = app ? workspace.apps[app]?.port : void 0;
+		if (!port) continue;
+		hooks.push({
+			bucket,
+			endpoint: `http://${HOST_GATEWAY}:${port}${require_SubscriberGenerator.objectsRoute(bucket)}`,
+			token: objectsWebhookToken(workspace.name, bucket, options.seed)
+		});
+	}
+	return hooks;
+}
+/**
 * Where each mobile app's Metro runs: its app's port, which `gkm exec` hands
 * Expo as `RCT_METRO_PORT`. Kept apart from the surfaces' addresses — a phone
 * reaches Metro by `exp://`, not through the edge.
@@ -5968,6 +6197,14 @@ function workerEnvKeys(manifest, workerId, runnables = {}) {
 /** What each construct an edge reaches hands the process that reaches it. */
 function addEdgeKeys(manifest, edges, keys) {
 	for (const id of edges) {
+		const bucket = require_discover.eventsEdgeBucket(id);
+		if (bucket) {
+			if (manifest[bucket]?.kind === "objects") {
+				keys.add((0, _geekmidas_manifest.provideKey)(bucket, "eventsConnectionString"));
+				keys.add((0, _geekmidas_manifest.provideKey)(bucket, "eventsToken"));
+			}
+			continue;
+		}
 		const target = manifest[id];
 		if (!target) continue;
 		if (target.kind === "rest-api") {
@@ -7003,17 +7240,59 @@ async function answers(connection: unknown): Promise<boolean> {
   }
 }
 
+/** A request to a route this worker mounted, and what it answered. */
+export interface WorkerRequest {
+  headers: Record<string, string | string[] | undefined>;
+  body: string;
+}
+export interface WorkerAnswer {
+  status: number;
+  body: unknown;
+}
+
+// The routes something pushes to: an SNS subscriber's, and the one a local
+// object store posts a bucket's events to. Mounted by the subscribers, served
+// by the entry's HTTP server beside the health check.
+const routes = new Map<string, (c: any) => unknown>();
+const app = {
+  post: (path: string, handler: (c: any) => unknown) => {
+    routes.set(path, handler);
+  },
+};
+
+/** Run one mounted route, as the subscribers' handlers expect to be called. */
+async function route(path: string, request: WorkerRequest): Promise<WorkerAnswer | undefined> {
+  const handler = routes.get(path);
+  if (!handler) return undefined;
+  let answer: WorkerAnswer | undefined;
+  const c = {
+    req: {
+      text: async () => request.body,
+      header: (name: string) => {
+        const value = request.headers[name.toLowerCase()];
+        return Array.isArray(value) ? value[0] : value;
+      },
+    },
+    json: (body: unknown, status = 200) => {
+      answer = { status, body };
+      return answer;
+    },
+  };
+  await handler(c);
+  return answer ?? { status: 204, body: null };
+}
+
 /** Start everything this worker runs. */
 export async function startWorker(): Promise<{
   health: () => Promise<WorkerHealth>;
   stop: () => Promise<void>;
+  route: typeof route;
+  /** Subscribe the pushed routes, once the server answers on \`port\`. */
+  subscribeForPush: (port: number) => Promise<void>;
 }> {
-  // An app object with no routes: on a server target nothing is pushed to a
-  // subscriber, so there is nothing to mount.
-  const noRoutes = { post: () => undefined };
-
-  await setupSubscribers(noRoutes, envParser, logger).catch((error) => {
+  const subscribeForPush = await setupSubscribers(app, envParser, logger).catch((error) => {
     logger.error({ err: error }, 'Failed to start subscribers');
+    return async (_port: number) => {};
   });
   await setupQueues(envParser, logger).catch((error) => {
     logger.error({ err: error }, 'Failed to start queue consumers');
@@ -7025,6 +7304,8 @@ export async function startWorker(): Promise<{
   const statuses = () => [subscribersStatus(), queuesStatus(), cronsStatus()];
 
   return {
+    route,
+    subscribeForPush,
     async health() {
       const all = statuses();
       const failed = all.flatMap((s) => s.failed);
@@ -7055,8 +7336,10 @@ function workerEntry(healthCheck) {
  * Generated by 'gkm build --production'.
  *
  * Runs this worker's crons, queue consumers and topic subscribers, and serves
- * one route: ${healthCheck}, on PORT — 200 when every consumer started and
- * every broker connection answers, 503 otherwise.
+ * its health check: ${healthCheck}, on PORT — 200 when every consumer started
+ * and every broker connection answers, 503 otherwise. Beside it, on the same
+ * port, the POST routes its subscribers mounted: where a local object store
+ * posts a bucket's events.
  *
  * On SIGTERM it stops pulling messages and scheduling crons, lets the handlers
  * in flight finish, closes its broker connections and database pools, and
@@ -7075,15 +7358,39 @@ let worker: Awaited<ReturnType<typeof startWorker>> | undefined;
 let stopping = false;
 
 const server = createServer((req, res) => {
-  const path = (req.url ?? '/').split('?')[0];
-  if (path !== ${JSON.stringify(healthCheck)} || (req.method !== 'GET' && req.method !== 'HEAD')) {
-    res.writeHead(404).end();
-    return;
-  }
+  const path = (req.url ?? '/').split('?')[0] ?? '/';
   const answer = (status: number, body: unknown) => {
     res.writeHead(status, { 'content-type': 'application/json' });
     res.end(JSON.stringify(body));
   };
+
+  // A route a subscriber mounted: what SNS pushes to, or what a local object
+  // store posts a bucket's events to. Refused while starting or stopping, so
+  // the sender keeps the message and sends it again.
+  if (req.method === 'POST') {
+    let body = '';
+    req.setEncoding('utf8');
+    req.on('data', (chunk) => {
+      body += chunk;
+    });
+    req.on('end', () => {
+      if (stopping) return answer(503, { status: 'stopping' });
+      if (!worker) return answer(503, { status: 'starting' });
+      worker.route(path, { headers: req.headers, body }).then(
+        (routed) => (routed ? answer(routed.status, routed.body) : answer(404, { status: 'not found' })),
+        (error) => {
+          logger.error({ err: error, path }, 'Route failed');
+          answer(500, { status: 'failed' });
+        },
+      );
+    });
+    return;
+  }
+
+  if (path !== ${JSON.stringify(healthCheck)} || (req.method !== 'GET' && req.method !== 'HEAD')) {
+    res.writeHead(404).end();
+    return;
+  }
   if (stopping) return answer(503, { status: 'stopping' });
   if (!worker) return answer(503, { status: 'starting' });
   worker.health().then(
@@ -7117,6 +7424,9 @@ process.on('SIGINT', shutdown);
 
 worker = await startWorker();
 logger.info({ port }, 'Worker started');
+await worker.subscribeForPush(port).catch((error) => {
+  logger.error({ err: error }, 'Failed to subscribe for push');
+});
 `;
 }
 //#endregion
@@ -7174,7 +7484,7 @@ async function buildDockerImage(app, buildRoot, options) {
 	const fullImageName = validateImageRef(registry ? `${registry}/${app.imageName}:${tag}` : `${app.imageName}:${tag}`);
 	logger$1.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	try {
-		await require_run.run("docker", [
+		await require_credentials.run("docker", [
 			"build",
 			`--file=${(0, node_path.relative)(buildRoot, app.dockerfile)}`,
 			`--tag=${fullImageName}`,
@@ -7201,7 +7511,7 @@ async function pushDockerImage(imageName, options, cwd) {
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
 	logger$1.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
-		await require_run.run("docker", ["push", fullImageName], { cwd });
+		await require_credentials.run("docker", ["push", fullImageName], { cwd });
 		logger$1.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
@@ -7485,7 +7795,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-DR1iws1P.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-OdQmKXE3.cjs"));
 		return new HostingerProvider(options.hostinger);
 	}
 	if (provider === "route53") {
@@ -7498,7 +7808,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-Dubq-pCc.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-0z5RAN1k.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8575,6 +8885,12 @@ Object.defineProperty(exports, "applyLifecycles", {
 		return applyLifecycles;
 	}
 });
+Object.defineProperty(exports, "applyNotifications", {
+	enumerable: true,
+	get: function() {
+		return applyNotifications;
+	}
+});
 Object.defineProperty(exports, "applyPolicies", {
 	enumerable: true,
 	get: function() {
@@ -8959,6 +9275,12 @@ Object.defineProperty(exports, "mergeLifecycle", {
 		return mergeLifecycle;
 	}
 });
+Object.defineProperty(exports, "minioWebhookEnv", {
+	enumerable: true,
+	get: function() {
+		return minioWebhookEnv;
+	}
+});
 Object.defineProperty(exports, "networkEnv", {
 	enumerable: true,
 	get: function() {
@@ -9283,6 +9605,12 @@ Object.defineProperty(exports, "verifyDnsRecords", {
 		return verifyDnsRecords;
 	}
 });
+Object.defineProperty(exports, "watchedBuckets", {
+	enumerable: true,
+	get: function() {
+		return watchedBuckets;
+	}
+});
 Object.defineProperty(exports, "withCustomSecret", {
 	enumerable: true,
 	get: function() {
@@ -9350,4 +9678,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-BWC-qjSI.cjs.map
+//# sourceMappingURL=seeds-DOfxmDRO.cjs.map