@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.124

package/dist/{compose-ChVvb3xM.cjs → compose-BfXXWJSp.cjs}

@@ -1,15 +1,15 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_run = require("./run-fVZ-rLnc.cjs");
+const require_credentials = require("./credentials-D7XJypNd.cjs");
 const require_workspace = require("./workspace-C82GLPnf.cjs");
-const require_dns = require("./dns-Bmnuttja.cjs");
+const require_snsSubscriptions = require("./snsSubscriptions-CSkteK2J.cjs");
 const require_define = require("./define-crmMcXFS.cjs");
-const require_seeds = require("./seeds-BWC-qjSI.cjs");
+const require_seeds = require("./seeds-DOfxmDRO.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-C8CPxrCK.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-C3QTae-R.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_discover = require("./discover-DozUKs8f.cjs");
-const require_drivers = require("./drivers-DbjiYpW6.cjs");
+const require_discover = require("./discover-ojkcbxHw.cjs");
+const require_drivers = require("./drivers-CQ32PB5w.cjs");
 const require_databases = require("./databases-fOaoBInm.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -235,16 +235,16 @@ const dockerCompose = {
 		};
 	},
 	async build(stack, services) {
-		await require_run.run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
+		await require_credentials.run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
 			...process.env,
 			DOCKER_BUILDKIT: "1"
 		}));
 	},
 	async pull(stack, services) {
-		await require_run.run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
+		await require_credentials.run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
 	},
 	async up(stack, services) {
-		await require_run.run("docker", compose(stack, [
+		await require_credentials.run("docker", compose(stack, [
 			"up",
 			"-d",
 			"--wait",
@@ -254,11 +254,11 @@ const dockerCompose = {
 		]), runOptions(stack));
 	},
 	async down(stack) {
-		await require_run.run("docker", compose(stack, ["down"]), runOptions(stack));
+		await require_credentials.run("docker", compose(stack, ["down"]), runOptions(stack));
 	},
 	async port(stack, service, inside) {
 		const env = engineEnv(stack);
-		const output = await require_run.runOutput("docker", compose(stack, [
+		const output = await require_credentials.runOutput("docker", compose(stack, [
 			"port",
 			service,
 			String(inside)
@@ -284,14 +284,14 @@ const dockerCompose = {
 	},
 	async copyOut(stack, service, from, to) {
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
-		await require_run.run("docker", compose(stack, [
+		await require_credentials.run("docker", compose(stack, [
 			"cp",
 			`${service}:${from}`,
 			to
 		]), runOptions(stack));
 	},
 	async push(stack, ref) {
-		const output = await require_run.runOutput("docker", ["push", ref], {
+		const output = await require_credentials.runOutput("docker", ["push", ref], {
 			cwd: stack.cwd,
 			...stack.signal ? { signal: stack.signal } : {}
 		});
@@ -1443,9 +1443,20 @@ function composeStack(input) {
 			...credential.containers.minio,
 			buckets,
 			policies: require_seeds.bucketPolicies(plan).filter((p) => buckets.includes(p.bucket)),
+			objects: services.minio.map((id) => ({
+				id,
+				name: byId.get(id)?.name
+			})).filter((b) => Boolean(b.name)).sort((a, b) => a.name.localeCompare(b.name)),
+			webhooks: [],
 			lifecycles: require_seeds.bucketLifecycles(plan).filter((l) => buckets.includes(l.bucket))
 		};
 	})() : void 0;
+	const bucketEventKeys = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		if (resource.kind !== "objects") continue;
+		bucketEventKeys.set((0, _geekmidas_manifest.provideKey)(resource.id, "eventsConnectionString"), resource.id);
+		bucketEventKeys.set((0, _geekmidas_manifest.provideKey)(resource.id, "eventsToken"), resource.id);
+	}
 	const fileServers = /* @__PURE__ */ new Map();
 	if (storage) for (const resource of plan.resources) {
 		if (resource.kind !== "file-server" || !resource.of) continue;
@@ -1490,7 +1501,8 @@ function composeStack(input) {
 		project: workspace.name,
 		credentials: credential.containers,
 		seed: credential.seed,
-		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
+		...!local && domain ? { mailFrom: `noreply@${domain}` } : {},
+		relayedBuckets: [...require_seeds.watchedBuckets(manifest, input.subscribers ?? {}).keys()].filter((bucket) => services.minio.includes(bucket))
 	};
 	const outside = require_seeds.networkEnv(plan, {
 		...derivation,
@@ -1508,6 +1520,11 @@ function composeStack(input) {
 	*/
 	const valueFor = (app, key, owner) => {
 		if (require_workspace.isReservedStageKey(key)) return void 0;
+		const watching = bucketEventKeys.get(key);
+		if (watching) {
+			if (custom[key] !== void 0) return custom[key];
+			return services.minio.includes(watching) ? outside[key] : void 0;
+		}
 		if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) return;
 		if (owner && SERVICE_KINDS[owner.kind]) {
 			if (custom[key] !== void 0) return custom[key];
@@ -1609,13 +1626,28 @@ function composeStack(input) {
 				serviceName: worker.name,
 				...telemetryValues ? { telemetry: telemetryValues } : {}
 			}),
-			...push ? { [SUBSCRIBER_PUSH_URL_KEY]: push.url } : {},
+			...push && !input.recordingSubscriptions ? { [require_SubscriberGenerator.SNS_SUBSCRIPTIONS_KEY]: recordedSubscriptions(worker, push, input.pushSubscriptions?.[worker.id]) } : {},
 			NODE_ENV: "production",
 			PORT: String(worker.port),
 			STAGE: stage
 		};
 		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
 	}
+	if (storage && !input.buildOnly) {
+		const watched = require_seeds.watchedBuckets(manifest, input.subscribers ?? {});
+		for (const [bucket, workerId] of watched) {
+			if (!services.minio.includes(bucket)) continue;
+			const worker = workers.find((w) => w.id === workerId);
+			const relay = worker?.env?.[(0, _geekmidas_manifest.provideKey)(bucket, "eventsConnectionString")];
+			const token = worker?.env?.[(0, _geekmidas_manifest.provideKey)(bucket, "eventsToken")];
+			if (!worker || !relay || relay.startsWith("sns:") || !token) continue;
+			storage.webhooks.push({
+				bucket,
+				endpoint: `http://${hostOf(worker.name)}:${worker.port}${require_SubscriberGenerator.objectsRoute(bucket)}`,
+				token
+			});
+		}
+	}
 	const deployedTls = certificate ? {
 		kind: "files",
 		...proxy === "caddy" ? {
@@ -1624,8 +1656,8 @@ function composeStack(input) {
 		} : edgeCertificatePaths(project)
 	} : { kind: "acme" };
 	const tls = local ? { kind: "internal" } : deployedTls;
-	const backupsChoice = input.buildOnly ? void 0 : require_dns.stageBackups(workspace, manifest, stage);
-	const backups = backupsChoice?.mode === "on" && infra.includes("postgres") ? require_dns.stackBackups({
+	const backupsChoice = input.buildOnly ? void 0 : require_snsSubscriptions.stageBackups(workspace, manifest, stage);
+	const backups = backupsChoice?.mode === "on" && infra.includes("postgres") ? require_snsSubscriptions.stackBackups({
 		workspace,
 		stage,
 		project,
@@ -1659,8 +1691,8 @@ function composeStack(input) {
 	});
 	if (!local) {
 		const sites = apps.filter((app) => app.kind === "site");
-		const chosen = require_dns.passwordSites(workspace, stage, sites.map((app) => app.name));
-		for (const app of sites) if (chosen.includes(app.name)) app.auth = require_dns.siteAuth(stage, app.name, custom);
+		const chosen = require_snsSubscriptions.passwordSites(workspace, stage, sites.map((app) => app.name));
+		for (const app of sites) if (chosen.includes(app.name)) app.auth = require_snsSubscriptions.siteAuth(stage, app.name, custom);
 	}
 	const routes = [
 		...apps.map((app) => ({
@@ -1795,29 +1827,61 @@ function stackApps(workspace, manifest, plan, options) {
 	}
 	return apps.sort((a, b) => a.name.localeCompare(b.name));
 }
-/** What the worker reads the public base of its push routes from. */
-const SUBSCRIBER_PUSH_URL_KEY = "GKM_SUBSCRIBER_PUSH_URL";
 /**
 * Where SNS pushes to a worker on a deployed stage, or nothing when it pushes
 * to none of its subscribers.
 *
-* A subscriber is pushed to when its topic's connection string, as this stage
-* resolved it for the worker, is an SNS one — the same test the worker's own
+* A subscriber is pushed to when the connection string its deliveries come
+* from — its topic's, or its bucket's events — as this stage resolved it for
+* the worker, is an SNS one — the same test the worker's own
 * startup makes, so the edge exposes a route exactly when the worker mounts
 * it. Each such route, and nothing else the worker serves, answers on
 * `<worker>.<domain>`.
 */
 function workerPush(worker, subscribers, env, options) {
-	const paths = subscribers.filter(({ topic }) => env[(0, _geekmidas_manifest.provideKey)(topic, "publisherConnectionString")]?.startsWith("sns:")).map(({ name }) => require_SubscriberGenerator.subscriberRoute(name)).sort();
-	if (paths.length === 0) return void 0;
+	const pushed = subscribers.filter(({ connectionKey }) => env[connectionKey]?.startsWith("sns:")).filter((subscriber, index, all) => all.findIndex((s) => s.name === subscriber.name) === index).sort((a, b) => a.name.localeCompare(b.name));
+	if (pushed.length === 0) return void 0;
 	if (!options.domain) throw new require_seeds.NoDomainForStage(options.stage);
 	const host = `${worker.name}.${options.domain}`;
+	const url = `https://${host}`;
 	return {
 		host,
-		url: `https://${host}`,
-		paths: [...new Set(paths)]
+		url,
+		paths: pushed.map(({ name }) => require_SubscriberGenerator.subscriberRoute(name)),
+		subscribers: pushed.map(({ name, connectionKey, events }) => ({
+			name,
+			connectionKey,
+			endpoint: `${url}${require_SubscriberGenerator.subscriberRoute(name)}`,
+			...events ? { events } : {}
+		}))
 	};
 }
+/** A pushed subscriber the deploy recorded no SNS subscription for. */
+var PushSubscriptionMissing = class extends require_errors.GkmError {
+	worker;
+	subscriber;
+	constructor(worker, subscriber) {
+		super(`SNS pushes to '${subscriber}' on the worker '${worker}', and the deploy recorded no subscription for it, so the worker would mount no route and SNS would deliver nowhere. Deploy the stage, which subscribes each pushed subscriber and records its ARN.`);
+		this.worker = worker;
+		this.subscriber = subscriber;
+		this.name = "PushSubscriptionMissing";
+	}
+};
+/**
+* The worker's `GKM_SNS_SUBSCRIPTIONS`: each pushed subscriber's recorded
+* subscription ARN, and nothing for a subscriber it does not run.
+*
+* @throws {PushSubscriptionMissing} when one has none
+*/
+function recordedSubscriptions(worker, push, recorded = {}) {
+	const arns = {};
+	for (const { name } of push.subscribers) {
+		const arn = recorded[name];
+		if (!arn) throw new PushSubscriptionMissing(worker.name, name);
+		arns[name] = arn;
+	}
+	return JSON.stringify(arns);
+}
 /** Two constructs the edge would answer on one host. */
 var EdgeHostTaken = class extends require_errors.GkmError {
 	host;
@@ -1897,13 +1961,14 @@ function stackFile(options) {
 		minio.environment = {
 			...minio.environment,
 			MINIO_ROOT_USER: options.storage.user,
-			MINIO_ROOT_PASSWORD: options.storage.password
+			MINIO_ROOT_PASSWORD: options.storage.password,
+			...require_seeds.minioWebhookEnv(options.storage.webhooks)
 		};
 		minio.ports = ["127.0.0.1::9000"];
 	}
 	if (services["redis"] && options.redis) services[require_seeds.REDIS_SERVICE] = require_seeds.redisService(options.redis);
 	if (options.logs) services[require_seeds.LOGS_SERVICE] = require_seeds.logsService(options.logs);
-	if (options.backups) services[require_dns.BACKUPS_SERVICE] = require_dns.backupsService(options.backups, options.envFiles);
+	if (options.backups) services[require_snsSubscriptions.BACKUPS_SERVICE] = require_snsSubscriptions.backupsService(options.backups, options.envFiles);
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
 		...app.build ? { build: {
@@ -2185,7 +2250,7 @@ function deployedStackSecrets(workspace, stage, stored, manifest) {
 		secrets: withLogs.secrets,
 		generated: []
 	};
-	const withSites = require_dns.withSitePasswords(withRedis.secrets, require_dns.passwordSites(workspace, stage, require_dns.siteNames(manifest)));
+	const withSites = require_snsSubscriptions.withSitePasswords(withRedis.secrets, require_snsSubscriptions.passwordSites(workspace, stage, require_snsSubscriptions.siteNames(manifest)));
 	return {
 		secrets: withSites.secrets,
 		generated: [
@@ -2265,6 +2330,119 @@ var ComposeAppsUnhealthy = class extends require_errors.GkmError {
 	}
 };
 //#endregion
+//#region src/target/compose/topicSubscriptions.ts
+/**
+* Every topic subscriber the stack pushes to: a subscriber whose connection
+* key is a topic's publisher string — a bucket's events key is not — and
+* whose value on this stage is an SNS one.
+*/
+function topicPushes(stack, manifest) {
+	const topicKeys = new Set(Object.values(manifest).filter((declaration) => declaration.kind === "topic").map((topic) => (0, _geekmidas_manifest.provideKey)(topic.id, "publisherConnectionString")));
+	const pushes = [];
+	for (const worker of stack.workers) for (const subscriber of worker.push?.subscribers ?? []) {
+		if (!topicKeys.has(subscriber.connectionKey)) continue;
+		const connectionString = worker.env?.[subscriber.connectionKey];
+		if (!connectionString?.startsWith("sns:")) continue;
+		pushes.push({
+			worker: worker.id,
+			name: subscriber.name,
+			endpoint: subscriber.endpoint,
+			connectionKey: subscriber.connectionKey,
+			connectionString,
+			...subscriber.events ? { events: subscriber.events } : {}
+		});
+	}
+	return pushes;
+}
+/** The subscriptions recorded for hand-set topics: those with a key. */
+function recordedTopicSubscriptions(resources) {
+	return Object.values(resources ?? {}).filter((record) => record.type === "sns-subscription" && typeof record.data?.connectionKey === "string");
+}
+/**
+* Converge each hand-set topic's subscriptions on the subscribers pushed to:
+* subscribe, bring filters up to date, unsubscribe a route on the worker's
+* host no subscriber wants any more — and record each ARN, forgetting what
+* was removed.
+*
+* @returns each worker's subscriptions, by export — what it is handed
+*/
+async function ensureTopicSubscriptions(input) {
+	const { snsUrl, reconcileHttpSubscriptions } = await import("@geekmidas/events/sns");
+	const groups = /* @__PURE__ */ new Map();
+	const group = (topicArn, host, connectionKey) => {
+		const id = `${topicArn}|${host}`;
+		const found = groups.get(id);
+		if (found) return found;
+		const created = {
+			topicArn,
+			host,
+			connectionKey,
+			pushes: [],
+			recorded: []
+		};
+		groups.set(id, created);
+		return created;
+	};
+	for (const push of input.pushes) {
+		const { topicArn } = snsUrl.parse(push.connectionString);
+		const into = group(topicArn, new URL(push.endpoint).host, push.connectionKey);
+		into.connectionString = push.connectionString;
+		into.pushes.push(push);
+	}
+	for (const record of recordedTopicSubscriptions(input.recorded)) group(String(record.data?.topicArn), new URL(String(record.data?.endpoint)).host, String(record.data?.connectionKey)).recorded.push(record);
+	const wanted = new Set(input.pushes.map(({ worker, name }) => require_snsSubscriptions.subscriptionKey(worker, name)));
+	const arns = {};
+	for (const { topicArn, host, connectionKey, ...members } of groups.values()) {
+		const stale = members.recorded.filter((r) => !wanted.has(r.key));
+		const named = members.connectionString ?? input.secrets[connectionKey];
+		if (!named?.startsWith("sns:")) {
+			for (const record of stale) {
+				input.log(`   – forgot ${record.data?.endpoint}: '${connectionKey}' no longer names an SNS topic to unsubscribe it from`);
+				await input.forget(record.key);
+			}
+			continue;
+		}
+		const address = new URL(named);
+		address.searchParams.set("topicArn", topicArn);
+		const connection = await require_snsSubscriptions.topicConnection({
+			connectionKey,
+			connectionString: address.toString(),
+			stage: input.stage,
+			env: input.env
+		});
+		const result = await reconcileHttpSubscriptions(connection, {
+			endpoints: members.pushes.map((push) => ({
+				name: push.name,
+				endpoint: push.endpoint,
+				...push.events ? { events: push.events } : {}
+			})),
+			ownedHost: host
+		});
+		await connection.close();
+		for (const push of members.pushes) {
+			const arn = result.subscriptions[push.name];
+			const key = require_snsSubscriptions.subscriptionKey(push.worker, push.name);
+			if (input.recorded?.[key]?.id !== arn) input.log(`   ✓ '${push.name}' subscribed to ${topicArn.split(":").pop()} at ${push.endpoint}`);
+			await input.record(require_snsSubscriptions.subscriptionResource({
+				worker: push.worker,
+				name: push.name,
+				topicArn,
+				endpoint: push.endpoint,
+				connectionKey: push.connectionKey,
+				pending: result.pending.includes(push.name),
+				...push.events ? { events: push.events } : {}
+			}, arn));
+			arns[push.worker] = {
+				...arns[push.worker],
+				[push.name]: arn
+			};
+		}
+		for (const arn of result.removed) input.log(`   – unsubscribed ${arn}: no subscriber wants it any more`);
+		for (const record of stale) await input.forget(record.key);
+	}
+	return arns;
+}
+//#endregion
 //#region src/target/compose/phases.ts
 /**
 * The compose target's phases: a stage as one Docker Compose stack behind
@@ -2344,7 +2522,7 @@ function stackOverrideFile(root, stage) {
 async function gitRevision(root) {
 	let sha;
 	try {
-		sha = (await require_run.runOutput("git", [
+		sha = (await require_credentials.runOutput("git", [
 			"rev-parse",
 			"--short",
 			"HEAD"
@@ -2353,7 +2531,7 @@ async function gitRevision(root) {
 		throw new NoGitRevision(root);
 	}
 	if (!sha) throw new NoGitRevision(root);
-	return (await require_run.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+	return (await require_credentials.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
 }
 /** The edge's ports, from the environment — 443 and 80 when unset. */
 function edgePorts(env = process.env) {
@@ -2387,7 +2565,7 @@ const defaultDeps = {
 	healthAttempts: 90,
 	healthIntervalMs: 2e3,
 	env: process.env,
-	lookup: require_dns.systemLookup,
+	lookup: require_snsSubscriptions.systemLookup,
 	server: sshAccess
 };
 /**
@@ -2415,8 +2593,9 @@ async function validateCompose(ctx, deps, options = {}) {
 		subscribers
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const recorded = push ? void 0 : await ctx.state.read(stage);
 	const layout = mode === "build" ? require_seeds.imageLayout(workspace) : void 0;
-	const composed = composeStack({
+	const input = {
 		workspace,
 		manifest,
 		runnables,
@@ -2435,16 +2614,31 @@ async function validateCompose(ctx, deps, options = {}) {
 		ports: edgePorts(deps.env),
 		...layout ? { layout } : {},
 		...push ? { buildOnly: true } : {}
+	};
+	const recordedArns = require_snsSubscriptions.recordedPushSubscriptions(recorded?.resources);
+	const planned = push ? void 0 : composeStack({
+		...input,
+		recordingSubscriptions: true
+	});
+	const pushes = planned ? topicPushes(planned, manifest) : [];
+	const topics = planned && (pushes.length > 0 || recordedTopicSubscriptions(recorded?.resources).length > 0) ? {
+		pushes,
+		recorded: recorded?.resources
+	} : void 0;
+	const composed = topics && planned ? planned : composeStack({
+		...input,
+		pushSubscriptions: recordedArns
 	});
 	if (mode === "build") assertRedisClient(workspace, composed, manifest, runnables);
-	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
+	const pinned = (unpinned) => options.pin ? withPinnedImages(unpinned, options.pin.file, options.pin.digests) : unpinned;
+	const stack = pinned(composed);
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
 	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
 		ctx.secrets.mask(stack.logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS);
 	}
-	if (!push && !stack.local) require_dns.requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+	if (!push && !stack.local) require_snsSubscriptions.requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
 	const server = push ? void 0 : composeServer({
 		stage,
 		local: stack.local,
@@ -2455,7 +2649,6 @@ async function validateCompose(ctx, deps, options = {}) {
 	const override = stackOverrideFile(root, stage);
 	const overrides = (0, node_fs.existsSync)(override) ? [override] : [];
 	if (overrides.length > 0) ctx.logger.info(`🧩 Merging docker-compose.${stage}.yml over the generated stack`);
-	const recorded = push ? void 0 : await ctx.state.read(stage);
 	const previous = Object.fromEntries(Object.entries(recorded?.state.releases ?? {}).map(([name, releases]) => {
 		const { ref, tag, digest } = releases.current;
 		return [name, {
@@ -2468,6 +2661,20 @@ async function validateCompose(ctx, deps, options = {}) {
 		mode,
 		push,
 		stack,
+		...topics ? { topicSubscriptions: {
+			...topics,
+			restack: (arns) => {
+				const merged = { ...recordedArns };
+				for (const [worker, own] of Object.entries(arns)) merged[worker] = {
+					...merged[worker],
+					...own
+				};
+				return pinned(composeStack({
+					...input,
+					pushSubscriptions: merged
+				}));
+			}
+		} } : {},
 		...server ? { server } : {},
 		dir,
 		ref: {
@@ -2501,7 +2708,7 @@ async function readyCompose(ctx, run, deps) {
 	}
 	if (stack.local) return;
 	if (run.server && !ctx.dryRun && !run.push) await deps.server.check(run.server);
-	const prune = await stageHostsDns(ctx, deps, require_dns.stackHosts(stack).filter((host) => !require_dns.isLocalHost(host)), run.secrets?.custom);
+	const prune = await stageHostsDns(ctx, deps, require_snsSubscriptions.stackHosts(stack).filter((host) => !require_snsSubscriptions.isLocalHost(host)), run.secrets?.custom);
 	if (prune) run.pruneDns = prune;
 }
 /** A stack whose caches are in Redis, built for an app that has no client. */
@@ -2544,21 +2751,21 @@ function assertRedisClient(workspace, stack, manifest, runnables) {
 */
 async function stageHostsDns(ctx, deps, hosts, custom) {
 	const { workspace, stage } = ctx;
-	const server = require_dns.requiredServerAddress(stage, workspace.domains?.[stage], custom);
+	const server = require_snsSubscriptions.requiredServerAddress(stage, workspace.domains?.[stage], custom);
 	if (hosts.length === 0) return;
 	if (ctx.skipDns) {
 		ctx.logger.info("🌐 DNS skipped (--skip-dns): no record is written or checked");
 		return;
 	}
 	if (!server) {
-		ctx.logger.info(`🌐 DNS skipped: no ${require_workspace.SERVER_IPV4_KEY} in '${stage}''s secrets — ${require_dns.serverAddressHint(stage)}`);
+		ctx.logger.info(`🌐 DNS skipped: no ${require_workspace.SERVER_IPV4_KEY} in '${stage}''s secrets — ${require_snsSubscriptions.serverAddressHint(stage)}`);
 		return;
 	}
 	const log = (line) => ctx.logger.info(line);
 	if (workspace.dns) log(`🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${ctx.dryRun ? " (dry run — nothing is written)" : ""}`);
 	try {
 		const stored = await ctx.state.read(stage);
-		const result = await require_dns.stageDns({
+		const result = await require_snsSubscriptions.stageDns({
 			stage,
 			hosts,
 			server,
@@ -2566,7 +2773,7 @@ async function stageHostsDns(ctx, deps, hosts, custom) {
 			recorded: require_seeds.dnsResources(stored?.resources ?? {}),
 			credentials: ctx.credentials,
 			log,
-			lookup: deps.lookup ?? require_dns.systemLookup,
+			lookup: deps.lookup ?? require_snsSubscriptions.systemLookup,
 			...ctx.dryRun ? { dryRun: true } : {},
 			...deps.dnsProviderFor ? { providerFor: deps.dnsProviderFor } : {}
 		});
@@ -2583,7 +2790,7 @@ async function stageHostsDns(ctx, deps, hosts, custom) {
 		}
 		return result.recorded.stale.length > 0 ? result.prune : void 0;
 	} catch (error) {
-		if (ctx.dryRun && error instanceof require_dns.HostNotPointingAtServer) {
+		if (ctx.dryRun && error instanceof require_snsSubscriptions.HostNotPointingAtServer) {
 			ctx.logger.warn(`⚠ ${error.message}`);
 			return;
 		}
@@ -2702,6 +2909,16 @@ async function planCompose(ctx, run) {
 			action: run.previous[worker.name] ? "reuse" : "create"
 		});
 	}
+	for (const push of run.topicSubscriptions?.pushes ?? []) {
+		const key = require_snsSubscriptions.subscriptionKey(push.worker, push.name);
+		const id = run.topicSubscriptions?.recorded?.[key]?.id;
+		planned({
+			key,
+			resourceType: require_snsSubscriptions.SUBSCRIPTION_TYPE,
+			action: id ? "reuse" : "create",
+			...id ? { id } : {}
+		});
+	}
 	if (!run.push) planned({
 		key: run.stack.proxy === "caddy" ? "service:caddy" : `service:${EDGE_PROJECT}/${EDGE_SERVICE}`,
 		resourceType: "service",
@@ -2714,7 +2931,7 @@ async function planCompose(ctx, run) {
 * migrations applied.
 */
 async function provisionCompose(ctx, run, deps) {
-	const { stack, ref } = run;
+	const { ref } = run;
 	if (run.push) return;
 	if (run.generated.length > 0 && run.secrets) {
 		await ctx.secrets.write(run.secrets);
@@ -2722,11 +2939,13 @@ async function provisionCompose(ctx, run, deps) {
 	}
 	const ports = edgePorts(deps.env);
 	await assertEdgePorts(deps.docker, {
-		project: stack.project,
-		proxy: stack.proxy,
+		project: run.stack.project,
+		proxy: run.stack.proxy,
 		ports,
 		engine: ref
 	});
+	if (run.topicSubscriptions) await subscribeTopics(ctx, run, deps);
+	const { stack } = run;
 	run.files = await writeStack(ctx.cwd, run.dir, stack);
 	printPlan(ctx, run);
 	if (stack.proxy === "traefik") {
@@ -2765,6 +2984,36 @@ async function provisionCompose(ctx, run, deps) {
 	if (stack.storage && stack.infra.includes("minio")) await prepareBuckets(ctx, run, deps);
 }
 /**
+* Subscribe each topic subscriber SNS pushes to — for a topic the stage set
+* to SNS by hand — record the ARNs, and compose the stack again with them,
+* before a file is written.
+*/
+async function subscribeTopics(ctx, run, deps) {
+	const { pushes, recorded, restack } = run.topicSubscriptions;
+	if (pushes.length > 0) ctx.logger.info("\n📮 SNS subscriptions for the stage's own topics");
+	run.stack = restack(await ensureTopicSubscriptions({
+		pushes,
+		recorded,
+		secrets: run.secrets?.custom ?? {},
+		stage: ctx.stage,
+		env: deps.env,
+		record: async (resource) => {
+			await ctx.state.putResource(ctx.stage, resource);
+			applied(ctx, run, {
+				key: resource.key,
+				resourceType: require_snsSubscriptions.SUBSCRIPTION_TYPE,
+				action: "ensure",
+				id: resource.id,
+				via: recorded?.[resource.key]?.id === resource.id ? "recorded" : "created"
+			});
+		},
+		forget: async (key) => {
+			await ctx.state.deleteResource(ctx.stage, key);
+		},
+		log: (line) => ctx.logger.info(line)
+	}));
+}
+/**
 * Create each bucket the stack's MinIO serves, and the open paths of each
 * one a file server fronts — from this machine, on MinIO's loopback port,
 * the way `gkm dev` creates them.
@@ -2779,7 +3028,8 @@ async function prepareBuckets(ctx, run, deps) {
 		done = [
 			...await require_seeds.applyBuckets(client, storage.buckets),
 			...await require_seeds.applyPolicies(client, storage.policies),
-			...await require_seeds.applyLifecycles(client, storage.lifecycles)
+			...await require_seeds.applyLifecycles(client, storage.lifecycles),
+			...await require_seeds.applyNotifications(client, storage.objects, new Set(storage.webhooks.map((hook) => hook.bucket)))
 		];
 	} finally {
 		await tunnel.close();
@@ -2830,7 +3080,7 @@ async function migrateAndSeed(ctx, run, deps, port) {
 		}, ...stack.local ? [require_seeds.LEGACY_LOCAL_LOGIN] : []]
 	});
 	if (login.notice) ctx.logger.info(login.notice);
-	const statements = [...require_seeds.postgresStatements(stack.plan, workspace.name, stack.credential.seed), ...stack.backups ? require_dns.backupsRoleStatements(stack.backups) : []];
+	const statements = [...require_seeds.postgresStatements(stack.plan, workspace.name, stack.credential.seed), ...stack.backups ? require_snsSubscriptions.backupsRoleStatements(stack.backups) : []];
 	if (statements.length > 0) {
 		ctx.logger.info("🗄️  Creating databases, roles and grants…");
 		await require_seeds.applyPostgres(deps.sql(port, login.login), statements);
@@ -3011,9 +3261,33 @@ async function verifyCompose(ctx, run, deps) {
 	}));
 	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down, stack.proxy);
 	await pruneStageDns(ctx, run);
+	await confirmSubscriptions(ctx, run, deps);
 	if (stack.logs) reportLogs(ctx, stack.logs, stack.local, run.server);
 }
 /**
+* The SNS subscriptions the stage's providers made before the workers were
+* up: each still pending is subscribed again, so SNS resends its
+* confirmation to a worker now there to answer it, and waited on. One still
+* pending after that is said, not failed on — every app is healthy, and
+* rolling them back would not confirm it.
+*/
+async function confirmSubscriptions(ctx, run, deps) {
+	const stored = await ctx.state.read(ctx.stage);
+	const left = await (deps.confirmSubscriptions ?? require_snsSubscriptions.confirmPendingSubscriptions)({
+		workspace: ctx.workspace,
+		stage: ctx.stage,
+		secrets: run.secrets?.custom ?? {},
+		resources: stored?.resources,
+		env: deps.env,
+		log: (line) => ctx.logger.info(line),
+		record: async (record) => {
+			const { updatedAt: _, updatedBy: __, ...input } = record;
+			await ctx.state.putResource(ctx.stage, input);
+		}
+	});
+	if (left.length > 0) ctx.logger.warn(`⚠ ${new require_snsSubscriptions.PushSubscriptionsUnconfirmed(left).message}`);
+}
+/**
 * A container's own health check, as Docker reports it: a worker's, which
 * has no route through the edge, and OpenObserve's — by default it has no
 * host there, and served publicly it answers only the addresses it allows,
@@ -3221,14 +3495,14 @@ async function writeStack(root, dir, stack) {
 	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write((0, node_path.join)(dir, `${require_seeds.LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
 	if (stack.redis && stack.compose.services["redis"]?.env_file) await write((0, node_path.join)(dir, `${require_seeds.REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
 	if (stack.backups) {
-		for (const [name, content] of Object.entries(stack.backups.files)) await write((0, node_path.join)(dir, require_dns.BACKUPS_SERVICE, name), content);
-		if (stack.compose.services["backups"]?.env_file) await write((0, node_path.join)(dir, `${require_dns.BACKUPS_SERVICE}.env`), envFile(stack.backups.env), 384);
+		for (const [name, content] of Object.entries(stack.backups.files)) await write((0, node_path.join)(dir, require_snsSubscriptions.BACKUPS_SERVICE, name), content);
+		if (stack.compose.services["backups"]?.env_file) await write((0, node_path.join)(dir, `${require_snsSubscriptions.BACKUPS_SERVICE}.env`), envFile(stack.backups.env), 384);
 	} else {
-		await (0, node_fs_promises.rm)((0, node_path.join)(dir, require_dns.BACKUPS_SERVICE), {
+		await (0, node_fs_promises.rm)((0, node_path.join)(dir, require_snsSubscriptions.BACKUPS_SERVICE), {
 			recursive: true,
 			force: true
 		});
-		await (0, node_fs_promises.rm)((0, node_path.join)(dir, `${require_dns.BACKUPS_SERVICE}.env`), { force: true });
+		await (0, node_fs_promises.rm)((0, node_path.join)(dir, `${require_snsSubscriptions.BACKUPS_SERVICE}.env`), { force: true });
 	}
 	for (const entry of await (0, node_fs_promises.readdir)(dir)) if (entry.endsWith(".credentials")) await (0, node_fs_promises.rm)((0, node_path.join)(dir, entry));
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
@@ -3256,7 +3530,7 @@ function printPlan(ctx, run) {
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
 	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} ${`worker ${worker.id} (no route)`.padEnd(40)} ${mode} ${worker.ref}`);
 	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
-	if (stack.backups) ctx.logger.info(`   ${require_dns.BACKUPS_SERVICE.padEnd(12)} ${stack.backups.databases.map((d) => d.file).join(", ")} — ${stack.backups.backups.describe}, to ${stack.backups.prefix}/`);
+	if (stack.backups) ctx.logger.info(`   ${require_snsSubscriptions.BACKUPS_SERVICE.padEnd(12)} ${stack.backups.databases.map((d) => d.file).join(", ")} — ${stack.backups.backups.describe}, to ${stack.backups.prefix}/`);
 	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
 }
 //#endregion
@@ -3476,4 +3750,4 @@ Object.defineProperty(exports, "stackPlan", {
 	}
 });
 
-//# sourceMappingURL=compose-ChVvb3xM.cjs.map
+//# sourceMappingURL=compose-BfXXWJSp.cjs.map