@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.125

package/dist/{deploy-DO4djCHb.mjs → deploy-D8pUA9Y0.mjs}

@@ -1,97 +1,24 @@
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { s as gkmHome } from "./run-BJLIerMM.mjs";
-import { r as storedCredentials } from "./credentials-B5N5yKk6.mjs";
-import { $ as IamUserNotOwned, G as checkS3Config, J as BucketNameUnavailable, K as AccessKeyLimit, L as resolveStageTelemetry, N as assertDeployedStage, Q as BucketRegionUnknown, U as stageProvider, W as S3_PROVISIONING, X as BucketProbeFailed, Y as BucketOwnedByAnotherProject, Z as BucketRegionMismatch, et as ProvisionedBucketUnreachable, ht as isReservedStageKey, nt as RotationInProgress, q as BucketKeySetElsewhere, rt as S3RegionRequired, tt as RecordedBucketUnreachable, u as getAppBuildOrder } from "./workspace-DUnnVjqC.mjs";
-import { D as deploysWithCompose, E as stageBackups, S as backupExpiries, c as stageDnsDomains, g as BACKUPS_URL_KEY, h as BACKUPS_SERVICE, n as dnsCredentials, u as assertSitePasswordTarget, w as backupsPrefix } from "./dns-DFvO5a53.mjs";
+import { r as storedCredentials, x as gkmHome } from "./credentials-DpfnUvIR.mjs";
+import { $ as IamUserNotOwned, G as checkS3Config, J as BucketNameUnavailable, K as AccessKeyLimit, L as resolveStageTelemetry, N as assertDeployedStage, Q as BucketRegionUnknown, U as stageProvider, W as S3_PROVISIONING, X as BucketProbeFailed, Y as BucketOwnedByAnotherProject, Z as BucketRegionMismatch, et as ProvisionedBucketUnreachable, ht as isReservedStageKey, nt as RotationInProgress, q as BucketKeySetElsewhere, rt as S3RegionRequired, tt as RecordedBucketUnreachable, u as getAppBuildOrder } from "./workspace-DBHF9Gba.mjs";
+import { D as BACKUPS_SERVICE, I as backupsPrefix, O as BACKUPS_URL_KEY, P as backupExpiries, R as stageBackups, S as assertSitePasswordTarget, _ as stageDnsDomains, a as subscriptionKey, b as awsEndpoint, d as recordTtl, l as dnsCredentials, m as settleStackDns, o as subscriptionResource, x as awsProvisioningCredentials, y as awsClientConfig, z as deploysWithCompose } from "./snsSubscriptions-BmYeeTH8.mjs";
 import { o as builtinTarget } from "./define-6poNqm5O.mjs";
-import { Bt as initStageSecrets, Lt as secretsStoreFor, N as stageProviderNotes, P as PROVIDER_KINDS, X as DevServicesNeedServerTarget, Z as ExternalServicesNotConfigured, d as DeployJournal, dn as mergeLifecycle, et as devServicesUsed, ft as constructGlobs, it as stageServiceDeclarations, j as assertStageProvidersEnabled, nr as isMainFrontendApp, nt as reportDevServices, ot as appEnvKeys, rr as resolveHost, tr as NoDomainForStage, tt as externalServices, v as createComposeState, y as createEmptyState, zn as usesTelemetry } from "./seeds-Dv78P9LS.mjs";
+import { $ as ORIGIN_VERIFY_HEADER, En as mergeLifecycle, N as stageProviderNotes, P as PROVIDER_KINDS, Qt as initStageSecrets, Yt as secretsStoreFor, _t as appEnvKeys, br as resolveHost, ct as ExternalServicesNotConfigured, d as DeployJournal, dt as devServicesUsed, er as usesTelemetry, f as extractSubdomain, ft as externalServices, ht as stageServiceDeclarations, j as assertStageProvidersEnabled, m as normalizeDnsConfig, nt as originSecretKey, p as findRootDomain, pt as reportDevServices, rt as processorOriginHost, st as DevServicesNeedServerTarget, tt as newOriginSecret, v as createComposeState, vr as NoDomainForStage, wt as constructGlobs, y as createEmptyState, yr as isMainFrontendApp } from "./seeds-CK7w79VC.mjs";
 import { n as derivedApps, t as appKey } from "./derive-B4vDpzgP.mjs";
+import { s as subscriberRoute } from "./SubscriberGenerator-ocQ2yj0K.mjs";
 import { n as deployIdentity, t as applicationName } from "./identity-CBXr4wNi.mjs";
-import { i as discover, p as withOutput } from "./discover-C5roJuc9.mjs";
+import { i as discover, m as eventsEdge, p as withOutput } from "./discover-CzGM5P3p.mjs";
 import { c as withSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { findWorkspaceRoot, loadWorkspaceConfig } from "./config.mjs";
-import { a as parseTargetOptions, o as resolveTarget } from "./resolve-j8hUcbGz.mjs";
-import { t as LocalSandbox } from "./local-BwC2v2Y8.mjs";
-import { E as eventError, S as createStateStore, v as assertStateOutlivesRun, y as assertStateRoom } from "./sniffer-qDFUQmWP.mjs";
+import { a as parseTargetOptions, o as resolveTarget } from "./resolve-BCU9pYDx.mjs";
+import { t as LocalSandbox } from "./local-B7Zv1NoA.mjs";
+import { E as eventError, S as createStateStore, v as assertStateOutlivesRun, y as assertStateRoom } from "./sniffer-g9v7cqDN.mjs";
 import { a as findProjectBucket, i as ensureProjectBucket, o as projectBucketName, r as callerAccountId, s as reconcileProjectBucketLifecycle } from "./projectBucket-C_DN4WzF.mjs";
-import { n as assertStageCredentials } from "./credentialSchemas-DDOLRCLF.mjs";
+import { n as assertStageCredentials } from "./credentialSchemas-DaMpt-Dx.mjs";
 import { resolve } from "node:path";
 import { randomInt } from "node:crypto";
-import { dependentsOf, kebabCase, provideKey, providedKeyFor } from "@geekmidas/manifest";
+import { bucketExpiry, dependentsOf, kebabCase, provideKey, providedKeyFor } from "@geekmidas/manifest";
 import * as s3Url from "@geekmidas/storage/s3-url";
-//#region src/providers/aws.ts
-/**
-* The AWS account a provider provisions in — the stage's, found the way the
-* SSM and Secrets Manager stores find it.
-*
-* 1. `--profile`, resolved on its own: exported keys left over from another
-*    account never win over a profile someone named.
-* 2. `AWS_PROFILE`, else `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` — the
-*    deploy's own `aws` credential kind (`storedCredentials`).
-* 3. The SDK's default chain: `~/.aws` default profile, SSO, a role. In CI,
-*    whatever `aws-actions/configure-aws-credentials` exported.
-*
-* None of them: the provider has no provisioning credentials, and the stage
-* is treated as `external`.
-*/
-async function awsProvisioningCredentials(lookup) {
-	const region = lookup.env.AWS_REGION ?? lookup.env.AWS_DEFAULT_REGION;
-	const where = region ? { region } : {};
-	if (lookup.profile) return {
-		profile: lookup.profile,
-		...where
-	};
-	const stored = await storedCredentials({
-		env: lookup.env,
-		...lookup.home ? { home: lookup.home } : {}
-	}).get({
-		kind: "aws",
-		stage: lookup.stage
-	});
-	if (stored) return stored;
-	try {
-		const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
-		await fromNodeProviderChain({
-			timeout: 1e3,
-			maxRetries: 0
-		})();
-		return {
-			chain: true,
-			...where
-		};
-	} catch {
-		return;
-	}
-}
-/**
-* An S3-compatible endpoint the environment points the SDK at — the AWS
-* emulator in tests. The SDK reads it itself; it is read here too, because
-* an emulator takes path-style requests, and a key written for one has to
-* say where it is.
-*/
-function awsEndpoint(env, service) {
-	return env[`AWS_ENDPOINT_URL_${service}`] ?? env.AWS_ENDPOINT_URL;
-}
-/** An SDK client's config for a provisioning credential. */
-async function awsClientConfig(credential, region) {
-	if ("profile" in credential) {
-		const { fromIni } = await import("@aws-sdk/credential-providers");
-		return {
-			region,
-			credentials: fromIni({ profile: credential.profile })
-		};
-	}
-	if ("accessKeyId" in credential) return {
-		region,
-		credentials: {
-			accessKeyId: credential.accessKeyId,
-			secretAccessKey: credential.secretAccessKey,
-			...credential.sessionToken ? { sessionToken: credential.sessionToken } : {}
-		}
-	};
-	return { region };
-}
-//#endregion
 //#region src/target/secrets.ts
 /**
 * A stage's secrets as a target sees them: read and written through the
@@ -247,28 +174,37 @@ const bucketArn = (bucket) => `arn:aws:s3:::${bucket}`;
 function userPolicy(bucket, options = {}) {
 	return {
 		Version: "2012-10-17",
-		Statement: [{
-			Sid: "GkmObjects",
-			Effect: "Allow",
-			Action: [
-				"s3:GetObject",
-				"s3:PutObject",
-				"s3:DeleteObject",
-				"s3:AbortMultipartUpload",
-				"s3:ListMultipartUploadParts",
-				...options.versioning ? ["s3:GetObjectVersion"] : []
-			],
-			Resource: `${bucketArn(bucket)}/*`
-		}, {
-			Sid: "GkmBucket",
-			Effect: "Allow",
-			Action: [
-				"s3:ListBucket",
-				"s3:GetBucketLocation",
-				"s3:ListBucketMultipartUploads"
-			],
-			Resource: bucketArn(bucket)
-		}]
+		Statement: [
+			{
+				Sid: "GkmObjects",
+				Effect: "Allow",
+				Action: [
+					"s3:GetObject",
+					"s3:PutObject",
+					"s3:DeleteObject",
+					"s3:AbortMultipartUpload",
+					"s3:ListMultipartUploadParts",
+					...options.versioning ? ["s3:GetObjectVersion"] : []
+				],
+				Resource: `${bucketArn(bucket)}/*`
+			},
+			{
+				Sid: "GkmBucket",
+				Effect: "Allow",
+				Action: [
+					"s3:ListBucket",
+					"s3:GetBucketLocation",
+					"s3:ListBucketMultipartUploads"
+				],
+				Resource: bucketArn(bucket)
+			},
+			...options.eventsTopicArn ? [{
+				Sid: "GkmEvents",
+				Effect: "Allow",
+				Action: "sns:ConfirmSubscription",
+				Resource: options.eventsTopicArn
+			}] : []
+		]
 	};
 }
 /**
@@ -283,10 +219,13 @@ function openResource(bucket, pattern) {
 }
 /**
 * The bucket's own policy: every request refused unless it came over TLS,
-* and — only when a file server opens paths on it — anonymous `s3:GetObject`
-* on exactly those prefixes.
+* and — only when a file server opens paths on it — `s3:GetObject` on
+* exactly those prefixes: to anyone, or, when a CDN serves them, to
+* CloudFront alone, for exactly the stage's distributions. Behind a CDN the
+* bucket is never public: a key outside the open prefixes is refused to
+* CloudFront too, so the edge answers it 403.
 */
-function bucketPolicy(bucket, open = []) {
+function bucketPolicy(bucket, open = [], options = {}) {
 	const statements = [{
 		Sid: "GkmDenyInsecureTransport",
 		Effect: "Deny",
@@ -295,12 +234,21 @@ function bucketPolicy(bucket, open = []) {
 		Resource: [bucketArn(bucket), `${bucketArn(bucket)}/*`],
 		Condition: { Bool: { "aws:SecureTransport": "false" } }
 	}];
-	if (open.length > 0) statements.push({
+	const resources = [...new Set(open.map((p) => openResource(bucket, p)))].sort();
+	if (open.length > 0 && options.cdn) statements.push({
+		Sid: "GkmCdnRead",
+		Effect: "Allow",
+		Principal: { Service: "cloudfront.amazonaws.com" },
+		Action: "s3:GetObject",
+		Resource: resources,
+		Condition: { StringEquals: { "AWS:SourceArn": [...new Set(options.cdn.distributionArns)].sort() } }
+	});
+	else if (open.length > 0) statements.push({
 		Sid: "GkmOpenPaths",
 		Effect: "Allow",
 		Principal: "*",
 		Action: "s3:GetObject",
-		Resource: [...new Set(open.map((p) => openResource(bucket, p)))].sort()
+		Resource: resources
 	});
 	return {
 		Version: "2012-10-17",
@@ -349,7 +297,7 @@ function canonical(value, key) {
 	}
 	if (value && typeof value === "object") return Object.fromEntries(Object.keys(value).sort().map((k) => {
 		const v = value[k];
-		return [k, canonical(k === "Action" || k === "Resource" || k === "AWS" ? Array.isArray(v) ? v : [v] : v, k)];
+		return [k, canonical(k === "Action" || k === "Resource" || k === "AWS" || k === "AWS:SourceArn" ? Array.isArray(v) ? v : [v] : v, k)];
 	}));
 	return value;
 }
@@ -395,7 +343,7 @@ function identityTags(ctx, id) {
 	];
 }
 /** A read whose "there is none" answer is one of `missing`. */
-async function readOr$1(read, missing) {
+async function readOr$3(read, missing) {
 	try {
 		return await read();
 	} catch (error) {
@@ -425,7 +373,7 @@ async function ensureIamUser(ctx, clients, input) {
 		key: `iam-user:${id}`,
 		type: "iam-user"
 	};
-	const found = await readOr$1(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
+	const found = await readOr$3(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
 	if (found?.User) {
 		const tags = await iam.send(new IAM.ListUserTagsCommand({ UserName: user }));
 		const tag = (key) => tags.Tags?.find((t) => t.Key === key)?.Value;
@@ -445,7 +393,7 @@ async function ensureIamUser(ctx, clients, input) {
 		await ctx.state.ready(entry, user);
 	});
 	const exists = Boolean(found?.User) || !ctx.dryRun;
-	const current = exists ? await readOr$1(() => iam.send(new IAM.GetUserPolicyCommand({
+	const current = exists ? await readOr$3(() => iam.send(new IAM.GetUserPolicyCommand({
 		UserName: user,
 		PolicyName: input.policyName
 	})), ["NoSuchEntity", "NoSuchEntityException"]) : void 0;
@@ -859,6 +807,1108 @@ async function verifyStageBackups(input) {
 	}
 }
 //#endregion
+//#region src/providers/dnsWriter.ts
+/**
+* The DNS records a provider asks for — a certificate's validation record, a
+* CDN's name — written through the stage's own DNS providers.
+*
+* The same machinery the deploy's DNS step uses for the stack's hosts
+* (`settleStackDns`), handed a plan of CNAMEs instead of the server's
+* addresses: a record holding its value is left alone, one with another value
+* is replaced and printed, and what is written is read back. A host under no
+* domain in `dns`, or under a `manual` one, is printed for the person to
+* create and reported back, so the provider can say what it is waiting on.
+*/
+async function writeProviderDns(records, options) {
+	const { log } = options;
+	const dns = options.workspace.dns ? normalizeDnsConfig(options.workspace.dns) : {};
+	const manual = [];
+	const domains = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const host = record.host.toLowerCase().replace(/\.$/, "");
+		const value = record.value.replace(/\.$/, "");
+		const domain = findRootDomain(host, dns);
+		if (!domain) {
+			log(`   create at its DNS host: ${host} CNAME ${value}`);
+			manual.push(host);
+			continue;
+		}
+		const config = dns[domain];
+		const plan = domains.get(domain) ?? {
+			domain,
+			provider: typeof config.provider === "string" ? config.provider : "custom",
+			config,
+			records: []
+		};
+		const planned = {
+			host,
+			domain,
+			name: extractSubdomain(host, domain),
+			type: record.type,
+			value,
+			ttl: recordTtl(config)
+		};
+		plan.records.push(planned);
+		domains.set(domain, plan);
+	}
+	if (domains.size === 0) return { manual };
+	const plans = [...domains.values()];
+	const tokens = await dnsCredentials(options.stage, plans.map(({ domain, config }) => ({
+		domain,
+		config
+	})), options.credentials);
+	const applied = await settleStackDns({
+		stage: options.stage,
+		server: { ipv4: "" },
+		domains: plans,
+		uncovered: []
+	}, {
+		...options.dryRun ? { dryRun: true } : { confirm: true },
+		log,
+		credentials: {
+			...tokens.godaddy ? { credential: tokens.godaddy } : {},
+			log
+		},
+		...tokens.hostinger ? { hostinger: tokens.hostinger } : {},
+		...options.providerFor ? { providerFor: options.providerFor } : {}
+	});
+	for (const change of applied.changes) {
+		if (change.action !== "manual") continue;
+		const host = plans.find((p) => p.domain === change.domain)?.records.find((r) => r.name === change.name)?.host;
+		if (host) manual.push(host);
+	}
+	return { manual: [...new Set(manual)].sort() };
+}
+//#endregion
+//#region src/providers/s3/cdn.ts
+/** AWS's managed `CachingOptimized` cache policy: path-keyed, gzip and brotli. */
+const CACHING_OPTIMIZED = "658327ea-f89d-4fab-a63d-7e88639e58f6";
+/** What an immutable path is served with. */
+const IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
+/** The only region CloudFront reads a certificate from. */
+const CDN_REGION = "us-east-1";
+/** The distribution's bucket origin. */
+const ORIGIN_ID = "bucket";
+/** Its processors' origin: the stack's processor unit, at a host of its own. */
+const PROCESSORS_ORIGIN_ID = "processors";
+/**
+* AWS's managed `CachingOptimizedForUncompressedObjects`: keyed on the path
+* alone, and nothing re-compressed — a derivative is an image, already
+* compressed, and its width is in the path, so nothing else may fragment it.
+*/
+const CACHING_OPTIMIZED_UNCOMPRESSED = "b2884449-e4de-46a7-ac36-70bc7f1ddd6d";
+/** A CDN is a name on the stage's domain, and the stage has none. */
+var FileServerCdnNeedsDomain = class extends GkmError {
+	server;
+	stage;
+	constructor(server, stage) {
+		super(`'${server}' is served through a CDN on '${stage}', which answers on <fileserver>.<domain> — and '${stage}' has no domain. Set domains.${stage} in gkm.config.ts, or set deploy.objects.${stage}.cdn to false to serve it from the bucket's own endpoint.`);
+		this.server = server;
+		this.stage = stage;
+		this.name = "FileServerCdnNeedsDomain";
+	}
+};
+/**
+* The certificate is waiting on its validation record: one the person has to
+* create, or one that has not propagated yet. Everything up to it is
+* recorded, so the next deploy carries on from here.
+*/
+var CdnCertificatePending = class extends GkmError {
+	server;
+	host;
+	record;
+	reason;
+	constructor(server, host, record, reason) {
+		super((reason === "manual" ? `The certificate for ${host} ('${server}') is validated by a DNS record no DNS provider in gkm.config.ts can write. Create it at the domain's DNS host:
+` : `The certificate for ${host} ('${server}') is not issued yet: ACM has not seen its validation record. It is written; DNS can take a while to answer with it. Check it resolves:
+`) + `  ${record.name} CNAME ${record.value}\nthen deploy again — the certificate and everything before it are recorded, and the deploy carries on from there.`);
+		this.server = server;
+		this.host = host;
+		this.record = record;
+		this.reason = reason;
+		this.name = "CdnCertificatePending";
+	}
+};
+/** ACM gave up on the certificate. */
+var CdnCertificateFailed = class extends GkmError {
+	server;
+	host;
+	status;
+	reason;
+	constructor(server, host, status, reason) {
+		super(`ACM did not issue the certificate for ${host} ('${server}'): ${status}` + (reason ? ` (${reason})` : "") + ". A CAA record on the domain that does not allow amazon.com, or a validation record removed before it was checked, are the usual causes. Fix it and deploy again: a new certificate is requested.");
+		this.server = server;
+		this.host = host;
+		this.status = status;
+		this.reason = reason;
+		this.name = "CdnCertificateFailed";
+	}
+};
+/** Where a file server answers: `<fileserver>.<domain>`. */
+function cdnHost(serverId, domain) {
+	return `${appKey(serverId)}.${domain}`.toLowerCase();
+}
+/**
+* The name the stage's CDN resources go by, within CloudFront's limits:
+* letters, digits, `-` and `_`, and at most 64 characters (an origin access
+* control's). Kept whole where it fits; otherwise shortened with a hash of
+* the whole, so two long names never meet.
+*/
+function cdnName(scope, stage, serverId) {
+	const whole = `gkm-${scope}-${stage}-${appKey(serverId)}`.replace(/[^A-Za-z0-9_-]/g, "-");
+	if (whole.length <= 56) return whole;
+	return `${whole.slice(0, 47)}-${hash(whole)}`;
+}
+function hash(value) {
+	let h = 2166136261;
+	for (let i = 0; i < value.length; i++) {
+		h ^= value.charCodeAt(i);
+		h = Math.imul(h, 16777619);
+	}
+	return (h >>> 0).toString(36).padStart(8, "0").slice(0, 8);
+}
+/**
+* An open or immutable glob as a CloudFront path pattern. CloudFront's `*`
+* crosses `/`, so a single star is as wide as a double one — the bucket
+* policy reads it the same way, and the construct's own check is the
+* stricter of the three.
+*/
+function pathPattern(glob) {
+	return glob.replace(/^\/+/, "").replace(/\*\*/g, "*");
+}
+/** A CloudFront list: its `Quantity` and, when it has some, its `Items`. */
+function list(items) {
+	return items.length > 0 ? {
+		Quantity: items.length,
+		Items: [...items]
+	} : { Quantity: 0 };
+}
+/** One of the stage's response headers policies. */
+function headersPolicyConfig(input) {
+	return {
+		Name: input.name,
+		Comment: input.comment,
+		...input.origins.length > 0 ? { CorsConfig: {
+			AccessControlAllowOrigins: list([...input.origins].sort()),
+			AccessControlAllowHeaders: {
+				Quantity: 1,
+				Items: ["*"]
+			},
+			AccessControlAllowMethods: {
+				Quantity: 3,
+				Items: [
+					"GET",
+					"HEAD",
+					"OPTIONS"
+				]
+			},
+			AccessControlAllowCredentials: false,
+			AccessControlMaxAgeSec: 86400,
+			OriginOverride: false
+		} } : {},
+		...input.immutable ? { CustomHeadersConfig: {
+			Quantity: 1,
+			Items: [{
+				Header: "Cache-Control",
+				Value: IMMUTABLE_CACHE_CONTROL,
+				Override: true
+			}]
+		} } : {}
+	};
+}
+/** The parts of a distribution's config this provider owns. */
+function distributionConfig(input) {
+	const behaviour = (policy) => ({
+		TargetOriginId: ORIGIN_ID,
+		ViewerProtocolPolicy: "redirect-to-https",
+		AllowedMethods: {
+			Quantity: 3,
+			Items: [
+				"GET",
+				"HEAD",
+				"OPTIONS"
+			],
+			CachedMethods: {
+				Quantity: 2,
+				Items: ["GET", "HEAD"]
+			}
+		},
+		Compress: true,
+		CachePolicyId: CACHING_OPTIMIZED,
+		...policy ? { ResponseHeadersPolicyId: policy } : {}
+	});
+	const patterns = [...new Set(input.immutable.map(pathPattern))].sort();
+	const processors = input.processors;
+	const processorPatterns = processors ? [...new Set(processors.prefixes.map((p) => `${pathPattern(p)}*`))].sort() : [];
+	return {
+		CallerReference: input.callerReference,
+		Comment: input.comment,
+		Enabled: true,
+		Aliases: {
+			Quantity: 1,
+			Items: [input.host]
+		},
+		Origins: list([{
+			Id: ORIGIN_ID,
+			DomainName: input.bucketDomain,
+			OriginPath: "",
+			S3OriginConfig: { OriginAccessIdentity: "" },
+			OriginAccessControlId: input.originAccessControlId
+		}, ...processors ? [{
+			Id: PROCESSORS_ORIGIN_ID,
+			DomainName: processors.host,
+			OriginPath: "",
+			CustomOriginConfig: {
+				HTTPPort: 80,
+				HTTPSPort: 443,
+				OriginProtocolPolicy: "https-only",
+				OriginSslProtocols: {
+					Quantity: 1,
+					Items: ["TLSv1.2"]
+				},
+				OriginReadTimeout: 30,
+				OriginKeepaliveTimeout: 5
+			},
+			CustomHeaders: {
+				Quantity: 1,
+				Items: [{
+					HeaderName: ORIGIN_VERIFY_HEADER,
+					HeaderValue: processors.secret
+				}]
+			}
+		}] : []]),
+		DefaultCacheBehavior: behaviour(input.corsPolicyId),
+		CacheBehaviors: list([...processorPatterns.map((PathPattern) => ({
+			...behaviour(input.corsPolicyId),
+			TargetOriginId: PROCESSORS_ORIGIN_ID,
+			Compress: false,
+			CachePolicyId: CACHING_OPTIMIZED_UNCOMPRESSED,
+			PathPattern
+		})), ...patterns.map((PathPattern) => ({
+			...behaviour(input.immutablePolicyId),
+			PathPattern
+		}))]),
+		ViewerCertificate: {
+			ACMCertificateArn: input.certificateArn,
+			SSLSupportMethod: "sni-only",
+			MinimumProtocolVersion: "TLSv1.2_2021",
+			CloudFrontDefaultCertificate: false
+		},
+		HttpVersion: "http2and3",
+		IsIPV6Enabled: true,
+		DefaultRootObject: ""
+	};
+}
+/**
+* Whether `current` already holds everything in `wanted`: each key `wanted`
+* names, recursively, with lists compared as sets. What else `current` holds
+* — logging, a WAF, geo restrictions set by hand — is left alone, and a
+* `CallerReference`, fixed at creation, is never compared.
+*/
+function holds(current, wanted, key) {
+	if (key === "CallerReference") return true;
+	if (Array.isArray(wanted)) return Array.isArray(current) && current.length === wanted.length && wanted.every((w) => current.some((c) => holds(c, w)));
+	if (wanted && typeof wanted === "object") {
+		if (!current || typeof current !== "object") return false;
+		return Object.entries(wanted).every(([k, v]) => holds(current[k], v, k));
+	}
+	return current === wanted;
+}
+/** Header configs a policy may hold that this provider never sets. */
+const FOREIGN_HEADER_CONFIGS = [
+	"CorsConfig",
+	"CustomHeadersConfig",
+	"SecurityHeadersConfig",
+	"RemoveHeadersConfig",
+	"ServerTimingHeadersConfig"
+];
+/** Whether a policy is exactly what is wanted: nothing missing, nothing more. */
+function sameHeadersPolicy(current, wanted) {
+	if (!current || !holds(current, wanted)) return false;
+	return FOREIGN_HEADER_CONFIGS.every((k) => {
+		if (k in wanted) return true;
+		const extra = current[k];
+		return !extra || extra.Quantity === 0;
+	});
+}
+const defaultCdnClients = async (credential) => {
+	const CF = await import("@aws-sdk/client-cloudfront");
+	const ACM = await import("@aws-sdk/client-acm");
+	const config = await awsClientConfig(credential, CDN_REGION);
+	const cloudfront = awsEndpoint(process.env, "CLOUDFRONT");
+	const acm = awsEndpoint(process.env, "ACM");
+	return {
+		CF,
+		ACM,
+		cloudfront: new CF.CloudFrontClient({
+			...config,
+			...cloudfront ? { endpoint: cloudfront } : {}
+		}),
+		acm: new ACM.ACMClient({
+			...config,
+			...acm ? { endpoint: acm } : {}
+		}),
+		wait: {
+			timeoutMs: 9e5,
+			intervalMs: 1e4
+		}
+	};
+};
+let makeCdnClients = defaultCdnClients;
+/** What an AWS SDK error is called, whichever field carries it. */
+function errorName$2(error) {
+	const e = error;
+	return e?.Code ?? e?.name ?? "";
+}
+async function readOr$2(read, missing) {
+	try {
+		return await read();
+	} catch (error) {
+		if (missing.includes(errorName$2(error))) return void 0;
+		throw error;
+	}
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** What stands in for an id a dry run would create. */
+const PLANNED = "(created by this deploy)";
+/** Each file server over a bucket, behind its own distribution. */
+async function ensureBucketCdn(ctx, input) {
+	const domain = ctx.workspace.domains?.[ctx.stage];
+	if (!domain) throw new FileServerCdnNeedsDomain(input.servers[0].id, ctx.stage);
+	const clients = await makeCdnClients(ctx.credential);
+	const out = {
+		distributionArns: [],
+		urls: {}
+	};
+	for (const server of input.servers) {
+		const { arn, url } = await ensureServerCdn(ctx, clients, {
+			...input,
+			server,
+			host: cdnHost(server.id, domain),
+			processorHost: processorOriginHost(server.id, domain)
+		});
+		out.distributionArns.push(arn);
+		out.urls[server.id] = url;
+	}
+	return out;
+}
+async function ensureServerCdn(ctx, clients, input) {
+	const { server, host } = input;
+	const name = cdnName(ctx.identity.scope, ctx.stage, server.id);
+	const comment = `gkm ${ctx.identity.key} ${ctx.stage} ${server.id}`.slice(0, 128);
+	const certificateArn = await ensureCertificate(ctx, clients, {
+		id: server.id,
+		host,
+		name
+	});
+	const originAccessControlId = await ensureOriginAccessControl(ctx, clients, {
+		id: server.id,
+		name,
+		bucket: input.bucket
+	});
+	const corsPolicyId = input.origins.length > 0 ? await ensureHeadersPolicy(ctx, clients, {
+		id: server.id,
+		kind: "cors",
+		config: headersPolicyConfig({
+			name: `${name}-cors`,
+			comment: `${comment}: CORS`,
+			origins: input.origins,
+			immutable: false
+		})
+	}) : void 0;
+	const immutablePolicyId = server.immutable.length > 0 ? await ensureHeadersPolicy(ctx, clients, {
+		id: server.id,
+		kind: "immutable",
+		config: headersPolicyConfig({
+			name: `${name}-immutable`,
+			comment: `${comment}: CORS and Cache-Control immutable`,
+			origins: input.origins,
+			immutable: true
+		})
+	}) : void 0;
+	const processors = server.processors?.length ? {
+		prefixes: server.processors,
+		host: input.processorHost,
+		secret: await ensureOriginSecret(ctx, server.id)
+	} : void 0;
+	const distribution = await ensureDistribution(ctx, clients, {
+		id: server.id,
+		comment,
+		config: distributionConfig({
+			comment,
+			callerReference: name,
+			host,
+			certificateArn,
+			bucketDomain: `${input.bucket}.s3.${input.region}.amazonaws.com`,
+			originAccessControlId,
+			...corsPolicyId ? { corsPolicyId } : {},
+			...immutablePolicyId ? { immutablePolicyId } : {},
+			immutable: server.immutable,
+			...processors ? { processors } : {}
+		})
+	});
+	if (distribution.domainName !== PLANNED) {
+		if ((await ctx.writeDns([{
+			host,
+			type: "CNAME",
+			value: distribution.domainName
+		}])).manual.includes(host)) ctx.log(`   ${host} answers once that record exists — ${server.id}'s URL is https://${host}`);
+	}
+	return {
+		arn: distribution.arn,
+		url: `https://${host}`
+	};
+}
+/**
+* The secret the CDN sends a file server's processors: the one in the stage's
+* secrets, or a new one written there — read by the stack, whose edge checks
+* it, when it composes.
+*/
+async function ensureOriginSecret(ctx, serverId) {
+	const key = originSecretKey(serverId);
+	const kept = ctx.secrets[key];
+	if (kept) return kept;
+	const secret = newOriginSecret();
+	ctx.log(`   ${serverId}: a new processor origin secret, kept as ${key}`);
+	await ctx.writeSecrets({ [key]: secret });
+	return secret;
+}
+/** The certificate for `host`: recorded, adopted, or requested — then issued. */
+async function ensureCertificate(ctx, clients, input) {
+	const { ACM, acm } = clients;
+	const { id, host } = input;
+	const entry = {
+		key: `acm-certificate:${id}`,
+		type: "acm-certificate",
+		data: { host }
+	};
+	const describe = (arn) => readOr$2(() => acm.send(new ACM.DescribeCertificateCommand({ CertificateArn: arn })), ["ResourceNotFoundException"]).then((out) => out?.Certificate);
+	let arn;
+	const recorded = ctx.state.record(entry.key);
+	if (recorded?.id && recorded.data?.host === host) {
+		const found = await describe(recorded.id);
+		if (found && found.Status !== "FAILED" && found.Status !== "VALIDATION_TIMED_OUT" && found.Status !== "REVOKED" && found.Status !== "EXPIRED") arn = recorded.id;
+	}
+	if (!arn) {
+		arn = await findCertificate(clients, host);
+		if (arn) ctx.log(`   adopting the certificate for ${host} — ${arn}`);
+	}
+	if (!arn) {
+		if (ctx.dryRun) {
+			await ctx.change({
+				construct: id,
+				resource: `certificate ${host}`,
+				change: "request (ACM, us-east-1, DNS-validated)"
+			}, async () => {});
+			return PLANNED;
+		}
+		await ctx.state.pending(entry);
+		arn = (await acm.send(new ACM.RequestCertificateCommand({
+			DomainName: host,
+			ValidationMethod: "DNS",
+			IdempotencyToken: input.name.replace(/[^A-Za-z0-9]/g, "").slice(0, 32),
+			Tags: identityTags(ctx, id).map((t) => ({
+				Key: t.Key,
+				Value: t.Value
+			}))
+		}))).CertificateArn;
+		await ctx.change({
+			construct: id,
+			resource: `certificate ${host}`,
+			change: "request (ACM, us-east-1, DNS-validated)"
+		}, async () => {});
+	}
+	if (!ctx.dryRun) await ctx.state.ready(entry, arn);
+	let certificate = await describe(arn);
+	let record = certificate?.DomainValidationOptions?.[0]?.ResourceRecord;
+	for (let i = 0; !record && i < 15; i++) {
+		await sleep(Math.min(clients.wait.intervalMs, 2e3));
+		certificate = await describe(arn);
+		record = certificate?.DomainValidationOptions?.[0]?.ResourceRecord;
+	}
+	const validation = record ? {
+		name: record.Name.replace(/\.$/, ""),
+		value: record.Value.replace(/\.$/, "")
+	} : void 0;
+	const written = validation ? await ctx.writeDns([{
+		host: validation.name,
+		type: "CNAME",
+		value: validation.value
+	}]) : { manual: [] };
+	if (certificate?.Status === "ISSUED" || ctx.dryRun) return arn;
+	if (validation && written.manual.includes(validation.name.toLowerCase())) throw new CdnCertificatePending(id, host, validation, "manual");
+	ctx.log(`   waiting for ACM to issue the certificate for ${host}…`);
+	const deadline = Date.now() + clients.wait.timeoutMs;
+	while (certificate?.Status === "PENDING_VALIDATION" && Date.now() < deadline) {
+		await sleep(clients.wait.intervalMs);
+		certificate = await describe(arn);
+	}
+	if (certificate?.Status === "ISSUED") return arn;
+	if (certificate?.Status === "PENDING_VALIDATION" || !certificate) throw new CdnCertificatePending(id, host, validation ?? {
+		name: `(not published yet) ${host}`,
+		value: ""
+	}, "timeout");
+	throw new CdnCertificateFailed(id, host, certificate.Status ?? "unknown", certificate.FailureReason);
+}
+/** An issued or pending certificate for exactly `host`, if the account has one. */
+async function findCertificate(clients, host) {
+	const { ACM, acm } = clients;
+	let NextToken;
+	do {
+		const page = await acm.send(new ACM.ListCertificatesCommand({
+			CertificateStatuses: ["ISSUED", "PENDING_VALIDATION"],
+			...NextToken ? { NextToken } : {}
+		}));
+		const match = page.CertificateSummaryList?.find((c) => c.DomainName?.toLowerCase() === host);
+		if (match?.CertificateArn) return match.CertificateArn;
+		NextToken = page.NextToken;
+	} while (NextToken);
+}
+/** The origin access control CloudFront signs its bucket requests with. */
+async function ensureOriginAccessControl(ctx, clients, input) {
+	const { CF, cloudfront } = clients;
+	const entry = {
+		key: `cloudfront-oac:${input.id}`,
+		type: "cloudfront-oac",
+		data: { name: input.name }
+	};
+	const recorded = ctx.state.record(entry.key)?.id;
+	if (recorded) {
+		if (await readOr$2(() => cloudfront.send(new CF.GetOriginAccessControlCommand({ Id: recorded })), ["NoSuchOriginAccessControl"])) return recorded;
+	}
+	let Marker;
+	do {
+		const page = await cloudfront.send(new CF.ListOriginAccessControlsCommand({ ...Marker ? { Marker } : {} }));
+		const match = page.OriginAccessControlList?.Items?.find((o) => o.Name === input.name);
+		if (match?.Id) {
+			if (!ctx.dryRun) await ctx.state.ready(entry, match.Id);
+			return match.Id;
+		}
+		Marker = page.OriginAccessControlList?.NextMarker;
+	} while (Marker);
+	let id = PLANNED;
+	await ctx.change({
+		construct: input.id,
+		resource: `origin access control ${input.name}`,
+		change: `create (CloudFront signs its reads of ${input.bucket})`
+	}, async () => {
+		await ctx.state.pending(entry);
+		id = (await cloudfront.send(new CF.CreateOriginAccessControlCommand({ OriginAccessControlConfig: {
+			Name: input.name,
+			Description: `gkm: CloudFront's reads of ${input.bucket}`,
+			OriginAccessControlOriginType: "s3",
+			SigningBehavior: "always",
+			SigningProtocol: "sigv4"
+		} }))).OriginAccessControl.Id;
+		await ctx.state.ready(entry, id);
+	});
+	return id;
+}
+/** One response headers policy, as wanted. */
+async function ensureHeadersPolicy(ctx, clients, input) {
+	const { CF, cloudfront } = clients;
+	const { config } = input;
+	const entry = {
+		key: `cloudfront-headers:${input.id}:${input.kind}`,
+		type: "cloudfront-headers",
+		data: { name: config.Name }
+	};
+	const read = (Id) => readOr$2(() => cloudfront.send(new CF.GetResponseHeadersPolicyConfigCommand({ Id })), ["NoSuchResponseHeadersPolicy"]);
+	let id = ctx.state.record(entry.key)?.id;
+	let current = id ? await read(id) : void 0;
+	if (!current) {
+		id = void 0;
+		let Marker;
+		do {
+			const page = await cloudfront.send(new CF.ListResponseHeadersPoliciesCommand({
+				Type: "custom",
+				...Marker ? { Marker } : {}
+			}));
+			const match = page.ResponseHeadersPolicyList?.Items?.find((p) => p.ResponseHeadersPolicy?.ResponseHeadersPolicyConfig?.Name === config.Name);
+			if (match?.ResponseHeadersPolicy?.Id) {
+				id = match.ResponseHeadersPolicy.Id;
+				current = await read(id);
+			}
+			Marker = page.ResponseHeadersPolicyList?.NextMarker;
+		} while (!id && Marker);
+	}
+	if (id && current) {
+		if (!ctx.dryRun) await ctx.state.ready(entry, id);
+		if (sameHeadersPolicy(current.ResponseHeadersPolicyConfig, config)) return id;
+		const existing = id;
+		await ctx.change({
+			construct: input.id,
+			resource: `response headers policy ${config.Name}`,
+			change: "put back what drifted"
+		}, async () => {
+			await cloudfront.send(new CF.UpdateResponseHeadersPolicyCommand({
+				Id: existing,
+				IfMatch: current.ETag,
+				ResponseHeadersPolicyConfig: config
+			}));
+		});
+		return existing;
+	}
+	let created = PLANNED;
+	await ctx.change({
+		construct: input.id,
+		resource: `response headers policy ${config.Name}`,
+		change: "create"
+	}, async () => {
+		await ctx.state.pending(entry);
+		created = (await cloudfront.send(new CF.CreateResponseHeadersPolicyCommand({ ResponseHeadersPolicyConfig: config }))).ResponseHeadersPolicy.Id;
+		await ctx.state.ready(entry, created);
+	});
+	return created;
+}
+/** The distribution: recorded, found by its comment, or created — as wanted. */
+async function ensureDistribution(ctx, clients, input) {
+	const { CF, cloudfront } = clients;
+	const entry = {
+		key: `cloudfront-distribution:${input.id}`,
+		type: "cloudfront-distribution"
+	};
+	const get = (Id) => readOr$2(() => cloudfront.send(new CF.GetDistributionCommand({ Id })), ["NoSuchDistribution"]);
+	let found = ctx.state.record(entry.key)?.id ? await get(ctx.state.record(entry.key).id) : void 0;
+	if (!found) {
+		let Marker;
+		do {
+			const page = await cloudfront.send(new CF.ListDistributionsCommand({ ...Marker ? { Marker } : {} }));
+			const match = page.DistributionList?.Items?.find((d) => d.Comment === input.comment);
+			if (match?.Id) found = await get(match.Id);
+			Marker = page.DistributionList?.NextMarker;
+		} while (!found && Marker);
+	}
+	if (found?.Distribution) {
+		const distribution = found.Distribution;
+		const id = distribution.Id;
+		const located = {
+			arn: distribution.ARN,
+			domainName: distribution.DomainName
+		};
+		if (!ctx.dryRun) await ctx.state.ready({
+			...entry,
+			data: located
+		}, id);
+		const current = await cloudfront.send(new CF.GetDistributionConfigCommand({ Id: id }));
+		if (holds(current.DistributionConfig, input.config)) return located;
+		await ctx.change({
+			construct: input.id,
+			resource: `distribution ${id}`,
+			change: "put back what drifted"
+		}, async () => {
+			await cloudfront.send(new CF.UpdateDistributionCommand({
+				Id: id,
+				IfMatch: current.ETag,
+				DistributionConfig: {
+					...current.DistributionConfig,
+					...input.config,
+					CallerReference: current.DistributionConfig.CallerReference
+				}
+			}));
+		});
+		return located;
+	}
+	let created = {
+		arn: `arn:aws:cloudfront::${PLANNED}`,
+		domainName: PLANNED
+	};
+	const host = input.config.Aliases?.Items?.[0] ?? input.id;
+	await ctx.change({
+		construct: input.id,
+		resource: `distribution ${host}`,
+		change: "create (CloudFront, takes minutes to reach every edge)"
+	}, async () => {
+		await ctx.state.pending(entry);
+		const out = await cloudfront.send(new CF.CreateDistributionWithTagsCommand({ DistributionConfigWithTags: {
+			DistributionConfig: input.config,
+			Tags: { Items: identityTags(ctx, input.id).map((t) => ({
+				Key: t.Key,
+				Value: t.Value
+			})) }
+		} }));
+		created = {
+			arn: out.Distribution.ARN,
+			domainName: out.Distribution.DomainName
+		};
+		await ctx.state.ready({
+			...entry,
+			data: created
+		}, out.Distribution.Id);
+	});
+	return created;
+}
+//#endregion
+//#region src/providers/s3/events.ts
+/** What S3 tells the topic about: every object written, and every removed. */
+const BUCKET_EVENTS = ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"];
+/**
+* Each bucket a subscriber watches, with the subscribers discovery could name.
+*
+* A bucket is watched when a process consumes its events — discovery records
+* the edge, and the subscriber by its export — or when a build put a
+* subscriber in its declaration. Only a named subscriber can be subscribed: a
+* route is named after its export.
+*/
+function bucketWatchers(manifest, runnables, subscribers = {}) {
+	const watched = /* @__PURE__ */ new Map();
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "objects") continue;
+		const key = provideKey(id, "eventsConnectionString");
+		const named = Object.entries(subscribers).flatMap(([worker, bound]) => bound.filter((s) => s.connectionKey === key).map((s) => ({
+			worker,
+			name: s.name
+		}))).sort((a, b) => `${a.worker}/${a.name}`.localeCompare(`${b.worker}/${b.name}`));
+		const edged = Object.values(runnables).some((edges) => edges.includes(eventsEdge(id)));
+		const declared = (declaration.subscribers?.length ?? 0) > 0;
+		if (named.length > 0 || edged || declared) watched.set(id, named);
+	}
+	return watched;
+}
+/** The topic a bucket's changes are published to. */
+function eventsTopicName(bucket) {
+	return `${bucket.replaceAll(".", "-")}-events`;
+}
+/** What SNS gives up delivering, kept. */
+function eventsDeadLetterName(bucket) {
+	return `${eventsTopicName(bucket)}-dlq`;
+}
+/** Only this bucket, in this account, may publish to its topic. */
+function eventsTopicPolicy(topicArn, bucket, account) {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "GkmBucketPublishes",
+			Effect: "Allow",
+			Principal: { Service: "s3.amazonaws.com" },
+			Action: "sns:Publish",
+			Resource: topicArn,
+			Condition: {
+				ArnLike: { "aws:SourceArn": `arn:aws:s3:::${bucket}` },
+				StringEquals: { "aws:SourceAccount": account }
+			}
+		}]
+	};
+}
+/** Only the bucket's topic may send to its dead-letter queue. */
+function eventsDeadLetterPolicy(queueArn, topicArn) {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "GkmTopicDeadLetters",
+			Effect: "Allow",
+			Principal: { Service: "sns.amazonaws.com" },
+			Action: "sqs:SendMessage",
+			Resource: queueArn,
+			Condition: { ArnEquals: { "aws:SourceArn": topicArn } }
+		}]
+	};
+}
+/** The id this provider's notification entry goes under. */
+const notificationId = (id) => `gkm-${id}`;
+/**
+* The bucket's notifications with this provider's entry put back, and whether
+* that changed anything. Every other entry — a queue, a function, a topic
+* somebody added by hand — is kept exactly as it was.
+*/
+function mergedNotifications(current, id, topicArn) {
+	const own = notificationId(id);
+	const wanted = {
+		Id: own,
+		TopicArn: topicArn,
+		Events: [...BUCKET_EVENTS]
+	};
+	const topics = current.TopicConfigurations ?? [];
+	const existing = topics.find((t) => t.Id === own);
+	const same = existing !== void 0 && existing.TopicArn === topicArn && JSON.stringify([...existing.Events ?? []].sort()) === JSON.stringify([...BUCKET_EVENTS].sort()) && existing.Filter === void 0;
+	const { ResponseMetadata: _, ...rest } = current;
+	return {
+		config: {
+			...rest,
+			TopicConfigurations: [...topics.filter((t) => t.Id !== own), wanted]
+		},
+		changed: !same
+	};
+}
+/** S3 refused the entry because another one already covers these events. */
+var BucketNotificationsOverlap = class extends GkmError {
+	bucket;
+	detail;
+	constructor(bucket, detail) {
+		super(`'${bucket}' already sends object creates or deletes somewhere else, and S3 sends each event to one place only, so the deploy cannot add its own entry. Remove the other notification from the bucket, or give it a prefix, and deploy again. S3 said: ${detail}`);
+		this.bucket = bucket;
+		this.detail = detail;
+		this.name = "BucketNotificationsOverlap";
+	}
+};
+const defaultEventsClients = async (credential, region) => {
+	const SNS = await import("@aws-sdk/client-sns");
+	const SQS = await import("@aws-sdk/client-sqs");
+	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+	const config = await awsClientConfig(credential, region);
+	const endpoint = awsEndpoint(process.env, "SNS");
+	const sts = new STSClient({
+		...config,
+		...awsEndpoint(process.env, "STS") ? { endpoint: awsEndpoint(process.env, "STS") } : {}
+	});
+	const { Account } = await sts.send(new GetCallerIdentityCommand({}));
+	sts.destroy();
+	return {
+		SNS,
+		SQS,
+		sns: new SNS.SNSClient({
+			...config,
+			...endpoint ? { endpoint } : {}
+		}),
+		sqs: new SQS.SQSClient({
+			...config,
+			...awsEndpoint(process.env, "SQS") ? { endpoint: awsEndpoint(process.env, "SQS") } : {}
+		}),
+		account: Account,
+		region,
+		...endpoint ? { endpoint } : {}
+	};
+};
+let makeEventsClients = defaultEventsClients;
+function errorName$1(error) {
+	const e = error;
+	return e?.name ?? e?.Code ?? e?.code ?? "";
+}
+async function readOr$1(read, missing) {
+	try {
+		return await read();
+	} catch (error) {
+		if (missing.includes(errorName$1(error))) return void 0;
+		throw error;
+	}
+}
+/**
+* The topic, its policy, the dead-letter queue and the bucket's notification
+* entry for one watched bucket — created where missing, put back where they
+* drifted.
+*/
+async function ensureBucketEvents(ctx, s3, input) {
+	const { id, bucket, region } = input;
+	const { SNS, SQS, sns, sqs, account } = await makeEventsClients(ctx.credential, region);
+	const topicName = eventsTopicName(bucket);
+	const topicArn = `arn:aws:sns:${region}:${account}:${topicName}`;
+	const topicEntry = {
+		key: `sns-topic:${id}`,
+		type: "sns-topic"
+	};
+	const topic = await readOr$1(() => sns.send(new SNS.GetTopicAttributesCommand({ TopicArn: topicArn })), ["NotFound", "NotFoundException"]);
+	if (topic) await ctx.state.ready(topicEntry, topicArn);
+	else await ctx.change({
+		construct: id,
+		resource: `SNS topic ${topicName}`,
+		change: "create"
+	}, async () => {
+		await ctx.state.pending(topicEntry);
+		await sns.send(new SNS.CreateTopicCommand({
+			Name: topicName,
+			Tags: identityTags(ctx, id)
+		}));
+		await ctx.state.ready(topicEntry, topicArn);
+	});
+	const topicPolicy = eventsTopicPolicy(topicArn, bucket, account);
+	const currentTopicPolicy = topic?.Attributes?.Policy;
+	if (!currentTopicPolicy || canonicalPolicy(JSON.parse(currentTopicPolicy)) !== canonicalPolicy(topicPolicy)) await ctx.change({
+		construct: id,
+		resource: `SNS topic ${topicName}`,
+		change: `publishable by '${bucket}' only`
+	}, async () => {
+		await sns.send(new SNS.SetTopicAttributesCommand({
+			TopicArn: topicArn,
+			AttributeName: "Policy",
+			AttributeValue: JSON.stringify(topicPolicy)
+		}));
+	});
+	const queueName = eventsDeadLetterName(bucket);
+	const deadLetterArn = `arn:aws:sqs:${region}:${account}:${queueName}`;
+	const queueEntry = {
+		key: `sqs-queue:${id}-events-dlq`,
+		type: "sqs-queue"
+	};
+	const queue = await readOr$1(() => sqs.send(new SQS.GetQueueUrlCommand({ QueueName: queueName })), ["QueueDoesNotExist", "AWS.SimpleQueueService.NonExistentQueue"]);
+	let queueUrl = queue?.QueueUrl;
+	if (queueUrl) await ctx.state.ready(queueEntry, deadLetterArn);
+	else await ctx.change({
+		construct: id,
+		resource: `SQS queue ${queueName}`,
+		change: "create"
+	}, async () => {
+		await ctx.state.pending(queueEntry);
+		queueUrl = (await sqs.send(new SQS.CreateQueueCommand({
+			QueueName: queueName,
+			Attributes: { MessageRetentionPeriod: "1209600" },
+			tags: Object.fromEntries(identityTags(ctx, id).map((t) => [t.Key, t.Value]))
+		}))).QueueUrl;
+		await ctx.state.ready(queueEntry, deadLetterArn);
+	});
+	const queuePolicy = eventsDeadLetterPolicy(deadLetterArn, topicArn);
+	const currentQueuePolicy = queue?.QueueUrl ? (await sqs.send(new SQS.GetQueueAttributesCommand({
+		QueueUrl: queue.QueueUrl,
+		AttributeNames: ["Policy"]
+	}))).Attributes?.Policy : void 0;
+	if (!currentQueuePolicy || canonicalPolicy(JSON.parse(currentQueuePolicy)) !== canonicalPolicy(queuePolicy)) await ctx.change({
+		construct: id,
+		resource: `SQS queue ${queueName}`,
+		change: `receives what ${topicName} cannot deliver`
+	}, async () => {
+		await sqs.send(new SQS.SetQueueAttributesCommand({
+			QueueUrl: queueUrl,
+			Attributes: { Policy: JSON.stringify(queuePolicy) }
+		}));
+	});
+	const merged = mergedNotifications(await readOr$1(() => s3.s3.send(new s3.S3.GetBucketNotificationConfigurationCommand({ Bucket: bucket })), ["NoSuchBucket"]) ?? {}, id, topicArn);
+	if (merged.changed) await ctx.change({
+		construct: id,
+		resource: `bucket ${bucket}`,
+		change: `send object creates and deletes to ${topicName}`
+	}, async () => {
+		try {
+			await s3.s3.send(new s3.S3.PutBucketNotificationConfigurationCommand({
+				Bucket: bucket,
+				NotificationConfiguration: merged.config
+			}));
+		} catch (error) {
+			const message = error.message ?? "";
+			if (/overlap/i.test(message)) throw new BucketNotificationsOverlap(bucket, message);
+			throw error;
+		}
+	});
+	sns.destroy();
+	sqs.destroy();
+	return {
+		topicArn,
+		deadLetterArn
+	};
+}
+/**
+* The events key: the topic's address, signed by the bucket's own access key
+* — read off the bucket's URL, so a rotated key rotates this one with it.
+*/
+async function ensureEventsKey(ctx, input) {
+	const { id, topicArn, region } = input;
+	const key = provideKey(id, "eventsConnectionString");
+	const url = ctx.secrets[provideKey(id, "url")];
+	let parsed;
+	try {
+		parsed = url ? s3Url.parse(url) : void 0;
+	} catch {
+		parsed = void 0;
+	}
+	if (!parsed?.accessKeyId || !parsed.secretAccessKey) {
+		await ctx.change({
+			construct: id,
+			resource: key,
+			change: "set to the topic’s address"
+		}, async () => {});
+		return;
+	}
+	const { snsUrl } = await import("@geekmidas/events/sns");
+	const endpoint = awsEndpoint(process.env, "SNS");
+	const address = new URL(snsUrl.build({
+		topicArn,
+		region,
+		...endpoint ? { endpoint } : {}
+	}));
+	address.searchParams.set("accessKeyId", parsed.accessKeyId);
+	address.searchParams.set("secretAccessKey", parsed.secretAccessKey);
+	const value = address.toString();
+	const entry = {
+		key: `events-key:${id}`,
+		type: "url"
+	};
+	if (ctx.secrets[key] === value) {
+		await ctx.state.ready(entry, topicArn);
+		return;
+	}
+	await ctx.change({
+		construct: id,
+		resource: key,
+		change: `set to ${topicArn}`
+	}, async () => {
+		await ctx.writeSecrets({ [key]: value });
+		await ctx.state.ready(entry, topicArn);
+	});
+}
+/** Where SNS pushes to a worker: its own host on the stage's domain. */
+function workerPushHost(worker, domain) {
+	return `${appKey(worker)}.${domain}`;
+}
+/**
+* One HTTP subscription per subscriber to the bucket's topic, at its route on
+* its worker's host, with the bucket's dead-letter queue — and each ARN
+* recorded, which is what the worker accepts deliveries under.
+*
+* Unfiltered: a bucket's notifications carry no `type` attribute, and the
+* subscriber's own filter — events, prefix, suffix — is what decides. Only a
+* compose stage pushes to a worker; any other is told so and left alone.
+*/
+async function ensurePushSubscriptions(ctx, input) {
+	const { id, events, region, watchers } = input;
+	if (!deploysWithCompose(ctx.workspace)) {
+		ctx.log(`   '${id}' is watched, and only a compose stage pushes a bucket's changes to a worker: its subscribers receive nothing on '${ctx.stage}'`);
+		return;
+	}
+	if (watchers.length === 0) return;
+	const domain = ctx.workspace.domains?.[ctx.stage];
+	if (!domain) throw new NoDomainForStage(ctx.stage);
+	const { SNSConnection, reconcileHttpSubscriptions } = await import("@geekmidas/events/sns");
+	const { credentials } = await awsClientConfig(ctx.credential, region);
+	const endpoint = awsEndpoint(process.env, "SNS");
+	const byWorker = /* @__PURE__ */ new Map();
+	for (const watcher of watchers) byWorker.set(watcher.worker, [...byWorker.get(watcher.worker) ?? [], watcher]);
+	for (const [worker, own] of byWorker) {
+		const host = workerPushHost(worker, domain);
+		const endpoints = own.map(({ name }) => ({
+			name,
+			endpoint: `https://${host}${subscriberRoute(name)}`,
+			deadLetterQueueArn: events.deadLetterArn
+		}));
+		const unrecorded = own.filter(({ name }) => ctx.state.record(subscriptionKey(worker, name))?.status !== "ready");
+		if (ctx.dryRun) {
+			if (unrecorded.length > 0) await ctx.change({
+				construct: id,
+				resource: `SNS subscriptions on ${host}`,
+				change: `subscribe ${unrecorded.map((w) => w.name).join(", ")}`
+			}, async () => {});
+			continue;
+		}
+		const connection = new SNSConnection({
+			topicArn: events.topicArn,
+			region,
+			...endpoint ? { endpoint } : {},
+			...credentials ? { credentials } : {}
+		});
+		const result = await reconcileHttpSubscriptions(connection, {
+			endpoints,
+			ownedHost: host
+		});
+		await connection.close();
+		for (const spec of endpoints) {
+			const arn = result.subscriptions[spec.name];
+			const pending = result.pending.includes(spec.name);
+			if (ctx.state.record(subscriptionKey(worker, spec.name))?.id !== arn) ctx.log(`   ✓ '${spec.name}' subscribed to ${events.topicArn.split(":").pop()} at ${spec.endpoint}`);
+			const { key, type, data } = subscriptionResource({
+				worker,
+				name: spec.name,
+				topicArn: events.topicArn,
+				endpoint: spec.endpoint,
+				deadLetterQueueArn: events.deadLetterArn,
+				pending
+			}, arn);
+			await ctx.state.ready({
+				key,
+				type,
+				...data ? { data } : {}
+			}, arn);
+		}
+		for (const arn of result.removed) ctx.log(`   – unsubscribed ${arn}: no subscriber wants it any more`);
+	}
+}
+//#endregion
 //#region src/providers/s3/origins.ts
 /**
 * Which browser origins may call a bucket: the stage's sites that depend on
@@ -917,10 +1967,12 @@ function bucketConstructs(manifest) {
 	return Object.entries(manifest).filter(([, d]) => d.kind === "objects").map(([id, d]) => ({
 		id,
 		versioned: d.versioned === true,
-		...d.expire ? { expire: d.expire } : {},
+		...bucketExpiry(manifest, id) ? { expire: bucketExpiry(manifest, id) } : {},
 		servers: Object.entries(manifest).filter(([, s]) => s.kind === "file-server" && s.of === id).map(([sid, s]) => ({
 			id: sid,
-			open: s.open ?? []
+			open: s.open ?? [],
+			immutable: s.immutable ?? [],
+			...s.processors?.length ? { processors: [...new Set(s.processors.map((p) => p.prefix))].sort() } : {}
 		})).sort((a, b) => a.id.localeCompare(b.id))
 	})).sort((a, b) => a.id.localeCompare(b.id));
 }
@@ -1052,9 +2104,10 @@ let makeClients = defaultClients;
 async function ensureS3(ctx) {
 	const region = s3Region(ctx);
 	const clients = await makeClients(ctx.credential, region);
-	for (const construct of bucketConstructs(ctx.manifest)) await ensureBucket(ctx, clients, construct);
+	const watched = bucketWatchers(ctx.manifest, ctx.runnables, ctx.subscribers);
+	for (const construct of bucketConstructs(ctx.manifest)) await ensureBucket(ctx, clients, construct, watched.get(construct.id));
 }
-async function ensureBucket(ctx, stageClients, construct) {
+async function ensureBucket(ctx, stageClients, construct, watchers) {
 	const { id } = construct;
 	const nameInput = {
 		scope: ctx.identity.scope,
@@ -1070,19 +2123,40 @@ async function ensureBucket(ctx, stageClients, construct) {
 		clients = await makeClients(ctx.credential, located.region);
 		ctx.log(`   '${bucket}' is in ${located.region}, not ${stageClients.region}: '${id}' is reached and addressed there`);
 	}
+	const cdn = ctx.config.cdn !== false && construct.servers.length > 0 ? await ensureBucketCdn(ctx, {
+		bucket,
+		region: clients.region,
+		servers: construct.servers,
+		origins: bucketOrigins({
+			workspace: ctx.workspace,
+			manifest: ctx.manifest,
+			runnables: ctx.runnables,
+			stage: ctx.stage,
+			bucket: id
+		}).origins
+	}) : void 0;
 	await ensureBucketSettings(ctx, clients, {
 		id,
 		bucket,
 		exists,
 		versioning,
 		open,
+		...cdn ? { cdn } : {},
 		...construct.expire ? { expire: construct.expire } : {}
 	});
+	const events = watchers ? await ensureBucketEvents(ctx, clients, {
+		id,
+		bucket,
+		region: clients.region
+	}) : void 0;
 	const user = await ensureIamUser(ctx, clients, {
 		id,
 		user: iamUserName(nameInput),
 		policyName: IAM_POLICY_NAME,
-		policy: userPolicy(bucket, { versioning }),
+		policy: userPolicy(bucket, {
+			versioning,
+			...events ? { eventsTopicArn: events.topicArn } : {}
+		}),
 		describe: "this bucket only"
 	});
 	await ensureAccessKey(ctx, clients, {
@@ -1091,8 +2165,22 @@ async function ensureBucket(ctx, stageClients, construct) {
 		urlKey: provideKey(id, "url"),
 		...user
 	});
-	const publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
+	if (events && watchers) {
+		await ensureEventsKey(ctx, {
+			id,
+			topicArn: events.topicArn,
+			region: clients.region
+		});
+		await ensurePushSubscriptions(ctx, {
+			id,
+			events,
+			region: clients.region,
+			watchers
+		});
+	}
+	const bucketUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
 	for (const server of construct.servers) {
+		const publicUrl = cdn?.urls[server.id] ?? bucketUrl;
 		const key = provideKey(server.id, "url");
 		const entry = {
 			key: `file-server:${server.id}`,
@@ -1250,7 +2338,7 @@ async function ensureBucketSettings(ctx, clients, input) {
 			Value: t.Value
 		})) }
 	})));
-	const isOpen = input.open.length > 0;
+	const isOpen = input.open.length > 0 && !input.cdn;
 	const block = publicAccessBlock(isOpen);
 	const ensureBlock = async () => {
 		const now = (await read(() => s3.send(new S3.GetPublicAccessBlockCommand({ Bucket })), ["NoSuchPublicAccessBlockConfiguration"]))?.PublicAccessBlockConfiguration;
@@ -1259,10 +2347,10 @@ async function ensureBucketSettings(ctx, clients, input) {
 			PublicAccessBlockConfiguration: block
 		})));
 	};
-	const policy = bucketPolicy(bucket, input.open);
+	const policy = bucketPolicy(bucket, input.open, input.cdn ? { cdn: input.cdn } : {});
 	const ensurePolicy = async () => {
 		const current = await read(() => s3.send(new S3.GetBucketPolicyCommand({ Bucket })), ["NoSuchBucketPolicy"]);
-		if (!(current?.Policy !== void 0 && canonicalPolicy(JSON.parse(current.Policy)) === canonicalPolicy(policy))) await set(isOpen ? `policy: TLS only, public read on ${input.open.join(", ")}` : "policy: TLS only", () => s3.send(new S3.PutBucketPolicyCommand({
+		if (!(current?.Policy !== void 0 && canonicalPolicy(JSON.parse(current.Policy)) === canonicalPolicy(policy))) await set(isOpen ? `policy: TLS only, public read on ${input.open.join(", ")}` : input.cdn && input.open.length > 0 ? `policy: TLS only, CloudFront reads ${input.open.join(", ")}` : "policy: TLS only", () => s3.send(new S3.PutBucketPolicyCommand({
 			Bucket,
 			Policy: JSON.stringify(policy)
 		})));
@@ -1393,8 +2481,13 @@ const BUILTIN_PROVIDERS = { objects: { s3: {
 	check: checkS3Config,
 	provisioning: S3_PROVISIONING,
 	credentials: awsProvisioningCredentials,
-	runtimeKeys(manifest) {
-		return bucketConstructs(manifest).flatMap((b) => [provideKey(b.id, "url"), ...b.servers.map((s) => provideKey(s.id, "url"))]);
+	runtimeKeys(manifest, runnables = {}) {
+		const watched = bucketWatchers(manifest, runnables);
+		return bucketConstructs(manifest).flatMap((b) => [
+			provideKey(b.id, "url"),
+			...watched.has(b.id) ? [provideKey(b.id, "eventsConnectionString")] : [],
+			...b.servers.map((s) => provideKey(s.id, "url"))
+		]);
 	},
 	ensure: ensureS3,
 	verify: verifyS3
@@ -1519,7 +2612,7 @@ async function provisionStage(options) {
 	}
 	const identity = deployIdentity(workspace, stage);
 	let secrets = (await options.secrets.read())?.custom ?? {};
-	for (const entry of configured) entry.report.planned = entry.provider.runtimeKeys(manifest).filter((key) => secrets[key] === void 0);
+	for (const entry of configured) entry.report.planned = entry.provider.runtimeKeys(manifest, runnables).filter((key) => secrets[key] === void 0);
 	const state = dryRun ? await readOnlyState(options.state, stage) : journalState(await DeployJournal.open(options.state, stage, () => deploysWithCompose(workspace) ? createComposeState(stage) : createEmptyState(stage, "", "")));
 	const writeSecrets = async (values) => {
 		if (dryRun) return;
@@ -1541,6 +2634,7 @@ async function provisionStage(options) {
 			workspace,
 			manifest,
 			runnables,
+			...options.subscribers ? { subscribers: options.subscribers } : {},
 			stage,
 			identity,
 			config: entry.config,
@@ -1558,6 +2652,17 @@ async function provisionStage(options) {
 				log(`   ${dryRun ? "would " : ""}${action.change} — ${action.resource}`);
 			},
 			writeSecrets,
+			writeDns: (records) => writeProviderDns(records, {
+				workspace,
+				stage,
+				dryRun,
+				credentials: options.credentials ?? storedCredentials({
+					env,
+					...options.home ? { home: options.home } : {}
+				}),
+				...options.dnsProviderFor ? { providerFor: options.dnsProviderFor } : {},
+				log
+			}),
 			log
 		});
 		if (entry.report.actions.length === 0) log("   up to date");
@@ -1993,12 +3098,14 @@ async function provisionResources(phaseCtx, request, ctx, store, emit) {
 			stage: phaseCtx.stage,
 			manifest: phaseCtx.manifest,
 			runnables: phaseCtx.runnables ?? {},
+			...phaseCtx.subscribers ? { subscribers: phaseCtx.subscribers } : {},
 			secrets: phaseCtx.secrets,
 			state: store,
 			dryRun: ctx.dryRun,
 			...request.rotateKeys ? { rotateKeys: true } : {},
 			...request.retireOldKeys ? { retireOldKeys: true } : {},
 			...ctx.home ? { home: ctx.home } : {},
+			credentials: ctx.credentials,
 			log: (line) => phaseCtx.logger.info(line)
 		});
 		if (!ctx.dryRun) return;
@@ -2087,11 +3194,13 @@ async function prepare(source, request, ctx, emit, redactor) {
 	assertSitePasswordTarget(configured, stage, resolved.target.name);
 	const runnables = {};
 	const background = {};
+	const subscribers = {};
 	const manifest = await discover({
 		patterns: constructGlobs(configured),
 		cwd: configured.root,
 		runnables,
-		background
+		background,
+		subscribers
 	});
 	resolveStageTelemetry({
 		...configured.deploy?.telemetry ? { telemetry: configured.deploy.telemetry } : {},
@@ -2172,6 +3281,7 @@ async function prepare(source, request, ctx, emit, redactor) {
 			manifest,
 			runnables,
 			background,
+			subscribers,
 			options,
 			dryRun: ctx.dryRun,
 			atomic: request.atomic ?? false,
@@ -2324,6 +3434,6 @@ async function load(input, sandbox) {
 	return workspace;
 }
 //#endregion
-export { UnknownDeployApps as a, bucketName as c, awsEndpoint as d, awsProvisioningCredentials as f, TargetBuildsNothing as i, iamUserName as l, NoDeployableApps as n, backupsUserName as o, RollbackFailed as r, IAM_USER_PATH as s, deploy as t, awsClientConfig as u };
+export { UnknownDeployApps as a, bucketName as c, TargetBuildsNothing as i, iamUserName as l, NoDeployableApps as n, backupsUserName as o, RollbackFailed as r, IAM_USER_PATH as s, deploy as t };
 
-//# sourceMappingURL=deploy-DO4djCHb.mjs.map
+//# sourceMappingURL=deploy-D8pUA9Y0.mjs.map