@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.125

package/dist/{discover-C5roJuc9.mjs → discover-CzGM5P3p.mjs}

@@ -6,15 +6,50 @@ import { t as WORKER_RESULT_MARKER } from "./workerRuntime-CsOyBRx2.mjs";
 import { createRequire } from "node:module";
 import { dirname, join, relative } from "node:path";
 import { existsSync } from "node:fs";
-import { assertDerivations, canonicalId } from "@geekmidas/manifest";
+import { assertDerivations, canonicalId, provideKey } from "@geekmidas/manifest";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { format } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
+import { Processor } from "@geekmidas/constructs/processors";
 import { Queue } from "@geekmidas/constructs/queue";
 import { Subscriber } from "@geekmidas/constructs/subscribers";
 import fg from "fast-glob";
 import kebabCase$1 from "lodash.kebabcase";
+//#region src/reconcile/edges.ts
+/**
+* Edges a process records for what its runnables consume, beyond the
+* construct ids `.dependsOn()` names.
+*/
+const EVENTS_SUFFIX = "#events";
+/**
+* A bucket's events, as an edge: what a process running one of the bucket's
+* subscribers consumes. Not the bucket's id — binding to a bucket's changes
+* is not reading its objects, so the process is handed the events key alone.
+*/
+function eventsEdge(bucketId) {
+	return `${bucketId}${EVENTS_SUFFIX}`;
+}
+/** The bucket an events edge names, or nothing for any other edge. */
+function eventsEdgeBucket(edge) {
+	return edge.endsWith(EVENTS_SUFFIX) ? edge.slice(0, -7) : void 0;
+}
+/**
+* The env key a subscriber's deliveries come from: its topic's publisher
+* connection string, or its bucket's events connection string.
+*/
+function subscriberConnectionKey(construct) {
+	if (construct.bucketName) return provideKey(canonicalId(construct.bucketName), "eventsConnectionString");
+	if (construct.topicName) return provideKey(canonicalId(construct.topicName), "publisherConnectionString");
+}
+/**
+* The key a bucket's relay token is read from, by the process that runs the
+* bucket's subscribers — beside its events connection string.
+*/
+function subscriberTokenKey(construct) {
+	return construct.bucketName ? provideKey(canonicalId(construct.bucketName), "eventsToken") : void 0;
+}
+//#endregion
 //#region src/output.ts
 /**
 * Where the CLI's progress lines go.
@@ -265,6 +300,7 @@ var discover_exports = /* @__PURE__ */ __exportAll({
 	ConstructsNotSerializable: () => ConstructsNotSerializable,
 	DuplicateConstruct: () => DuplicateConstruct,
 	LiveConstructsUnavailable: () => LiveConstructsUnavailable,
+	ProcessorServerUnknown: () => ProcessorServerUnknown,
 	consumedBy: () => consumedBy,
 	discover: () => discover,
 	isDeclarable: () => isDeclarable
@@ -295,7 +331,8 @@ const DiscoverAnswer = discriminatedUnion("reason", [
 		background: record(string(), array(string())).optional(),
 		subscribers: record(string(), array(object({
 			name: string(),
-			topic: string()
+			connectionKey: string(),
+			events: array(string()).optional()
 		}))).optional()
 	}),
 	object({
@@ -422,6 +459,8 @@ async function discover(options) {
 	});
 	/** Matched files, for the diagnostic below. */
 	let matched = 0;
+	/** Each processor, once, by the export that first reached it. */
+	const processors = /* @__PURE__ */ new Map();
 	for await (const found of files) {
 		matched++;
 		const file = found.toString();
@@ -429,6 +468,14 @@ async function discover(options) {
 		for (const [exportName, exported] of Object.entries(module)) {
 			if (options.background) recordBackground(options.background, exported, file);
 			if (options.subscribers) recordSubscriber(options.subscribers, exported, exportName);
+			if (Processor.isProcessor(exported)) {
+				const seenAt = processors.get(exported);
+				if (!seenAt || definedIn(file, seenAt.file)) processors.set(exported, {
+					exportName,
+					file,
+					processor: exported
+				});
+			}
 			if (!isDeclarable(exported)) {
 				if (options.runnables) recordRunnable(options.runnables, exported);
 				continue;
@@ -454,6 +501,7 @@ async function discover(options) {
 			}
 		}
 	}
+	nestProcessors(manifest, [...processors.values()], cwd);
 	assertDerivations(manifest);
 	warnIfNothingFound(globs, matched, Object.keys(manifest).length);
 	return manifest;
@@ -471,22 +519,84 @@ function recordBackground(background, exported, file) {
 	background[key] = files;
 	if (!files.includes(file)) files.push(file);
 }
+/** A processor built from a file server the discovery never found. */
+var ProcessorServerUnknown = class extends GkmError {
+	processor;
+	server;
+	constructor(processor, server) {
+		super(`The processor '${processor}' answers on '${server}', which no discovered file declares. Export the FileServer from a file the workspace's constructs glob matches.`);
+		this.processor = processor;
+		this.server = server;
+		this.name = "ProcessorServerUnknown";
+	}
+};
 /**
-* Record a topic subscriber under the worker that runs it, by its export.
-* Once per name: a file reached twice through a re-export finds it again.
+* Whether `file` is the likelier home of an export also reached from
+* `other`: not a barrel (`index.*`) where the other is, and otherwise the
+* first by path — so the answer never depends on the order the glob
+* streamed them in.
+*/
+function definedIn(file, other) {
+	const barrel = (path) => /(^|[/\\])index\.[cm]?[jt]s$/.test(path);
+	if (barrel(file) !== barrel(other)) return barrel(other);
+	return file < other;
+}
+/**
+* Nest each processor in the file server it answers on.
+*
+* A processor is positional, as a subscriber is: it answers on its server's
+* domain and nothing else. It is nested here, not only by the build, because
+* every deploy path — the compose stack, the CDN in front of the bucket, the
+* SST stack — reads the discovered manifest. Its handler is its source until a
+* build replaces it with the generated one.
+*/
+function nestProcessors(manifest, processors, cwd) {
+	for (const { exportName, file, processor } of processors) {
+		const server = manifest[processor.surfaceId];
+		if (server?.kind !== "file-server") throw new ProcessorServerUnknown(exportName, processor.surfaceId);
+		const declaration = {
+			id: exportName,
+			handler: `${relative(cwd, file)}#${exportName}`,
+			path: processor.pattern,
+			prefix: processor.prefix,
+			...processor.native.length ? { native: [...processor.native] } : {},
+			...processor.timeout !== void 0 ? { timeout: processor.timeout } : {},
+			...processor.memorySize !== void 0 ? { memorySize: processor.memorySize } : {},
+			dependencies: processor.constructs.flatMap((id) => {
+				const target = manifest[canonicalId(id)];
+				return target ? [{
+					target: target.id,
+					kind: target.kind
+				}] : [];
+			})
+		};
+		manifest[server.id] = {
+			...server,
+			processors: [...(server.processors ?? []).filter((p) => p.id !== exportName), declaration].sort((a, b) => a.id.localeCompare(b.id))
+		};
+	}
+}
+/**
+* Record a subscriber — to a topic or to a bucket — under the worker that
+* runs it, by its export. Once per name: a file reached twice through a
+* re-export finds it again.
 */
 function recordSubscriber(subscribers, exported, exportName) {
 	if (!Subscriber.isSubscriber(exported)) return;
-	const { owner, topicName } = exported;
-	if (typeof owner !== "string" || typeof topicName !== "string") return;
+	const owner = exported.owner;
+	const connectionKey = subscriberConnectionKey(exported);
+	if (typeof owner !== "string" || !connectionKey) return;
 	const key = canonicalId(owner);
 	const bound = subscribers[key] ?? [];
 	subscribers[key] = bound;
-	const topic = canonicalId(topicName);
-	if (!bound.some((s) => s.topic === topic && s.name === exportName)) bound.push({
-		name: exportName,
-		topic
-	});
+	if (!bound.some((s) => s.connectionKey === connectionKey && s.name === exportName)) {
+		const events = exported.topicName ? exported.subscribedEvents : void 0;
+		bound.push({
+			name: exportName,
+			connectionKey,
+			...events ? { events: [...events] } : {}
+		});
+	}
 }
 /**
 * What a runnable consumes, by id: a queue's consumer drains that queue, a
@@ -495,9 +605,20 @@ function recordSubscriber(subscribers, exported, exportName) {
 function consumedBy(runnable) {
 	if (Queue.isQueue(runnable)) return [runnable.id];
 	if (Subscriber.isSubscriber(runnable) && runnable.topicName) return [canonicalId(runnable.topicName)];
+	if (Subscriber.isSubscriber(runnable) && runnable.bucketName) return [canonicalId(runnable.bucketName)];
 	return [];
 }
 /**
+* The edges a runnable's process records for what it consumes. A bucket's
+* subscriber consumes the bucket's *events*, not the bucket: binding to its
+* changes is not reading its objects, so its process is handed the events
+* key and not the bucket's URL — that still takes `.dependsOn([bucket])`.
+*/
+function consumedEdges(runnable) {
+	if (Subscriber.isSubscriber(runnable) && runnable.bucketName) return [eventsEdge(canonicalId(runnable.bucketName))];
+	return consumedBy(runnable);
+}
+/**
 * Record a runnable's edges under the construct that owns it — the surface an
 * endpoint was built from, or the worker a cron or subscriber was. Anything
 * with no owner, or that is not a runnable at all, is left alone.
@@ -510,11 +631,12 @@ function recordRunnable(runnables, exported) {
 	const key = canonicalId(owner);
 	const edges = runnables[key] ?? [];
 	runnables[key] = edges;
-	for (const id of [...runnable.constructs, ...consumedBy(exported)]) {
+	for (const id of runnable.constructs) {
 		if (typeof id !== "string") continue;
 		const target = canonicalId(id);
 		if (!edges.includes(target)) edges.push(target);
 	}
+	for (const edge of consumedEdges(exported)) if (!edges.includes(edge)) edges.push(edge);
 }
 /**
 * Say so when a glob was configured and found nothing.
@@ -555,6 +677,6 @@ var DuplicateConstruct = class extends GkmError {
 	}
 };
 //#endregion
-export { discover_exports as a, nodeWithTsx as c, ConstructGenerator as d, output as f, discover as i, runWorker as l, ConstructsNotSerializable as n, isDeclarable as o, withOutput as p, consumedBy as r, SandboxWorkerFailed as s, ConstructDiscoveryFailed as t, withOwningTsconfigJsx as u };
+export { subscriberTokenKey as _, discover_exports as a, nodeWithTsx as c, ConstructGenerator as d, output as f, subscriberConnectionKey as g, eventsEdgeBucket as h, discover as i, runWorker as l, eventsEdge as m, ConstructsNotSerializable as n, isDeclarable as o, withOutput as p, consumedBy as r, SandboxWorkerFailed as s, ConstructDiscoveryFailed as t, withOwningTsconfigJsx as u };
 
-//# sourceMappingURL=discover-C5roJuc9.mjs.map
+//# sourceMappingURL=discover-CzGM5P3p.mjs.map

package/dist/discover-CzGM5P3p.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover-CzGM5P3p.mjs","names":["kebabCase","z.discriminatedUnion","z.object","z.literal","z.record","z.string","z.array","z\n\t\t\t.record","z\n\t\t\t.object"],"sources":["../src/reconcile/edges.ts","../src/output.ts","../src/generators/Generator.ts","../src/owningTsconfigJsx.ts","../src/sandbox/worker.ts","../src/reconcile/discover.ts"],"sourcesContent":["/**\n * Edges a process records for what its runnables consume, beyond the\n * construct ids `.dependsOn()` names.\n */\n\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\n\nconst EVENTS_SUFFIX = '#events';\n\n/**\n * A bucket's events, as an edge: what a process running one of the bucket's\n * subscribers consumes. Not the bucket's id — binding to a bucket's changes\n * is not reading its objects, so the process is handed the events key alone.\n */\nexport function eventsEdge(bucketId: string): string {\n\treturn `${bucketId}${EVENTS_SUFFIX}`;\n}\n\n/** The bucket an events edge names, or nothing for any other edge. */\nexport function eventsEdgeBucket(edge: string): string | undefined {\n\treturn edge.endsWith(EVENTS_SUFFIX)\n\t\t? edge.slice(0, -EVENTS_SUFFIX.length)\n\t\t: undefined;\n}\n\n/**\n * The env key a subscriber's deliveries come from: its topic's publisher\n * connection string, or its bucket's events connection string.\n */\nexport function subscriberConnectionKey(construct: {\n\ttopicName?: string;\n\tbucketName?: string;\n}): string | undefined {\n\tif (construct.bucketName) {\n\t\treturn provideKey(\n\t\t\tcanonicalId(construct.bucketName),\n\t\t\t'eventsConnectionString',\n\t\t);\n\t}\n\tif (construct.topicName) {\n\t\treturn provideKey(\n\t\t\tcanonicalId(construct.topicName),\n\t\t\t'publisherConnectionString',\n\t\t);\n\t}\n\treturn undefined;\n}\n\n/**\n * The key a bucket's relay token is read from, by the process that runs the\n * bucket's subscribers — beside its events connection string.\n */\nexport function subscriberTokenKey(construct: {\n\tbucketName?: string;\n}): string | undefined {\n\treturn construct.bucketName\n\t\t? provideKey(canonicalId(construct.bucketName), 'eventsToken')\n\t\t: undefined;\n}\n","/**\n * Where the CLI's progress lines go.\n *\n * Commands write their progress through `output` rather than `console`. Run\n * from the terminal that is the same thing. Run inside `deploy()`, each line\n * goes to the run that wrote it instead — as an event its caller can iterate,\n * and to the logger it was handed — so a deploy embedded in another program\n * does not print over that program's own output.\n *\n * Carried by `AsyncLocalStorage` rather than passed down, because the lines\n * come from everywhere a deploy reaches — the Dockerfile generator, the env\n * sniffer, construct discovery — and two deploys running in one process must\n * not hear each other.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { format } from 'node:util';\n\n/** How loud a line is. */\nexport type OutputLevel = 'info' | 'warn' | 'error';\n\n/** Receives each line written while it is the current sink. */\nexport type OutputSink = (level: OutputLevel, message: string) => void;\n\nconst current = new AsyncLocalStorage<OutputSink>();\n\n/** Runs `fn` with every line written through `output` sent to `sink`. */\nexport function withOutput<T>(sink: OutputSink, fn: () => T): T {\n\treturn current.run(sink, fn);\n}\n\nfunction write(\n\tlevel: OutputLevel,\n\tfallback: (...args: unknown[]) => void,\n): (...args: unknown[]) => void {\n\treturn (...args) => {\n\t\tconst sink = current.getStore();\n\t\tif (sink) sink(level, format(...args));\n\t\telse fallback(...args);\n\t};\n}\n\n/**\n * `console`, for the methods the CLI logs through — routed to the current\n * run's sink when there is one.\n */\nexport const output = {\n\tlog: write('info', (...args) => console.log(...args)),\n\tinfo: write('info', (...args) => console.info(...args)),\n\twarn: write('warn', (...args) => console.warn(...args)),\n\terror: write('error', (...args) => console.error(...args)),\n};\n","import { relative } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\nimport fg from 'fast-glob';\nimport kebabCase from 'lodash.kebabcase';\nimport type { BuildContext } from '../build/types';\nimport type { MainProvider, Routes } from '../types';\n\n/**\n * Zod v4 maintains a process-wide registry of schemas registered via\n * `.meta({ id })`. When we cache-bust user module imports (by appending a\n * `?t=timestamp` query), those modules re-execute and try to register the\n * same ids again, which throws `ID X already exists in the registry`.\n *\n * Clearing the registry in the CLI process is safe: the user's running\n * server lives in a subprocess and has its own isolated registry.\n *\n * Exported for tests.\n */\nexport function clearZodGlobalRegistry(): void {\n\tconst registry = (\n\t\tglobalThis as { __zod_globalRegistry?: { clear?: () => void } }\n\t).__zod_globalRegistry;\n\tif (registry && typeof registry.clear === 'function') {\n\t\tregistry.clear();\n\t}\n}\n\nexport interface GeneratorOptions {\n\t/** Where the build deploys: one Lambda per construct, or one process. */\n\ttarget?: MainProvider;\n\t/**\n\t * What a handler path in the manifest is relative to — the workspace root,\n\t * which is where `sst.config.ts` runs and resolves it from.\n\t */\n\troot?: string;\n\t[key: string]: any;\n}\n\nexport abstract class ConstructGenerator<T extends Construct, R = void> {\n\tabstract isConstruct(value: any): value is T;\n\n\tstatic async build<T extends Construct, R = void>(\n\t\tcontext: BuildContext,\n\t\toutputDir: string,\n\t\tgenerator: ConstructGenerator<T, R>,\n\t\tpatterns?: Routes,\n\t\toptions?: GeneratorOptions,\n\t): Promise<R> {\n\t\tconst constructs = await generator.load(patterns);\n\t\treturn generator.build(context, constructs, outputDir, options);\n\t}\n\n\tabstract build(\n\t\tcontext: BuildContext,\n\t\tconstructs: GeneratedConstruct<T>[],\n\t\toutputDir: string,\n\t\toptions?: GeneratorOptions,\n\t): Promise<R>;\n\n\tasync load(\n\t\tpatterns?: Routes,\n\t\tcwd = process.cwd(),\n\t\tbustCache = false,\n\t): Promise<GeneratedConstruct<T>[]> {\n\t\tconst logger = console;\n\n\t\tconst globPatterns = Array.isArray(patterns)\n\t\t\t? patterns\n\t\t\t: patterns\n\t\t\t\t? [patterns]\n\t\t\t\t: [];\n\n\t\t// Find all files\n\t\tconst files = fg.stream(globPatterns, {\n\t\t\tcwd,\n\t\t\tabsolute: true,\n\t\t});\n\n\t\t// Cache-busted re-imports re-execute user modules, which would try to\n\t\t// re-register Zod schemas with the same `.meta({ id })`. Clear the\n\t\t// global registry once per load to prevent duplicate-id errors.\n\t\tif (bustCache) {\n\t\t\tclearZodGlobalRegistry();\n\t\t}\n\n\t\t// Load constructs\n\t\tconst constructs: GeneratedConstruct<T>[] = [];\n\n\t\tfor await (const f of files) {\n\t\t\ttry {\n\t\t\t\tconst file = f.toString();\n\t\t\t\t// Append cache-busting query param to force re-import of changed modules\n\t\t\t\tconst importPath = bustCache ? `${file}?t=${Date.now()}` : file;\n\t\t\t\tconst module = await import(importPath);\n\n\t\t\t\t// Check all exports for constructs\n\t\t\t\tfor (const [key, construct] of Object.entries(module)) {\n\t\t\t\t\tif (this.isConstruct(construct)) {\n\t\t\t\t\t\tconstructs.push({\n\t\t\t\t\t\t\tkey,\n\t\t\t\t\t\t\tname: kebabCase(key),\n\t\t\t\t\t\t\tconstruct,\n\t\t\t\t\t\t\tpath: {\n\t\t\t\t\t\t\t\tabsolute: file,\n\t\t\t\t\t\t\t\trelative: relative(process.cwd(), file),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tconst err = error as Error;\n\t\t\t\tlogger.error(`Failed to load ${f}: ${err.message}`);\n\t\t\t\tif (err.stack) {\n\t\t\t\t\tlogger.error(err.stack);\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\n\t\treturn constructs;\n\t}\n}\n\nexport interface GeneratedConstruct<T extends Construct> {\n\tkey: string;\n\tname: string;\n\tconstruct: T;\n\tpath: {\n\t\tabsolute: string;\n\t\trelative: string;\n\t};\n}\n","import { existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath, pathToFileURL } from 'node:url';\n\nconst REGISTER = 'owning-tsconfig-jsx-register.mjs';\n\n/** The CLI's `bin/` was not found above the module looking for it. */\nexport class OwningTsconfigJsxHookMissing extends Error {\n\tconstructor(readonly from: string) {\n\t\tsuper(\n\t\t\t`Could not find bin/${REGISTER} in any directory above '${from}'. ` +\n\t\t\t\t'It ships with @geekmidas/cli beside bin/gkm.mjs; reinstall the ' +\n\t\t\t\t'package if it is missing.',\n\t\t);\n\t\tthis.name = 'OwningTsconfigJsxHookMissing';\n\t}\n}\n\n/**\n * The CLI's `bin/owning-tsconfig-jsx-register.mjs`, as a file URL. Searched\n * upward because this module runs from `src/` in the repo and from a chunk in\n * `dist/` once built, and `bin/` sits beside both.\n */\nfunction registerUrl(): string {\n\tconst from = dirname(fileURLToPath(import.meta.url));\n\tfor (let dir = from; ; dir = dirname(dir)) {\n\t\tconst candidate = join(dir, 'bin', REGISTER);\n\t\tif (existsSync(candidate)) return pathToFileURL(candidate).href;\n\t\tif (dirname(dir) === dir) throw new OwningTsconfigJsxHookMissing(from);\n\t}\n}\n\n/**\n * `NODE_OPTIONS` for a process that runs app code through tsx, with the hook\n * that compiles each `.tsx` with its own tsconfig's JSX settings (see\n * `bin/owning-tsconfig-jsx.mjs`) put in front of every other `--import`, so it\n * is registered before tsx and reads the source on tsx's behalf.\n *\n * `bin/gkm.mjs` already starts the CLI this way, and its children inherit it;\n * this is for those that set `NODE_OPTIONS` themselves, or whose CLI was\n * started with tsx already imported.\n */\nexport function withOwningTsconfigJsx(nodeOptions = ''): string {\n\tif (nodeOptions.includes(REGISTER)) return nodeOptions;\n\treturn [`--import=${registerUrl()}`, nodeOptions].filter(Boolean).join(' ');\n}\n","/**\n * Running one of the CLI's own worker scripts inside a sandbox, and reading\n * back the one JSON value it answers with.\n *\n * The worker imports the project's TypeScript — `gkm.config.ts`, construct\n * modules, an app's entry — so it starts with the CLI's own tsx and the two\n * hooks `gkm` itself runs with (JSX by the owning tsconfig, path aliases by\n * the adjacent one). The host process needs none of them loaded: a program\n * calling `deploy()` without `--import tsx` still loads a TypeScript config.\n */\n\nimport { existsSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath, pathToFileURL } from 'node:url';\nimport type { z } from 'zod';\nimport { withOwningTsconfigJsx } from '../owningTsconfigJsx';\nimport { oncePerRun, type Sandbox } from './sandbox';\nimport { WORKER_RESULT_MARKER } from './workerRuntime';\n\nconst here = dirname(fileURLToPath(import.meta.url));\n\n/**\n * A worker's file: `dist/sandbox/<name>.mjs` once built — whether this module\n * was bundled into `dist/` or sits beside it — or the `.ts` source under tsx.\n */\nexport function workerFile(name: string): string {\n\tconst candidates = [\n\t\tjoin(here, 'sandbox', `${name}.mjs`),\n\t\tjoin(here, `${name}.mjs`),\n\t\tjoin(here, '..', 'sandbox', `${name}.mjs`),\n\t\tjoin(here, `${name}.ts`),\n\t];\n\treturn (\n\t\tcandidates.find((path) => existsSync(path)) ?? join(here, `${name}.ts`)\n\t);\n}\n\n/** tsx, from the CLI's own dependencies — never the project's. */\nexport function tsxUrl(): string {\n\treturn pathToFileURL(createRequire(import.meta.url).resolve('tsx')).href;\n}\n\n/**\n * `node`'s arguments for `script`: the CLI's TypeScript loaders, then any\n * further `imports`, then the script and its `args` — an argument array, so\n * nothing about a path is read by a shell.\n */\nexport function nodeWithTsx(\n\tscript: string,\n\targs: readonly string[],\n\timports: readonly string[] = [],\n): string[] {\n\treturn [\n\t\t...withOwningTsconfigJsx(`--import=${tsxUrl()}`).split(' '),\n\t\t...imports.map((path) => `--import=${pathToFileURL(path).href}`),\n\t\tscript,\n\t\t...args,\n\t];\n}\n\n/** A worker ended without the answer it exists to give. */\nexport class SandboxWorkerFailed extends Error {\n\tconstructor(\n\t\treadonly step: string,\n\t\treadonly exitCode: number | null,\n\t\treadonly stderr: string,\n\t) {\n\t\tsuper(\n\t\t\t`The sandboxed ${step} ended (exit code ${exitCode}) without an ` +\n\t\t\t\t`answer.${stderr.trim() ? `\\n${stderr.trim()}` : ''}\\nIts output ` +\n\t\t\t\t'above says why; the sandbox must be able to run `node` with the ' +\n\t\t\t\t\"CLI's own files at the paths they have here.\",\n\t\t);\n\t\tthis.name = 'SandboxWorkerFailed';\n\t}\n}\n\nexport interface WorkerRun<T> {\n\t/** What the worker answered, as the schema reads it. */\n\tvalue: T;\n\t/** What it wrote to stderr: warnings a caller may pass on. */\n\tstderr: string;\n}\n\n/**\n * Run worker `name` in `sandbox`, and parse its answer with `schema`.\n *\n * The answer is the last marked line on stdout. Anything else the project's\n * code printed is ignored, and an answer the schema refuses is a failure\n * rather than data — a worker in an isolating sandbox runs code the host does\n * not trust.\n *\n * Within a run (`withSandbox`), the same worker asked the same question is\n * started once; every ask gets its own copy of the answer, and its stderr, as\n * though it had run again.\n */\nexport async function runWorker<S extends z.ZodType>(\n\tsandbox: Sandbox,\n\tstep: string,\n\toptions: WorkerOptions<S>,\n): Promise<WorkerRun<z.infer<S>>> {\n\t// A step handed secrets acts on something — a database it migrates — and\n\t// is not a question whose answer can be reused; nor do its secrets belong\n\t// in a cache key.\n\tif (options.secrets) return startWorker(sandbox, step, options);\n\n\tconst key = JSON.stringify([\n\t\toptions.name,\n\t\toptions.cwd,\n\t\toptions.args,\n\t\toptions.env ?? {},\n\t]);\n\tconst answer = await oncePerRun(sandbox, key, () =>\n\t\tstartWorker(sandbox, step, options),\n\t);\n\treturn structuredClone(answer);\n}\n\ninterface WorkerOptions<S extends z.ZodType> {\n\tname: string;\n\targs: readonly string[];\n\tcwd: string;\n\ttimeoutMs: number;\n\tenv?: Readonly<Record<string, string>>;\n\t/** Mounted as files, named by `GKM_SECRETS_DIR` — never variables. */\n\tsecrets?: Readonly<Record<string, string>>;\n\tsignal?: AbortSignal;\n\tschema: S;\n}\n\nasync function startWorker<S extends z.ZodType>(\n\tsandbox: Sandbox,\n\tstep: string,\n\toptions: WorkerOptions<S>,\n): Promise<WorkerRun<z.infer<S>>> {\n\tconst result = await sandbox.exec(\n\t\t'node',\n\t\tnodeWithTsx(workerFile(options.name), options.args),\n\t\t{\n\t\t\tcwd: options.cwd,\n\t\t\tenv: { ...sandbox.env, ...options.env },\n\t\t\ttimeoutMs: options.timeoutMs,\n\t\t\toutput: 'capture',\n\t\t\t...(options.secrets ? { secrets: options.secrets } : {}),\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t},\n\t);\n\n\tconst line = result.stdout\n\t\t.split('\\n')\n\t\t.reverse()\n\t\t.find((l) => l.startsWith(WORKER_RESULT_MARKER));\n\tif (line) {\n\t\ttry {\n\t\t\tconst parsed = options.schema.safeParse(\n\t\t\t\tJSON.parse(line.slice(WORKER_RESULT_MARKER.length)),\n\t\t\t);\n\t\t\tif (parsed.success) return { value: parsed.data, stderr: result.stderr };\n\t\t} catch {\n\t\t\t// Not JSON: as good as no answer.\n\t\t}\n\t}\n\n\tthrow new SandboxWorkerFailed(step, result.exitCode, result.stderr);\n}\n","/**\n * Discovery — one glob, one structural test.\n *\n * A glob per kind is the same specialness the construct model removes, and\n * resources have no kind to be listed under: a declared `ObjectStorage` would\n * never be found by `routes:` or `crons:`. So there is one `constructs` glob,\n * every export of every matching module is inspected, and the per-kind\n * `isConstruct` checks collapse into a single question — does it have an id and\n * can it declare?\n *\n * Structural rather than `instanceof` on purpose. A construct from a different\n * copy of `@geekmidas/constructs` — a linked workspace, two versions in a\n * lockfile — is still a construct, and `instanceof` is exactly the check that\n * says otherwise.\n */\n\nimport { relative } from 'node:path';\nimport { Cron } from '@geekmidas/constructs/crons';\nimport { Processor } from '@geekmidas/constructs/processors';\nimport { Queue } from '@geekmidas/constructs/queue';\nimport { Subscriber } from '@geekmidas/constructs/subscribers';\nimport {\n\tassertDerivations,\n\ttype ConstructManifest,\n\tcanonicalId,\n\ttype Declaration,\n\ttype ProcessorDeclaration,\n} from '@geekmidas/manifest';\nimport fg from 'fast-glob';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport { clearZodGlobalRegistry } from '../generators/Generator';\nimport { output } from '../output';\nimport { activeSandbox, type Sandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\nimport { eventsEdge, subscriberConnectionKey } from './edges';\n\n/** `console`, or the deploy run discovering the manifest. */\nconst logger = output;\n\n/** The construct face discovery needs: an id, and the ability to declare. */\ninterface Declarable {\n\tid: string;\n\tdeclare(): Declaration[];\n}\n\n/**\n * Whether a module export is a construct.\n *\n * Deliberately loose about what else it carries — a construct that also has a\n * `service` is still a construct, and requiring one would exclude the kinds that\n * own no address.\n */\nexport function isDeclarable(value: unknown): value is Declarable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Declarable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\tcandidate.id.length > 0 &&\n\t\ttypeof candidate.declare === 'function'\n\t);\n}\n\nexport interface DiscoverOptions {\n\t/** The glob(s) to search. One pattern, not one per kind. */\n\tpatterns: string | readonly string[];\n\tcwd?: string;\n\t/**\n\t * Re-import changed modules, for the dev watcher.\n\t *\n\t * A single glob makes discovery more central, not less: a new construct file\n\t * has to be picked up on `add`, not only on `change`.\n\t */\n\tbustCache?: boolean;\n\t/**\n\t * Filled in with where each construct was found, when provided.\n\t *\n\t * Discovery is the only thing that knows: it globbed the files and imported\n\t * them. Everything downstream that needs to *write* an import — the build,\n\t * generating a server entry that reads a surface's logger — would otherwise\n\t * have to be told the path in config, which is the string this removes.\n\t *\n\t * An out-parameter rather than a second return value so that every existing\n\t * caller, which wants the manifest and nothing else, is unchanged.\n\t */\n\tsources?: Record<string, ConstructSource>;\n\t/**\n\t * Filled in, when provided, with the ids each owner's runnables declared an\n\t * edge to — keyed by the surface an endpoint was built from, or the worker\n\t * a cron or subscriber was.\n\t *\n\t * A runnable is not a declaration: a surface's endpoints are found by the\n\t * glob, not listed by the surface, so its node says `endpoints: []` until a\n\t * build folds the routes in. Anything deciding what an app's process reaches\n\t * — which keys its container is given — needs those edges before any build,\n\t * and discovery is already importing the files they are in.\n\t */\n\trunnables?: Record<string, string[]>;\n\t/**\n\t * Filled in, when provided, with the files each worker's background work is\n\t * declared in — its crons, queue consumers and topic subscribers — keyed by\n\t * the worker.\n\t *\n\t * What says which app's build carries a worker's entry: the one whose\n\t * directory holds its work. A worker declares no path of its own.\n\t */\n\tbackground?: Record<string, string[]>;\n\t/**\n\t * Filled in, when provided, with each worker's subscribers — by the export\n\t * a push route is named after, and the key its deliveries come from: its\n\t * topic's, or its bucket's events — keyed by the worker.\n\t *\n\t * What says which worker SNS pushes to, and on which paths: a build bound\n\t * for a server records no subscriber in the manifest, because none has a\n\t * handler of its own there.\n\t */\n\tsubscribers?: Record<string, BoundSubscriber[]>;\n\t/**\n\t * Import the construct modules in this sandbox rather than in this\n\t * process. Defaults to the run's own (`withSandbox`), so a deploy's every\n\t * discovery — the engine's included — happens there; with neither, they\n\t * are imported here, as before.\n\t */\n\tsandbox?: Sandbox;\n}\n\n/** A worker's subscriber — to a topic or to a bucket — as discovery found it. */\nexport interface BoundSubscriber {\n\t/** Its export — what its push route is named after. */\n\tname: string;\n\t/**\n\t * The env key its deliveries come from: its topic's publisher connection\n\t * string, or its bucket's events connection string. An `sns://` value is\n\t * what makes SNS push to it.\n\t */\n\tconnectionKey: string;\n\t/**\n\t * The event types a topic subscriber names — its SNS subscription's filter\n\t * on the `type` attribute the topic's publisher sets. Absent for a\n\t * bucket's subscriber: S3 sets no such attribute, and the subscriber's own\n\t * filter decides.\n\t */\n\tevents?: readonly string[];\n}\n\n/** What the discovery worker answers. Checked: the worker ran project code. */\nconst DiscoverAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('discovered'),\n\t\tmanifest: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ id: z.string(), kind: z.string() }).loose(),\n\t\t),\n\t\trunnables: z.record(z.string(), z.array(z.string())),\n\t\tbackground: z.record(z.string(), z.array(z.string())).optional(),\n\t\tsubscribers: z\n\t\t\t.record(\n\t\t\t\tz.string(),\n\t\t\t\tz.array(\n\t\t\t\t\tz.object({\n\t\t\t\t\t\tname: z.string(),\n\t\t\t\t\t\tconnectionKey: z.string(),\n\t\t\t\t\t\tevents: z.array(z.string()).optional(),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t)\n\t\t\t.optional(),\n\t}),\n\tz.object({ reason: z.literal('live'), paths: z.array(z.string()) }),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z\n\t\t\t.object({\n\t\t\t\tname: z.string(),\n\t\t\t\tmessage: z.string(),\n\t\t\t\tid: z.string().optional(),\n\t\t\t\tsources: z.array(z.string()).optional(),\n\t\t\t})\n\t\t\t.loose(),\n\t}),\n]);\n\n/**\n * The manifest, discovered in `sandbox` and handed back as JSON — or\n * `undefined` when it holds something JSON cannot carry and the sandbox is\n * not isolating, for the caller to discover here as before.\n */\nasync function discoverInSandbox(\n\tsandbox: Sandbox,\n\toptions: DiscoverOptions,\n): Promise<ConstructManifest | undefined> {\n\tconst cwd = options.cwd ?? sandbox.root;\n\tconst patterns =\n\t\ttypeof options.patterns === 'string'\n\t\t\t? [options.patterns]\n\t\t\t: [...options.patterns];\n\n\tconst { value, stderr } = await runWorker(sandbox, 'construct discovery', {\n\t\tname: 'discover-worker',\n\t\targs: [JSON.stringify({ patterns, cwd })],\n\t\tcwd,\n\t\ttimeoutMs: DISCOVER_TIMEOUT_MS,\n\t\tschema: DiscoverAnswer,\n\t});\n\n\t// Discovery's own warnings — a glob that matched nothing — are the\n\t// run's, as they would be had it discovered in-process: as written, one\n\t// message, less the newline the worker's `console.warn` ended it with.\n\tif (stderr.trim()) logger.warn(stderr.replace(/\\n$/, ''));\n\n\tswitch (value.reason) {\n\t\tcase 'discovered':\n\t\t\tif (options.runnables) {\n\t\t\t\tfor (const [owner, edges] of Object.entries(value.runnables)) {\n\t\t\t\t\toptions.runnables[owner] = edges;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (options.background) {\n\t\t\t\tfor (const [owner, files] of Object.entries(value.background ?? {})) {\n\t\t\t\t\toptions.background[owner] = files;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (options.subscribers) {\n\t\t\t\tfor (const [owner, bound] of Object.entries(value.subscribers ?? {})) {\n\t\t\t\t\toptions.subscribers[owner] = bound;\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn value.manifest as unknown as ConstructManifest;\n\t\tcase 'failed':\n\t\t\tif (value.error.name === 'DuplicateConstruct' && value.error.id) {\n\t\t\t\tthrow new DuplicateConstruct(value.error.id, value.error.sources ?? []);\n\t\t\t}\n\t\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t\tcase 'live':\n\t\t\tif (sandbox.isolating) throw new ConstructsNotSerializable(value.paths);\n\t\t\treturn undefined;\n\t}\n}\n\n/**\n * A caller asked for the construct objects (`sources`) or a watcher's\n * re-import under an isolating sandbox, where only data comes back.\n */\nexport class LiveConstructsUnavailable extends Error {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'Discovery was asked for the construct objects themselves under an ' +\n\t\t\t\t'isolating sandbox, which hands back only data. Run this step ' +\n\t\t\t\t'without one, or ask only for the manifest.',\n\t\t);\n\t\tthis.name = 'LiveConstructsUnavailable';\n\t}\n}\n\n/** How long discovering a project's constructs may take in a sandbox. */\nconst DISCOVER_TIMEOUT_MS = 60_000;\n\n/** Importing a construct module, or declaring one, threw in the sandbox. */\nexport class ConstructDiscoveryFailed extends Error {\n\tconstructor(\n\t\treadonly errorName: string,\n\t\treadonly detail: string,\n\t) {\n\t\tsuper(`Discovering constructs failed (${errorName}): ${detail}`);\n\t\tthis.name = 'ConstructDiscoveryFailed';\n\t}\n}\n\n/**\n * The constructs' declarations hold something that is not data, and the\n * sandbox they were discovered in hands the deploy nothing but data.\n */\nexport class ConstructsNotSerializable extends Error {\n\tconstructor(readonly paths: readonly string[]) {\n\t\tsuper(\n\t\t\t`The construct manifest holds values that are not plain data at: ` +\n\t\t\t\t`${paths.join(', ')}. Under an isolating sandbox the deploy only ` +\n\t\t\t\t'receives what JSON can carry; deploy with a sandbox that is not ' +\n\t\t\t\t'isolating if the host trusts this project.',\n\t\t);\n\t\tthis.name = 'ConstructsNotSerializable';\n\t}\n}\n\n/** Where a construct was declared, and under what name. */\nexport interface ConstructSource {\n\t/** Absolute path to the module that exported it. */\n\tfile: string;\n\t/** The name it was exported as — what an import statement has to say. */\n\texportName: string;\n\t/**\n\t * The exported construct itself.\n\t *\n\t * What a declaration cannot say — whether it serves itself — the object can\n\t * be asked, and discovery already imported it.\n\t */\n\tconstruct: unknown;\n}\n\n/**\n * Build the construct manifest for a project.\n *\n * Runs the manifest's own validation before returning, so an app is wrong here\n * — where the error names a file — rather than at deploy.\n *\n * @throws {DuplicateConstruct} when two exports claim one id.\n */\nexport async function discover(\n\toptions: DiscoverOptions,\n): Promise<ConstructManifest> {\n\tconst sandbox = options.sandbox ?? activeSandbox();\n\tif (sandbox) {\n\t\tif (!options.sources && !options.bustCache) {\n\t\t\tconst sandboxed = await discoverInSandbox(sandbox, options);\n\t\t\tif (sandboxed) return sandboxed;\n\t\t} else if (sandbox.isolating) {\n\t\t\t// The construct objects themselves, or a re-import for the watcher:\n\t\t\t// neither can cross a sandbox that hands back only data.\n\t\t\tthrow new LiveConstructsUnavailable();\n\t\t}\n\t}\n\n\tconst {\n\t\tpatterns,\n\t\tcwd = process.cwd(),\n\t\tbustCache = false,\n\t\tsources: out,\n\t} = options;\n\n\t// Re-importing user modules re-executes them, and Zod v4 throws on a\n\t// re-registered `.meta({ id })`. Same reason the generators clear it.\n\tif (bustCache) clearZodGlobalRegistry();\n\n\tconst manifest: Record<string, Declaration> = {};\n\t/** Which file declared each id, for the error when two of them do. */\n\tconst sources: Record<string, string> = {};\n\t/**\n\t * Constructs already seen, by identity.\n\t *\n\t * A re-export is the *same object* reached through a second file — ESM\n\t * bindings are live, so `export * from './database.js'` hands back the\n\t * binding rather than a copy. Without this, a barrel file made every\n\t * construct in it appear declared twice, and `constructs/index.ts` is the\n\t * first thing anyone writes in a shared folder.\n\t *\n\t * Identity rather than file is also the more honest rule: what may not\n\t * happen twice is two *different* constructs claiming one id, and that is\n\t * still an error below.\n\t */\n\tconst seen = new WeakSet<object>();\n\n\tconst globs = Array.isArray(patterns) ? [...patterns] : [patterns as string];\n\tconst files = fg.stream(globs, { cwd, absolute: true });\n\n\t/** Matched files, for the diagnostic below. */\n\tlet matched = 0;\n\n\t/** Each processor, once, by the export that first reached it. */\n\tconst processors = new Map<\n\t\tobject,\n\t\t{ exportName: string; file: string; processor: Processor<string> }\n\t>();\n\n\tfor await (const found of files) {\n\t\tmatched++;\n\t\tconst file = found.toString();\n\t\tconst module = await import(bustCache ? `${file}?t=${Date.now()}` : file);\n\n\t\tfor (const [exportName, exported] of Object.entries(module)) {\n\t\t\tif (options.background)\n\t\t\t\trecordBackground(options.background, exported, file);\n\t\t\tif (options.subscribers)\n\t\t\t\trecordSubscriber(options.subscribers, exported, exportName);\n\t\t\tif (Processor.isProcessor(exported)) {\n\t\t\t\tconst seenAt = processors.get(exported);\n\t\t\t\tif (!seenAt || definedIn(file, seenAt.file)) {\n\t\t\t\t\tprocessors.set(exported, { exportName, file, processor: exported });\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (!isDeclarable(exported)) {\n\t\t\t\tif (options.runnables) recordRunnable(options.runnables, exported);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// The same construct, reached again through a re-export. Skipped\n\t\t\t// rather than re-declared: it has already claimed its id, from the\n\t\t\t// file that defined it.\n\t\t\tif (seen.has(exported as object)) continue;\n\t\t\tseen.add(exported as object);\n\n\t\t\t// A construct that is also something a process runs — a queue and its\n\t\t\t// consumer, built from a worker — reaches what it depends on through\n\t\t\t// that process, exactly as an endpoint or a cron does.\n\t\t\tif (\n\t\t\t\toptions.runnables &&\n\t\t\t\ttypeof (exported as { owner?: unknown }).owner === 'string'\n\t\t\t) {\n\t\t\t\trecordRunnable(options.runnables, exported);\n\t\t\t}\n\n\t\t\tfor (const declaration of exported.declare()) {\n\t\t\t\t// Canonicalise here too: a construct built by hand rather than through\n\t\t\t\t// a constructor is still subject to the same identity rule.\n\t\t\t\tconst id = canonicalId(declaration.id);\n\t\t\t\tconst source = relative(cwd, file);\n\n\t\t\t\tconst claimed = sources[id];\n\t\t\t\tif (claimed !== undefined && claimed !== source) {\n\t\t\t\t\tthrow new DuplicateConstruct(id, [claimed, source]);\n\t\t\t\t}\n\n\t\t\t\tmanifest[id] = { ...declaration, id };\n\t\t\t\tsources[id] = source;\n\t\t\t\tif (out) out[id] = { file, exportName, construct: exported };\n\t\t\t}\n\t\t}\n\t}\n\n\tnestProcessors(manifest, [...processors.values()], cwd);\n\n\t// Reference integrity before anyone reads it — a schema tenant naming a\n\t// database that was deleted is a manifest error, not a reconcile failure.\n\tassertDerivations(manifest);\n\n\twarnIfNothingFound(globs, matched, Object.keys(manifest).length);\n\n\treturn manifest;\n}\n\n/**\n * Record where a worker's background work is declared: a cron, a queue\n * consumer or a topic subscriber, under the worker that owns it.\n */\nfunction recordBackground(\n\tbackground: Record<string, string[]>,\n\texported: unknown,\n\tfile: string,\n): void {\n\tif (\n\t\t!Cron.isCron(exported) &&\n\t\t!Queue.isQueue(exported) &&\n\t\t!Subscriber.isSubscriber(exported)\n\t) {\n\t\treturn;\n\t}\n\tconst owner = (exported as { owner?: unknown }).owner;\n\tif (typeof owner !== 'string') return;\n\n\tconst key = canonicalId(owner);\n\tconst files = background[key] ?? [];\n\tbackground[key] = files;\n\tif (!files.includes(file)) files.push(file);\n}\n\n/** A processor built from a file server the discovery never found. */\nexport class ProcessorServerUnknown extends GkmError {\n\tconstructor(\n\t\treadonly processor: string,\n\t\treadonly server: string,\n\t) {\n\t\tsuper(\n\t\t\t`The processor '${processor}' answers on '${server}', which no ` +\n\t\t\t\t`discovered file declares. Export the FileServer from a file the ` +\n\t\t\t\t`workspace's constructs glob matches.`,\n\t\t);\n\t\tthis.name = 'ProcessorServerUnknown';\n\t}\n}\n\n/**\n * Whether `file` is the likelier home of an export also reached from\n * `other`: not a barrel (`index.*`) where the other is, and otherwise the\n * first by path — so the answer never depends on the order the glob\n * streamed them in.\n */\nfunction definedIn(file: string, other: string): boolean {\n\tconst barrel = (path: string) => /(^|[/\\\\])index\\.[cm]?[jt]s$/.test(path);\n\tif (barrel(file) !== barrel(other)) return barrel(other);\n\treturn file < other;\n}\n\n/**\n * Nest each processor in the file server it answers on.\n *\n * A processor is positional, as a subscriber is: it answers on its server's\n * domain and nothing else. It is nested here, not only by the build, because\n * every deploy path — the compose stack, the CDN in front of the bucket, the\n * SST stack — reads the discovered manifest. Its handler is its source until a\n * build replaces it with the generated one.\n */\nfunction nestProcessors(\n\tmanifest: Record<string, Declaration>,\n\tprocessors: readonly {\n\t\texportName: string;\n\t\tfile: string;\n\t\tprocessor: Processor<string>;\n\t}[],\n\tcwd: string,\n): void {\n\tfor (const { exportName, file, processor } of processors) {\n\t\tconst server = manifest[processor.surfaceId];\n\t\tif (server?.kind !== 'file-server') {\n\t\t\tthrow new ProcessorServerUnknown(exportName, processor.surfaceId);\n\t\t}\n\t\tconst declaration: ProcessorDeclaration = {\n\t\t\tid: exportName,\n\t\t\thandler: `${relative(cwd, file)}#${exportName}`,\n\t\t\tpath: processor.pattern,\n\t\t\tprefix: processor.prefix,\n\t\t\t...(processor.native.length ? { native: [...processor.native] } : {}),\n\t\t\t...(processor.timeout !== undefined\n\t\t\t\t? { timeout: processor.timeout }\n\t\t\t\t: {}),\n\t\t\t...(processor.memorySize !== undefined\n\t\t\t\t? { memorySize: processor.memorySize }\n\t\t\t\t: {}),\n\t\t\tdependencies: processor.constructs.flatMap((id) => {\n\t\t\t\tconst target = manifest[canonicalId(id)];\n\t\t\t\treturn target ? [{ target: target.id, kind: target.kind }] : [];\n\t\t\t}),\n\t\t};\n\t\tmanifest[server.id] = {\n\t\t\t...server,\n\t\t\tprocessors: [\n\t\t\t\t...(server.processors ?? []).filter((p) => p.id !== exportName),\n\t\t\t\tdeclaration,\n\t\t\t].sort((a, b) => a.id.localeCompare(b.id)),\n\t\t};\n\t}\n}\n\n/**\n * Record a subscriber — to a topic or to a bucket — under the worker that\n * runs it, by its export. Once per name: a file reached twice through a\n * re-export finds it again.\n */\nfunction recordSubscriber(\n\tsubscribers: Record<string, BoundSubscriber[]>,\n\texported: unknown,\n\texportName: string,\n): void {\n\tif (!Subscriber.isSubscriber(exported)) return;\n\tconst owner = (exported as { owner?: unknown }).owner;\n\tconst connectionKey = subscriberConnectionKey(exported);\n\tif (typeof owner !== 'string' || !connectionKey) return;\n\n\tconst key = canonicalId(owner);\n\tconst bound = subscribers[key] ?? [];\n\tsubscribers[key] = bound;\n\tif (\n\t\t!bound.some(\n\t\t\t(s) => s.connectionKey === connectionKey && s.name === exportName,\n\t\t)\n\t) {\n\t\tconst events = exported.topicName ? exported.subscribedEvents : undefined;\n\t\tbound.push({\n\t\t\tname: exportName,\n\t\t\tconnectionKey,\n\t\t\t...(events ? { events: [...events] } : {}),\n\t\t});\n\t}\n}\n\n/**\n * What a runnable consumes, by id: a queue's consumer drains that queue, a\n * subscriber its topic. Nothing for anything else.\n */\nexport function consumedBy(runnable: unknown): string[] {\n\tif (Queue.isQueue(runnable)) return [runnable.id];\n\tif (Subscriber.isSubscriber(runnable) && runnable.topicName) {\n\t\treturn [canonicalId(runnable.topicName)];\n\t}\n\tif (Subscriber.isSubscriber(runnable) && runnable.bucketName) {\n\t\treturn [canonicalId(runnable.bucketName)];\n\t}\n\treturn [];\n}\n\n/**\n * The edges a runnable's process records for what it consumes. A bucket's\n * subscriber consumes the bucket's *events*, not the bucket: binding to its\n * changes is not reading its objects, so its process is handed the events\n * key and not the bucket's URL — that still takes `.dependsOn([bucket])`.\n */\nfunction consumedEdges(runnable: unknown): string[] {\n\tif (Subscriber.isSubscriber(runnable) && runnable.bucketName) {\n\t\treturn [eventsEdge(canonicalId(runnable.bucketName))];\n\t}\n\treturn consumedBy(runnable);\n}\n\n/**\n * Record a runnable's edges under the construct that owns it — the surface an\n * endpoint was built from, or the worker a cron or subscriber was. Anything\n * with no owner, or that is not a runnable at all, is left alone.\n */\nfunction recordRunnable(\n\trunnables: Record<string, string[]>,\n\texported: unknown,\n): void {\n\tif (typeof exported !== 'object' || exported === null) return;\n\n\tconst runnable = exported as {\n\t\tsurface?: { id?: unknown };\n\t\towner?: unknown;\n\t\tconstructs?: unknown;\n\t};\n\tconst owner =\n\t\ttypeof runnable.surface?.id === 'string'\n\t\t\t? runnable.surface.id\n\t\t\t: typeof runnable.owner === 'string'\n\t\t\t\t? runnable.owner\n\t\t\t\t: undefined;\n\tif (!owner || !Array.isArray(runnable.constructs)) return;\n\n\tconst key = canonicalId(owner);\n\tconst edges = runnables[key] ?? [];\n\trunnables[key] = edges;\n\t// What it consumes is an edge of its process too, so a worker is handed\n\t// the carriers its own work is bound to and no other.\n\tfor (const id of runnable.constructs) {\n\t\tif (typeof id !== 'string') continue;\n\t\tconst target = canonicalId(id);\n\t\tif (!edges.includes(target)) edges.push(target);\n\t}\n\tfor (const edge of consumedEdges(exported)) {\n\t\tif (!edges.includes(edge)) edges.push(edge);\n\t}\n}\n\n/**\n * Say so when a glob was configured and found nothing.\n *\n * The glob is not a filter over declarations already known — it is *how they\n * are found*, by importing what it matches. So a file it misses is a\n * declaration that does not exist, and every symptom of that appears somewhere\n * other than the cause: no container starts, no env key is written, and the\n * application fails on first use against a resource it can see in its own\n * source.\n *\n * Nothing reported it before, because an unmatched file is indistinguishable\n * from a file nobody wrote. These two cases are the ones that are *not*\n * ambiguous — a glob was configured, so something was expected.\n *\n * Silent when no glob is configured at all: that is a project which has not\n * adopted constructs, and has nothing to be missing.\n */\nfunction warnIfNothingFound(\n\tglobs: readonly string[],\n\tmatched: number,\n\tdeclared: number,\n): void {\n\tif (globs.length === 0) return;\n\n\tif (matched === 0) {\n\t\tlogger.warn(\n\t\t\t`\\n⚠️  The constructs glob matched no files, so nothing was declared.\\n` +\n\t\t\t\t`   Patterns: ${globs.join(', ')}\\n` +\n\t\t\t\t`   Nothing will be provisioned — no containers, no env keys, no ` +\n\t\t\t\t`resources.\\n` +\n\t\t\t\t`   A common cause is depth: '*.ts' matches one level, '**/*.ts' ` +\n\t\t\t\t`matches any.`,\n\t\t);\n\t\treturn;\n\t}\n\n\tif (declared === 0) {\n\t\tlogger.warn(\n\t\t\t`\\n⚠️  The constructs glob matched ${matched} file(s) but none declared ` +\n\t\t\t\t`anything.\\n` +\n\t\t\t\t`   Patterns: ${globs.join(', ')}\\n` +\n\t\t\t\t`   Discovery keeps exports with an 'id' that can 'declare()'. A ` +\n\t\t\t\t`construct that is\\n` +\n\t\t\t\t`   built but never exported is invisible to it.`,\n\t\t);\n\t}\n}\n\n/** Two constructs claiming one id. */\nexport class DuplicateConstruct extends GkmError {\n\t/** The id claimed twice. */\n\treadonly id: string;\n\t/** The files that claimed it. */\n\treadonly sources: readonly string[];\n\n\tconstructor(id: string, sources: readonly string[]) {\n\t\tsuper('Two constructs declare the same id');\n\t\tthis.name = 'DuplicateConstruct';\n\t\tthis.id = id;\n\t\tthis.sources = sources;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAOA,MAAM,gBAAgB;;;;;;AAOtB,SAAgB,WAAW,UAA0B;CACpD,OAAO,GAAG,WAAW;AACtB;;AAGA,SAAgB,iBAAiB,MAAkC;CAClE,OAAO,KAAK,SAAS,aAAa,IAC/B,KAAK,MAAM,GAAG,EAAqB,IACnC,KAAA;AACJ;;;;;AAMA,SAAgB,wBAAwB,WAGjB;CACtB,IAAI,UAAU,YACb,OAAO,WACN,YAAY,UAAU,UAAU,GAChC,wBACD;CAED,IAAI,UAAU,WACb,OAAO,WACN,YAAY,UAAU,SAAS,GAC/B,2BACD;AAGF;;;;;AAMA,SAAgB,mBAAmB,WAEZ;CACtB,OAAO,UAAU,aACd,WAAW,YAAY,UAAU,UAAU,GAAG,aAAa,IAC3D,KAAA;AACJ;;;;;;;;;;;;;;;;;AClCA,MAAM,UAAU,IAAI,kBAA8B;;AAGlD,SAAgB,WAAc,MAAkB,IAAgB;CAC/D,OAAO,QAAQ,IAAI,MAAM,EAAE;AAC5B;AAEA,SAAS,MACR,OACA,UAC+B;CAC/B,QAAQ,GAAG,SAAS;EACnB,MAAM,OAAO,QAAQ,SAAS;EAC9B,IAAI,MAAM,KAAK,OAAO,OAAO,GAAG,IAAI,CAAC;OAChC,SAAS,GAAG,IAAI;CACtB;AACD;;;;;AAMA,MAAa,SAAS;CACrB,KAAK,MAAM,SAAS,GAAG,SAAS,QAAQ,IAAI,GAAG,IAAI,CAAC;CACpD,MAAM,MAAM,SAAS,GAAG,SAAS,QAAQ,KAAK,GAAG,IAAI,CAAC;CACtD,MAAM,MAAM,SAAS,GAAG,SAAS,QAAQ,KAAK,GAAG,IAAI,CAAC;CACtD,OAAO,MAAM,UAAU,GAAG,SAAS,QAAQ,MAAM,GAAG,IAAI,CAAC;AAC1D;;;;;;;;;;;;;;ACjCA,SAAgB,yBAA+B;CAC9C,MAAM,WACL,WACC;CACF,IAAI,YAAY,OAAO,SAAS,UAAU,YACzC,SAAS,MAAM;AAEjB;AAaA,IAAsB,qBAAtB,MAAwE;CAGvE,aAAa,MACZ,SACA,WACA,WACA,UACA,SACa;EACb,MAAM,aAAa,MAAM,UAAU,KAAK,QAAQ;EAChD,OAAO,UAAU,MAAM,SAAS,YAAY,WAAW,OAAO;CAC/D;CASA,MAAM,KACL,UACA,MAAM,QAAQ,IAAI,GAClB,YAAY,OACuB;EACnC,MAAM,SAAS;EAEf,MAAM,eAAe,MAAM,QAAQ,QAAQ,IACxC,WACA,WACC,CAAC,QAAQ,IACT,CAAC;EAGL,MAAM,QAAQ,GAAG,OAAO,cAAc;GACrC;GACA,UAAU;EACX,CAAC;EAKD,IAAI,WACH,uBAAuB;EAIxB,MAAM,aAAsC,CAAC;EAE7C,WAAW,MAAM,KAAK,OACrB,IAAI;GACH,MAAM,OAAO,EAAE,SAAS;GAGxB,MAAM,SAAS,OADI,YAAA,OAAY,GAAG,KAAK,KAAK,KAAK,IAAI,OAAA,OAAM;GAI3D,KAAK,MAAM,CAAC,KAAK,cAAc,OAAO,QAAQ,MAAM,GACnD,IAAI,KAAK,YAAY,SAAS,GAC7B,WAAW,KAAK;IACf;IACA,MAAMA,YAAU,GAAG;IACnB;IACA,MAAM;KACL,UAAU;KACV,UAAU,SAAS,QAAQ,IAAI,GAAG,IAAI;IACvC;GACD,CAAC;EAGJ,SAAS,OAAO;GACf,MAAM,MAAM;GACZ,OAAO,MAAM,kBAAkB,EAAE,IAAI,IAAI,SAAS;GAClD,IAAI,IAAI,OACP,OAAO,MAAM,IAAI,KAAK;GAEvB,MAAM;EACP;EAGD,OAAO;CACR;AACD;;;ACrHA,MAAM,WAAW;;AAGjB,IAAa,+BAAb,cAAkD,MAAM;CAClC;CAArB,YAAY,MAAuB;EAClC,MACC,sBAAsB,SAAS,2BAA2B,KAAK,4FAGhE;EALoB,KAAA,OAAA;EAMpB,KAAK,OAAO;CACb;AACD;;;;;;AAOA,SAAS,cAAsB;CAC9B,MAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;CACnD,KAAK,IAAI,MAAM,OAAQ,MAAM,QAAQ,GAAG,GAAG;EAC1C,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ;EAC3C,IAAI,WAAW,SAAS,GAAG,OAAO,cAAc,SAAS,CAAC,CAAC;EAC3D,IAAI,QAAQ,GAAG,MAAM,KAAK,MAAM,IAAI,6BAA6B,IAAI;CACtE;AACD;;;;;;;;;;;AAYA,SAAgB,sBAAsB,cAAc,IAAY;CAC/D,IAAI,YAAY,SAAS,QAAQ,GAAG,OAAO;CAC3C,OAAO,CAAC,YAAY,YAAY,KAAK,WAAW,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;AAC3E;;;;;;;;;;;;;ACzBA,MAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;;;;;AAMnD,SAAgB,WAAW,MAAsB;CAOhD,OACC;EANA,KAAK,MAAM,WAAW,GAAG,KAAK,KAAK;EACnC,KAAK,MAAM,GAAG,KAAK,KAAK;EACxB,KAAK,MAAM,MAAM,WAAW,GAAG,KAAK,KAAK;EACzC,KAAK,MAAM,GAAG,KAAK,IAAI;CAGd,CAAC,CAAC,MAAM,SAAS,WAAW,IAAI,CAAC,KAAK,KAAK,MAAM,GAAG,KAAK,IAAI;AAExE;;AAGA,SAAgB,SAAiB;CAChC,OAAO,cAAc,cAAc,YAAY,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;AACrE;;;;;;AAOA,SAAgB,YACf,QACA,MACA,UAA6B,CAAC,GACnB;CACX,OAAO;EACN,GAAG,sBAAsB,YAAY,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG;EAC1D,GAAG,QAAQ,KAAK,SAAS,YAAY,cAAc,IAAI,CAAC,CAAC,MAAM;EAC/D;EACA,GAAG;CACJ;AACD;;AAGA,IAAa,sBAAb,cAAyC,MAAM;CAEpC;CACA;CACA;CAHV,YACC,MACA,UACA,QACC;EACD,MACC,iBAAiB,KAAK,oBAAoB,SAAS,sBACxC,OAAO,KAAK,IAAI,KAAK,OAAO,KAAK,MAAM,GAAG,4HAGtD;EATS,KAAA,OAAA;EACA,KAAA,WAAA;EACA,KAAA,SAAA;EAQT,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;AAqBA,eAAsB,UACrB,SACA,MACA,SACiC;CAIjC,IAAI,QAAQ,SAAS,OAAO,YAAY,SAAS,MAAM,OAAO;CAE9D,MAAM,MAAM,KAAK,UAAU;EAC1B,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ,OAAO,CAAC;CACjB,CAAC;CACD,MAAM,SAAS,MAAM,WAAW,SAAS,WACxC,YAAY,SAAS,MAAM,OAAO,CACnC;CACA,OAAO,gBAAgB,MAAM;AAC9B;AAcA,eAAe,YACd,SACA,MACA,SACiC;CACjC,MAAM,SAAS,MAAM,QAAQ,KAC5B,QACA,YAAY,WAAW,QAAQ,IAAI,GAAG,QAAQ,IAAI,GAClD;EACC,KAAK,QAAQ;EACb,KAAK;GAAE,GAAG,QAAQ;GAAK,GAAG,QAAQ;EAAI;EACtC,WAAW,QAAQ;EACnB,QAAQ;EACR,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACtD,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;CACpD,CACD;CAEA,MAAM,OAAO,OAAO,OAClB,MAAM,IAAI,CAAC,CACX,QAAQ,CAAC,CACT,MAAM,MAAM,EAAE,WAAW,oBAAoB,CAAC;CAChD,IAAI,MACH,IAAI;EACH,MAAM,SAAS,QAAQ,OAAO,UAC7B,KAAK,MAAM,KAAK,MAAM,qBAAqB,MAAM,CAAC,CACnD;EACA,IAAI,OAAO,SAAS,OAAO;GAAE,OAAO,OAAO;GAAM,QAAQ,OAAO;EAAO;CACxE,QAAQ,CAER;CAGD,MAAM,IAAI,oBAAoB,MAAM,OAAO,UAAU,OAAO,MAAM;AACnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/HA,MAAM,SAAS;;;;;;;;AAef,SAAgB,aAAa,OAAqC;CACjE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,YAAY;CAElB,OACC,OAAO,UAAU,OAAO,YACxB,UAAU,GAAG,SAAS,KACtB,OAAO,UAAU,YAAY;AAE/B;;AAqFA,MAAM,iBAAiBC,mBAAqB,UAAU;CACrDC,OAAS;EACR,QAAQC,QAAU,YAAY;EAC9B,UAAUC,OACTC,OAAS,GACTH,OAAS;GAAE,IAAIG,OAAS;GAAG,MAAMA,OAAS;EAAE,CAAC,CAAC,CAAC,MAAM,CACtD;EACA,WAAWD,OAASC,OAAS,GAAGC,MAAQD,OAAS,CAAC,CAAC;EACnD,YAAYD,OAASC,OAAS,GAAGC,MAAQD,OAAS,CAAC,CAAC,CAAC,CAAC,SAAS;EAC/D,aAAaE,OAEXF,OAAS,GACTC,MACCJ,OAAS;GACR,MAAMG,OAAS;GACf,eAAeA,OAAS;GACxB,QAAQC,MAAQD,OAAS,CAAC,CAAC,CAAC,SAAS;EACtC,CAAC,CACF,CACD,CAAC,CACA,SAAS;CACZ,CAAC;CACDH,OAAS;EAAE,QAAQC,QAAU,MAAM;EAAG,OAAOG,MAAQD,OAAS,CAAC;CAAE,CAAC;CAClEH,OAAS;EACR,QAAQC,QAAU,QAAQ;EAC1B,OAAOK,OACE;GACP,MAAMH,OAAS;GACf,SAASA,OAAS;GAClB,IAAIA,OAAS,CAAC,CAAC,SAAS;GACxB,SAASC,MAAQD,OAAS,CAAC,CAAC,CAAC,SAAS;EACvC,CAAC,CAAC,CACD,MAAM;CACT,CAAC;AACF,CAAC;;;;;;AAOD,eAAe,kBACd,SACA,SACyC;CACzC,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,WACL,OAAO,QAAQ,aAAa,WACzB,CAAC,QAAQ,QAAQ,IACjB,CAAC,GAAG,QAAQ,QAAQ;CAExB,MAAM,EAAE,OAAO,WAAW,MAAM,UAAU,SAAS,uBAAuB;EACzE,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE;GAAU;EAAI,CAAC,CAAC;EACxC;EACA,WAAW;EACX,QAAQ;CACT,CAAC;CAKD,IAAI,OAAO,KAAK,GAAG,OAAO,KAAK,OAAO,QAAQ,OAAO,EAAE,CAAC;CAExD,QAAQ,MAAM,QAAd;EACC,KAAK;GACJ,IAAI,QAAQ,WACX,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,MAAM,SAAS,GAC1D,QAAQ,UAAU,SAAS;GAG7B,IAAI,QAAQ,YACX,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,MAAM,cAAc,CAAC,CAAC,GACjE,QAAQ,WAAW,SAAS;GAG9B,IAAI,QAAQ,aACX,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,MAAM,eAAe,CAAC,CAAC,GAClE,QAAQ,YAAY,SAAS;GAG/B,OAAO,MAAM;EACd,KAAK;GACJ,IAAI,MAAM,MAAM,SAAS,wBAAwB,MAAM,MAAM,IAC5D,MAAM,IAAI,mBAAmB,MAAM,MAAM,IAAI,MAAM,MAAM,WAAW,CAAC,CAAC;GAEvE,MAAM,IAAI,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;EACzE,KAAK;GACJ,IAAI,QAAQ,WAAW,MAAM,IAAI,0BAA0B,MAAM,KAAK;GACtE;CACF;AACD;;;;;AAMA,IAAa,4BAAb,cAA+C,MAAM;CACpD,cAAc;EACb,MACC,2KAGD;EACA,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,sBAAsB;;AAG5B,IAAa,2BAAb,cAA8C,MAAM;CAEzC;CACA;CAFV,YACC,WACA,QACC;EACD,MAAM,kCAAkC,UAAU,KAAK,QAAQ;EAHtD,KAAA,YAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACb;AACD;;;;;AAMA,IAAa,4BAAb,cAA+C,MAAM;CAC/B;CAArB,YAAY,OAAmC;EAC9C,MACC,mEACI,MAAM,KAAK,IAAI,EAAE,wJAGtB;EANoB,KAAA,QAAA;EAOpB,KAAK,OAAO;CACb;AACD;;;;;;;;;AAyBA,eAAsB,SACrB,SAC6B;CAC7B,MAAM,UAAU,QAAQ,WAAW,cAAc;CACjD,IAAI,SAAS;EACZ,IAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,WAAW;GAC3C,MAAM,YAAY,MAAM,kBAAkB,SAAS,OAAO;GAC1D,IAAI,WAAW,OAAO;EACvB,OAAO,IAAI,QAAQ,WAGlB,MAAM,IAAI,0BAA0B;CAEtC;CAEA,MAAM,EACL,UACA,MAAM,QAAQ,IAAI,GAClB,YAAY,OACZ,SAAS,QACN;CAIJ,IAAI,WAAW,uBAAuB;CAEtC,MAAM,WAAwC,CAAC;;CAE/C,MAAM,UAAkC,CAAC;;;;;;;;;;;;;;CAczC,MAAM,uBAAO,IAAI,QAAgB;CAEjC,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,QAAkB;CAC3E,MAAM,QAAQ,GAAG,OAAO,OAAO;EAAE;EAAK,UAAU;CAAK,CAAC;;CAGtD,IAAI,UAAU;;CAGd,MAAM,6BAAa,IAAI,IAGrB;CAEF,WAAW,MAAM,SAAS,OAAO;EAChC;EACA,MAAM,OAAO,MAAM,SAAS;EAC5B,MAAM,SAAS,OAAa,YAAA,OAAY,GAAG,KAAK,KAAK,KAAK,IAAI,OAAA,OAAM;EAEpE,KAAK,MAAM,CAAC,YAAY,aAAa,OAAO,QAAQ,MAAM,GAAG;GAC5D,IAAI,QAAQ,YACX,iBAAiB,QAAQ,YAAY,UAAU,IAAI;GACpD,IAAI,QAAQ,aACX,iBAAiB,QAAQ,aAAa,UAAU,UAAU;GAC3D,IAAI,UAAU,YAAY,QAAQ,GAAG;IACpC,MAAM,SAAS,WAAW,IAAI,QAAQ;IACtC,IAAI,CAAC,UAAU,UAAU,MAAM,OAAO,IAAI,GACzC,WAAW,IAAI,UAAU;KAAE;KAAY;KAAM,WAAW;IAAS,CAAC;GAEpE;GACA,IAAI,CAAC,aAAa,QAAQ,GAAG;IAC5B,IAAI,QAAQ,WAAW,eAAe,QAAQ,WAAW,QAAQ;IACjE;GACD;GAKA,IAAI,KAAK,IAAI,QAAkB,GAAG;GAClC,KAAK,IAAI,QAAkB;GAK3B,IACC,QAAQ,aACR,OAAQ,SAAiC,UAAU,UAEnD,eAAe,QAAQ,WAAW,QAAQ;GAG3C,KAAK,MAAM,eAAe,SAAS,QAAQ,GAAG;IAG7C,MAAM,KAAK,YAAY,YAAY,EAAE;IACrC,MAAM,SAAS,SAAS,KAAK,IAAI;IAEjC,MAAM,UAAU,QAAQ;IACxB,IAAI,YAAY,KAAA,KAAa,YAAY,QACxC,MAAM,IAAI,mBAAmB,IAAI,CAAC,SAAS,MAAM,CAAC;IAGnD,SAAS,MAAM;KAAE,GAAG;KAAa;IAAG;IACpC,QAAQ,MAAM;IACd,IAAI,KAAK,IAAI,MAAM;KAAE;KAAM;KAAY,WAAW;IAAS;GAC5D;EACD;CACD;CAEA,eAAe,UAAU,CAAC,GAAG,WAAW,OAAO,CAAC,GAAG,GAAG;CAItD,kBAAkB,QAAQ;CAE1B,mBAAmB,OAAO,SAAS,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAM;CAE/D,OAAO;AACR;;;;;AAMA,SAAS,iBACR,YACA,UACA,MACO;CACP,IACC,CAAC,KAAK,OAAO,QAAQ,KACrB,CAAC,MAAM,QAAQ,QAAQ,KACvB,CAAC,WAAW,aAAa,QAAQ,GAEjC;CAED,MAAM,QAAS,SAAiC;CAChD,IAAI,OAAO,UAAU,UAAU;CAE/B,MAAM,MAAM,YAAY,KAAK;CAC7B,MAAM,QAAQ,WAAW,QAAQ,CAAC;CAClC,WAAW,OAAO;CAClB,IAAI,CAAC,MAAM,SAAS,IAAI,GAAG,MAAM,KAAK,IAAI;AAC3C;;AAGA,IAAa,yBAAb,cAA4C,SAAS;CAE1C;CACA;CAFV,YACC,WACA,QACC;EACD,MACC,kBAAkB,UAAU,gBAAgB,OAAO,iHAGpD;EAPS,KAAA,YAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACb;AACD;;;;;;;AAQA,SAAS,UAAU,MAAc,OAAwB;CACxD,MAAM,UAAU,SAAiB,8BAA8B,KAAK,IAAI;CACxE,IAAI,OAAO,IAAI,MAAM,OAAO,KAAK,GAAG,OAAO,OAAO,KAAK;CACvD,OAAO,OAAO;AACf;;;;;;;;;;AAWA,SAAS,eACR,UACA,YAKA,KACO;CACP,KAAK,MAAM,EAAE,YAAY,MAAM,eAAe,YAAY;EACzD,MAAM,SAAS,SAAS,UAAU;EAClC,IAAI,QAAQ,SAAS,eACpB,MAAM,IAAI,uBAAuB,YAAY,UAAU,SAAS;EAEjE,MAAM,cAAoC;GACzC,IAAI;GACJ,SAAS,GAAG,SAAS,KAAK,IAAI,EAAE,GAAG;GACnC,MAAM,UAAU;GAChB,QAAQ,UAAU;GAClB,GAAI,UAAU,OAAO,SAAS,EAAE,QAAQ,CAAC,GAAG,UAAU,MAAM,EAAE,IAAI,CAAC;GACnE,GAAI,UAAU,YAAY,KAAA,IACvB,EAAE,SAAS,UAAU,QAAQ,IAC7B,CAAC;GACJ,GAAI,UAAU,eAAe,KAAA,IAC1B,EAAE,YAAY,UAAU,WAAW,IACnC,CAAC;GACJ,cAAc,UAAU,WAAW,SAAS,OAAO;IAClD,MAAM,SAAS,SAAS,YAAY,EAAE;IACtC,OAAO,SAAS,CAAC;KAAE,QAAQ,OAAO;KAAI,MAAM,OAAO;IAAK,CAAC,IAAI,CAAC;GAC/D,CAAC;EACF;EACA,SAAS,OAAO,MAAM;GACrB,GAAG;GACH,YAAY,CACX,IAAI,OAAO,cAAc,CAAC,EAAA,CAAG,QAAQ,MAAM,EAAE,OAAO,UAAU,GAC9D,WACD,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;EAC1C;CACD;AACD;;;;;;AAOA,SAAS,iBACR,aACA,UACA,YACO;CACP,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;CACxC,MAAM,QAAS,SAAiC;CAChD,MAAM,gBAAgB,wBAAwB,QAAQ;CACtD,IAAI,OAAO,UAAU,YAAY,CAAC,eAAe;CAEjD,MAAM,MAAM,YAAY,KAAK;CAC7B,MAAM,QAAQ,YAAY,QAAQ,CAAC;CACnC,YAAY,OAAO;CACnB,IACC,CAAC,MAAM,MACL,MAAM,EAAE,kBAAkB,iBAAiB,EAAE,SAAS,UACxD,GACC;EACD,MAAM,SAAS,SAAS,YAAY,SAAS,mBAAmB,KAAA;EAChE,MAAM,KAAK;GACV,MAAM;GACN;GACA,GAAI,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC;EACzC,CAAC;CACF;AACD;;;;;AAMA,SAAgB,WAAW,UAA6B;CACvD,IAAI,MAAM,QAAQ,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE;CAChD,IAAI,WAAW,aAAa,QAAQ,KAAK,SAAS,WACjD,OAAO,CAAC,YAAY,SAAS,SAAS,CAAC;CAExC,IAAI,WAAW,aAAa,QAAQ,KAAK,SAAS,YACjD,OAAO,CAAC,YAAY,SAAS,UAAU,CAAC;CAEzC,OAAO,CAAC;AACT;;;;;;;AAQA,SAAS,cAAc,UAA6B;CACnD,IAAI,WAAW,aAAa,QAAQ,KAAK,SAAS,YACjD,OAAO,CAAC,WAAW,YAAY,SAAS,UAAU,CAAC,CAAC;CAErD,OAAO,WAAW,QAAQ;AAC3B;;;;;;AAOA,SAAS,eACR,WACA,UACO;CACP,IAAI,OAAO,aAAa,YAAY,aAAa,MAAM;CAEvD,MAAM,WAAW;CAKjB,MAAM,QACL,OAAO,SAAS,SAAS,OAAO,WAC7B,SAAS,QAAQ,KACjB,OAAO,SAAS,UAAU,WACzB,SAAS,QACT,KAAA;CACL,IAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,SAAS,UAAU,GAAG;CAEnD,MAAM,MAAM,YAAY,KAAK;CAC7B,MAAM,QAAQ,UAAU,QAAQ,CAAC;CACjC,UAAU,OAAO;CAGjB,KAAK,MAAM,MAAM,SAAS,YAAY;EACrC,IAAI,OAAO,OAAO,UAAU;EAC5B,MAAM,SAAS,YAAY,EAAE;EAC7B,IAAI,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM,KAAK,MAAM;CAC/C;CACA,KAAK,MAAM,QAAQ,cAAc,QAAQ,GACxC,IAAI,CAAC,MAAM,SAAS,IAAI,GAAG,MAAM,KAAK,IAAI;AAE5C;;;;;;;;;;;;;;;;;;AAmBA,SAAS,mBACR,OACA,SACA,UACO;CACP,IAAI,MAAM,WAAW,GAAG;CAExB,IAAI,YAAY,GAAG;EAClB,OAAO,KACN,sFACiB,MAAM,KAAK,IAAI,EAAE,2JAKnC;EACA;CACD;CAEA,IAAI,aAAa,GAChB,OAAO,KACN,qCAAqC,QAAQ,qDAE5B,MAAM,KAAK,IAAI,EAAE,qIAInC;AAEF;;AAGA,IAAa,qBAAb,cAAwC,SAAS;;CAEhD;;CAEA;CAEA,YAAY,IAAY,SAA4B;EACnD,MAAM,oCAAoC;EAC1C,KAAK,OAAO;EACZ,KAAK,KAAK;EACV,KAAK,UAAU;CAChB;AACD"}

package/dist/{discover-DozUKs8f.cjs → discover-DL6h-J97.cjs}

@@ -11,12 +11,47 @@ let node_url = require("node:url");
 let node_async_hooks = require("node:async_hooks");
 let node_util = require("node:util");
 let _geekmidas_constructs_crons = require("@geekmidas/constructs/crons");
+let _geekmidas_constructs_processors = require("@geekmidas/constructs/processors");
 let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_subscribers = require("@geekmidas/constructs/subscribers");
 let fast_glob = require("fast-glob");
 fast_glob = require_rolldown_runtime.__toESM(fast_glob, 1);
 let lodash_kebabcase = require("lodash.kebabcase");
 lodash_kebabcase = require_rolldown_runtime.__toESM(lodash_kebabcase, 1);
+//#region src/reconcile/edges.ts
+/**
+* Edges a process records for what its runnables consume, beyond the
+* construct ids `.dependsOn()` names.
+*/
+const EVENTS_SUFFIX = "#events";
+/**
+* A bucket's events, as an edge: what a process running one of the bucket's
+* subscribers consumes. Not the bucket's id — binding to a bucket's changes
+* is not reading its objects, so the process is handed the events key alone.
+*/
+function eventsEdge(bucketId) {
+	return `${bucketId}${EVENTS_SUFFIX}`;
+}
+/** The bucket an events edge names, or nothing for any other edge. */
+function eventsEdgeBucket(edge) {
+	return edge.endsWith(EVENTS_SUFFIX) ? edge.slice(0, -7) : void 0;
+}
+/**
+* The env key a subscriber's deliveries come from: its topic's publisher
+* connection string, or its bucket's events connection string.
+*/
+function subscriberConnectionKey(construct) {
+	if (construct.bucketName) return (0, _geekmidas_manifest.provideKey)((0, _geekmidas_manifest.canonicalId)(construct.bucketName), "eventsConnectionString");
+	if (construct.topicName) return (0, _geekmidas_manifest.provideKey)((0, _geekmidas_manifest.canonicalId)(construct.topicName), "publisherConnectionString");
+}
+/**
+* The key a bucket's relay token is read from, by the process that runs the
+* bucket's subscribers — beside its events connection string.
+*/
+function subscriberTokenKey(construct) {
+	return construct.bucketName ? (0, _geekmidas_manifest.provideKey)((0, _geekmidas_manifest.canonicalId)(construct.bucketName), "eventsToken") : void 0;
+}
+//#endregion
 //#region src/output.ts
 /**
 * Where the CLI's progress lines go.
@@ -267,6 +302,7 @@ var discover_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	ConstructsNotSerializable: () => ConstructsNotSerializable,
 	DuplicateConstruct: () => DuplicateConstruct,
 	LiveConstructsUnavailable: () => LiveConstructsUnavailable,
+	ProcessorServerUnknown: () => ProcessorServerUnknown,
 	consumedBy: () => consumedBy,
 	discover: () => discover,
 	isDeclarable: () => isDeclarable
@@ -297,7 +333,8 @@ const DiscoverAnswer = require_schemas.discriminatedUnion("reason", [
 		background: require_schemas.record(require_schemas.string(), require_schemas.array(require_schemas.string())).optional(),
 		subscribers: require_schemas.record(require_schemas.string(), require_schemas.array(require_schemas.object({
 			name: require_schemas.string(),
-			topic: require_schemas.string()
+			connectionKey: require_schemas.string(),
+			events: require_schemas.array(require_schemas.string()).optional()
 		}))).optional()
 	}),
 	require_schemas.object({
@@ -424,6 +461,8 @@ async function discover(options) {
 	});
 	/** Matched files, for the diagnostic below. */
 	let matched = 0;
+	/** Each processor, once, by the export that first reached it. */
+	const processors = /* @__PURE__ */ new Map();
 	for await (const found of files) {
 		matched++;
 		const file = found.toString();
@@ -431,6 +470,14 @@ async function discover(options) {
 		for (const [exportName, exported] of Object.entries(module)) {
 			if (options.background) recordBackground(options.background, exported, file);
 			if (options.subscribers) recordSubscriber(options.subscribers, exported, exportName);
+			if (_geekmidas_constructs_processors.Processor.isProcessor(exported)) {
+				const seenAt = processors.get(exported);
+				if (!seenAt || definedIn(file, seenAt.file)) processors.set(exported, {
+					exportName,
+					file,
+					processor: exported
+				});
+			}
 			if (!isDeclarable(exported)) {
 				if (options.runnables) recordRunnable(options.runnables, exported);
 				continue;
@@ -456,6 +503,7 @@ async function discover(options) {
 			}
 		}
 	}
+	nestProcessors(manifest, [...processors.values()], cwd);
 	(0, _geekmidas_manifest.assertDerivations)(manifest);
 	warnIfNothingFound(globs, matched, Object.keys(manifest).length);
 	return manifest;
@@ -473,22 +521,84 @@ function recordBackground(background, exported, file) {
 	background[key] = files;
 	if (!files.includes(file)) files.push(file);
 }
+/** A processor built from a file server the discovery never found. */
+var ProcessorServerUnknown = class extends require_errors.GkmError {
+	processor;
+	server;
+	constructor(processor, server) {
+		super(`The processor '${processor}' answers on '${server}', which no discovered file declares. Export the FileServer from a file the workspace's constructs glob matches.`);
+		this.processor = processor;
+		this.server = server;
+		this.name = "ProcessorServerUnknown";
+	}
+};
 /**
-* Record a topic subscriber under the worker that runs it, by its export.
-* Once per name: a file reached twice through a re-export finds it again.
+* Whether `file` is the likelier home of an export also reached from
+* `other`: not a barrel (`index.*`) where the other is, and otherwise the
+* first by path — so the answer never depends on the order the glob
+* streamed them in.
+*/
+function definedIn(file, other) {
+	const barrel = (path) => /(^|[/\\])index\.[cm]?[jt]s$/.test(path);
+	if (barrel(file) !== barrel(other)) return barrel(other);
+	return file < other;
+}
+/**
+* Nest each processor in the file server it answers on.
+*
+* A processor is positional, as a subscriber is: it answers on its server's
+* domain and nothing else. It is nested here, not only by the build, because
+* every deploy path — the compose stack, the CDN in front of the bucket, the
+* SST stack — reads the discovered manifest. Its handler is its source until a
+* build replaces it with the generated one.
+*/
+function nestProcessors(manifest, processors, cwd) {
+	for (const { exportName, file, processor } of processors) {
+		const server = manifest[processor.surfaceId];
+		if (server?.kind !== "file-server") throw new ProcessorServerUnknown(exportName, processor.surfaceId);
+		const declaration = {
+			id: exportName,
+			handler: `${(0, node_path.relative)(cwd, file)}#${exportName}`,
+			path: processor.pattern,
+			prefix: processor.prefix,
+			...processor.native.length ? { native: [...processor.native] } : {},
+			...processor.timeout !== void 0 ? { timeout: processor.timeout } : {},
+			...processor.memorySize !== void 0 ? { memorySize: processor.memorySize } : {},
+			dependencies: processor.constructs.flatMap((id) => {
+				const target = manifest[(0, _geekmidas_manifest.canonicalId)(id)];
+				return target ? [{
+					target: target.id,
+					kind: target.kind
+				}] : [];
+			})
+		};
+		manifest[server.id] = {
+			...server,
+			processors: [...(server.processors ?? []).filter((p) => p.id !== exportName), declaration].sort((a, b) => a.id.localeCompare(b.id))
+		};
+	}
+}
+/**
+* Record a subscriber — to a topic or to a bucket — under the worker that
+* runs it, by its export. Once per name: a file reached twice through a
+* re-export finds it again.
 */
 function recordSubscriber(subscribers, exported, exportName) {
 	if (!_geekmidas_constructs_subscribers.Subscriber.isSubscriber(exported)) return;
-	const { owner, topicName } = exported;
-	if (typeof owner !== "string" || typeof topicName !== "string") return;
+	const owner = exported.owner;
+	const connectionKey = subscriberConnectionKey(exported);
+	if (typeof owner !== "string" || !connectionKey) return;
 	const key = (0, _geekmidas_manifest.canonicalId)(owner);
 	const bound = subscribers[key] ?? [];
 	subscribers[key] = bound;
-	const topic = (0, _geekmidas_manifest.canonicalId)(topicName);
-	if (!bound.some((s) => s.topic === topic && s.name === exportName)) bound.push({
-		name: exportName,
-		topic
-	});
+	if (!bound.some((s) => s.connectionKey === connectionKey && s.name === exportName)) {
+		const events = exported.topicName ? exported.subscribedEvents : void 0;
+		bound.push({
+			name: exportName,
+			connectionKey,
+			...events ? { events: [...events] } : {}
+		});
+	}
 }
 /**
 * What a runnable consumes, by id: a queue's consumer drains that queue, a
@@ -497,9 +607,20 @@ function recordSubscriber(subscribers, exported, exportName) {
 function consumedBy(runnable) {
 	if (_geekmidas_constructs_queue.Queue.isQueue(runnable)) return [runnable.id];
 	if (_geekmidas_constructs_subscribers.Subscriber.isSubscriber(runnable) && runnable.topicName) return [(0, _geekmidas_manifest.canonicalId)(runnable.topicName)];
+	if (_geekmidas_constructs_subscribers.Subscriber.isSubscriber(runnable) && runnable.bucketName) return [(0, _geekmidas_manifest.canonicalId)(runnable.bucketName)];
 	return [];
 }
 /**
+* The edges a runnable's process records for what it consumes. A bucket's
+* subscriber consumes the bucket's *events*, not the bucket: binding to its
+* changes is not reading its objects, so its process is handed the events
+* key and not the bucket's URL — that still takes `.dependsOn([bucket])`.
+*/
+function consumedEdges(runnable) {
+	if (_geekmidas_constructs_subscribers.Subscriber.isSubscriber(runnable) && runnable.bucketName) return [eventsEdge((0, _geekmidas_manifest.canonicalId)(runnable.bucketName))];
+	return consumedBy(runnable);
+}
+/**
 * Record a runnable's edges under the construct that owns it — the surface an
 * endpoint was built from, or the worker a cron or subscriber was. Anything
 * with no owner, or that is not a runnable at all, is left alone.
@@ -512,11 +633,12 @@ function recordRunnable(runnables, exported) {
 	const key = (0, _geekmidas_manifest.canonicalId)(owner);
 	const edges = runnables[key] ?? [];
 	runnables[key] = edges;
-	for (const id of [...runnable.constructs, ...consumedBy(exported)]) {
+	for (const id of runnable.constructs) {
 		if (typeof id !== "string") continue;
 		const target = (0, _geekmidas_manifest.canonicalId)(id);
 		if (!edges.includes(target)) edges.push(target);
 	}
+	for (const edge of consumedEdges(exported)) if (!edges.includes(edge)) edges.push(edge);
 }
 /**
 * Say so when a glob was configured and found nothing.
@@ -599,6 +721,18 @@ Object.defineProperty(exports, "discover_exports", {
 		return discover_exports;
 	}
 });
+Object.defineProperty(exports, "eventsEdge", {
+	enumerable: true,
+	get: function() {
+		return eventsEdge;
+	}
+});
+Object.defineProperty(exports, "eventsEdgeBucket", {
+	enumerable: true,
+	get: function() {
+		return eventsEdgeBucket;
+	}
+});
 Object.defineProperty(exports, "isDeclarable", {
 	enumerable: true,
 	get: function() {
@@ -623,6 +757,18 @@ Object.defineProperty(exports, "runWorker", {
 		return runWorker;
 	}
 });
+Object.defineProperty(exports, "subscriberConnectionKey", {
+	enumerable: true,
+	get: function() {
+		return subscriberConnectionKey;
+	}
+});
+Object.defineProperty(exports, "subscriberTokenKey", {
+	enumerable: true,
+	get: function() {
+		return subscriberTokenKey;
+	}
+});
 Object.defineProperty(exports, "withOutput", {
 	enumerable: true,
 	get: function() {
@@ -636,4 +782,4 @@ Object.defineProperty(exports, "withOwningTsconfigJsx", {
 	}
 });
 
-//# sourceMappingURL=discover-DozUKs8f.cjs.map
+//# sourceMappingURL=discover-DL6h-J97.cjs.map