@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.125

package/dist/{seeds-Dv78P9LS.mjs → seeds-CK7w79VC.mjs}

@@ -1,14 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
-import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as UnknownSecretsStoreProvider, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, j as TEST_STAGE, pt as SERVER_IPV6_KEY, ut as s3SecretsLocation, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-DUnnVjqC.mjs";
+import { s as run$1, x as gkmHome } from "./credentials-DpfnUvIR.mjs";
+import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as UnknownSecretsStoreProvider, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, j as TEST_STAGE, pt as SERVER_IPV6_KEY, ut as s3SecretsLocation, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-DBHF9Gba.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { a as readFakes, c as DEFAULT_STORAGE, i as readCredentialFakes, l as holdsEveryCache, o as DEFAULT_CACHE, s as DEFAULT_EVENTS$1, t as SubscriberGenerator } from "./SubscriberGenerator-y3pncae_.mjs";
+import { c as DEFAULT_CACHE, d as holdsEveryCache, i as readFakes, l as DEFAULT_EVENTS$1, o as objectsRoute, r as readCredentialFakes, t as SubscriberGenerator, u as DEFAULT_STORAGE } from "./SubscriberGenerator-ocQ2yj0K.mjs";
 import { n as deployIdentity } from "./identity-CBXr4wNi.mjs";
-import { a as startTelemetryCode, n as runtimeFor, s as writeTelemetryModule, u as telemetryArgs } from "./EndpointGenerator-CP_z_E3e.mjs";
-import { d as ConstructGenerator, f as output, i as discover } from "./discover-C5roJuc9.mjs";
+import { a as startTelemetryCode, n as runtimeFor, s as writeTelemetryModule, u as telemetryArgs } from "./EndpointGenerator-errMeldx.mjs";
+import { d as ConstructGenerator, f as output, h as eventsEdgeBucket, i as discover } from "./discover-CzGM5P3p.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { c as runtimeOf } from "./resolve-j8hUcbGz.mjs";
+import { c as runtimeOf } from "./resolve-BCU9pYDx.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -16,7 +16,7 @@ import { homedir, hostname, networkInterfaces, userInfo } from "node:os";
 import { execFile, spawn } from "node:child_process";
 import { createServer } from "node:net";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from "node:crypto";
-import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, PUBLIC_PREFIX, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, drawSecret, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
+import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, PUBLIC_PREFIX, TELEMETRY_KEYS, bucketExpiry, cacheTable, cookieDomain, dependenciesOf, dependentsOf, drawSecret, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
 import { formatKeyring, generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import * as snsUrl from "@geekmidas/events/sns/url";
@@ -25,8 +25,9 @@ import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import { config } from "dotenv";
 import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
+import { Processor } from "@geekmidas/constructs/processors";
 import { Queue } from "@geekmidas/constructs/queue";
-import { CreateBucketCommand, DeleteBucketLifecycleCommand, GetBucketLifecycleConfigurationCommand, GetBucketPolicyCommand, HeadBucketCommand, ListBucketsCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, DeleteBucketLifecycleCommand, GetBucketLifecycleConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, HeadBucketCommand, ListBucketsCommand, PutBucketLifecycleConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
 import { CreateTopicCommand, GetTopicAttributesCommand, SNSClient } from "@aws-sdk/client-sns";
 import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/client-sqs";
 import { Client } from "pg";
@@ -486,6 +487,21 @@ function volumeOf(container) {
 	}[container];
 }
 //#endregion
+//#region src/generators/processorRoute.ts
+/**
+* Where `gkm dev` serves a file server's processors, on the dev server of the
+* app holding them: named after the file server.
+*
+* One definition for both sides — the dev server mounts it, and the local
+* edge rewrites each processor pattern on the file server's host onto it — so
+* the path the edge sends and the path the server answers cannot drift.
+*/
+const PROCESSORS_DEV_PREFIX = "/__gkm/processors/";
+/** The base a file server's processors answer under, in `gkm dev`. */
+function processorsDevRoute(fileServerId) {
+	return `${PROCESSORS_DEV_PREFIX}${fileServerId}`;
+}
+//#endregion
 //#region src/reconcile/caddyfile.ts
 /**
 * The Caddy configuration a plan implies.
@@ -535,7 +551,7 @@ const EDGE_KINDS = {
 * Docker Desktop resolves this name already; on Linux the compose definition
 * maps it to the host gateway.
 */
-const HOST_GATEWAY = "host.docker.internal";
+const HOST_GATEWAY$1 = "host.docker.internal";
 /**
 * The suffix every local host shares.
 *
@@ -552,19 +568,26 @@ const LOCAL_TLD = "localhost";
 * are a legitimate arrangement — two cache behaviours, one origin — and naming
 * the host after the bucket would make them collide.
 */
-function sitesFor(plan, project, addresses = {}) {
+function sitesFor(plan, project, addresses = {}, processorAddresses = {}) {
 	const byId = new Map(plan.resources.map((r) => [r.id, r]));
 	const sites = [];
 	for (const resource of plan.resources) {
 		if (!EDGE_KINDS[resource.kind]) continue;
-		const host = hostFor(resource, project);
+		const host = hostFor$1(resource, project);
 		if (resource.kind === "file-server") {
 			const origin = resource.of ? byId.get(resource.of) : void 0;
 			if (!origin) continue;
+			const address = processorAddresses[resource.id];
+			const port = address ? portOf(address) : void 0;
 			sites.push({
 				host,
 				upstream: "http://minio:9000",
-				rewrite: `/${origin.name}{uri}`
+				rewrite: `/${origin.name}{uri}`,
+				...resource.processors?.length && port ? { processors: {
+					prefixes: resource.processors,
+					upstream: `http://${HOST_GATEWAY$1}:${port}`,
+					under: processorsDevRoute(resource.id)
+				} } : {}
 			});
 			continue;
 		}
@@ -574,7 +597,7 @@ function sitesFor(plan, project, addresses = {}) {
 		if (!port) continue;
 		sites.push({
 			host,
-			upstream: `http://${HOST_GATEWAY}:${port}`
+			upstream: `http://${HOST_GATEWAY$1}:${port}`
 		});
 	}
 	return sites;
@@ -596,7 +619,7 @@ function portOf(address) {
 * name, because an empty label makes `uploads..localhost` — a host nothing
 * resolves and no certificate can be issued for.
 */
-function hostFor(resource, project) {
+function hostFor$1(resource, project) {
 	return [
 		resource.root && project ? stageOf(resource) : labelOf(resource),
 		project,
@@ -654,14 +677,24 @@ function toCaddyfile(sites) {
 	if (sites.length === 0) return `${GENERATED}
 # No file server is declared in this stage, so it routes nothing.
 `;
-	const blocks = sites.map(({ host, upstream, rewrite }) => `
+	const blocks = sites.map(({ host, upstream, rewrite, processors }) => `
 https://${host} {
 	tls internal
 
 	# gkm's own header, which only a service of this stack may send: the auth
 	# server rate-limits by the client address it carries.
 	request_header -${CLIENT_IP_HEADER}
-
+${processors ? `
+	# Its processors' patterns, to the dev server holding them — under the
+	# route it mounts them on. Answered there, so the bucket below never is.
+	@processors path ${processors.prefixes.map((prefix) => `${prefix}*`).join(" ")}
+	handle @processors {
+		reverse_proxy ${processors.upstream} {
+			rewrite ${processors.under}{uri}
+			header_up Host {host}
+		}
+	}
+` : ""}
 	reverse_proxy ${upstream} {${rewrite ? `
 		rewrite ${rewrite}
 		# MinIO routes and signs on the Host header, so forwarding the requested
@@ -720,6 +753,108 @@ function emulatorQueueUrl(name, port) {
 	return `${emulatorEndpoint(port)}/${EMULATOR_ACCOUNT}/${name}`;
 }
 //#endregion
+//#region src/reconcile/objectEvents.ts
+/**
+* A bucket's object events, where the bucket is a local MinIO.
+*
+* S3 publishes a bucket's events to a topic the deploy creates; MinIO has no
+* topic to publish to, but it can post each event to a webhook. So where MinIO
+* holds a watched bucket, it posts the bucket's events to the process that
+* runs the bucket's subscribers, on a route only it can use, and that process
+* relays each one onto the events broker — under the bucket's name, as
+* `object.created` or `object.deleted` — where every subscriber drains a queue
+* of its own, as a topic's subscribers do.
+*
+* Declared to MinIO in two halves, both derived here so they cannot drift:
+*
+* - **a webhook target per bucket**, as container environment: where to post,
+*   the token to present, and a queue on disk, because MinIO starts before the
+*   process it posts to and must keep what it could not deliver;
+* - **the bucket's notification**, written through the S3 API once the bucket
+*   exists: every created and removed object, to that target. Unfiltered —
+*   two subscribers watching overlapping prefixes are two rules S3 refuses on
+*   one bucket, and each subscriber filters what it is handed anyway.
+*/
+/**
+* The token MinIO presents when it posts a bucket's events.
+*
+* Derived, never stored: the container and the process it posts to are handed
+* the same value by the same derivation — with the stage's random seed where a
+* deployed stage's stack has one, so the token is a secret there, and from the
+* project alone locally, where everything it would protect is on loopback.
+* Not salted by the stage: one MinIO serves `gkm dev` and `gkm test`, and a
+* target is declared once per container.
+*/
+function objectsWebhookToken(project, bucket, seed) {
+	return createHash("sha256").update(`${seed ? `${seed}:` : ""}${project}:objects-webhook:${bucket}`).digest("base64url").slice(0, 32);
+}
+/**
+* The target's id in MinIO's environment — `MINIO_NOTIFY_WEBHOOK_*_<ID>`.
+*
+* Upper-cased with nothing between words: a canonical id is letters and
+* digits, and an underscore inside the id would read as part of the setting's
+* name.
+*/
+function minioTargetId(bucket) {
+	return bucket.toUpperCase();
+}
+/** The target as a notification names it. */
+function minioTargetArn(bucket) {
+	return `arn:minio:sqs::${minioTargetId(bucket)}:webhook`;
+}
+/** How a container reaches a process on the host. */
+const HOST_GATEWAY = "host.docker.internal";
+/** Where MinIO keeps what it could not deliver yet, inside its container. */
+const QUEUE_ROOT = "/gkm-object-events";
+/** The id of the notification rule gkm owns on a bucket. */
+const NOTIFICATION_RULE_PREFIX = "gkm-";
+/**
+* MinIO's environment for each watched bucket's webhook target.
+*
+* Sorted, so the same buckets always render the same environment and a
+* reconcile that changed nothing does not recreate the container.
+*/
+function minioWebhookEnv(hooks) {
+	const env = {};
+	for (const hook of [...hooks].sort((a, b) => a.bucket.localeCompare(b.bucket))) {
+		const id = minioTargetId(hook.bucket);
+		env[`MINIO_NOTIFY_WEBHOOK_ENABLE_${id}`] = "on";
+		env[`MINIO_NOTIFY_WEBHOOK_ENDPOINT_${id}`] = hook.endpoint;
+		env[`MINIO_NOTIFY_WEBHOOK_AUTH_TOKEN_${id}`] = hook.token;
+		env[`MINIO_NOTIFY_WEBHOOK_QUEUE_DIR_${id}`] = `${QUEUE_ROOT}/${id.toLowerCase()}`;
+	}
+	return env;
+}
+/** The rule that sends every created and removed object to the bucket's target. */
+function minioNotificationRule(bucket) {
+	return {
+		Id: `${NOTIFICATION_RULE_PREFIX}${bucket}`,
+		QueueArn: minioTargetArn(bucket),
+		Events: ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"]
+	};
+}
+/**
+* Each watched bucket, and the workers that run one of its subscribers.
+*
+* A bucket is watched when a subscriber reads its events key. MinIO posts a
+* bucket's events to one place, and the relay fans them out to every
+* subscriber whichever worker received them — so one worker per bucket is
+* enough, and the first, by id, is the one chosen, so the choice is stable.
+*/
+function watchedBuckets(manifest, subscribers) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const declaration of Object.values(manifest)) {
+		if (declaration.kind !== "objects") continue;
+		byKey.set(provideKey(declaration.id, "eventsConnectionString"), declaration.id);
+	}
+	const watched = /* @__PURE__ */ new Map();
+	for (const worker of Object.keys(subscribers).sort()) for (const { connectionKey } of subscribers[worker] ?? []) {
+		const bucket = byKey.get(connectionKey);
+		if (bucket && !watched.has(bucket)) watched.set(bucket, worker);
+	}
+	return watched;
+}
+//#endregion
 //#region src/telemetry/edges.ts
 /**
 * Which processes use a `Telemetry` node — read off the manifest's edges.
@@ -744,13 +879,14 @@ function nodeOf(manifest, id) {
 	return node?.kind === "telemetry" ? node : void 0;
 }
 /**
-* The `Telemetry` node the process for `id` — a surface or a worker, by
-* construct id — emits through, or undefined when it has no edge to one.
+* The `Telemetry` node the process for `id` — a surface, a worker, or a file
+* server's processor unit, by construct id — emits through, or undefined
+* when it has no edge to one.
 */
 function telemetryOf(manifest, id) {
 	const declaration = manifest[id];
 	if (!declaration) return void 0;
-	if (declaration.kind === "worker") return nodeOf(manifest, declaration.telemetry);
+	if (declaration.kind === "worker" || declaration.kind === "file-server") return nodeOf(manifest, declaration.telemetry);
 	if (declaration.kind !== "rest-api") return void 0;
 	return nodeOf(manifest, declaration.telemetry);
 }
@@ -764,7 +900,7 @@ function appTelemetry(manifest, appName) {
 }
 /** Whether any process in the manifest emits through a `Telemetry` node. */
 function usesTelemetry(manifest) {
-	return Object.entries(manifest).some(([id, d]) => (d.kind === "rest-api" || d.kind === "worker") && telemetryOf(manifest, id) !== void 0);
+	return Object.entries(manifest).some(([id, d]) => (d.kind === "rest-api" || d.kind === "worker" || d.kind === "file-server") && telemetryOf(manifest, id) !== void 0);
 }
 /**
 * One process's share of the telemetry keys a stage resolved: all of them,
@@ -1025,7 +1161,8 @@ function planFor(manifest, stage, order, options = {}) {
 				...declaration.scheme ? { scheme: declaration.scheme } : {}
 			} : {},
 			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
-			...declaration.kind === "objects" && declaration.expire ? { expire: declaration.expire } : {},
+			...declaration.kind === "file-server" && declaration.processors?.length ? { processors: [...new Set(declaration.processors.map((p) => p.prefix))].sort() } : {},
+			...declaration.kind === "objects" && bucketExpiry(manifest, id) ? { expire: bucketExpiry(manifest, id) } : {},
 			...(declaration.kind === "rest-api" || declaration.kind === "site") && declaration.subdomain ? { subdomain: declaration.subdomain } : {},
 			...fake ? { fake: {
 				key: fake.key,
@@ -1215,6 +1352,14 @@ function envFor(plan, options) {
 	}
 	Object.assign(env, publicEnv(plan, env, options.addresses));
 	Object.assign(env, brokerEnv(plan, options.ports, credential));
+	const relay = env.EVENT_PUBLISHER_CONNECTION_STRING;
+	if (relay && options.relayedBuckets?.length) for (const resource of plan.resources) {
+		if (resource.kind !== "objects" || resource.container !== "minio") continue;
+		if (!options.relayedBuckets.includes(resource.id)) continue;
+		if (!env[resource.envKey]) continue;
+		env[provideKey(resource.id, "eventsConnectionString")] = relay;
+		env[provideKey(resource.id, "eventsToken")] = objectsWebhookToken(options.project ?? "", resource.id, credential.seed);
+	}
 	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, storageCredentials(options.credentials));
 	return env;
 }
@@ -1366,7 +1511,7 @@ function urlFor(resource, plan, ports, project, addresses, credential) {
 	if (resource.kind === "rest-api" || resource.kind === "site") {
 		const address = addresses?.[resource.id];
 		const edge = plan.containers.includes("caddy") ? ports[primaryPortKey("caddy")] : void 0;
-		return address && edge !== void 0 ? `https://${hostFor(resource, project)}:${edge}` : address;
+		return address && edge !== void 0 ? `https://${hostFor$1(resource, project)}:${edge}` : address;
 	}
 	if (!resource.container) return void 0;
 	const port = ports[primaryPortKey(resource.container)];
@@ -1393,7 +1538,7 @@ function urlFor(resource, plan, ports, project, addresses, credential) {
 		case "file-server": {
 			const origin = plan.resources.find((r) => r.id === resource.of);
 			if (!origin) return void 0;
-			return plan.containers.includes("caddy") ? `https://${hostFor(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
+			return plan.containers.includes("caddy") ? `https://${hostFor$1(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
 		}
 		case "cache":
 			if (resource.of) {
@@ -2582,6 +2727,56 @@ async function databasesExist(client, names) {
 	}
 }
 /**
+* Point each watched bucket's events at its webhook target, and stop sending
+* an unwatched one's.
+*
+* Merged rather than written whole: only the rule gkm owns on a bucket
+* (`gkm-<Bucket>`) is added or removed, and every other rule — one somebody
+* added by hand — is kept. Compared before writing, so a converged reconcile
+* changes nothing.
+*
+* @param buckets - each bucket the plan names, by construct id and name
+* @param watched - the construct ids whose events are relayed
+*/
+async function applyNotifications(client, buckets, watched) {
+	const applied = [];
+	for (const { id, name } of buckets) {
+		const current = await client.notification(name);
+		const queues = current.QueueConfigurations ?? [];
+		const others = queues.filter((rule) => !rule.Id?.startsWith(NOTIFICATION_RULE_PREFIX));
+		const wanted = watched.has(id) ? [...others, minioNotificationRule(id)] : others;
+		if (!watched.has(id) && others.length === queues.length) continue;
+		const describe = `object events from ${name}`;
+		const ours = queues.filter((rule) => rule.Id?.startsWith(NOTIFICATION_RULE_PREFIX));
+		if (watched.has(id) ? ours.length === 1 && sameRule(ours[0], minioNotificationRule(id)) : ours.length === 0) {
+			applied.push({
+				id: `${name}:events`,
+				describe,
+				created: false
+			});
+			continue;
+		}
+		await client.setNotification(name, {
+			...current,
+			QueueConfigurations: wanted
+		});
+		applied.push({
+			id: `${name}:events`,
+			describe,
+			created: true
+		});
+	}
+	return applied;
+}
+/**
+* Whether a rule read back says what gkm wrote: the same target, the same
+* events in any order, and no filter — the store may hand back an empty one.
+*/
+function sameRule(current, wanted) {
+	const filter = current.Filter;
+	return current.Id === wanted.Id && current.QueueArn === wanted.QueueArn && JSON.stringify([...current.Events ?? []].sort()) === JSON.stringify([...wanted.Events ?? []].sort()) && (filter?.Key?.FilterRules?.length ?? 0) === 0;
+}
+/**
 * Apply each bucket's expiry, beside whatever other rules it has, skipping
 * those already correct — the same merge the `s3` provider makes deployed.
 */
@@ -2703,14 +2898,7 @@ var WorkerNameTaken = class extends GkmError {
 * @param background Each worker's files, from discovery's `background`.
 */
 function workerUnits(workspace, manifest, background) {
-	const hosts = Object.entries(workspace.apps).filter(([, app]) => app.type === "backend" && !app.entry).map(([name, app]) => {
-		const surface = Object.entries(manifest).find(([id, d]) => d.kind === "rest-api" && appKey(id) === name)?.[1];
-		return {
-			name,
-			root: isAbsolute(app.path) ? app.path : join(workspace.root, app.path),
-			generated: !(surface?.kind === "rest-api" && surface.endpoints.length > 0)
-		};
-	}).sort((a, b) => a.name.localeCompare(b.name));
+	const hosts = hostApps(workspace, manifest);
 	const units = [];
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "worker") continue;
@@ -2718,12 +2906,8 @@ function workerUnits(workspace, manifest, background) {
 		if (files.length === 0) continue;
 		const name = appKey(id);
 		if (workspace.apps[name]) throw new WorkerNameTaken(id, name);
-		const ranked = hosts.map((host) => ({
-			host,
-			holds: files.filter((file) => isUnder(file, host.root)).length
-		})).sort((a, b) => b.holds - a.holds || Number(b.host.generated) - Number(a.host.generated));
-		const host = ranked[0]?.host;
-		if (!host || ranked[0].holds === 0 && !host.generated) throw new WorkerHasNoApp(id);
+		const host = hostFor(hosts, files);
+		if (!host) throw new WorkerHasNoApp(id);
 		units.push({
 			id,
 			name,
@@ -2732,6 +2916,70 @@ function workerUnits(workspace, manifest, background) {
 	}
 	return units.sort((a, b) => a.name.localeCompare(b.name));
 }
+/** The service and image name of a file server's processors: `assets-processors`. */
+function processorUnitName(fileServerId) {
+	return `${appKey(fileServerId.replace(/Server$/, ""))}-processors`;
+}
+/** A file server with processors and no backend app to build them from. */
+var ProcessorsHaveNoApp = class extends GkmError {
+	fileServer;
+	constructor(fileServer) {
+		super(`The file server '${fileServer}' has processors, and the workspace has no backend app that builds a server to carry their entry. Declare a RestApi whose app holds the processors' code.`);
+		this.fileServer = fileServer;
+		this.name = "ProcessorsHaveNoApp";
+	}
+};
+/**
+* The processor units a workspace deploys — each file server with processors
+* — and the app each is built from, chosen as a worker's is: the backend app
+* holding the most of its processors' files.
+*/
+function processorUnits(workspace, manifest) {
+	const hosts = hostApps(workspace, manifest);
+	const units = [];
+	for (const declaration of Object.values(manifest)) {
+		if (declaration.kind !== "file-server") continue;
+		const processors = declaration.processors ?? [];
+		if (processors.length === 0) continue;
+		const host = hostFor(hosts, processors.map(({ handler }) => {
+			const file = handler.split("#")[0] ?? handler;
+			return isAbsolute(file) ? file : join(workspace.root, file);
+		}));
+		if (!host) throw new ProcessorsHaveNoApp(declaration.id);
+		const name = processorUnitName(declaration.id);
+		if (workspace.apps[name]) throw new WorkerNameTaken(declaration.id, name);
+		units.push({
+			id: declaration.id,
+			name,
+			app: host.name
+		});
+	}
+	return units.sort((a, b) => a.name.localeCompare(b.name));
+}
+/** The backend apps whose builds generate a server, each where it lives. */
+function hostApps(workspace, manifest) {
+	return Object.entries(workspace.apps).filter(([, app]) => app.type === "backend" && !app.entry).map(([name, app]) => {
+		const surface = Object.entries(manifest).find(([id, d]) => d.kind === "rest-api" && appKey(id) === name)?.[1];
+		return {
+			name,
+			root: isAbsolute(app.path) ? app.path : join(workspace.root, app.path),
+			generated: !(surface?.kind === "rest-api" && surface.endpoints.length > 0)
+		};
+	}).sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* The app holding the most of these files; then one that generates a server;
+* then by name. None when no app holds any and none generates a server.
+*/
+function hostFor(hosts, files) {
+	const ranked = hosts.map((host) => ({
+		host,
+		holds: files.filter((file) => isUnder(file, host.root)).length
+	})).sort((a, b) => b.holds - a.holds || Number(b.host.generated) - Number(a.host.generated));
+	const host = ranked[0]?.host;
+	if (!host || ranked[0].holds === 0 && !host.generated) return void 0;
+	return host;
+}
 /** Whether `file` is inside `dir`. */
 function isUnder(file, dir) {
 	const rel = relative(dir, file);
@@ -3381,6 +3629,8 @@ function generateBackendDockerfile(options) {
 }
 /** The port a worker answers its health check on, inside its container. */
 const WORKER_PORT = 3e3;
+/** The port a processor unit answers on, inside its container. */
+const PROCESSOR_PORT = 3e3;
 /**
 * A Worker's image: the same build as its host app's backend — a pruned
 * slice, `gkm build --provider server --production` in the image, with the
@@ -3397,6 +3647,19 @@ function generateWorkerDockerfile(options) {
 		expose: false
 	});
 }
+/**
+* A file server's processor unit: its host app's build, and the unit's bundle
+* as the runner. Its native packages — `sharp` — are installed for the image's
+* platform beside the bundle, at the versions the build resolved.
+*/
+function generateProcessorDockerfile(options) {
+	return gkmBundleDockerfile(options, {
+		title: `Processors Dockerfile (${options.fileServer})`,
+		bundle: options.bundle,
+		as: "processors.mjs",
+		expose: true
+	});
+}
 function gkmBundleDockerfile(options, runner) {
 	const { port, healthCheckPath = "/health" } = options;
 	const { app } = layout(options);
@@ -3423,7 +3686,7 @@ RUN apk add --no-cache tini
 RUN addgroup --system --gid 1001 nodejs && \\
     adduser --system --uid 1001 hono
 
-# The bundled ${runner.as === "server.mjs" ? "server" : "worker"}
+# The bundled ${runner.as.replace(/\.mjs$/, "")}
 COPY --from=builder --chown=hono:nodejs ${app}/.gkm/server/dist/${runner.bundle} ./${runner.as === runner.bundle ? "" : runner.as}${externals.copy}
 
 ENV NODE_ENV=production
@@ -3915,7 +4178,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
 		case "s3": {
-			const { S3SecretsStore } = await import("./s3-B4FTQQkV.mjs");
+			const { S3SecretsStore } = await import("./s3-BZzSnker.mjs");
 			const { deployIdentity } = await import("./identity-CBXr4wNi.mjs").then((n) => n.r);
 			const location = s3SecretsLocation(config, workspace.state);
 			return new S3SecretsStore({
@@ -4289,6 +4552,14 @@ function composeFor(plan, options) {
 		const volume = volumeOf(container);
 		if (volume) volumes[volume] = {};
 	}
+	const minio = services.minio;
+	if (minio && options.objectWebhooks?.length) {
+		minio.environment = {
+			...minio.environment,
+			...minioWebhookEnv(options.objectWebhooks)
+		};
+		if (options.objectWebhooks.some((hook) => hook.endpoint.includes(`//host.docker.internal:`))) minio.extra_hosts = [`${HOST_GATEWAY}:host-gateway`];
+	}
 	return {
 		name: options.project,
 		services: {
@@ -4662,6 +4933,16 @@ function bucketClient(port, credentials) {
 				Bucket: bucket,
 				LifecycleConfiguration: { Rules: rules }
 			}));
+		},
+		async notification(bucket) {
+			const { $metadata: _, ...notification } = await s3.send(new GetBucketNotificationConfigurationCommand({ Bucket: bucket }));
+			return notification;
+		},
+		async setNotification(bucket, notification) {
+			await s3.send(new PutBucketNotificationConfigurationCommand({
+				Bucket: bucket,
+				NotificationConfiguration: notification
+			}));
 		}
 	};
 }
@@ -5498,9 +5779,10 @@ async function reconcile(options) {
 		project,
 		ports,
 		credentials: options.credentials,
-		...options.apps ? { apps: options.apps(plan.containers) } : {}
+		...options.apps ? { apps: options.apps(plan.containers) } : {},
+		...options.objectWebhooks?.length ? { objectWebhooks: options.objectWebhooks } : {}
 	});
-	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
+	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses, options.processorAddresses));
 	const hash = planHash(plan, compose, {
 		caddyfile,
 		postgres: postgresStatements(plan, project, seed).map((statement) => statement.create).join(";\n")
@@ -5516,7 +5798,8 @@ async function reconcile(options) {
 			...options.mailFrom ? { mailFrom: options.mailFrom } : {},
 			...options.addresses ? { addresses: options.addresses } : {},
 			...lan ? { lanAddress: lan } : {},
-			...options.metroPorts ? { metroPorts: options.metroPorts } : {}
+			...options.metroPorts ? { metroPorts: options.metroPorts } : {},
+			...options.objectWebhooks?.length ? { relayedBuckets: options.objectWebhooks.map((hook) => hook.bucket) } : {}
 		});
 		const env = exports ? resolved : scopeTelemetryEnv(resolved, {
 			uses: false,
@@ -5573,7 +5856,7 @@ async function reconcile(options) {
 	};
 	const credentials = checked.credentials;
 	if (start && provision) options.progress?.("🗄️  Creating what the constructs declare — databases, roles, buckets, topics");
-	const provisioned = start && provision ? await create(plan, ports, credentials, sql, buckets, carriers, project) : [];
+	const provisioned = start && provision ? await create(plan, ports, credentials, sql, buckets, carriers, project, new Set(stage === (options.localStage ?? stage) ? (options.objectWebhooks ?? []).map((hook) => hook.bucket) : [])) : [];
 	await saveState(root, {
 		hash,
 		stage
@@ -5593,7 +5876,7 @@ async function reconcile(options) {
 * Idempotent throughout, so this runs on every non-converged reconcile rather
 * than being something to remember.
 */
-async function create(plan, ports, credentials, sql, buckets, emulatorCarriers, project) {
+async function create(plan, ports, credentials, sql, buckets, emulatorCarriers, project, watched) {
 	const applied = [];
 	const postgresPort = ports[primaryPortKey("postgres")];
 	const statements = postgresStatements(plan, project, credentials.seed);
@@ -5607,6 +5890,10 @@ async function create(plan, ports, credentials, sql, buckets, emulatorCarriers,
 		if (names.length > 0) applied.push(...await applyBuckets(client, names));
 		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
 		if (lifecycles.length > 0) applied.push(...await applyLifecycles(client, lifecycles));
+		if (names.length > 0) applied.push(...await applyNotifications(client, plan.resources.filter((r) => r.provisions && r.kind === "objects").map((r) => ({
+			id: r.id,
+			name: r.name
+		})), watched));
 	}
 	const emulatorPort = ports[primaryPortKey("localstack")];
 	const carriers = carrierNames(plan);
@@ -5672,7 +5959,9 @@ var workspace_exports = /* @__PURE__ */ __exportAll({
 	constructGlobs: () => constructGlobs,
 	derivedContainers: () => derivedContainers,
 	fakesApply: () => fakesApply,
+	localObjectWebhooks: () => localObjectWebhooks,
 	metroPorts: () => metroPorts,
+	processorAddresses: () => processorAddresses,
 	reconcileWorkspace: () => reconcileWorkspace,
 	surfaceAddresses: () => surfaceAddresses
 });
@@ -5735,16 +6024,25 @@ function fakesApply(stage, fake, env = process.env) {
 */
 async function reconcileWorkspace(workspace, options) {
 	const runnables = {};
+	const background = {};
+	const subscribers = {};
 	const discovered = await discover({
 		patterns: constructGlobs(workspace),
 		cwd: workspace.root,
-		runnables
+		runnables,
+		background,
+		subscribers
 	});
 	const manifest = options.manifest ?? discovered;
 	const faked = fakesApply(options.stage, options.fake);
 	const fakes = faked ? await readFakes(workspace.root, manifest) : {};
 	const credentialFakes = faked ? await readCredentialFakes(workspace.root, manifest) : {};
 	const { credentials } = await loadLocalCredentials(workspace);
+	const objectWebhooks = localObjectWebhooks(workspace, manifest, {
+		background,
+		subscribers,
+		seed: credentials.seed
+	});
 	const result = await reconcile({
 		credentials,
 		root: workspace.root,
@@ -5755,9 +6053,11 @@ async function reconcileWorkspace(workspace, options) {
 		...backendsOf(workspace),
 		saved: await loadPortState(workspace.root),
 		addresses: surfaceAddresses(workspace, manifest),
+		processorAddresses: processorAddresses(workspace, manifest),
 		metroPorts: metroPorts(workspace, manifest),
 		fakes,
 		credentialFakes,
+		...objectWebhooks.length > 0 ? { objectWebhooks } : {},
 		apps: (containers) => appServices(workspace, manifest, containers, credentials, runnables, fakes, credentialFakes),
 		...options.start === void 0 ? {} : { start: options.start },
 		...options.progress ? { progress: options.progress } : {}
@@ -5772,6 +6072,40 @@ async function reconcileWorkspace(workspace, options) {
 	};
 }
 /**
+* Where MinIO posts each watched bucket's events under `gkm dev`: the dev
+* server of the app that builds the worker running the bucket's subscribers,
+* on the host, on that app's port — the process that relays them onto the
+* broker.
+*
+* None where the broker is SNS: there a bucket's events come from a topic, and
+* nothing relays them. None for a worker no app can build — `gkm build` says
+* so; a dev loop has nothing to post to.
+*/
+function localObjectWebhooks(workspace, manifest, options) {
+	if (backendsOf(workspace).events === "sns") return [];
+	const watched = watchedBuckets(manifest, options.subscribers);
+	if (watched.size === 0) return [];
+	let units;
+	try {
+		units = workerUnits(workspace, manifest, options.background);
+	} catch (error) {
+		if (error instanceof WorkerHasNoApp) return [];
+		throw error;
+	}
+	const hooks = [];
+	for (const [bucket, worker] of watched) {
+		const app = units.find((unit) => unit.id === worker)?.app;
+		const port = app ? workspace.apps[app]?.port : void 0;
+		if (!port) continue;
+		hooks.push({
+			bucket,
+			endpoint: `http://${HOST_GATEWAY}:${port}${objectsRoute(bucket)}`,
+			token: objectsWebhookToken(workspace.name, bucket, options.seed)
+		});
+	}
+	return hooks;
+}
+/**
 * Where each mobile app's Metro runs: its app's port, which `gkm exec` hands
 * Expo as `RCT_METRO_PORT`. Kept apart from the surfaces' addresses — a phone
 * reaches Metro by `exp://`, not through the edge.
@@ -5786,6 +6120,19 @@ function metroPorts(workspace, manifest) {
 	return ports;
 }
 /**
+* Where each file server's processors answer locally: the dev server of the
+* app holding them, which `gkm dev` mounts them on — the same app whose build
+* writes their unit deployed.
+*/
+function processorAddresses(workspace, manifest) {
+	const addresses = {};
+	for (const unit of processorUnits(workspace, manifest)) {
+		const port = workspace.apps[unit.app]?.port;
+		if (port) addresses[unit.id] = localAddress(port);
+	}
+	return addresses;
+}
+/**
 * Where each declared surface and site answers locally.
 *
 * The addresses come from the ports the workspace already assigns; which
@@ -5964,8 +6311,31 @@ function workerEnvKeys(manifest, workerId, runnables = {}) {
 	return keys;
 }
 /** What each construct an edge reaches hands the process that reaches it. */
+/**
+* The keys a file server's processor unit reads: its bucket's, and what each
+* of its processors depends on. `undefined` for a file server with none.
+*/
+function processorEnvKeys(manifest, fileServerId, runnables = {}) {
+	const server = manifest[fileServerId];
+	if (server?.kind !== "file-server" || !server.processors?.length) return;
+	const keys = /* @__PURE__ */ new Set();
+	addEdgeKeys(manifest, [
+		server.of,
+		...server.processors.flatMap((p) => p.dependencies.map((d) => d.target)),
+		...runnables[fileServerId] ?? []
+	], keys);
+	return keys;
+}
 function addEdgeKeys(manifest, edges, keys) {
 	for (const id of edges) {
+		const bucket = eventsEdgeBucket(id);
+		if (bucket) {
+			if (manifest[bucket]?.kind === "objects") {
+				keys.add(provideKey(bucket, "eventsConnectionString"));
+				keys.add(provideKey(bucket, "eventsToken"));
+			}
+			continue;
+		}
 		const target = manifest[id];
 		if (!target) continue;
 		if (target.kind === "rest-api") {
@@ -6423,6 +6793,308 @@ function validateImageRef(ref) {
 	return ref;
 }
 //#endregion
+//#region src/providers/processorOrigin.ts
+/**
+* A file server's processors as a CDN origin: the names both sides agree on.
+*
+* On a compose stage whose bucket is on S3, the CDN serves the bucket and
+* sends each processor pattern to the stack's processor unit, at a host of
+* its own. That host is public — a CDN reaches its origin over the internet —
+* so the CDN adds a secret header and the edge refuses any request without
+* it. One definition, read by the CDN that sends the header and by the stack
+* whose edge checks it, so the two cannot drift.
+*/
+/** The header the CDN adds to every request it sends a processor. */
+const ORIGIN_VERIFY_HEADER = "X-Gkm-Origin-Verify";
+/** Where a file server's processors answer the CDN: `<fileserver>-processors.<domain>`. */
+function processorOriginHost(serverId, domain) {
+	return `${appKey(serverId)}-processors.${domain}`.toLowerCase();
+}
+/** The stage secret holding the header's value: `ASSETS_SERVER_ORIGIN_SECRET`. */
+function originSecretKey(serverId) {
+	return provideKey(serverId, "originSecret");
+}
+/**
+* What the processor unit reads that secret from. Set wherever the CDN fronts
+* it, so the unit refuses a request without the header itself — on Dokploy,
+* whose edge cannot match a header, the only check; behind the stack's own
+* edge, a second one.
+*/
+const PROCESSOR_ORIGIN_SECRET_ENV = "GKM_PROCESSOR_ORIGIN_SECRET";
+/** A new value for that secret: random, generated once, kept in the stage. */
+function newOriginSecret() {
+	return randomBytes(32).toString("base64url");
+}
+//#endregion
+//#region src/generators/ProcessorGenerator.ts
+/** Where a file server's processor entry lives, under an app's `.gkm/server`. */
+function processorEntryDir(serverDir, fileServerId) {
+	return join(serverDir, "processors", processorUnitName(fileServerId));
+}
+/** The file its bundle is written to, beside the server's. */
+function processorBundleName(fileServerId) {
+	return `${processorUnitName(fileServerId)}.mjs`;
+}
+/**
+* A file server's processors, as the build generates them.
+*
+* On AWS each is a Lambda behind a function URL — the CDN's origin for its
+* pattern. On a server they are one process per file server, the processor
+* unit (see {@link ProcessorGenerator.buildEntry}), so the `server` target
+* generates nothing per processor here.
+*/
+var ProcessorGenerator = class extends ConstructGenerator {
+	isConstruct(value) {
+		return Processor.isProcessor(value);
+	}
+	async build(context, constructs, outputDir, options) {
+		if ((options?.target ?? "aws") !== "aws" || constructs.length === 0) return [];
+		const dir = join(outputDir, "processors");
+		await mkdir(dir, { recursive: true });
+		const infos = [];
+		for (const { key, construct, path } of constructs) {
+			const file = join(dir, `${key}.ts`);
+			const importPath = relative(dirname(file), path.relative).replace(/\.ts$/, ".js");
+			await writeFile(file, `import { AWSLambdaProcessor } from '@geekmidas/constructs/processors';
+import { ${key} } from '${importPath}';
+${context.storageDrivers?.imports ?? ""}
+${context.storageDrivers?.setup ? `\n// The handler registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
+const adapter = new AWSLambdaProcessor(${key});
+
+export const handler = adapter.handler;
+`);
+			infos.push(await processorInfo(key, construct, relative(options?.root ?? process.cwd(), file).replace(/\.ts$/, ".handler"), context));
+		}
+		return infos;
+	}
+	/**
+	* `gkm dev`'s half: `processors.ts` beside the dev server's app, mounting
+	* each file server's processors under `/__gkm/processors/<FileServer>`.
+	* The local edge sends each pattern on the file server's host there, so
+	* `processedUrl()` answers locally as it does deployed.
+	*
+	* In the dev server's own process rather than a unit of its own: locally
+	* there is no CPU to protect, and the dev server already reloads on change.
+	*/
+	async buildDev(outputDir, processors) {
+		await mkdir(outputDir, { recursive: true });
+		const file = join(outputDir, "processors.ts");
+		const imports = processors.map(({ key, path }) => {
+			const specifier = relative(outputDir, path.absolute).replace(/\.ts$/, ".js");
+			return `import { ${key} } from '${specifier.startsWith(".") ? specifier : `./${specifier}`}';`;
+		}).join("\n");
+		const byServer = /* @__PURE__ */ new Map();
+		for (const { key, construct } of processors) byServer.set(construct.surfaceId, [...byServer.get(construct.surfaceId) ?? [], key]);
+		const units = [...byServer.entries()].map(([id, keys]) => `    ${JSON.stringify(id)}: [${keys.join(", ")}],`).join("\n");
+		await writeFile(file, `/**
+ * Generated processors setup for \`gkm dev\`.
+ *
+ * Each file server's processors, under ${PROCESSORS_DEV_PREFIX}<FileServer>: the
+ * local edge rewrites each processor pattern on the file server's host here.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import { processorServer } from '@geekmidas/constructs/processors';
+${imports}
+
+export function setupProcessors(
+  app: { all: (path: string, handler: (c: any) => unknown) => unknown },
+  envParser: EnvironmentParser<any>,
+): void {
+  const units: Record<string, ReturnType<typeof processorServer>> = Object.fromEntries(
+    Object.entries({
+${units}
+    }).map(([id, processors]) => [id, processorServer(processors, envParser)]),
+  );
+
+  app.all('${PROCESSORS_DEV_PREFIX}:server/*', async (c: any) => {
+    const server = c.req.param('server') as string;
+    const serve = units[server];
+    if (!serve) return c.notFound();
+    const path = c.req.path.slice(\`${PROCESSORS_DEV_PREFIX}\${server}\`.length) || '/';
+    const response = await serve({ method: c.req.method, path });
+    if (!response) {
+      return new Response(null, {
+        status: 404,
+        headers: { 'cache-control': 'public, max-age=60' },
+      });
+    }
+    return new Response(c.req.method === 'HEAD' ? null : response.body, {
+      status: response.status,
+      headers: response.headers,
+    });
+  });
+}
+`);
+		return file;
+	}
+	/**
+	* A file server's processor unit: one process answering each of its
+	* processors' patterns, and `/health`. Returns its entry, `processors.ts`.
+	*
+	* Its own process because making a derivative is CPU-bound — a resize
+	* spike in the API's process would be every request's latency.
+	*/
+	async buildEntry(input) {
+		const { context, outputDir, processors } = input;
+		await mkdir(outputDir, { recursive: true });
+		await writeTelemetryModule(outputDir, input.telemetry);
+		const healthCheck = context.production?.healthCheck ?? "/health";
+		const imports = processors.map(({ key, path }) => {
+			const specifier = relative(outputDir, path.absolute).replace(/\.ts$/, ".js");
+			return `import { ${key} } from '${specifier.startsWith(".") ? specifier : `./${specifier}`}';`;
+		}).join("\n");
+		const entry = join(outputDir, "processors.ts");
+		await writeFile(entry, `#!/usr/bin/env node
+/**
+ * Production entry for ${input.fileServerId}'s processors.
+ * Generated by 'gkm build --production'.
+ *
+ * Answers each processor's pattern, and ${healthCheck} on PORT. The edge
+ * routes only those patterns here; everything else on the file server's
+ * domain is the bucket.
+ */
+import { timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { runShutdownHooks } from '@geekmidas/constructs';
+import { processorServer } from '@geekmidas/constructs/processors';
+${context.storageDrivers?.imports ?? ""}
+${imports}
+
+${startTelemetryCode([healthCheck])}
+${context.storageDrivers?.setup ? `// The entry point registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
+process.env.GKM_APP_NAME ??= ${JSON.stringify(processorUnitName(input.fileServerId))};
+
+const processors = [${processors.map(({ key }) => key).join(", ")}];
+const serve = processorServer(processors);
+const port = Number(process.env.PORT) || 3000;
+let stopping = false;
+
+${input.telemetry ? REQUEST_SPANS : NO_REQUEST_SPANS}
+// Where the CDN fronts this unit, the secret it adds to every request: one
+// without it is refused here, whatever the edge in front did or could not.
+const originSecret = process.env.${PROCESSOR_ORIGIN_SECRET_ENV}
+  ? Buffer.from(process.env.${PROCESSOR_ORIGIN_SECRET_ENV})
+  : undefined;
+const fromOrigin = (header: string | string[] | undefined) => {
+  if (!originSecret) return true;
+  const given = Buffer.from(typeof header === 'string' ? header : '');
+  return given.length === originSecret.length && timingSafeEqual(given, originSecret);
+};
+
+const server = createServer(async (req, res) => {
+  const method = req.method ?? 'GET';
+  const path = (req.url ?? '/').split('?')[0] ?? '/';
+  if (path === ${JSON.stringify(healthCheck)}) {
+    res.writeHead(stopping ? 503 : 200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ status: stopping ? 'stopping' : 'ok' }));
+    return;
+  }
+  if (!fromOrigin(req.headers[${JSON.stringify(ORIGIN_VERIFY_HEADER.toLowerCase())}])) {
+    res.writeHead(403, { 'cache-control': 'no-store' }).end();
+    return;
+  }
+  await traced(method, path, async () => {
+    try {
+      const response = await serve({ method, path });
+      if (!response) {
+        res.writeHead(404, { 'cache-control': 'public, max-age=60' }).end();
+        return 404;
+      }
+      res.writeHead(response.status, response.headers);
+      res.end(method === 'HEAD' ? undefined : response.body);
+      return response.status;
+    } catch (error) {
+      console.error(error);
+      res.writeHead(500, { 'cache-control': 'no-store' }).end();
+      return 500;
+    }
+  });
+});
+server.listen(port);
+
+const shutdown = async () => {
+  if (stopping) return;
+  stopping = true;
+  setTimeout(() => process.exit(1), Number(process.env.GKM_SHUTDOWN_TIMEOUT_MS) || 8000).unref();
+  server.close();
+  await runShutdownHooks((error) => console.error(error));
+  process.exit(0);
+};
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
+`);
+		return entry;
+	}
+};
+/**
+* A SERVER span per request, once telemetry has started — opened by the unit
+* rather than by hooking node:http, which sees nothing inside a bundle. Named
+* after the processor's pattern, never the key, which has no bound.
+*
+* Only in an entry whose file server has a `Telemetry` node: the bundle
+* follows the import, and an app without one need not install the API.
+*/
+const REQUEST_SPANS = `const tracing = requestSpans ? await import('@opentelemetry/api') : undefined;
+const routeOf = (path: string) =>
+  processors.find((processor) => path.startsWith(processor.prefix))?.pattern;
+
+async function traced(
+  method: string,
+  path: string,
+  run: () => Promise<number>,
+): Promise<void> {
+  if (!tracing) {
+    await run();
+    return;
+  }
+  const route = routeOf(path);
+  await tracing.trace.getTracer('@geekmidas/processors').startActiveSpan(
+    route ? \`\${method} \${route}\` : method,
+    {
+      kind: tracing.SpanKind.SERVER,
+      attributes: {
+        'http.request.method': method,
+        'url.path': path,
+        ...(route ? { 'http.route': route } : {}),
+      },
+    },
+    async (span) => {
+      try {
+        const status = await run();
+        span.setAttribute('http.response.status_code', status);
+        if (status >= 500) span.setStatus({ code: tracing.SpanStatusCode.ERROR });
+      } finally {
+        span.end();
+      }
+    },
+  );
+}
+`;
+/** The same shape without telemetry: each request just runs. */
+const NO_REQUEST_SPANS = `async function traced(
+  _method: string,
+  _path: string,
+  run: () => Promise<number>,
+): Promise<void> {
+  await run();
+}
+`;
+/** What the manifest records of one processor. */
+async function processorInfo(name, processor, handler, context) {
+	return {
+		name,
+		handler,
+		fileServer: processor.surfaceId,
+		path: processor.pattern,
+		prefix: processor.prefix,
+		...processor.native.length ? { native: [...processor.native] } : {},
+		...processor.timeout !== void 0 ? { timeout: processor.timeout } : {},
+		...processor.memorySize !== void 0 ? { memorySize: processor.memorySize } : {},
+		environment: await processor.getEnvironment({ markOptional: context.markOptional }),
+		dependencies: processor.constructs
+	};
+}
+//#endregion
 //#region src/generators/CronGenerator.ts
 var CronGenerator = class extends ConstructGenerator {
 	async build(context, constructs, outputDir, options) {
@@ -7001,17 +7673,59 @@ async function answers(connection: unknown): Promise<boolean> {
   }
 }
 
+/** A request to a route this worker mounted, and what it answered. */
+export interface WorkerRequest {
+  headers: Record<string, string | string[] | undefined>;
+  body: string;
+}
+export interface WorkerAnswer {
+  status: number;
+  body: unknown;
+}
+
+// The routes something pushes to: an SNS subscriber's, and the one a local
+// object store posts a bucket's events to. Mounted by the subscribers, served
+// by the entry's HTTP server beside the health check.
+const routes = new Map<string, (c: any) => unknown>();
+const app = {
+  post: (path: string, handler: (c: any) => unknown) => {
+    routes.set(path, handler);
+  },
+};
+
+/** Run one mounted route, as the subscribers' handlers expect to be called. */
+async function route(path: string, request: WorkerRequest): Promise<WorkerAnswer | undefined> {
+  const handler = routes.get(path);
+  if (!handler) return undefined;
+  let answer: WorkerAnswer | undefined;
+  const c = {
+    req: {
+      text: async () => request.body,
+      header: (name: string) => {
+        const value = request.headers[name.toLowerCase()];
+        return Array.isArray(value) ? value[0] : value;
+      },
+    },
+    json: (body: unknown, status = 200) => {
+      answer = { status, body };
+      return answer;
+    },
+  };
+  await handler(c);
+  return answer ?? { status: 204, body: null };
+}
+
 /** Start everything this worker runs. */
 export async function startWorker(): Promise<{
   health: () => Promise<WorkerHealth>;
   stop: () => Promise<void>;
+  route: typeof route;
+  /** Subscribe the pushed routes, once the server answers on \`port\`. */
+  subscribeForPush: (port: number) => Promise<void>;
 }> {
-  // An app object with no routes: on a server target nothing is pushed to a
-  // subscriber, so there is nothing to mount.
-  const noRoutes = { post: () => undefined };
-
-  await setupSubscribers(noRoutes, envParser, logger).catch((error) => {
+  const subscribeForPush = await setupSubscribers(app, envParser, logger).catch((error) => {
     logger.error({ err: error }, 'Failed to start subscribers');
+    return async (_port: number) => {};
   });
   await setupQueues(envParser, logger).catch((error) => {
     logger.error({ err: error }, 'Failed to start queue consumers');
@@ -7023,6 +7737,8 @@ export async function startWorker(): Promise<{
   const statuses = () => [subscribersStatus(), queuesStatus(), cronsStatus()];
 
   return {
+    route,
+    subscribeForPush,
     async health() {
       const all = statuses();
       const failed = all.flatMap((s) => s.failed);
@@ -7053,8 +7769,10 @@ function workerEntry(healthCheck) {
  * Generated by 'gkm build --production'.
  *
  * Runs this worker's crons, queue consumers and topic subscribers, and serves
- * one route: ${healthCheck}, on PORT — 200 when every consumer started and
- * every broker connection answers, 503 otherwise.
+ * its health check: ${healthCheck}, on PORT — 200 when every consumer started
+ * and every broker connection answers, 503 otherwise. Beside it, on the same
+ * port, the POST routes its subscribers mounted: where a local object store
+ * posts a bucket's events.
  *
  * On SIGTERM it stops pulling messages and scheduling crons, lets the handlers
  * in flight finish, closes its broker connections and database pools, and
@@ -7073,15 +7791,39 @@ let worker: Awaited<ReturnType<typeof startWorker>> | undefined;
 let stopping = false;
 
 const server = createServer((req, res) => {
-  const path = (req.url ?? '/').split('?')[0];
-  if (path !== ${JSON.stringify(healthCheck)} || (req.method !== 'GET' && req.method !== 'HEAD')) {
-    res.writeHead(404).end();
-    return;
-  }
+  const path = (req.url ?? '/').split('?')[0] ?? '/';
   const answer = (status: number, body: unknown) => {
     res.writeHead(status, { 'content-type': 'application/json' });
     res.end(JSON.stringify(body));
   };
+
+  // A route a subscriber mounted: what SNS pushes to, or what a local object
+  // store posts a bucket's events to. Refused while starting or stopping, so
+  // the sender keeps the message and sends it again.
+  if (req.method === 'POST') {
+    let body = '';
+    req.setEncoding('utf8');
+    req.on('data', (chunk) => {
+      body += chunk;
+    });
+    req.on('end', () => {
+      if (stopping) return answer(503, { status: 'stopping' });
+      if (!worker) return answer(503, { status: 'starting' });
+      worker.route(path, { headers: req.headers, body }).then(
+        (routed) => (routed ? answer(routed.status, routed.body) : answer(404, { status: 'not found' })),
+        (error) => {
+          logger.error({ err: error, path }, 'Route failed');
+          answer(500, { status: 'failed' });
+        },
+      );
+    });
+    return;
+  }
+
+  if (path !== ${JSON.stringify(healthCheck)} || (req.method !== 'GET' && req.method !== 'HEAD')) {
+    res.writeHead(404).end();
+    return;
+  }
   if (stopping) return answer(503, { status: 'stopping' });
   if (!worker) return answer(503, { status: 'starting' });
   worker.health().then(
@@ -7115,6 +7857,9 @@ process.on('SIGINT', shutdown);
 
 worker = await startWorker();
 logger.info({ port }, 'Worker started');
+await worker.subscribeForPush(port).catch((error) => {
+  logger.error({ err: error }, 'Failed to subscribe for push');
+});
 `;
 }
 //#endregion
@@ -7260,6 +8005,25 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 			imageName: imageNames[worker.name] ?? worker.name
 		});
 	}
+	for (const unit of manifest ? processorUnits(workspace, manifest) : []) {
+		logger$1.log(`\n   📄 Generating Dockerfile for ${unit.name} (processors of ${unit.id}, built from ${unit.app})`);
+		const dockerfile = processorDockerfile(unit, workspace.apps[unit.app], {
+			layout,
+			workspaceRoot: workspace.root,
+			native: processorNative(manifest, unit.id)
+		});
+		const path = workerDockerfileOf(unit.name);
+		const dockerfilePath = join(workspace.root, path);
+		await mkdir(dirname(dockerfilePath), { recursive: true });
+		await writeFile(dockerfilePath, dockerfile);
+		logger$1.log(`      Generated: ${path}`);
+		results.push({
+			appName: unit.name,
+			type: "backend",
+			dockerfile: dockerfilePath,
+			imageName: imageNames[unit.name] ?? unit.name
+		});
+	}
 	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
 	logger$1.log(`\n   Ensured: ${dockerignorePath}`);
 	const composePath = await writeConstructsCompose(workspace);
@@ -7319,6 +8083,29 @@ function workerDockerfile(worker, host, options) {
 		...options.cache ? { cache: options.cache } : {}
 	});
 }
+/** The native packages a file server's processors named, once each. */
+function processorNative(manifest, fileServerId) {
+	const server = manifest[fileServerId];
+	if (server?.kind !== "file-server") return [];
+	return [...new Set((server.processors ?? []).flatMap((p) => p.native ?? []))].sort();
+}
+/**
+* A file server's processor unit's Dockerfile: its host app's build, and the
+* unit's bundle as the runner, with its processors' native packages
+* installed beside it — see `generateProcessorDockerfile`.
+*/
+function processorDockerfile(unit, host, options) {
+	return generateProcessorDockerfile({
+		...appImageOptions(options.layout, unit.app, host, options.workspaceRoot),
+		imageName: unit.name,
+		port: PROCESSOR_PORT,
+		fileServer: unit.id,
+		bundle: processorBundleName(unit.id),
+		healthCheckPath: "/health",
+		...options.native.length ? { external: [...options.native] } : {},
+		...options.cache ? { cache: options.cache } : {}
+	});
+}
 /**
 * A site's Dockerfile, with an `ARG` for every key its bundler inlines.
 *
@@ -7483,7 +8270,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-BNpS9aRJ.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-Cjh_2Ml6.mjs");
 		return new HostingerProvider(options.hostinger);
 	}
 	if (provider === "route53") {
@@ -7496,7 +8283,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-BlB5nJky.mjs");
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-BN1dODm9.mjs");
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8345,6 +9132,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { assertDevServicesFlag as $, stackLogs as $n, publicBuildValues as $t, StageProviderDisabled as A, localRolePassword as An, findAvailablePort as At, workerDockerfile as B, EMULATOR_ACCESS_KEY_ID as Bn, initStageSecrets as Bt, recordRollback as C, REDIS_SERVICE as Cn, composeFor as Ct, setPostgresBackupId as D, stackRedis as Dn, storageBackendFor as Dt, setGeneratedSecret as E, runsRedis as En, providerOf as Et, DockerBuildFailed as F, isTelemetryKey as Fn, prepareEntryCredentials as Ft, QueueGenerator as G, portKeys as Gn, composeBuildPaths as Gt, WorkerGenerator as H, DEFAULT_IMAGES as Hn, storage_exports as Ht, DockerPushFailed as I, scopeTelemetryEnv as In, isRemoteStore as It, AllowDevServicesTakesNoValue as J, primaryPortKey as Jn, WORKER_PORT as Jt, CronGenerator as K, portsOf as Kn, imageLayout as Kt, appDockerfile as L, surfaceClientTraced as Ln, secretsStoreFor as Lt, provisionCommand as M, planFor as Mn, loadEnvFiles as Mt, stageProviderNotes as N, resourceName as Nn, loadPortState as Nt, DnsRecordsUnreadable as O, withRedisPassword as On, createCredentialsPreload as Ot, PROVIDER_KINDS as P, appTelemetry as Pn, loadSecretsForApp as Pt, STORAGE_KEY_PAIR as Q, logsService as Qn, isImageBuild as Qt, dockerCommand as R, telemetryOf as Rn, storeFromConfig as Rt, recordRelease as S, withGeneratedSecrets as Sn, CLUSTER_DATABASE as St, setBackupState as T, redisService as Tn, eventsBackendFor as Tt, workerBundleName as U, describeServices as Un, toEmbeddableSecrets as Ut, workerDockerfileOf as V, hostFor as Vn, maskPassword as Vt, workerEntryDir as W, fakeKey as Wn, withCustomSecret as Wt, DevServicesNeedServerTarget as X, LOGS_SERVICE as Xn, findBuildRoot as Xt, DEV_SERVICES as Y, LOCAL_LOGS_EMAIL as Yn, detectPackageManager as Yt, ExternalServicesNotConfigured as Z, logsAccess as Zn, imageBuildCredentials as Zt, asDokployState as _, FileSecretsStore as _n, forgetState as _t, dnsResources as a, applyPostgres as an, suppliedOnly as at, getBackupState as b, projectKey as bn, bucketClient as bt, currentActor as c, postgresDatabaseNames as cn, networkEnv as ct, DeployJournal as d, mergeLifecycle as dn, backendsOf as dt, isUnder as en, withLogsPassword as er, devServicesUsed as et, extractSubdomain as f, LOCAL_RABBITMQ_USER as fn, constructGlobs as ft, verifyDnsRecords as g, readLocalCredentials as gn, LOCAL_CA_PATH as gt, orchestrateDns as h, postgresSuperuser as hn, workspace_exports as ht, dnsRecordResource as i, applyPolicies as in, stageServiceDeclarations as it, assertStageProvidersEnabled as j, TELEMETRY_CONTAINER as jn, isPortAvailable as jt, createDnsProvider as k, envFor as kn, createEntryWrapper as kt, describeActor as l, postgresStatements as ln, workerEnvKeys as lt, normalizeDnsConfig as m, postgresRoleSlug as mn, reconcileWorkspace as mt, reportDatabaseRuns as n, applyBuckets as nn, isMainFrontendApp as nr, reportDevServices as nt, forgetDnsResource as o, bucketLifecycles as on, appEnvKeys as ot, findRootDomain as p, loadLocalCredentials as pn, derivedContainers as pt, validateImageRef as q, postgresImage as qn, TURBO_VERSION as qt, reportPlannedSeeds as r, applyLifecycles as rn, resolveHost as rr, requiredStageKeys as rt, recordDnsChanges as s, bucketPolicies as sn, dockerfileOf as st, DeploySeedsFailed as t, workerUnits as tn, NoDomainForStage as tr, externalServices as tt, isCi as u, quoteIdentifier as un, FAKE_ENV as ut, createComposeState as v, getKeyPath as vn, LEGACY_LOCAL_LOGIN as vt, setApplicationId as w, STACK_CACHE as wn, cacheBackendFor as wt, getGeneratedSecret as x, readKey as xn, pgClient as xt, createEmptyState as y, keystoreProject as yn, ensurePostgresLogin as yt, ensureDockerignore as z, usesTelemetry as zn, store_exports as zt };
+export { ORIGIN_VERIFY_HEADER as $, telemetryOf as $n, maskPassword as $t, StageProviderDisabled as A, postgresSuperuser as An, LEGACY_LOCAL_LOGIN as At, processorDockerfile as B, redisService as Bn, createCredentialsPreload as Bt, recordRollback as C, postgresDatabaseNames as Cn, backendsOf as Ct, setPostgresBackupId as D, LOCAL_RABBITMQ_USER as Dn, workspace_exports as Dt, setGeneratedSecret as E, mergeLifecycle as En, reconcileWorkspace as Et, DockerBuildFailed as F, projectKey as Fn, composeFor as Ft, workerBundleName as G, localRolePassword as Gn, loadPortState as Gt, workerDockerfile as H, stackRedis as Hn, findAvailablePort as Ht, DockerPushFailed as I, readKey as In, cacheBackendFor as It, CronGenerator as J, resourceName as Jn, isRemoteStore as Jt, workerEntryDir as K, TELEMETRY_CONTAINER as Kn, loadSecretsForApp as Kt, appDockerfile as L, withGeneratedSecrets as Ln, eventsBackendFor as Lt, provisionCommand as M, FileSecretsStore as Mn, bucketClient as Mt, stageProviderNotes as N, getKeyPath as Nn, pgClient as Nt, DnsRecordsUnreadable as O, loadLocalCredentials as On, LOCAL_CA_PATH as Ot, PROVIDER_KINDS as P, keystoreProject as Pn, CLUSTER_DATABASE as Pt, processorInfo as Q, surfaceClientTraced as Qn, initStageSecrets as Qt, dockerCommand as R, REDIS_SERVICE as Rn, providerOf as Rt, recordRelease as S, bucketPolicies as Sn, FAKE_ENV as St, setBackupState as T, quoteIdentifier as Tn, derivedContainers as Tt, workerDockerfileOf as U, withRedisPassword as Un, isPortAvailable as Ut, processorNative as V, runsRedis as Vn, createEntryWrapper as Vt, WorkerGenerator as W, envFor as Wn, loadEnvFiles as Wt, processorBundleName as X, isTelemetryKey as Xn, storeFromConfig as Xt, ProcessorGenerator as Y, appTelemetry as Yn, secretsStoreFor as Yt, processorEntryDir as Z, scopeTelemetryEnv as Zn, store_exports as Zt, asDokployState as _, applyLifecycles as _n, withLogsPassword as _r, appEnvKeys as _t, dnsResources as a, PROCESSOR_PORT as an, DEFAULT_IMAGES as ar, AllowDevServicesTakesNoValue as at, getBackupState as b, applyPostgres as bn, resolveHost as br, processorEnvKeys as bt, currentActor as c, detectPackageManager as cn, portKeys as cr, ExternalServicesNotConfigured as ct, DeployJournal as d, isImageBuild as dn, primaryPortKey as dr, devServicesUsed as dt, storage_exports as en, usesTelemetry as er, PROCESSOR_ORIGIN_SECRET_ENV as et, extractSubdomain as f, publicBuildValues as fn, LOCAL_LOGS_EMAIL as fr, externalServices as ft, verifyDnsRecords as g, applyBuckets as gn, stackLogs as gr, suppliedOnly as gt, orchestrateDns as h, workerUnits as hn, logsService as hr, stageServiceDeclarations as ht, dnsRecordResource as i, imageLayout as in, hostFor$1 as ir, validateImageRef as it, assertStageProvidersEnabled as j, readLocalCredentials as jn, ensurePostgresLogin as jt, createDnsProvider as k, postgresRoleSlug as kn, forgetState as kt, describeActor as l, findBuildRoot as ln, portsOf as lr, STORAGE_KEY_PAIR as lt, normalizeDnsConfig as m, processorUnits as mn, logsAccess as mr, requiredStageKeys as mt, reportDatabaseRuns as n, withCustomSecret as nn, watchedBuckets as nr, originSecretKey as nt, forgetDnsResource as o, TURBO_VERSION as on, describeServices as or, DEV_SERVICES as ot, findRootDomain as p, isUnder as pn, LOGS_SERVICE as pr, reportDevServices as pt, QueueGenerator as q, planFor as qn, prepareEntryCredentials as qt, reportPlannedSeeds as r, composeBuildPaths as rn, EMULATOR_ACCESS_KEY_ID as rr, processorOriginHost as rt, recordDnsChanges as s, WORKER_PORT as sn, fakeKey as sr, DevServicesNeedServerTarget as st, DeploySeedsFailed as t, toEmbeddableSecrets as tn, minioWebhookEnv as tr, newOriginSecret as tt, isCi as u, imageBuildCredentials as un, postgresImage as ur, assertDevServicesFlag as ut, createComposeState as v, applyNotifications as vn, NoDomainForStage as vr, dockerfileOf as vt, setApplicationId as w, postgresStatements as wn, constructGlobs as wt, getGeneratedSecret as x, bucketLifecycles as xn, workerEnvKeys as xt, createEmptyState as y, applyPolicies as yn, isMainFrontendApp as yr, networkEnv as yt, ensureDockerignore as z, STACK_CACHE as zn, storageBackendFor as zt };
 
-//# sourceMappingURL=seeds-Dv78P9LS.mjs.map
+//# sourceMappingURL=seeds-CK7w79VC.mjs.map