@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.125

package/dist/{seeds-BWC-qjSI.cjs → seeds-CPEcmoPn.cjs}

@@ -1,14 +1,14 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_run = require("./run-fVZ-rLnc.cjs");
-const require_workspace = require("./workspace-C82GLPnf.cjs");
+const require_credentials = require("./credentials-D7XJypNd.cjs");
+const require_workspace = require("./workspace-Du4Afb03.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-C8CPxrCK.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-BDUp7OeY.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-BDa6pPgE.cjs");
-const require_discover = require("./discover-DozUKs8f.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-BGxf9jWE.cjs");
+const require_discover = require("./discover-DL6h-J97.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-AsfohXd1.cjs");
+const require_resolve = require("./resolve-C9QqOl5t.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -27,6 +27,7 @@ let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
 let dotenv = require("dotenv");
 let node_util = require("node:util");
 let _geekmidas_constructs_crons = require("@geekmidas/constructs/crons");
+let _geekmidas_constructs_processors = require("@geekmidas/constructs/processors");
 let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_client_sns = require("@aws-sdk/client-sns");
@@ -488,6 +489,21 @@ function volumeOf(container) {
 	}[container];
 }
 //#endregion
+//#region src/generators/processorRoute.ts
+/**
+* Where `gkm dev` serves a file server's processors, on the dev server of the
+* app holding them: named after the file server.
+*
+* One definition for both sides — the dev server mounts it, and the local
+* edge rewrites each processor pattern on the file server's host onto it — so
+* the path the edge sends and the path the server answers cannot drift.
+*/
+const PROCESSORS_DEV_PREFIX = "/__gkm/processors/";
+/** The base a file server's processors answer under, in `gkm dev`. */
+function processorsDevRoute(fileServerId) {
+	return `${PROCESSORS_DEV_PREFIX}${fileServerId}`;
+}
+//#endregion
 //#region src/reconcile/caddyfile.ts
 /**
 * The Caddy configuration a plan implies.
@@ -537,7 +553,7 @@ const EDGE_KINDS = {
 * Docker Desktop resolves this name already; on Linux the compose definition
 * maps it to the host gateway.
 */
-const HOST_GATEWAY = "host.docker.internal";
+const HOST_GATEWAY$1 = "host.docker.internal";
 /**
 * The suffix every local host shares.
 *
@@ -554,19 +570,26 @@ const LOCAL_TLD = "localhost";
 * are a legitimate arrangement — two cache behaviours, one origin — and naming
 * the host after the bucket would make them collide.
 */
-function sitesFor(plan, project, addresses = {}) {
+function sitesFor(plan, project, addresses = {}, processorAddresses = {}) {
 	const byId = new Map(plan.resources.map((r) => [r.id, r]));
 	const sites = [];
 	for (const resource of plan.resources) {
 		if (!EDGE_KINDS[resource.kind]) continue;
-		const host = hostFor(resource, project);
+		const host = hostFor$1(resource, project);
 		if (resource.kind === "file-server") {
 			const origin = resource.of ? byId.get(resource.of) : void 0;
 			if (!origin) continue;
+			const address = processorAddresses[resource.id];
+			const port = address ? portOf(address) : void 0;
 			sites.push({
 				host,
 				upstream: "http://minio:9000",
-				rewrite: `/${origin.name}{uri}`
+				rewrite: `/${origin.name}{uri}`,
+				...resource.processors?.length && port ? { processors: {
+					prefixes: resource.processors,
+					upstream: `http://${HOST_GATEWAY$1}:${port}`,
+					under: processorsDevRoute(resource.id)
+				} } : {}
 			});
 			continue;
 		}
@@ -576,7 +599,7 @@ function sitesFor(plan, project, addresses = {}) {
 		if (!port) continue;
 		sites.push({
 			host,
-			upstream: `http://${HOST_GATEWAY}:${port}`
+			upstream: `http://${HOST_GATEWAY$1}:${port}`
 		});
 	}
 	return sites;
@@ -598,7 +621,7 @@ function portOf(address) {
 * name, because an empty label makes `uploads..localhost` — a host nothing
 * resolves and no certificate can be issued for.
 */
-function hostFor(resource, project) {
+function hostFor$1(resource, project) {
 	return [
 		resource.root && project ? stageOf(resource) : labelOf(resource),
 		project,
@@ -656,14 +679,24 @@ function toCaddyfile(sites) {
 	if (sites.length === 0) return `${GENERATED}
 # No file server is declared in this stage, so it routes nothing.
 `;
-	const blocks = sites.map(({ host, upstream, rewrite }) => `
+	const blocks = sites.map(({ host, upstream, rewrite, processors }) => `
 https://${host} {
 	tls internal
 
 	# gkm's own header, which only a service of this stack may send: the auth
 	# server rate-limits by the client address it carries.
 	request_header -${_geekmidas_manifest.CLIENT_IP_HEADER}
-
+${processors ? `
+	# Its processors' patterns, to the dev server holding them — under the
+	# route it mounts them on. Answered there, so the bucket below never is.
+	@processors path ${processors.prefixes.map((prefix) => `${prefix}*`).join(" ")}
+	handle @processors {
+		reverse_proxy ${processors.upstream} {
+			rewrite ${processors.under}{uri}
+			header_up Host {host}
+		}
+	}
+` : ""}
 	reverse_proxy ${upstream} {${rewrite ? `
 		rewrite ${rewrite}
 		# MinIO routes and signs on the Host header, so forwarding the requested
@@ -722,6 +755,108 @@ function emulatorQueueUrl(name, port) {
 	return `${emulatorEndpoint(port)}/${EMULATOR_ACCOUNT}/${name}`;
 }
 //#endregion
+//#region src/reconcile/objectEvents.ts
+/**
+* A bucket's object events, where the bucket is a local MinIO.
+*
+* S3 publishes a bucket's events to a topic the deploy creates; MinIO has no
+* topic to publish to, but it can post each event to a webhook. So where MinIO
+* holds a watched bucket, it posts the bucket's events to the process that
+* runs the bucket's subscribers, on a route only it can use, and that process
+* relays each one onto the events broker — under the bucket's name, as
+* `object.created` or `object.deleted` — where every subscriber drains a queue
+* of its own, as a topic's subscribers do.
+*
+* Declared to MinIO in two halves, both derived here so they cannot drift:
+*
+* - **a webhook target per bucket**, as container environment: where to post,
+*   the token to present, and a queue on disk, because MinIO starts before the
+*   process it posts to and must keep what it could not deliver;
+* - **the bucket's notification**, written through the S3 API once the bucket
+*   exists: every created and removed object, to that target. Unfiltered —
+*   two subscribers watching overlapping prefixes are two rules S3 refuses on
+*   one bucket, and each subscriber filters what it is handed anyway.
+*/
+/**
+* The token MinIO presents when it posts a bucket's events.
+*
+* Derived, never stored: the container and the process it posts to are handed
+* the same value by the same derivation — with the stage's random seed where a
+* deployed stage's stack has one, so the token is a secret there, and from the
+* project alone locally, where everything it would protect is on loopback.
+* Not salted by the stage: one MinIO serves `gkm dev` and `gkm test`, and a
+* target is declared once per container.
+*/
+function objectsWebhookToken(project, bucket, seed) {
+	return (0, node_crypto.createHash)("sha256").update(`${seed ? `${seed}:` : ""}${project}:objects-webhook:${bucket}`).digest("base64url").slice(0, 32);
+}
+/**
+* The target's id in MinIO's environment — `MINIO_NOTIFY_WEBHOOK_*_<ID>`.
+*
+* Upper-cased with nothing between words: a canonical id is letters and
+* digits, and an underscore inside the id would read as part of the setting's
+* name.
+*/
+function minioTargetId(bucket) {
+	return bucket.toUpperCase();
+}
+/** The target as a notification names it. */
+function minioTargetArn(bucket) {
+	return `arn:minio:sqs::${minioTargetId(bucket)}:webhook`;
+}
+/** How a container reaches a process on the host. */
+const HOST_GATEWAY = "host.docker.internal";
+/** Where MinIO keeps what it could not deliver yet, inside its container. */
+const QUEUE_ROOT = "/gkm-object-events";
+/** The id of the notification rule gkm owns on a bucket. */
+const NOTIFICATION_RULE_PREFIX = "gkm-";
+/**
+* MinIO's environment for each watched bucket's webhook target.
+*
+* Sorted, so the same buckets always render the same environment and a
+* reconcile that changed nothing does not recreate the container.
+*/
+function minioWebhookEnv(hooks) {
+	const env = {};
+	for (const hook of [...hooks].sort((a, b) => a.bucket.localeCompare(b.bucket))) {
+		const id = minioTargetId(hook.bucket);
+		env[`MINIO_NOTIFY_WEBHOOK_ENABLE_${id}`] = "on";
+		env[`MINIO_NOTIFY_WEBHOOK_ENDPOINT_${id}`] = hook.endpoint;
+		env[`MINIO_NOTIFY_WEBHOOK_AUTH_TOKEN_${id}`] = hook.token;
+		env[`MINIO_NOTIFY_WEBHOOK_QUEUE_DIR_${id}`] = `${QUEUE_ROOT}/${id.toLowerCase()}`;
+	}
+	return env;
+}
+/** The rule that sends every created and removed object to the bucket's target. */
+function minioNotificationRule(bucket) {
+	return {
+		Id: `${NOTIFICATION_RULE_PREFIX}${bucket}`,
+		QueueArn: minioTargetArn(bucket),
+		Events: ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"]
+	};
+}
+/**
+* Each watched bucket, and the workers that run one of its subscribers.
+*
+* A bucket is watched when a subscriber reads its events key. MinIO posts a
+* bucket's events to one place, and the relay fans them out to every
+* subscriber whichever worker received them — so one worker per bucket is
+* enough, and the first, by id, is the one chosen, so the choice is stable.
+*/
+function watchedBuckets(manifest, subscribers) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const declaration of Object.values(manifest)) {
+		if (declaration.kind !== "objects") continue;
+		byKey.set((0, _geekmidas_manifest.provideKey)(declaration.id, "eventsConnectionString"), declaration.id);
+	}
+	const watched = /* @__PURE__ */ new Map();
+	for (const worker of Object.keys(subscribers).sort()) for (const { connectionKey } of subscribers[worker] ?? []) {
+		const bucket = byKey.get(connectionKey);
+		if (bucket && !watched.has(bucket)) watched.set(bucket, worker);
+	}
+	return watched;
+}
+//#endregion
 //#region src/telemetry/edges.ts
 /**
 * Which processes use a `Telemetry` node — read off the manifest's edges.
@@ -746,13 +881,14 @@ function nodeOf(manifest, id) {
 	return node?.kind === "telemetry" ? node : void 0;
 }
 /**
-* The `Telemetry` node the process for `id` — a surface or a worker, by
-* construct id — emits through, or undefined when it has no edge to one.
+* The `Telemetry` node the process for `id` — a surface, a worker, or a file
+* server's processor unit, by construct id — emits through, or undefined
+* when it has no edge to one.
 */
 function telemetryOf(manifest, id) {
 	const declaration = manifest[id];
 	if (!declaration) return void 0;
-	if (declaration.kind === "worker") return nodeOf(manifest, declaration.telemetry);
+	if (declaration.kind === "worker" || declaration.kind === "file-server") return nodeOf(manifest, declaration.telemetry);
 	if (declaration.kind !== "rest-api") return void 0;
 	return nodeOf(manifest, declaration.telemetry);
 }
@@ -766,7 +902,7 @@ function appTelemetry(manifest, appName) {
 }
 /** Whether any process in the manifest emits through a `Telemetry` node. */
 function usesTelemetry(manifest) {
-	return Object.entries(manifest).some(([id, d]) => (d.kind === "rest-api" || d.kind === "worker") && telemetryOf(manifest, id) !== void 0);
+	return Object.entries(manifest).some(([id, d]) => (d.kind === "rest-api" || d.kind === "worker" || d.kind === "file-server") && telemetryOf(manifest, id) !== void 0);
 }
 /**
 * One process's share of the telemetry keys a stage resolved: all of them,
@@ -1027,7 +1163,8 @@ function planFor(manifest, stage, order, options = {}) {
 				...declaration.scheme ? { scheme: declaration.scheme } : {}
 			} : {},
 			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
-			...declaration.kind === "objects" && declaration.expire ? { expire: declaration.expire } : {},
+			...declaration.kind === "file-server" && declaration.processors?.length ? { processors: [...new Set(declaration.processors.map((p) => p.prefix))].sort() } : {},
+			...declaration.kind === "objects" && (0, _geekmidas_manifest.bucketExpiry)(manifest, id) ? { expire: (0, _geekmidas_manifest.bucketExpiry)(manifest, id) } : {},
 			...(declaration.kind === "rest-api" || declaration.kind === "site") && declaration.subdomain ? { subdomain: declaration.subdomain } : {},
 			...fake ? { fake: {
 				key: fake.key,
@@ -1217,6 +1354,14 @@ function envFor(plan, options) {
 	}
 	Object.assign(env, publicEnv(plan, env, options.addresses));
 	Object.assign(env, brokerEnv(plan, options.ports, credential));
+	const relay = env.EVENT_PUBLISHER_CONNECTION_STRING;
+	if (relay && options.relayedBuckets?.length) for (const resource of plan.resources) {
+		if (resource.kind !== "objects" || resource.container !== "minio") continue;
+		if (!options.relayedBuckets.includes(resource.id)) continue;
+		if (!env[resource.envKey]) continue;
+		env[(0, _geekmidas_manifest.provideKey)(resource.id, "eventsConnectionString")] = relay;
+		env[(0, _geekmidas_manifest.provideKey)(resource.id, "eventsToken")] = objectsWebhookToken(options.project ?? "", resource.id, credential.seed);
+	}
 	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, storageCredentials(options.credentials));
 	return env;
 }
@@ -1368,7 +1513,7 @@ function urlFor(resource, plan, ports, project, addresses, credential) {
 	if (resource.kind === "rest-api" || resource.kind === "site") {
 		const address = addresses?.[resource.id];
 		const edge = plan.containers.includes("caddy") ? ports[primaryPortKey("caddy")] : void 0;
-		return address && edge !== void 0 ? `https://${hostFor(resource, project)}:${edge}` : address;
+		return address && edge !== void 0 ? `https://${hostFor$1(resource, project)}:${edge}` : address;
 	}
 	if (!resource.container) return void 0;
 	const port = ports[primaryPortKey(resource.container)];
@@ -1395,7 +1540,7 @@ function urlFor(resource, plan, ports, project, addresses, credential) {
 		case "file-server": {
 			const origin = plan.resources.find((r) => r.id === resource.of);
 			if (!origin) return void 0;
-			return plan.containers.includes("caddy") ? `https://${hostFor(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
+			return plan.containers.includes("caddy") ? `https://${hostFor$1(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
 		}
 		case "cache":
 			if (resource.of) {
@@ -1869,7 +2014,7 @@ function folderName(path) {
 function getKeystoreDir(project) {
 	if (!PROJECT_KEY.test(project.key)) throw new KeystoreProjectInvalid(project.key);
 	const [namespace, name] = project.key.split("/");
-	return (0, node_path.join)(project.home ?? require_run.gkmHome(), "keys", namespace, name);
+	return (0, node_path.join)(project.home ?? require_credentials.gkmHome(), "keys", namespace, name);
 }
 /** Get the path to a stage's encryption key. */
 function getKeyPath(stage, project) {
@@ -1886,7 +2031,7 @@ function legacyKeyPaths(stage, project) {
 		key,
 		home: project.home
 	}));
-	const homes = [.../* @__PURE__ */ new Set([project.home ?? require_run.gkmHome(), (0, node_path.join)((0, node_os.homedir)(), ".gkm")])];
+	const homes = [.../* @__PURE__ */ new Set([project.home ?? require_credentials.gkmHome(), (0, node_path.join)((0, node_os.homedir)(), ".gkm")])];
 	const names = (project.legacy ?? []).filter(isLegacyName);
 	return [...aliases, ...names.flatMap((name) => homes.map((home) => (0, node_path.join)(home, name, `${stage}.key`)))];
 }
@@ -2140,7 +2285,7 @@ function localCredentialsPath(project) {
 	const keys = getKeystoreDir(project);
 	const name = keys.split(/[\\/]/).at(-1);
 	const namespace = keys.split(/[\\/]/).at(-2);
-	return (0, node_path.join)(project.home ?? require_run.gkmHome(), "local", namespace, `${name}.json`);
+	return (0, node_path.join)(project.home ?? require_credentials.gkmHome(), "local", namespace, `${name}.json`);
 }
 /** The local stage's logins file is there, and its key is not. */
 var LocalCredentialsKeyMissing = class extends require_errors.GkmError {
@@ -2584,6 +2729,56 @@ async function databasesExist(client, names) {
 	}
 }
 /**
+* Point each watched bucket's events at its webhook target, and stop sending
+* an unwatched one's.
+*
+* Merged rather than written whole: only the rule gkm owns on a bucket
+* (`gkm-<Bucket>`) is added or removed, and every other rule — one somebody
+* added by hand — is kept. Compared before writing, so a converged reconcile
+* changes nothing.
+*
+* @param buckets - each bucket the plan names, by construct id and name
+* @param watched - the construct ids whose events are relayed
+*/
+async function applyNotifications(client, buckets, watched) {
+	const applied = [];
+	for (const { id, name } of buckets) {
+		const current = await client.notification(name);
+		const queues = current.QueueConfigurations ?? [];
+		const others = queues.filter((rule) => !rule.Id?.startsWith(NOTIFICATION_RULE_PREFIX));
+		const wanted = watched.has(id) ? [...others, minioNotificationRule(id)] : others;
+		if (!watched.has(id) && others.length === queues.length) continue;
+		const describe = `object events from ${name}`;
+		const ours = queues.filter((rule) => rule.Id?.startsWith(NOTIFICATION_RULE_PREFIX));
+		if (watched.has(id) ? ours.length === 1 && sameRule(ours[0], minioNotificationRule(id)) : ours.length === 0) {
+			applied.push({
+				id: `${name}:events`,
+				describe,
+				created: false
+			});
+			continue;
+		}
+		await client.setNotification(name, {
+			...current,
+			QueueConfigurations: wanted
+		});
+		applied.push({
+			id: `${name}:events`,
+			describe,
+			created: true
+		});
+	}
+	return applied;
+}
+/**
+* Whether a rule read back says what gkm wrote: the same target, the same
+* events in any order, and no filter — the store may hand back an empty one.
+*/
+function sameRule(current, wanted) {
+	const filter = current.Filter;
+	return current.Id === wanted.Id && current.QueueArn === wanted.QueueArn && JSON.stringify([...current.Events ?? []].sort()) === JSON.stringify([...wanted.Events ?? []].sort()) && (filter?.Key?.FilterRules?.length ?? 0) === 0;
+}
+/**
 * Apply each bucket's expiry, beside whatever other rules it has, skipping
 * those already correct — the same merge the `s3` provider makes deployed.
 */
@@ -2705,14 +2900,7 @@ var WorkerNameTaken = class extends require_errors.GkmError {
 * @param background Each worker's files, from discovery's `background`.
 */
 function workerUnits(workspace, manifest, background) {
-	const hosts = Object.entries(workspace.apps).filter(([, app]) => app.type === "backend" && !app.entry).map(([name, app]) => {
-		const surface = Object.entries(manifest).find(([id, d]) => d.kind === "rest-api" && require_derive.appKey(id) === name)?.[1];
-		return {
-			name,
-			root: (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path),
-			generated: !(surface?.kind === "rest-api" && surface.endpoints.length > 0)
-		};
-	}).sort((a, b) => a.name.localeCompare(b.name));
+	const hosts = hostApps(workspace, manifest);
 	const units = [];
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "worker") continue;
@@ -2720,12 +2908,8 @@ function workerUnits(workspace, manifest, background) {
 		if (files.length === 0) continue;
 		const name = require_derive.appKey(id);
 		if (workspace.apps[name]) throw new WorkerNameTaken(id, name);
-		const ranked = hosts.map((host) => ({
-			host,
-			holds: files.filter((file) => isUnder(file, host.root)).length
-		})).sort((a, b) => b.holds - a.holds || Number(b.host.generated) - Number(a.host.generated));
-		const host = ranked[0]?.host;
-		if (!host || ranked[0].holds === 0 && !host.generated) throw new WorkerHasNoApp(id);
+		const host = hostFor(hosts, files);
+		if (!host) throw new WorkerHasNoApp(id);
 		units.push({
 			id,
 			name,
@@ -2734,6 +2918,70 @@ function workerUnits(workspace, manifest, background) {
 	}
 	return units.sort((a, b) => a.name.localeCompare(b.name));
 }
+/** The service and image name of a file server's processors: `assets-processors`. */
+function processorUnitName(fileServerId) {
+	return `${require_derive.appKey(fileServerId.replace(/Server$/, ""))}-processors`;
+}
+/** A file server with processors and no backend app to build them from. */
+var ProcessorsHaveNoApp = class extends require_errors.GkmError {
+	fileServer;
+	constructor(fileServer) {
+		super(`The file server '${fileServer}' has processors, and the workspace has no backend app that builds a server to carry their entry. Declare a RestApi whose app holds the processors' code.`);
+		this.fileServer = fileServer;
+		this.name = "ProcessorsHaveNoApp";
+	}
+};
+/**
+* The processor units a workspace deploys — each file server with processors
+* — and the app each is built from, chosen as a worker's is: the backend app
+* holding the most of its processors' files.
+*/
+function processorUnits(workspace, manifest) {
+	const hosts = hostApps(workspace, manifest);
+	const units = [];
+	for (const declaration of Object.values(manifest)) {
+		if (declaration.kind !== "file-server") continue;
+		const processors = declaration.processors ?? [];
+		if (processors.length === 0) continue;
+		const host = hostFor(hosts, processors.map(({ handler }) => {
+			const file = handler.split("#")[0] ?? handler;
+			return (0, node_path.isAbsolute)(file) ? file : (0, node_path.join)(workspace.root, file);
+		}));
+		if (!host) throw new ProcessorsHaveNoApp(declaration.id);
+		const name = processorUnitName(declaration.id);
+		if (workspace.apps[name]) throw new WorkerNameTaken(declaration.id, name);
+		units.push({
+			id: declaration.id,
+			name,
+			app: host.name
+		});
+	}
+	return units.sort((a, b) => a.name.localeCompare(b.name));
+}
+/** The backend apps whose builds generate a server, each where it lives. */
+function hostApps(workspace, manifest) {
+	return Object.entries(workspace.apps).filter(([, app]) => app.type === "backend" && !app.entry).map(([name, app]) => {
+		const surface = Object.entries(manifest).find(([id, d]) => d.kind === "rest-api" && require_derive.appKey(id) === name)?.[1];
+		return {
+			name,
+			root: (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path),
+			generated: !(surface?.kind === "rest-api" && surface.endpoints.length > 0)
+		};
+	}).sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* The app holding the most of these files; then one that generates a server;
+* then by name. None when no app holds any and none generates a server.
+*/
+function hostFor(hosts, files) {
+	const ranked = hosts.map((host) => ({
+		host,
+		holds: files.filter((file) => isUnder(file, host.root)).length
+	})).sort((a, b) => b.holds - a.holds || Number(b.host.generated) - Number(a.host.generated));
+	const host = ranked[0]?.host;
+	if (!host || ranked[0].holds === 0 && !host.generated) return void 0;
+	return host;
+}
 /** Whether `file` is inside `dir`. */
 function isUnder(file, dir) {
 	const rel = (0, node_path.relative)(dir, file);
@@ -3383,6 +3631,8 @@ function generateBackendDockerfile(options) {
 }
 /** The port a worker answers its health check on, inside its container. */
 const WORKER_PORT = 3e3;
+/** The port a processor unit answers on, inside its container. */
+const PROCESSOR_PORT = 3e3;
 /**
 * A Worker's image: the same build as its host app's backend — a pruned
 * slice, `gkm build --provider server --production` in the image, with the
@@ -3399,6 +3649,19 @@ function generateWorkerDockerfile(options) {
 		expose: false
 	});
 }
+/**
+* A file server's processor unit: its host app's build, and the unit's bundle
+* as the runner. Its native packages — `sharp` — are installed for the image's
+* platform beside the bundle, at the versions the build resolved.
+*/
+function generateProcessorDockerfile(options) {
+	return gkmBundleDockerfile(options, {
+		title: `Processors Dockerfile (${options.fileServer})`,
+		bundle: options.bundle,
+		as: "processors.mjs",
+		expose: true
+	});
+}
 function gkmBundleDockerfile(options, runner) {
 	const { port, healthCheckPath = "/health" } = options;
 	const { app } = layout(options);
@@ -3425,7 +3688,7 @@ RUN apk add --no-cache tini
 RUN addgroup --system --gid 1001 nodejs && \\
     adduser --system --uid 1001 hono
 
-# The bundled ${runner.as === "server.mjs" ? "server" : "worker"}
+# The bundled ${runner.as.replace(/\.mjs$/, "")}
 COPY --from=builder --chown=hono:nodejs ${app}/.gkm/server/dist/${runner.bundle} ./${runner.as === runner.bundle ? "" : runner.as}${externals.copy}
 
 ENV NODE_ENV=production
@@ -3917,7 +4180,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
 		case "s3": {
-			const { S3SecretsStore } = await Promise.resolve().then(() => require("./s3-DwKLXwUT.cjs"));
+			const { S3SecretsStore } = await Promise.resolve().then(() => require("./s3-pqgmCTOq.cjs"));
 			const { deployIdentity } = await Promise.resolve().then(() => require("./identity-CbLfgQNT.cjs")).then((n) => n.identity_exports);
 			const location = require_workspace.s3SecretsLocation(config, workspace.state);
 			return new S3SecretsStore({
@@ -4291,6 +4554,14 @@ function composeFor(plan, options) {
 		const volume = volumeOf(container);
 		if (volume) volumes[volume] = {};
 	}
+	const minio = services.minio;
+	if (minio && options.objectWebhooks?.length) {
+		minio.environment = {
+			...minio.environment,
+			...minioWebhookEnv(options.objectWebhooks)
+		};
+		if (options.objectWebhooks.some((hook) => hook.endpoint.includes(`//host.docker.internal:`))) minio.extra_hosts = [`${HOST_GATEWAY}:host-gateway`];
+	}
 	return {
 		name: options.project,
 		services: {
@@ -4664,6 +4935,16 @@ function bucketClient(port, credentials) {
 				Bucket: bucket,
 				LifecycleConfiguration: { Rules: rules }
 			}));
+		},
+		async notification(bucket) {
+			const { $metadata: _, ...notification } = await s3.send(new _aws_sdk_client_s3.GetBucketNotificationConfigurationCommand({ Bucket: bucket }));
+			return notification;
+		},
+		async setNotification(bucket, notification) {
+			await s3.send(new _aws_sdk_client_s3.PutBucketNotificationConfigurationCommand({
+				Bucket: bucket,
+				NotificationConfiguration: notification
+			}));
 		}
 	};
 }
@@ -5500,9 +5781,10 @@ async function reconcile(options) {
 		project,
 		ports,
 		credentials: options.credentials,
-		...options.apps ? { apps: options.apps(plan.containers) } : {}
+		...options.apps ? { apps: options.apps(plan.containers) } : {},
+		...options.objectWebhooks?.length ? { objectWebhooks: options.objectWebhooks } : {}
 	});
-	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
+	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses, options.processorAddresses));
 	const hash = planHash(plan, compose, {
 		caddyfile,
 		postgres: postgresStatements(plan, project, seed).map((statement) => statement.create).join(";\n")
@@ -5518,7 +5800,8 @@ async function reconcile(options) {
 			...options.mailFrom ? { mailFrom: options.mailFrom } : {},
 			...options.addresses ? { addresses: options.addresses } : {},
 			...lan ? { lanAddress: lan } : {},
-			...options.metroPorts ? { metroPorts: options.metroPorts } : {}
+			...options.metroPorts ? { metroPorts: options.metroPorts } : {},
+			...options.objectWebhooks?.length ? { relayedBuckets: options.objectWebhooks.map((hook) => hook.bucket) } : {}
 		});
 		const env = exports ? resolved : scopeTelemetryEnv(resolved, {
 			uses: false,
@@ -5575,7 +5858,7 @@ async function reconcile(options) {
 	};
 	const credentials = checked.credentials;
 	if (start && provision) options.progress?.("🗄️  Creating what the constructs declare — databases, roles, buckets, topics");
-	const provisioned = start && provision ? await create(plan, ports, credentials, sql, buckets, carriers, project) : [];
+	const provisioned = start && provision ? await create(plan, ports, credentials, sql, buckets, carriers, project, new Set(stage === (options.localStage ?? stage) ? (options.objectWebhooks ?? []).map((hook) => hook.bucket) : [])) : [];
 	await saveState(root, {
 		hash,
 		stage
@@ -5595,7 +5878,7 @@ async function reconcile(options) {
 * Idempotent throughout, so this runs on every non-converged reconcile rather
 * than being something to remember.
 */
-async function create(plan, ports, credentials, sql, buckets, emulatorCarriers, project) {
+async function create(plan, ports, credentials, sql, buckets, emulatorCarriers, project, watched) {
 	const applied = [];
 	const postgresPort = ports[primaryPortKey("postgres")];
 	const statements = postgresStatements(plan, project, credentials.seed);
@@ -5609,6 +5892,10 @@ async function create(plan, ports, credentials, sql, buckets, emulatorCarriers,
 		if (names.length > 0) applied.push(...await applyBuckets(client, names));
 		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
 		if (lifecycles.length > 0) applied.push(...await applyLifecycles(client, lifecycles));
+		if (names.length > 0) applied.push(...await applyNotifications(client, plan.resources.filter((r) => r.provisions && r.kind === "objects").map((r) => ({
+			id: r.id,
+			name: r.name
+		})), watched));
 	}
 	const emulatorPort = ports[primaryPortKey("localstack")];
 	const carriers = carrierNames(plan);
@@ -5674,7 +5961,9 @@ var workspace_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	constructGlobs: () => constructGlobs,
 	derivedContainers: () => derivedContainers,
 	fakesApply: () => fakesApply,
+	localObjectWebhooks: () => localObjectWebhooks,
 	metroPorts: () => metroPorts,
+	processorAddresses: () => processorAddresses,
 	reconcileWorkspace: () => reconcileWorkspace,
 	surfaceAddresses: () => surfaceAddresses
 });
@@ -5737,16 +6026,25 @@ function fakesApply(stage, fake, env = process.env) {
 */
 async function reconcileWorkspace(workspace, options) {
 	const runnables = {};
+	const background = {};
+	const subscribers = {};
 	const discovered = await require_discover.discover({
 		patterns: constructGlobs(workspace),
 		cwd: workspace.root,
-		runnables
+		runnables,
+		background,
+		subscribers
 	});
 	const manifest = options.manifest ?? discovered;
 	const faked = fakesApply(options.stage, options.fake);
 	const fakes = faked ? await require_SubscriberGenerator.readFakes(workspace.root, manifest) : {};
 	const credentialFakes = faked ? await require_SubscriberGenerator.readCredentialFakes(workspace.root, manifest) : {};
 	const { credentials } = await loadLocalCredentials(workspace);
+	const objectWebhooks = localObjectWebhooks(workspace, manifest, {
+		background,
+		subscribers,
+		seed: credentials.seed
+	});
 	const result = await reconcile({
 		credentials,
 		root: workspace.root,
@@ -5757,9 +6055,11 @@ async function reconcileWorkspace(workspace, options) {
 		...backendsOf(workspace),
 		saved: await loadPortState(workspace.root),
 		addresses: surfaceAddresses(workspace, manifest),
+		processorAddresses: processorAddresses(workspace, manifest),
 		metroPorts: metroPorts(workspace, manifest),
 		fakes,
 		credentialFakes,
+		...objectWebhooks.length > 0 ? { objectWebhooks } : {},
 		apps: (containers) => appServices(workspace, manifest, containers, credentials, runnables, fakes, credentialFakes),
 		...options.start === void 0 ? {} : { start: options.start },
 		...options.progress ? { progress: options.progress } : {}
@@ -5774,6 +6074,40 @@ async function reconcileWorkspace(workspace, options) {
 	};
 }
 /**
+* Where MinIO posts each watched bucket's events under `gkm dev`: the dev
+* server of the app that builds the worker running the bucket's subscribers,
+* on the host, on that app's port — the process that relays them onto the
+* broker.
+*
+* None where the broker is SNS: there a bucket's events come from a topic, and
+* nothing relays them. None for a worker no app can build — `gkm build` says
+* so; a dev loop has nothing to post to.
+*/
+function localObjectWebhooks(workspace, manifest, options) {
+	if (backendsOf(workspace).events === "sns") return [];
+	const watched = watchedBuckets(manifest, options.subscribers);
+	if (watched.size === 0) return [];
+	let units;
+	try {
+		units = workerUnits(workspace, manifest, options.background);
+	} catch (error) {
+		if (error instanceof WorkerHasNoApp) return [];
+		throw error;
+	}
+	const hooks = [];
+	for (const [bucket, worker] of watched) {
+		const app = units.find((unit) => unit.id === worker)?.app;
+		const port = app ? workspace.apps[app]?.port : void 0;
+		if (!port) continue;
+		hooks.push({
+			bucket,
+			endpoint: `http://${HOST_GATEWAY}:${port}${require_SubscriberGenerator.objectsRoute(bucket)}`,
+			token: objectsWebhookToken(workspace.name, bucket, options.seed)
+		});
+	}
+	return hooks;
+}
+/**
 * Where each mobile app's Metro runs: its app's port, which `gkm exec` hands
 * Expo as `RCT_METRO_PORT`. Kept apart from the surfaces' addresses — a phone
 * reaches Metro by `exp://`, not through the edge.
@@ -5788,6 +6122,19 @@ function metroPorts(workspace, manifest) {
 	return ports;
 }
 /**
+* Where each file server's processors answer locally: the dev server of the
+* app holding them, which `gkm dev` mounts them on — the same app whose build
+* writes their unit deployed.
+*/
+function processorAddresses(workspace, manifest) {
+	const addresses = {};
+	for (const unit of processorUnits(workspace, manifest)) {
+		const port = workspace.apps[unit.app]?.port;
+		if (port) addresses[unit.id] = localAddress(port);
+	}
+	return addresses;
+}
+/**
 * Where each declared surface and site answers locally.
 *
 * The addresses come from the ports the workspace already assigns; which
@@ -5966,8 +6313,31 @@ function workerEnvKeys(manifest, workerId, runnables = {}) {
 	return keys;
 }
 /** What each construct an edge reaches hands the process that reaches it. */
+/**
+* The keys a file server's processor unit reads: its bucket's, and what each
+* of its processors depends on. `undefined` for a file server with none.
+*/
+function processorEnvKeys(manifest, fileServerId, runnables = {}) {
+	const server = manifest[fileServerId];
+	if (server?.kind !== "file-server" || !server.processors?.length) return;
+	const keys = /* @__PURE__ */ new Set();
+	addEdgeKeys(manifest, [
+		server.of,
+		...server.processors.flatMap((p) => p.dependencies.map((d) => d.target)),
+		...runnables[fileServerId] ?? []
+	], keys);
+	return keys;
+}
 function addEdgeKeys(manifest, edges, keys) {
 	for (const id of edges) {
+		const bucket = require_discover.eventsEdgeBucket(id);
+		if (bucket) {
+			if (manifest[bucket]?.kind === "objects") {
+				keys.add((0, _geekmidas_manifest.provideKey)(bucket, "eventsConnectionString"));
+				keys.add((0, _geekmidas_manifest.provideKey)(bucket, "eventsToken"));
+			}
+			continue;
+		}
 		const target = manifest[id];
 		if (!target) continue;
 		if (target.kind === "rest-api") {
@@ -6425,6 +6795,308 @@ function validateImageRef(ref) {
 	return ref;
 }
 //#endregion
+//#region src/providers/processorOrigin.ts
+/**
+* A file server's processors as a CDN origin: the names both sides agree on.
+*
+* On a compose stage whose bucket is on S3, the CDN serves the bucket and
+* sends each processor pattern to the stack's processor unit, at a host of
+* its own. That host is public — a CDN reaches its origin over the internet —
+* so the CDN adds a secret header and the edge refuses any request without
+* it. One definition, read by the CDN that sends the header and by the stack
+* whose edge checks it, so the two cannot drift.
+*/
+/** The header the CDN adds to every request it sends a processor. */
+const ORIGIN_VERIFY_HEADER = "X-Gkm-Origin-Verify";
+/** Where a file server's processors answer the CDN: `<fileserver>-processors.<domain>`. */
+function processorOriginHost(serverId, domain) {
+	return `${require_derive.appKey(serverId)}-processors.${domain}`.toLowerCase();
+}
+/** The stage secret holding the header's value: `ASSETS_SERVER_ORIGIN_SECRET`. */
+function originSecretKey(serverId) {
+	return (0, _geekmidas_manifest.provideKey)(serverId, "originSecret");
+}
+/**
+* What the processor unit reads that secret from. Set wherever the CDN fronts
+* it, so the unit refuses a request without the header itself — on Dokploy,
+* whose edge cannot match a header, the only check; behind the stack's own
+* edge, a second one.
+*/
+const PROCESSOR_ORIGIN_SECRET_ENV = "GKM_PROCESSOR_ORIGIN_SECRET";
+/** A new value for that secret: random, generated once, kept in the stage. */
+function newOriginSecret() {
+	return (0, node_crypto.randomBytes)(32).toString("base64url");
+}
+//#endregion
+//#region src/generators/ProcessorGenerator.ts
+/** Where a file server's processor entry lives, under an app's `.gkm/server`. */
+function processorEntryDir(serverDir, fileServerId) {
+	return (0, node_path.join)(serverDir, "processors", processorUnitName(fileServerId));
+}
+/** The file its bundle is written to, beside the server's. */
+function processorBundleName(fileServerId) {
+	return `${processorUnitName(fileServerId)}.mjs`;
+}
+/**
+* A file server's processors, as the build generates them.
+*
+* On AWS each is a Lambda behind a function URL — the CDN's origin for its
+* pattern. On a server they are one process per file server, the processor
+* unit (see {@link ProcessorGenerator.buildEntry}), so the `server` target
+* generates nothing per processor here.
+*/
+var ProcessorGenerator = class extends require_discover.ConstructGenerator {
+	isConstruct(value) {
+		return _geekmidas_constructs_processors.Processor.isProcessor(value);
+	}
+	async build(context, constructs, outputDir, options) {
+		if ((options?.target ?? "aws") !== "aws" || constructs.length === 0) return [];
+		const dir = (0, node_path.join)(outputDir, "processors");
+		await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+		const infos = [];
+		for (const { key, construct, path } of constructs) {
+			const file = (0, node_path.join)(dir, `${key}.ts`);
+			const importPath = (0, node_path.relative)((0, node_path.dirname)(file), path.relative).replace(/\.ts$/, ".js");
+			await (0, node_fs_promises.writeFile)(file, `import { AWSLambdaProcessor } from '@geekmidas/constructs/processors';
+import { ${key} } from '${importPath}';
+${context.storageDrivers?.imports ?? ""}
+${context.storageDrivers?.setup ? `\n// The handler registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
+const adapter = new AWSLambdaProcessor(${key});
+
+export const handler = adapter.handler;
+`);
+			infos.push(await processorInfo(key, construct, (0, node_path.relative)(options?.root ?? process.cwd(), file).replace(/\.ts$/, ".handler"), context));
+		}
+		return infos;
+	}
+	/**
+	* `gkm dev`'s half: `processors.ts` beside the dev server's app, mounting
+	* each file server's processors under `/__gkm/processors/<FileServer>`.
+	* The local edge sends each pattern on the file server's host there, so
+	* `processedUrl()` answers locally as it does deployed.
+	*
+	* In the dev server's own process rather than a unit of its own: locally
+	* there is no CPU to protect, and the dev server already reloads on change.
+	*/
+	async buildDev(outputDir, processors) {
+		await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
+		const file = (0, node_path.join)(outputDir, "processors.ts");
+		const imports = processors.map(({ key, path }) => {
+			const specifier = (0, node_path.relative)(outputDir, path.absolute).replace(/\.ts$/, ".js");
+			return `import { ${key} } from '${specifier.startsWith(".") ? specifier : `./${specifier}`}';`;
+		}).join("\n");
+		const byServer = /* @__PURE__ */ new Map();
+		for (const { key, construct } of processors) byServer.set(construct.surfaceId, [...byServer.get(construct.surfaceId) ?? [], key]);
+		const units = [...byServer.entries()].map(([id, keys]) => `    ${JSON.stringify(id)}: [${keys.join(", ")}],`).join("\n");
+		await (0, node_fs_promises.writeFile)(file, `/**
+ * Generated processors setup for \`gkm dev\`.
+ *
+ * Each file server's processors, under ${PROCESSORS_DEV_PREFIX}<FileServer>: the
+ * local edge rewrites each processor pattern on the file server's host here.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import { processorServer } from '@geekmidas/constructs/processors';
+${imports}
+
+export function setupProcessors(
+  app: { all: (path: string, handler: (c: any) => unknown) => unknown },
+  envParser: EnvironmentParser<any>,
+): void {
+  const units: Record<string, ReturnType<typeof processorServer>> = Object.fromEntries(
+    Object.entries({
+${units}
+    }).map(([id, processors]) => [id, processorServer(processors, envParser)]),
+  );
+
+  app.all('${PROCESSORS_DEV_PREFIX}:server/*', async (c: any) => {
+    const server = c.req.param('server') as string;
+    const serve = units[server];
+    if (!serve) return c.notFound();
+    const path = c.req.path.slice(\`${PROCESSORS_DEV_PREFIX}\${server}\`.length) || '/';
+    const response = await serve({ method: c.req.method, path });
+    if (!response) {
+      return new Response(null, {
+        status: 404,
+        headers: { 'cache-control': 'public, max-age=60' },
+      });
+    }
+    return new Response(c.req.method === 'HEAD' ? null : response.body, {
+      status: response.status,
+      headers: response.headers,
+    });
+  });
+}
+`);
+		return file;
+	}
+	/**
+	* A file server's processor unit: one process answering each of its
+	* processors' patterns, and `/health`. Returns its entry, `processors.ts`.
+	*
+	* Its own process because making a derivative is CPU-bound — a resize
+	* spike in the API's process would be every request's latency.
+	*/
+	async buildEntry(input) {
+		const { context, outputDir, processors } = input;
+		await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
+		await require_EndpointGenerator.writeTelemetryModule(outputDir, input.telemetry);
+		const healthCheck = context.production?.healthCheck ?? "/health";
+		const imports = processors.map(({ key, path }) => {
+			const specifier = (0, node_path.relative)(outputDir, path.absolute).replace(/\.ts$/, ".js");
+			return `import { ${key} } from '${specifier.startsWith(".") ? specifier : `./${specifier}`}';`;
+		}).join("\n");
+		const entry = (0, node_path.join)(outputDir, "processors.ts");
+		await (0, node_fs_promises.writeFile)(entry, `#!/usr/bin/env node
+/**
+ * Production entry for ${input.fileServerId}'s processors.
+ * Generated by 'gkm build --production'.
+ *
+ * Answers each processor's pattern, and ${healthCheck} on PORT. The edge
+ * routes only those patterns here; everything else on the file server's
+ * domain is the bucket.
+ */
+import { timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { runShutdownHooks } from '@geekmidas/constructs';
+import { processorServer } from '@geekmidas/constructs/processors';
+${context.storageDrivers?.imports ?? ""}
+${imports}
+
+${require_EndpointGenerator.startTelemetryCode([healthCheck])}
+${context.storageDrivers?.setup ? `// The entry point registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
+process.env.GKM_APP_NAME ??= ${JSON.stringify(processorUnitName(input.fileServerId))};
+
+const processors = [${processors.map(({ key }) => key).join(", ")}];
+const serve = processorServer(processors);
+const port = Number(process.env.PORT) || 3000;
+let stopping = false;
+
+${input.telemetry ? REQUEST_SPANS : NO_REQUEST_SPANS}
+// Where the CDN fronts this unit, the secret it adds to every request: one
+// without it is refused here, whatever the edge in front did or could not.
+const originSecret = process.env.${PROCESSOR_ORIGIN_SECRET_ENV}
+  ? Buffer.from(process.env.${PROCESSOR_ORIGIN_SECRET_ENV})
+  : undefined;
+const fromOrigin = (header: string | string[] | undefined) => {
+  if (!originSecret) return true;
+  const given = Buffer.from(typeof header === 'string' ? header : '');
+  return given.length === originSecret.length && timingSafeEqual(given, originSecret);
+};
+
+const server = createServer(async (req, res) => {
+  const method = req.method ?? 'GET';
+  const path = (req.url ?? '/').split('?')[0] ?? '/';
+  if (path === ${JSON.stringify(healthCheck)}) {
+    res.writeHead(stopping ? 503 : 200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ status: stopping ? 'stopping' : 'ok' }));
+    return;
+  }
+  if (!fromOrigin(req.headers[${JSON.stringify(ORIGIN_VERIFY_HEADER.toLowerCase())}])) {
+    res.writeHead(403, { 'cache-control': 'no-store' }).end();
+    return;
+  }
+  await traced(method, path, async () => {
+    try {
+      const response = await serve({ method, path });
+      if (!response) {
+        res.writeHead(404, { 'cache-control': 'public, max-age=60' }).end();
+        return 404;
+      }
+      res.writeHead(response.status, response.headers);
+      res.end(method === 'HEAD' ? undefined : response.body);
+      return response.status;
+    } catch (error) {
+      console.error(error);
+      res.writeHead(500, { 'cache-control': 'no-store' }).end();
+      return 500;
+    }
+  });
+});
+server.listen(port);
+
+const shutdown = async () => {
+  if (stopping) return;
+  stopping = true;
+  setTimeout(() => process.exit(1), Number(process.env.GKM_SHUTDOWN_TIMEOUT_MS) || 8000).unref();
+  server.close();
+  await runShutdownHooks((error) => console.error(error));
+  process.exit(0);
+};
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
+`);
+		return entry;
+	}
+};
+/**
+* A SERVER span per request, once telemetry has started — opened by the unit
+* rather than by hooking node:http, which sees nothing inside a bundle. Named
+* after the processor's pattern, never the key, which has no bound.
+*
+* Only in an entry whose file server has a `Telemetry` node: the bundle
+* follows the import, and an app without one need not install the API.
+*/
+const REQUEST_SPANS = `const tracing = requestSpans ? await import('@opentelemetry/api') : undefined;
+const routeOf = (path: string) =>
+  processors.find((processor) => path.startsWith(processor.prefix))?.pattern;
+
+async function traced(
+  method: string,
+  path: string,
+  run: () => Promise<number>,
+): Promise<void> {
+  if (!tracing) {
+    await run();
+    return;
+  }
+  const route = routeOf(path);
+  await tracing.trace.getTracer('@geekmidas/processors').startActiveSpan(
+    route ? \`\${method} \${route}\` : method,
+    {
+      kind: tracing.SpanKind.SERVER,
+      attributes: {
+        'http.request.method': method,
+        'url.path': path,
+        ...(route ? { 'http.route': route } : {}),
+      },
+    },
+    async (span) => {
+      try {
+        const status = await run();
+        span.setAttribute('http.response.status_code', status);
+        if (status >= 500) span.setStatus({ code: tracing.SpanStatusCode.ERROR });
+      } finally {
+        span.end();
+      }
+    },
+  );
+}
+`;
+/** The same shape without telemetry: each request just runs. */
+const NO_REQUEST_SPANS = `async function traced(
+  _method: string,
+  _path: string,
+  run: () => Promise<number>,
+): Promise<void> {
+  await run();
+}
+`;
+/** What the manifest records of one processor. */
+async function processorInfo(name, processor, handler, context) {
+	return {
+		name,
+		handler,
+		fileServer: processor.surfaceId,
+		path: processor.pattern,
+		prefix: processor.prefix,
+		...processor.native.length ? { native: [...processor.native] } : {},
+		...processor.timeout !== void 0 ? { timeout: processor.timeout } : {},
+		...processor.memorySize !== void 0 ? { memorySize: processor.memorySize } : {},
+		environment: await processor.getEnvironment({ markOptional: context.markOptional }),
+		dependencies: processor.constructs
+	};
+}
+//#endregion
 //#region src/generators/CronGenerator.ts
 var CronGenerator = class extends require_discover.ConstructGenerator {
 	async build(context, constructs, outputDir, options) {
@@ -7003,17 +7675,59 @@ async function answers(connection: unknown): Promise<boolean> {
   }
 }
 
+/** A request to a route this worker mounted, and what it answered. */
+export interface WorkerRequest {
+  headers: Record<string, string | string[] | undefined>;
+  body: string;
+}
+export interface WorkerAnswer {
+  status: number;
+  body: unknown;
+}
+
+// The routes something pushes to: an SNS subscriber's, and the one a local
+// object store posts a bucket's events to. Mounted by the subscribers, served
+// by the entry's HTTP server beside the health check.
+const routes = new Map<string, (c: any) => unknown>();
+const app = {
+  post: (path: string, handler: (c: any) => unknown) => {
+    routes.set(path, handler);
+  },
+};
+
+/** Run one mounted route, as the subscribers' handlers expect to be called. */
+async function route(path: string, request: WorkerRequest): Promise<WorkerAnswer | undefined> {
+  const handler = routes.get(path);
+  if (!handler) return undefined;
+  let answer: WorkerAnswer | undefined;
+  const c = {
+    req: {
+      text: async () => request.body,
+      header: (name: string) => {
+        const value = request.headers[name.toLowerCase()];
+        return Array.isArray(value) ? value[0] : value;
+      },
+    },
+    json: (body: unknown, status = 200) => {
+      answer = { status, body };
+      return answer;
+    },
+  };
+  await handler(c);
+  return answer ?? { status: 204, body: null };
+}
+
 /** Start everything this worker runs. */
 export async function startWorker(): Promise<{
   health: () => Promise<WorkerHealth>;
   stop: () => Promise<void>;
+  route: typeof route;
+  /** Subscribe the pushed routes, once the server answers on \`port\`. */
+  subscribeForPush: (port: number) => Promise<void>;
 }> {
-  // An app object with no routes: on a server target nothing is pushed to a
-  // subscriber, so there is nothing to mount.
-  const noRoutes = { post: () => undefined };
-
-  await setupSubscribers(noRoutes, envParser, logger).catch((error) => {
+  const subscribeForPush = await setupSubscribers(app, envParser, logger).catch((error) => {
     logger.error({ err: error }, 'Failed to start subscribers');
+    return async (_port: number) => {};
   });
   await setupQueues(envParser, logger).catch((error) => {
     logger.error({ err: error }, 'Failed to start queue consumers');
@@ -7025,6 +7739,8 @@ export async function startWorker(): Promise<{
   const statuses = () => [subscribersStatus(), queuesStatus(), cronsStatus()];
 
   return {
+    route,
+    subscribeForPush,
     async health() {
       const all = statuses();
       const failed = all.flatMap((s) => s.failed);
@@ -7055,8 +7771,10 @@ function workerEntry(healthCheck) {
  * Generated by 'gkm build --production'.
  *
  * Runs this worker's crons, queue consumers and topic subscribers, and serves
- * one route: ${healthCheck}, on PORT — 200 when every consumer started and
- * every broker connection answers, 503 otherwise.
+ * its health check: ${healthCheck}, on PORT — 200 when every consumer started
+ * and every broker connection answers, 503 otherwise. Beside it, on the same
+ * port, the POST routes its subscribers mounted: where a local object store
+ * posts a bucket's events.
  *
  * On SIGTERM it stops pulling messages and scheduling crons, lets the handlers
  * in flight finish, closes its broker connections and database pools, and
@@ -7075,15 +7793,39 @@ let worker: Awaited<ReturnType<typeof startWorker>> | undefined;
 let stopping = false;
 
 const server = createServer((req, res) => {
-  const path = (req.url ?? '/').split('?')[0];
-  if (path !== ${JSON.stringify(healthCheck)} || (req.method !== 'GET' && req.method !== 'HEAD')) {
-    res.writeHead(404).end();
-    return;
-  }
+  const path = (req.url ?? '/').split('?')[0] ?? '/';
   const answer = (status: number, body: unknown) => {
     res.writeHead(status, { 'content-type': 'application/json' });
     res.end(JSON.stringify(body));
   };
+
+  // A route a subscriber mounted: what SNS pushes to, or what a local object
+  // store posts a bucket's events to. Refused while starting or stopping, so
+  // the sender keeps the message and sends it again.
+  if (req.method === 'POST') {
+    let body = '';
+    req.setEncoding('utf8');
+    req.on('data', (chunk) => {
+      body += chunk;
+    });
+    req.on('end', () => {
+      if (stopping) return answer(503, { status: 'stopping' });
+      if (!worker) return answer(503, { status: 'starting' });
+      worker.route(path, { headers: req.headers, body }).then(
+        (routed) => (routed ? answer(routed.status, routed.body) : answer(404, { status: 'not found' })),
+        (error) => {
+          logger.error({ err: error, path }, 'Route failed');
+          answer(500, { status: 'failed' });
+        },
+      );
+    });
+    return;
+  }
+
+  if (path !== ${JSON.stringify(healthCheck)} || (req.method !== 'GET' && req.method !== 'HEAD')) {
+    res.writeHead(404).end();
+    return;
+  }
   if (stopping) return answer(503, { status: 'stopping' });
   if (!worker) return answer(503, { status: 'starting' });
   worker.health().then(
@@ -7117,6 +7859,9 @@ process.on('SIGINT', shutdown);
 
 worker = await startWorker();
 logger.info({ port }, 'Worker started');
+await worker.subscribeForPush(port).catch((error) => {
+  logger.error({ err: error }, 'Failed to subscribe for push');
+});
 `;
 }
 //#endregion
@@ -7174,7 +7919,7 @@ async function buildDockerImage(app, buildRoot, options) {
 	const fullImageName = validateImageRef(registry ? `${registry}/${app.imageName}:${tag}` : `${app.imageName}:${tag}`);
 	logger$1.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	try {
-		await require_run.run("docker", [
+		await require_credentials.run("docker", [
 			"build",
 			`--file=${(0, node_path.relative)(buildRoot, app.dockerfile)}`,
 			`--tag=${fullImageName}`,
@@ -7201,7 +7946,7 @@ async function pushDockerImage(imageName, options, cwd) {
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
 	logger$1.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
-		await require_run.run("docker", ["push", fullImageName], { cwd });
+		await require_credentials.run("docker", ["push", fullImageName], { cwd });
 		logger$1.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
@@ -7262,6 +8007,25 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 			imageName: imageNames[worker.name] ?? worker.name
 		});
 	}
+	for (const unit of manifest ? processorUnits(workspace, manifest) : []) {
+		logger$1.log(`\n   📄 Generating Dockerfile for ${unit.name} (processors of ${unit.id}, built from ${unit.app})`);
+		const dockerfile = processorDockerfile(unit, workspace.apps[unit.app], {
+			layout,
+			workspaceRoot: workspace.root,
+			native: processorNative(manifest, unit.id)
+		});
+		const path = workerDockerfileOf(unit.name);
+		const dockerfilePath = (0, node_path.join)(workspace.root, path);
+		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(dockerfilePath), { recursive: true });
+		await (0, node_fs_promises.writeFile)(dockerfilePath, dockerfile);
+		logger$1.log(`      Generated: ${path}`);
+		results.push({
+			appName: unit.name,
+			type: "backend",
+			dockerfile: dockerfilePath,
+			imageName: imageNames[unit.name] ?? unit.name
+		});
+	}
 	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
 	logger$1.log(`\n   Ensured: ${dockerignorePath}`);
 	const composePath = await writeConstructsCompose(workspace);
@@ -7321,6 +8085,29 @@ function workerDockerfile(worker, host, options) {
 		...options.cache ? { cache: options.cache } : {}
 	});
 }
+/** The native packages a file server's processors named, once each. */
+function processorNative(manifest, fileServerId) {
+	const server = manifest[fileServerId];
+	if (server?.kind !== "file-server") return [];
+	return [...new Set((server.processors ?? []).flatMap((p) => p.native ?? []))].sort();
+}
+/**
+* A file server's processor unit's Dockerfile: its host app's build, and the
+* unit's bundle as the runner, with its processors' native packages
+* installed beside it — see `generateProcessorDockerfile`.
+*/
+function processorDockerfile(unit, host, options) {
+	return generateProcessorDockerfile({
+		...appImageOptions(options.layout, unit.app, host, options.workspaceRoot),
+		imageName: unit.name,
+		port: PROCESSOR_PORT,
+		fileServer: unit.id,
+		bundle: processorBundleName(unit.id),
+		healthCheckPath: "/health",
+		...options.native.length ? { external: [...options.native] } : {},
+		...options.cache ? { cache: options.cache } : {}
+	});
+}
 /**
 * A site's Dockerfile, with an `ARG` for every key its bundler inlines.
 *
@@ -7485,7 +8272,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-DR1iws1P.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-OdQmKXE3.cjs"));
 		return new HostingerProvider(options.hostinger);
 	}
 	if (provider === "route53") {
@@ -7498,7 +8285,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-Dubq-pCc.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-BTdtqhI_.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8485,12 +9272,36 @@ Object.defineProperty(exports, "NoDomainForStage", {
 		return NoDomainForStage;
 	}
 });
+Object.defineProperty(exports, "ORIGIN_VERIFY_HEADER", {
+	enumerable: true,
+	get: function() {
+		return ORIGIN_VERIFY_HEADER;
+	}
+});
+Object.defineProperty(exports, "PROCESSOR_ORIGIN_SECRET_ENV", {
+	enumerable: true,
+	get: function() {
+		return PROCESSOR_ORIGIN_SECRET_ENV;
+	}
+});
+Object.defineProperty(exports, "PROCESSOR_PORT", {
+	enumerable: true,
+	get: function() {
+		return PROCESSOR_PORT;
+	}
+});
 Object.defineProperty(exports, "PROVIDER_KINDS", {
 	enumerable: true,
 	get: function() {
 		return PROVIDER_KINDS;
 	}
 });
+Object.defineProperty(exports, "ProcessorGenerator", {
+	enumerable: true,
+	get: function() {
+		return ProcessorGenerator;
+	}
+});
 Object.defineProperty(exports, "QueueGenerator", {
 	enumerable: true,
 	get: function() {
@@ -8575,6 +9386,12 @@ Object.defineProperty(exports, "applyLifecycles", {
 		return applyLifecycles;
 	}
 });
+Object.defineProperty(exports, "applyNotifications", {
+	enumerable: true,
+	get: function() {
+		return applyNotifications;
+	}
+});
 Object.defineProperty(exports, "applyPolicies", {
 	enumerable: true,
 	get: function() {
@@ -8836,7 +9653,7 @@ Object.defineProperty(exports, "getKeyPath", {
 Object.defineProperty(exports, "hostFor", {
 	enumerable: true,
 	get: function() {
-		return hostFor;
+		return hostFor$1;
 	}
 });
 Object.defineProperty(exports, "imageBuildCredentials", {
@@ -8959,12 +9776,24 @@ Object.defineProperty(exports, "mergeLifecycle", {
 		return mergeLifecycle;
 	}
 });
+Object.defineProperty(exports, "minioWebhookEnv", {
+	enumerable: true,
+	get: function() {
+		return minioWebhookEnv;
+	}
+});
 Object.defineProperty(exports, "networkEnv", {
 	enumerable: true,
 	get: function() {
 		return networkEnv;
 	}
 });
+Object.defineProperty(exports, "newOriginSecret", {
+	enumerable: true,
+	get: function() {
+		return newOriginSecret;
+	}
+});
 Object.defineProperty(exports, "normalizeDnsConfig", {
 	enumerable: true,
 	get: function() {
@@ -8977,6 +9806,12 @@ Object.defineProperty(exports, "orchestrateDns", {
 		return orchestrateDns;
 	}
 });
+Object.defineProperty(exports, "originSecretKey", {
+	enumerable: true,
+	get: function() {
+		return originSecretKey;
+	}
+});
 Object.defineProperty(exports, "pgClient", {
 	enumerable: true,
 	get: function() {
@@ -9043,6 +9878,54 @@ Object.defineProperty(exports, "primaryPortKey", {
 		return primaryPortKey;
 	}
 });
+Object.defineProperty(exports, "processorBundleName", {
+	enumerable: true,
+	get: function() {
+		return processorBundleName;
+	}
+});
+Object.defineProperty(exports, "processorDockerfile", {
+	enumerable: true,
+	get: function() {
+		return processorDockerfile;
+	}
+});
+Object.defineProperty(exports, "processorEntryDir", {
+	enumerable: true,
+	get: function() {
+		return processorEntryDir;
+	}
+});
+Object.defineProperty(exports, "processorEnvKeys", {
+	enumerable: true,
+	get: function() {
+		return processorEnvKeys;
+	}
+});
+Object.defineProperty(exports, "processorInfo", {
+	enumerable: true,
+	get: function() {
+		return processorInfo;
+	}
+});
+Object.defineProperty(exports, "processorNative", {
+	enumerable: true,
+	get: function() {
+		return processorNative;
+	}
+});
+Object.defineProperty(exports, "processorOriginHost", {
+	enumerable: true,
+	get: function() {
+		return processorOriginHost;
+	}
+});
+Object.defineProperty(exports, "processorUnits", {
+	enumerable: true,
+	get: function() {
+		return processorUnits;
+	}
+});
 Object.defineProperty(exports, "projectKey", {
 	enumerable: true,
 	get: function() {
@@ -9283,6 +10166,12 @@ Object.defineProperty(exports, "verifyDnsRecords", {
 		return verifyDnsRecords;
 	}
 });
+Object.defineProperty(exports, "watchedBuckets", {
+	enumerable: true,
+	get: function() {
+		return watchedBuckets;
+	}
+});
 Object.defineProperty(exports, "withCustomSecret", {
 	enumerable: true,
 	get: function() {
@@ -9350,4 +10239,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-BWC-qjSI.cjs.map
+//# sourceMappingURL=seeds-CPEcmoPn.cjs.map