@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.125

package/dist/{compose-cHkF---f.mjs → compose-BFmdLig3.mjs}

@@ -1,15 +1,15 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
-import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-DUnnVjqC.mjs";
-import { E as stageBackups, a as serverAddressHint, b as stackBackups, d as passwordSites, f as siteAuth, h as BACKUPS_SERVICE, i as requiredServerAddress, l as systemLookup, m as withSitePasswords, o as stackHosts, p as siteNames, r as isLocalHost, s as stageDns, t as HostNotPointingAtServer, v as backupsRoleStatements, y as backupsService } from "./dns-DFvO5a53.mjs";
+import { c as runOutput, s as run } from "./credentials-DpfnUvIR.mjs";
+import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-DBHF9Gba.mjs";
+import { A as backupsRoleStatements, C as passwordSites, D as BACKUPS_SERVICE, E as withSitePasswords, M as stackBackups, R as stageBackups, T as siteNames, a as subscriptionKey, c as HostNotPointingAtServer, f as requiredServerAddress, g as stageDns, h as stackHosts, i as recordedPushSubscriptions, j as backupsService, n as SUBSCRIPTION_TYPE, o as subscriptionResource, p as serverAddressHint, r as confirmPendingSubscriptions, s as topicConnection, t as PushSubscriptionsUnconfirmed, u as isLocalHost, v as systemLookup, w as siteAuth } from "./snsSubscriptions-BmYeeTH8.mjs";
 import { t as defineTarget } from "./define-6poNqm5O.mjs";
-import { $n as stackLogs, $t as publicBuildValues, An as localRolePassword, B as workerDockerfile, Bn as EMULATOR_ACCESS_KEY_ID, Bt as initStageSecrets, Cn as REDIS_SERVICE, Ct as composeFor, Dn as stackRedis, En as runsRedis, Fn as isTelemetryKey, Gn as portKeys, Gt as composeBuildPaths, Hn as DEFAULT_IMAGES, In as scopeTelemetryEnv, Jn as primaryPortKey, Jt as WORKER_PORT, Kt as imageLayout, L as appDockerfile, Mn as planFor, N as stageProviderNotes, On as withRedisPassword, Qn as logsService, Rn as telemetryOf, S as recordRelease, Sn as withGeneratedSecrets, Tn as redisService, Vn as hostFor, Xn as LOGS_SERVICE, Xt as findBuildRoot, Zn as logsAccess, a as dnsResources, an as applyPostgres, at as suppliedOnly, bt as bucketClient, c as currentActor, ct as networkEnv, d as DeployJournal, er as withLogsPassword, et as devServicesUsed, fn as LOCAL_RABBITMQ_USER, ft as constructGlobs, hn as postgresSuperuser, in as applyPolicies, it as stageServiceDeclarations, kn as envFor, ln as postgresStatements, lt as workerEnvKeys, n as reportDatabaseRuns, nn as applyBuckets, nr as isMainFrontendApp, o as forgetDnsResource, on as bucketLifecycles, ot as appEnvKeys, pn as loadLocalCredentials, q as validateImageRef, qt as TURBO_VERSION, r as reportPlannedSeeds, rn as applyLifecycles, rr as resolveHost, s as recordDnsChanges, sn as bucketPolicies, t as DeploySeedsFailed, tn as workerUnits, tr as NoDomainForStage, tt as externalServices, v as createComposeState, vt as LEGACY_LOCAL_LOGIN, wn as STACK_CACHE, xt as pgClient, yt as ensurePostgresLogin, z as ensureDockerignore, zn as usesTelemetry } from "./seeds-Dv78P9LS.mjs";
+import { $ as ORIGIN_VERIFY_HEADER, $n as telemetryOf, An as postgresSuperuser, At as LEGACY_LOCAL_LOGIN, B as processorDockerfile, Bn as redisService, Dn as LOCAL_RABBITMQ_USER, Ft as composeFor, Gn as localRolePassword, H as workerDockerfile, Hn as stackRedis, L as appDockerfile, Ln as withGeneratedSecrets, Mt as bucketClient, N as stageProviderNotes, Nt as pgClient, On as loadLocalCredentials, Qt as initStageSecrets, Rn as REDIS_SERVICE, S as recordRelease, Sn as bucketPolicies, Un as withRedisPassword, V as processorNative, Vn as runsRedis, Wn as envFor, Xn as isTelemetryKey, Zn as scopeTelemetryEnv, _n as applyLifecycles, _r as withLogsPassword, _t as appEnvKeys, a as dnsResources, an as PROCESSOR_PORT, ar as DEFAULT_IMAGES, bn as applyPostgres, br as resolveHost, bt as processorEnvKeys, c as currentActor, cr as portKeys, d as DeployJournal, dr as primaryPortKey, dt as devServicesUsed, er as usesTelemetry, fn as publicBuildValues, ft as externalServices, gn as applyBuckets, gr as stackLogs, gt as suppliedOnly, hn as workerUnits, hr as logsService, ht as stageServiceDeclarations, in as imageLayout, ir as hostFor, it as validateImageRef, jt as ensurePostgresLogin, ln as findBuildRoot, mn as processorUnits, mr as logsAccess, n as reportDatabaseRuns, nr as watchedBuckets, nt as originSecretKey, o as forgetDnsResource, on as TURBO_VERSION, pr as LOGS_SERVICE, qn as planFor, r as reportPlannedSeeds, rn as composeBuildPaths, rr as EMULATOR_ACCESS_KEY_ID, rt as processorOriginHost, s as recordDnsChanges, sn as WORKER_PORT, t as DeploySeedsFailed, tr as minioWebhookEnv, v as createComposeState, vn as applyNotifications, vr as NoDomainForStage, wn as postgresStatements, wt as constructGlobs, xn as bucketLifecycles, xt as workerEnvKeys, yn as applyPolicies, yr as isMainFrontendApp, yt as networkEnv, z as ensureDockerignore, zn as STACK_CACHE } from "./seeds-CK7w79VC.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { n as subscriberRoute, s as DEFAULT_EVENTS } from "./SubscriberGenerator-y3pncae_.mjs";
+import { a as SNS_SUBSCRIPTIONS_KEY, l as DEFAULT_EVENTS, o as objectsRoute, s as subscriberRoute } from "./SubscriberGenerator-ocQ2yj0K.mjs";
 import { a as imageRef } from "./identity-CBXr4wNi.mjs";
-import { i as discover } from "./discover-C5roJuc9.mjs";
-import { i as installedFrom } from "./drivers-BjGDYfnC.mjs";
+import { i as discover } from "./discover-CzGM5P3p.mjs";
+import { i as installedFrom } from "./drivers-C-VqMtld.mjs";
 import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-BPOgTn1u.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
@@ -649,6 +649,21 @@ const sshAccess = {
 	}
 };
 //#endregion
+//#region src/compose/routes.ts
+/** A route with handlers and a check that would have to hold for each of them. */
+var EdgeRouteConflict = class extends Error {
+	route;
+	constructor(route) {
+		super(`The edge route '${route}' sends some paths to other upstreams and also restricts who or what it answers. The two are not combined: give the restricted paths a host of their own.`);
+		this.route = route;
+		this.name = "EdgeRouteConflict";
+	}
+};
+/** @throws {EdgeRouteConflict} */
+function assertRouteRenderable(route) {
+	if (route.handlers?.length && (route.allow || route.paths || route.prefixes || route.requireHeader)) throw new EdgeRouteConflict(route.name);
+}
+//#endregion
 //#region src/compose/caddyfile.ts
 /**
 * The stack's own edge, rendered for Caddy: one site block per route.
@@ -684,26 +699,55 @@ function edgeCaddyfile(routes, options) {
 ` : tls.kind === "files" ? `
 	tls ${tls.certFile} ${tls.keyFile}
 ` : "";
-	const blocks = routes.map(({ host, upstreams, prefix, allow, auth, paths, streaming }) => `https://${host} {${certificate}
-	# gkm's own header, which only a service of this stack may send: the auth
-	# server rate-limits by the client address it carries.
-	request_header -${CLIENT_IP_HEADER}
-${allow ? `
+	const blocks = routes.map((route) => siteBlock(route, certificate));
+	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+}
+/** One route's site block. */
+function siteBlock(route, certificate) {
+	assertRouteRenderable(route);
+	const { host, allow, auth, paths, prefixes, requireHeader, handlers } = route;
+	const allowed = [...paths ?? [], ...(prefixes ?? []).map((prefix) => `${prefix}*`)];
+	const checks = `${allow ? `
 	# Only these addresses — the peer Caddy sees, never a header a client
 	# could set. Everything else is refused before it reaches the upstream.
 	@denied not remote_ip ${allow.join(" ")}
 	respond @denied 403
+` : ""}${requireHeader ? `
+	# Only what the CDN sends: it adds this header to every request, and this
+	# host would be reached around the CDN otherwise.
+	@forged not header ${requireHeader.name} "${requireHeader.value}"
+	respond @forged 403
 ` : ""}${auth ? `
 	# The stage's login, asked for before anything reaches the upstream.
 	basic_auth {
 		${auth.user} ${auth.hash}
 	}
-` : ""}${paths ? `
+` : ""}${allowed.length ? `
 	# Only these paths answer. Everything else on this host is refused before
 	# it reaches the upstream.
-	@elsewhere not path ${paths.join(" ")}
+	@elsewhere not path ${allowed.join(" ")}
 	respond @elsewhere 404
-` : ""}${prefix ? `
+` : ""}`;
+	const proxy = proxyBlock(route);
+	const body = handlers?.length ? `${handlers.map((handler, index) => `
+	# Answered by another service: ${handler.name}.
+	@handler${index} path ${handler.prefixes.map((prefix) => `${prefix}*`).join(" ")}
+	handle @handler${index} {
+		reverse_proxy ${handler.upstreams.map(address).join(" ")}
+	}
+`).join("")}
+	handle {${proxy.replace(/\n/g, "\n	")}
+	}` : proxy;
+	return `https://${host} {${certificate}
+	# gkm's own header, which only a service of this stack may send: the auth
+	# server rate-limits by the client address it carries.
+	request_header -${CLIENT_IP_HEADER}
+${checks}${body}
+}`;
+}
+/** Where a route's requests go, when no handler took them. */
+function proxyBlock({ upstreams, prefix, streaming }) {
+	return prefix ? `
 	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
 	# which routes and signs on the Host header — so it is sent the upstream's.
 	reverse_proxy ${upstreams.map(address).join(" ")} {
@@ -716,17 +760,16 @@ ${allow ? `
 		# Never buffer: a streamed response — server-sent events, a Next.js
 		# RSC payload — reaches the client as each chunk is written.
 		flush_interval -1
-	}` : ""}`}
-}`);
-	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+	}` : ""}`;
 }
 const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
 #
 # One host per API and site, each in front of its own container, one per
-# file server in front of the stack's MinIO, one per worker SNS pushes to,
-# answering only those routes, and — when its logs are served publicly — one
-# for OpenObserve, to the addresses it allows. A site the stage puts behind a
-# password asks for its login first.
+# file server in front of the stack's MinIO — its processors' paths sent to
+# their own service — one per worker SNS pushes to and per processor unit a
+# CDN reaches, answering only those paths, and — when its logs are served
+# publicly — one for OpenObserve, to the addresses it allows. A site the
+# stage puts behind a password asks for its login first.
 `;
 //#endregion
 //#region src/compose/images.ts
@@ -1029,9 +1072,24 @@ function traefikDynamic(routes, options) {
 			middlewares[name(route, "prefix")] = { addPrefix: { prefix: route.prefix } };
 			chain.push(name(route, "prefix"));
 		}
-		const paths = route.paths ? ` && (${route.paths.map((path) => `Path(\`${path}\`)`).join(" || ")})` : "";
+		assertRouteRenderable(route);
+		const allowed = [...(route.paths ?? []).map((path) => `Path(\`${path}\`)`), ...(route.prefixes ?? []).map((prefix) => `PathPrefix(\`${prefix}\`)`)];
+		const paths = allowed.length ? ` && (${allowed.join(" || ")})` : "";
+		const header = route.requireHeader ? ` && Header(\`${route.requireHeader.name}\`, \`${route.requireHeader.value}\`)` : "";
+		for (const handler of route.handlers ?? []) {
+			const handlerName = name(route, handler.name);
+			routers[handlerName] = {
+				rule: `Host(\`${route.host}\`) && (${handler.prefixes.map((prefix) => `PathPrefix(\`${prefix}\`)`).join(" || ")})`,
+				priority: 1e4,
+				entryPoints: ["websecure"],
+				service: handlerName,
+				middlewares: [strip],
+				tls: tls.kind === "acme" ? { certResolver: ACME_RESOLVER } : {}
+			};
+			services[handlerName] = { loadBalancer: { servers: handler.upstreams.map((upstream) => ({ url: url(upstream) })) } };
+		}
 		routers[name(route)] = {
-			rule: `Host(\`${route.host}\`)${paths}`,
+			rule: `Host(\`${route.host}\`)${paths}${header}`,
 			entryPoints: ["websecure"],
 			service: name(route),
 			middlewares: chain,
@@ -1173,6 +1231,19 @@ const LOG_ROTATION = {
 		"max-file": "3"
 	}
 };
+/** A CDN serves the bucket, and the secret it sends the processors is not in the stage. */
+var ProcessorOriginSecretMissing = class extends GkmError {
+	fileServer;
+	key;
+	stage;
+	constructor(fileServer, key, stage) {
+		super(`'${fileServer}' has processors, and its bucket is not the stack's MinIO, so they are reached through the CDN in front of it — which sends ${key}, and stage '${stage}' has none. It is written by the deploy that creates the CDN (\`deploy.objects.${stage}\` on s3, cdn on): run gkm deploy --stage ${stage}.`);
+		this.fileServer = fileServer;
+		this.key = key;
+		this.stage = stage;
+		this.name = "ProcessorOriginSecretMissing";
+	}
+};
 /**
 * The stack with Caddy's files inline: its Caddyfile and, where the stage has
 * one, its own certificate — `configs` with their `content`, which compose
@@ -1381,7 +1452,13 @@ function composeStack(input) {
 		identity,
 		images: input.images
 	});
-	if (apps.length === 0 && workers.length === 0) throw new NothingToCompose(workspace.root);
+	const processors = stackProcessors(processorUnits(workspace, manifest), {
+		manifest,
+		stage,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0 && workers.length === 0 && processors.length === 0) throw new NothingToCompose(workspace.root);
 	const owners = /* @__PURE__ */ new Map();
 	for (const resource of plan.resources) {
 		owners.set(resource.envKey, resource);
@@ -1443,9 +1520,20 @@ function composeStack(input) {
 			...credential.containers.minio,
 			buckets,
 			policies: bucketPolicies(plan).filter((p) => buckets.includes(p.bucket)),
+			objects: services.minio.map((id) => ({
+				id,
+				name: byId.get(id)?.name
+			})).filter((b) => Boolean(b.name)).sort((a, b) => a.name.localeCompare(b.name)),
+			webhooks: [],
 			lifecycles: bucketLifecycles(plan).filter((l) => buckets.includes(l.bucket))
 		};
 	})() : void 0;
+	const bucketEventKeys = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		if (resource.kind !== "objects") continue;
+		bucketEventKeys.set(provideKey(resource.id, "eventsConnectionString"), resource.id);
+		bucketEventKeys.set(provideKey(resource.id, "eventsToken"), resource.id);
+	}
 	const fileServers = /* @__PURE__ */ new Map();
 	if (storage) for (const resource of plan.resources) {
 		if (resource.kind !== "file-server" || !resource.of) continue;
@@ -1490,7 +1578,8 @@ function composeStack(input) {
 		project: workspace.name,
 		credentials: credential.containers,
 		seed: credential.seed,
-		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
+		...!local && domain ? { mailFrom: `noreply@${domain}` } : {},
+		relayedBuckets: [...watchedBuckets(manifest, input.subscribers ?? {}).keys()].filter((bucket) => services.minio.includes(bucket))
 	};
 	const outside = networkEnv(plan, {
 		...derivation,
@@ -1508,6 +1597,11 @@ function composeStack(input) {
 	*/
 	const valueFor = (app, key, owner) => {
 		if (isReservedStageKey(key)) return void 0;
+		const watching = bucketEventKeys.get(key);
+		if (watching) {
+			if (custom[key] !== void 0) return custom[key];
+			return services.minio.includes(watching) ? outside[key] : void 0;
+		}
 		if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) return;
 		if (owner && SERVICE_KINDS[owner.kind]) {
 			if (custom[key] !== void 0) return custom[key];
@@ -1609,13 +1703,70 @@ function composeStack(input) {
 				serviceName: worker.name,
 				...telemetryValues ? { telemetry: telemetryValues } : {}
 			}),
-			...push ? { [SUBSCRIBER_PUSH_URL_KEY]: push.url } : {},
+			...push && !input.recordingSubscriptions ? { [SNS_SUBSCRIPTIONS_KEY]: recordedSubscriptions(worker, push, input.pushSubscriptions?.[worker.id]) } : {},
 			NODE_ENV: "production",
 			PORT: String(worker.port),
 			STAGE: stage
 		};
 		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
 	}
+	for (const unit of processors) {
+		const served = fileServers.get(unit.id);
+		if (served) served.route = {
+			...served.route,
+			handlers: [{
+				name: unit.name,
+				prefixes: unit.prefixes,
+				upstreams: [{
+					service: unit.name,
+					port: unit.port
+				}]
+			}]
+		};
+		else if (!local && !input.buildOnly) {
+			if (!domain) throw new NoDomainForStage(stage);
+			const key = originSecretKey(unit.id);
+			const secret = custom[key];
+			if (!secret) throw new ProcessorOriginSecretMissing(unit.id, key, stage);
+			unit.origin = {
+				host: processorOriginHost(unit.id, domain),
+				secret
+			};
+		}
+		if (proxy === "traefik" && (served || unit.origin)) edgeServices.add(unit.name);
+		if (input.buildOnly) continue;
+		const keys = processorEnvKeys(manifest, unit.id, input.runnables) ?? /* @__PURE__ */ new Set();
+		unit.env = {
+			...scopeTelemetryEnv(valuesFor({
+				name: unit.name,
+				id: unit.id,
+				kind: "rest-api"
+			}, keys), {
+				uses: telemetryOf(manifest, unit.id) !== void 0,
+				serviceName: unit.name,
+				...telemetryValues ? { telemetry: telemetryValues } : {}
+			}),
+			NODE_ENV: "production",
+			PORT: String(unit.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(unit.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(unit.name, key);
+	}
+	if (storage && !input.buildOnly) {
+		const watched = watchedBuckets(manifest, input.subscribers ?? {});
+		for (const [bucket, workerId] of watched) {
+			if (!services.minio.includes(bucket)) continue;
+			const worker = workers.find((w) => w.id === workerId);
+			const relay = worker?.env?.[provideKey(bucket, "eventsConnectionString")];
+			const token = worker?.env?.[provideKey(bucket, "eventsToken")];
+			if (!worker || !relay || relay.startsWith("sns:") || !token) continue;
+			storage.webhooks.push({
+				bucket,
+				endpoint: `http://${hostOf(worker.name)}:${worker.port}${objectsRoute(bucket)}`,
+				token
+			});
+		}
+	}
 	const deployedTls = certificate ? {
 		kind: "files",
 		...proxy === "caddy" ? {
@@ -1643,6 +1794,7 @@ function composeStack(input) {
 		infra,
 		apps,
 		workers,
+		processors,
 		credentials: credential.containers,
 		...storage ? { storage } : {},
 		...logs ? { logs } : {},
@@ -1678,6 +1830,21 @@ function composeStack(input) {
 			health: app.kind === "site" ? "/" : "/health"
 		})),
 		...[...fileServers.values()].map(({ route }) => route),
+		...processors.flatMap(({ name, port, prefixes, origin }) => origin ? [{
+			name,
+			host: origin.host,
+			upstreams: [{
+				service: name,
+				port
+			}],
+			streaming: false,
+			prefixes,
+			requireHeader: {
+				name: ORIGIN_VERIFY_HEADER,
+				value: origin.secret
+			},
+			health: "/health"
+		}] : []),
 		...workers.flatMap(({ name, port, push }) => push ? [{
 			name,
 			host: push.host,
@@ -1727,12 +1894,26 @@ function composeStack(input) {
 			cache: STACK_CACHE
 		});
 	}
+	for (const unit of processors) {
+		if (!unit.build) continue;
+		dockerfiles[unit.build.dockerfile] = processorDockerfile({
+			id: unit.id,
+			name: unit.name,
+			app: unit.host
+		}, workspace.apps[unit.host], {
+			layout,
+			workspaceRoot: workspace.root,
+			native: unit.native,
+			cache: STACK_CACHE
+		});
+	}
 	return {
 		project,
 		stage,
 		local,
 		apps,
 		workers,
+		processors,
 		mobileApps,
 		infra,
 		compose,
@@ -1795,29 +1976,61 @@ function stackApps(workspace, manifest, plan, options) {
 	}
 	return apps.sort((a, b) => a.name.localeCompare(b.name));
 }
-/** What the worker reads the public base of its push routes from. */
-const SUBSCRIBER_PUSH_URL_KEY = "GKM_SUBSCRIBER_PUSH_URL";
 /**
 * Where SNS pushes to a worker on a deployed stage, or nothing when it pushes
 * to none of its subscribers.
 *
-* A subscriber is pushed to when its topic's connection string, as this stage
-* resolved it for the worker, is an SNS one — the same test the worker's own
+* A subscriber is pushed to when the connection string its deliveries come
+* from — its topic's, or its bucket's events — as this stage resolved it for
+* the worker, is an SNS one — the same test the worker's own
 * startup makes, so the edge exposes a route exactly when the worker mounts
 * it. Each such route, and nothing else the worker serves, answers on
 * `<worker>.<domain>`.
 */
 function workerPush(worker, subscribers, env, options) {
-	const paths = subscribers.filter(({ topic }) => env[provideKey(topic, "publisherConnectionString")]?.startsWith("sns:")).map(({ name }) => subscriberRoute(name)).sort();
-	if (paths.length === 0) return void 0;
+	const pushed = subscribers.filter(({ connectionKey }) => env[connectionKey]?.startsWith("sns:")).filter((subscriber, index, all) => all.findIndex((s) => s.name === subscriber.name) === index).sort((a, b) => a.name.localeCompare(b.name));
+	if (pushed.length === 0) return void 0;
 	if (!options.domain) throw new NoDomainForStage(options.stage);
 	const host = `${worker.name}.${options.domain}`;
+	const url = `https://${host}`;
 	return {
 		host,
-		url: `https://${host}`,
-		paths: [...new Set(paths)]
+		url,
+		paths: pushed.map(({ name }) => subscriberRoute(name)),
+		subscribers: pushed.map(({ name, connectionKey, events }) => ({
+			name,
+			connectionKey,
+			endpoint: `${url}${subscriberRoute(name)}`,
+			...events ? { events } : {}
+		}))
 	};
 }
+/** A pushed subscriber the deploy recorded no SNS subscription for. */
+var PushSubscriptionMissing = class extends GkmError {
+	worker;
+	subscriber;
+	constructor(worker, subscriber) {
+		super(`SNS pushes to '${subscriber}' on the worker '${worker}', and the deploy recorded no subscription for it, so the worker would mount no route and SNS would deliver nowhere. Deploy the stage, which subscribes each pushed subscriber and records its ARN.`);
+		this.worker = worker;
+		this.subscriber = subscriber;
+		this.name = "PushSubscriptionMissing";
+	}
+};
+/**
+* The worker's `GKM_SNS_SUBSCRIPTIONS`: each pushed subscriber's recorded
+* subscription ARN, and nothing for a subscriber it does not run.
+*
+* @throws {PushSubscriptionMissing} when one has none
+*/
+function recordedSubscriptions(worker, push, recorded = {}) {
+	const arns = {};
+	for (const { name } of push.subscribers) {
+		const arn = recorded[name];
+		if (!arn) throw new PushSubscriptionMissing(worker.name, name);
+		arns[name] = arn;
+	}
+	return JSON.stringify(arns);
+}
 /** Two constructs the edge would answer on one host. */
 var EdgeHostTaken = class extends GkmError {
 	host;
@@ -1840,6 +2053,25 @@ function assertHostsUnique(routes) {
 		claimed.set(host, name);
 	}
 }
+/** Each processor unit's image, and where it is built from. */
+function stackProcessors(units, options) {
+	return units.map((unit) => {
+		const server = options.manifest[unit.id];
+		const processors = server?.kind === "file-server" ? server.processors ?? [] : [];
+		return {
+			app: unit.name,
+			name: unit.name,
+			id: unit.id,
+			host: unit.app,
+			port: PROCESSOR_PORT,
+			prefixes: [...new Set(processors.map((p) => p.prefix))].sort(),
+			native: processorNative(options.manifest, unit.id),
+			ref: validateImageRef(imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
+			tag: options.images.tag,
+			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${unit.name}` } } : {}
+		};
+	});
+}
 /** Each worker's image, and where it is built from. */
 function stackWorkers(units, options) {
 	return units.map((unit) => ({
@@ -1897,7 +2129,8 @@ function stackFile(options) {
 		minio.environment = {
 			...minio.environment,
 			MINIO_ROOT_USER: options.storage.user,
-			MINIO_ROOT_PASSWORD: options.storage.password
+			MINIO_ROOT_PASSWORD: options.storage.password,
+			...minioWebhookEnv(options.storage.webhooks)
 		};
 		minio.ports = ["127.0.0.1::9000"];
 	}
@@ -1925,7 +2158,7 @@ function stackFile(options) {
 		} : {},
 		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
 	};
-	for (const worker of options.workers) services[worker.name] = {
+	for (const worker of [...options.workers, ...options.processors]) services[worker.name] = {
 		image: worker.ref,
 		...worker.build ? { build: composeBuildPaths({
 			composeDir: options.composeDir,
@@ -1946,7 +2179,11 @@ function stackFile(options) {
 		restart: "unless-stopped",
 		ports: [`${options.https}:443`, `${options.http}:80`],
 		volumes: ["caddy-data:/data", "caddy-config:/config"],
-		depends_on: Object.fromEntries([...apps.map((app) => app.name), ...options.workers.filter((w) => w.push).map((w) => w.name)].map((name) => [name, HEALTHY])),
+		depends_on: Object.fromEntries([
+			...apps.map((app) => app.name),
+			...options.workers.filter((w) => w.push).map((w) => w.name),
+			...options.processors.map((p) => p.name)
+		].map((name) => [name, HEALTHY])),
 		healthcheck: {
 			test: [
 				"CMD",
@@ -2265,6 +2502,119 @@ var ComposeAppsUnhealthy = class extends GkmError {
 	}
 };
 //#endregion
+//#region src/target/compose/topicSubscriptions.ts
+/**
+* Every topic subscriber the stack pushes to: a subscriber whose connection
+* key is a topic's publisher string — a bucket's events key is not — and
+* whose value on this stage is an SNS one.
+*/
+function topicPushes(stack, manifest) {
+	const topicKeys = new Set(Object.values(manifest).filter((declaration) => declaration.kind === "topic").map((topic) => provideKey(topic.id, "publisherConnectionString")));
+	const pushes = [];
+	for (const worker of stack.workers) for (const subscriber of worker.push?.subscribers ?? []) {
+		if (!topicKeys.has(subscriber.connectionKey)) continue;
+		const connectionString = worker.env?.[subscriber.connectionKey];
+		if (!connectionString?.startsWith("sns:")) continue;
+		pushes.push({
+			worker: worker.id,
+			name: subscriber.name,
+			endpoint: subscriber.endpoint,
+			connectionKey: subscriber.connectionKey,
+			connectionString,
+			...subscriber.events ? { events: subscriber.events } : {}
+		});
+	}
+	return pushes;
+}
+/** The subscriptions recorded for hand-set topics: those with a key. */
+function recordedTopicSubscriptions(resources) {
+	return Object.values(resources ?? {}).filter((record) => record.type === "sns-subscription" && typeof record.data?.connectionKey === "string");
+}
+/**
+* Converge each hand-set topic's subscriptions on the subscribers pushed to:
+* subscribe, bring filters up to date, unsubscribe a route on the worker's
+* host no subscriber wants any more — and record each ARN, forgetting what
+* was removed.
+*
+* @returns each worker's subscriptions, by export — what it is handed
+*/
+async function ensureTopicSubscriptions(input) {
+	const { snsUrl, reconcileHttpSubscriptions } = await import("@geekmidas/events/sns");
+	const groups = /* @__PURE__ */ new Map();
+	const group = (topicArn, host, connectionKey) => {
+		const id = `${topicArn}|${host}`;
+		const found = groups.get(id);
+		if (found) return found;
+		const created = {
+			topicArn,
+			host,
+			connectionKey,
+			pushes: [],
+			recorded: []
+		};
+		groups.set(id, created);
+		return created;
+	};
+	for (const push of input.pushes) {
+		const { topicArn } = snsUrl.parse(push.connectionString);
+		const into = group(topicArn, new URL(push.endpoint).host, push.connectionKey);
+		into.connectionString = push.connectionString;
+		into.pushes.push(push);
+	}
+	for (const record of recordedTopicSubscriptions(input.recorded)) group(String(record.data?.topicArn), new URL(String(record.data?.endpoint)).host, String(record.data?.connectionKey)).recorded.push(record);
+	const wanted = new Set(input.pushes.map(({ worker, name }) => subscriptionKey(worker, name)));
+	const arns = {};
+	for (const { topicArn, host, connectionKey, ...members } of groups.values()) {
+		const stale = members.recorded.filter((r) => !wanted.has(r.key));
+		const named = members.connectionString ?? input.secrets[connectionKey];
+		if (!named?.startsWith("sns:")) {
+			for (const record of stale) {
+				input.log(`   – forgot ${record.data?.endpoint}: '${connectionKey}' no longer names an SNS topic to unsubscribe it from`);
+				await input.forget(record.key);
+			}
+			continue;
+		}
+		const address = new URL(named);
+		address.searchParams.set("topicArn", topicArn);
+		const connection = await topicConnection({
+			connectionKey,
+			connectionString: address.toString(),
+			stage: input.stage,
+			env: input.env
+		});
+		const result = await reconcileHttpSubscriptions(connection, {
+			endpoints: members.pushes.map((push) => ({
+				name: push.name,
+				endpoint: push.endpoint,
+				...push.events ? { events: push.events } : {}
+			})),
+			ownedHost: host
+		});
+		await connection.close();
+		for (const push of members.pushes) {
+			const arn = result.subscriptions[push.name];
+			const key = subscriptionKey(push.worker, push.name);
+			if (input.recorded?.[key]?.id !== arn) input.log(`   ✓ '${push.name}' subscribed to ${topicArn.split(":").pop()} at ${push.endpoint}`);
+			await input.record(subscriptionResource({
+				worker: push.worker,
+				name: push.name,
+				topicArn,
+				endpoint: push.endpoint,
+				connectionKey: push.connectionKey,
+				pending: result.pending.includes(push.name),
+				...push.events ? { events: push.events } : {}
+			}, arn));
+			arns[push.worker] = {
+				...arns[push.worker],
+				[push.name]: arn
+			};
+		}
+		for (const arn of result.removed) input.log(`   – unsubscribed ${arn}: no subscriber wants it any more`);
+		for (const record of stale) await input.forget(record.key);
+	}
+	return arns;
+}
+//#endregion
 //#region src/target/compose/phases.ts
 /**
 * The compose target's phases: a stage as one Docker Compose stack behind
@@ -2415,8 +2765,9 @@ async function validateCompose(ctx, deps, options = {}) {
 		subscribers
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const recorded = push ? void 0 : await ctx.state.read(stage);
 	const layout = mode === "build" ? imageLayout(workspace) : void 0;
-	const composed = composeStack({
+	const input = {
 		workspace,
 		manifest,
 		runnables,
@@ -2435,10 +2786,29 @@ async function validateCompose(ctx, deps, options = {}) {
 		ports: edgePorts(deps.env),
 		...layout ? { layout } : {},
 		...push ? { buildOnly: true } : {}
+	};
+	const recordedArns = recordedPushSubscriptions(recorded?.resources);
+	const planned = push ? void 0 : composeStack({
+		...input,
+		recordingSubscriptions: true
+	});
+	const pushes = planned ? topicPushes(planned, manifest) : [];
+	const topics = planned && (pushes.length > 0 || recordedTopicSubscriptions(recorded?.resources).length > 0) ? {
+		pushes,
+		recorded: recorded?.resources
+	} : void 0;
+	const composed = topics && planned ? planned : composeStack({
+		...input,
+		pushSubscriptions: recordedArns
 	});
 	if (mode === "build") assertRedisClient(workspace, composed, manifest, runnables);
-	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
-	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
+	const pinned = (unpinned) => options.pin ? withPinnedImages(unpinned, options.pin.file, options.pin.digests) : unpinned;
+	const stack = pinned(composed);
+	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [
+		...stack.apps,
+		...stack.workers,
+		...stack.processors
+	]);
 	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
@@ -2455,7 +2825,6 @@ async function validateCompose(ctx, deps, options = {}) {
 	const override = stackOverrideFile(root, stage);
 	const overrides = existsSync(override) ? [override] : [];
 	if (overrides.length > 0) ctx.logger.info(`🧩 Merging docker-compose.${stage}.yml over the generated stack`);
-	const recorded = push ? void 0 : await ctx.state.read(stage);
 	const previous = Object.fromEntries(Object.entries(recorded?.state.releases ?? {}).map(([name, releases]) => {
 		const { ref, tag, digest } = releases.current;
 		return [name, {
@@ -2468,6 +2837,20 @@ async function validateCompose(ctx, deps, options = {}) {
 		mode,
 		push,
 		stack,
+		...topics ? { topicSubscriptions: {
+			...topics,
+			restack: (arns) => {
+				const merged = { ...recordedArns };
+				for (const [worker, own] of Object.entries(arns)) merged[worker] = {
+					...merged[worker],
+					...own
+				};
+				return pinned(composeStack({
+					...input,
+					pushSubscriptions: merged
+				}));
+			}
+		} } : {},
 		...server ? { server } : {},
 		dir,
 		ref: {
@@ -2631,8 +3014,13 @@ async function stageSecrets(ctx, manifest) {
 function withPinnedImages(stack, file, digests) {
 	const apps = pinImages(file, digests, stack.apps);
 	const workers = pinImages(file, digests, stack.workers);
+	const processors = pinImages(file, digests, stack.processors);
 	const services = { ...stack.compose.services };
-	for (const image of [...apps, ...workers]) services[image.name] = {
+	for (const image of [
+		...apps,
+		...workers,
+		...processors
+	]) services[image.name] = {
 		...services[image.name],
 		image: image.ref
 	};
@@ -2640,6 +3028,7 @@ function withPinnedImages(stack, file, digests) {
 		...stack,
 		apps,
 		workers,
+		processors,
 		compose: {
 			...stack.compose,
 			services
@@ -2688,7 +3077,7 @@ async function planCompose(ctx, run) {
 			action: run.previous[app.name] ? "reuse" : "create"
 		});
 	}
-	for (const worker of run.stack.workers) {
+	for (const worker of [...run.stack.workers, ...run.stack.processors]) {
 		planned({
 			key: `image:${worker.name}`,
 			resourceType: "image",
@@ -2702,6 +3091,16 @@ async function planCompose(ctx, run) {
 			action: run.previous[worker.name] ? "reuse" : "create"
 		});
 	}
+	for (const push of run.topicSubscriptions?.pushes ?? []) {
+		const key = subscriptionKey(push.worker, push.name);
+		const id = run.topicSubscriptions?.recorded?.[key]?.id;
+		planned({
+			key,
+			resourceType: SUBSCRIPTION_TYPE,
+			action: id ? "reuse" : "create",
+			...id ? { id } : {}
+		});
+	}
 	if (!run.push) planned({
 		key: run.stack.proxy === "caddy" ? "service:caddy" : `service:${EDGE_PROJECT}/${EDGE_SERVICE}`,
 		resourceType: "service",
@@ -2714,7 +3113,7 @@ async function planCompose(ctx, run) {
 * migrations applied.
 */
 async function provisionCompose(ctx, run, deps) {
-	const { stack, ref } = run;
+	const { ref } = run;
 	if (run.push) return;
 	if (run.generated.length > 0 && run.secrets) {
 		await ctx.secrets.write(run.secrets);
@@ -2722,11 +3121,13 @@ async function provisionCompose(ctx, run, deps) {
 	}
 	const ports = edgePorts(deps.env);
 	await assertEdgePorts(deps.docker, {
-		project: stack.project,
-		proxy: stack.proxy,
+		project: run.stack.project,
+		proxy: run.stack.proxy,
 		ports,
 		engine: ref
 	});
+	if (run.topicSubscriptions) await subscribeTopics(ctx, run, deps);
+	const { stack } = run;
 	run.files = await writeStack(ctx.cwd, run.dir, stack);
 	printPlan(ctx, run);
 	if (stack.proxy === "traefik") {
@@ -2765,6 +3166,36 @@ async function provisionCompose(ctx, run, deps) {
 	if (stack.storage && stack.infra.includes("minio")) await prepareBuckets(ctx, run, deps);
 }
 /**
+* Subscribe each topic subscriber SNS pushes to — for a topic the stage set
+* to SNS by hand — record the ARNs, and compose the stack again with them,
+* before a file is written.
+*/
+async function subscribeTopics(ctx, run, deps) {
+	const { pushes, recorded, restack } = run.topicSubscriptions;
+	if (pushes.length > 0) ctx.logger.info("\n📮 SNS subscriptions for the stage's own topics");
+	run.stack = restack(await ensureTopicSubscriptions({
+		pushes,
+		recorded,
+		secrets: run.secrets?.custom ?? {},
+		stage: ctx.stage,
+		env: deps.env,
+		record: async (resource) => {
+			await ctx.state.putResource(ctx.stage, resource);
+			applied(ctx, run, {
+				key: resource.key,
+				resourceType: SUBSCRIPTION_TYPE,
+				action: "ensure",
+				id: resource.id,
+				via: recorded?.[resource.key]?.id === resource.id ? "recorded" : "created"
+			});
+		},
+		forget: async (key) => {
+			await ctx.state.deleteResource(ctx.stage, key);
+		},
+		log: (line) => ctx.logger.info(line)
+	}));
+}
+/**
 * Create each bucket the stack's MinIO serves, and the open paths of each
 * one a file server fronts — from this machine, on MinIO's loopback port,
 * the way `gkm dev` creates them.
@@ -2779,7 +3210,8 @@ async function prepareBuckets(ctx, run, deps) {
 		done = [
 			...await applyBuckets(client, storage.buckets),
 			...await applyPolicies(client, storage.policies),
-			...await applyLifecycles(client, storage.lifecycles)
+			...await applyLifecycles(client, storage.lifecycles),
+			...await applyNotifications(client, storage.objects, new Set(storage.webhooks.map((hook) => hook.bucket)))
 		];
 	} finally {
 		await tunnel.close();
@@ -2881,7 +3313,11 @@ async function migrateAndSeed(ctx, run, deps, port) {
 */
 async function buildCompose(ctx, run, deps) {
 	const { stack, ref } = run;
-	const images = [...stack.apps, ...stack.workers];
+	const images = [
+		...stack.apps,
+		...stack.workers,
+		...stack.processors
+	];
 	const apps = images.map((image) => image.app);
 	if (run.push) {
 		run.files = await writeStack(ctx.cwd, run.dir, stack);
@@ -2953,7 +3389,7 @@ async function releaseCompose(ctx, run, deps) {
 			url: app.url
 		});
 	}
-	for (const worker of stack.workers) applied(ctx, run, {
+	for (const worker of [...stack.workers, ...stack.processors]) applied(ctx, run, {
 		key: `service:${worker.name}`,
 		resourceType: "service",
 		action: "ensure",
@@ -2963,6 +3399,7 @@ async function releaseCompose(ctx, run, deps) {
 	ctx.logger.info(`\n✅ ${stack.project} is running:`);
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}${app.auth ? `  🔒 user: ${app.auth.user}, password: gkm secrets:show --stage ${ctx.stage} --reveal → ${app.auth.key}` : ""}`);
 	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} worker ${worker.id}`);
+	for (const unit of stack.processors) ctx.logger.info(`   ${unit.name.padEnd(12)} processors of ${unit.id}`);
 	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
 }
 /**
@@ -2973,7 +3410,11 @@ async function releaseCompose(ctx, run, deps) {
 async function recordImages(ctx, run) {
 	const journal = await DeployJournal.open(ctx.state, ctx.stage, () => createComposeState(ctx.stage));
 	const by = currentActor();
-	for (const app of [...run.stack.apps, ...run.stack.workers]) {
+	for (const app of [
+		...run.stack.apps,
+		...run.stack.workers,
+		...run.stack.processors
+	]) {
 		const image = run.images[app.app] ?? {
 			ref: app.ref,
 			tag: app.tag
@@ -3002,7 +3443,7 @@ async function verifyCompose(ctx, run, deps) {
 		ca,
 		edge
 	})));
-	results.push(...await Promise.all(stack.workers.map((worker) => checkContainer(ctx, run, deps, worker.name))));
+	results.push(...await Promise.all([...stack.workers, ...stack.processors].map((worker) => checkContainer(ctx, run, deps, worker.name))));
 	if (stack.logs) results.push(await checkContainer(ctx, run, deps, LOGS_SERVICE));
 	const down = results.filter((result) => !result.healthy).map(({ app, url, last }) => ({
 		app,
@@ -3011,9 +3452,33 @@ async function verifyCompose(ctx, run, deps) {
 	}));
 	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down, stack.proxy);
 	await pruneStageDns(ctx, run);
+	await confirmSubscriptions(ctx, run, deps);
 	if (stack.logs) reportLogs(ctx, stack.logs, stack.local, run.server);
 }
 /**
+* The SNS subscriptions the stage's providers made before the workers were
+* up: each still pending is subscribed again, so SNS resends its
+* confirmation to a worker now there to answer it, and waited on. One still
+* pending after that is said, not failed on — every app is healthy, and
+* rolling them back would not confirm it.
+*/
+async function confirmSubscriptions(ctx, run, deps) {
+	const stored = await ctx.state.read(ctx.stage);
+	const left = await (deps.confirmSubscriptions ?? confirmPendingSubscriptions)({
+		workspace: ctx.workspace,
+		stage: ctx.stage,
+		secrets: run.secrets?.custom ?? {},
+		resources: stored?.resources,
+		env: deps.env,
+		log: (line) => ctx.logger.info(line),
+		record: async (record) => {
+			const { updatedAt: _, updatedBy: __, ...input } = record;
+			await ctx.state.putResource(ctx.stage, input);
+		}
+	});
+	if (left.length > 0) ctx.logger.warn(`⚠ ${new PushSubscriptionsUnconfirmed(left).message}`);
+}
+/**
 * A container's own health check, as Docker reports it: a worker's, which
 * has no route through the edge, and OpenObserve's — by default it has no
 * host there, and served publicly it answers only the addresses it allows,
@@ -3143,7 +3608,7 @@ function composeResult(ctx, run) {
 			...image?.digest ? { digest: image.digest } : {},
 			url: app.url
 		};
-	}), ...run.stack.workers.map((worker) => {
+	}), ...[...run.stack.workers, ...run.stack.processors].map((worker) => {
 		const image = run.images[worker.name];
 		return {
 			appName: worker.name,
@@ -3217,7 +3682,11 @@ async function writeStack(root, dir, stack) {
 		recursive: true,
 		force: true
 	});
-	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const app of [
+		...stack.apps,
+		...stack.workers,
+		...stack.processors
+	]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
 	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write(join(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
 	if (stack.redis && stack.compose.services["redis"]?.env_file) await write(join(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
 	if (stack.backups) {
@@ -3255,6 +3724,7 @@ function printPlan(ctx, run) {
 	if (run.server) ctx.logger.info(`   → ${sshTarget(run.server)} (docker over ssh)`);
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
 	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} ${`worker ${worker.id} (no route)`.padEnd(40)} ${mode} ${worker.ref}`);
+	for (const unit of stack.processors) ctx.logger.info(`   ${unit.name.padEnd(12)} ${`processors of ${unit.id}`.padEnd(40)} ${mode} ${unit.ref}`);
 	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
 	if (stack.backups) ctx.logger.info(`   ${BACKUPS_SERVICE.padEnd(12)} ${stack.backups.databases.map((d) => d.file).join(", ")} — ${stack.backups.backups.describe}, to ${stack.backups.prefix}/`);
 	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
@@ -3333,4 +3803,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { dockerCompose as C, sshTarget as S, parseDigests as _, edgePorts as a, dockerHost as b, edgeRef as c, composeStack as d, derivedCredentials as f, edgeAlias as g, EDGE_PROJECT as h, ComposePushNeedsBuild as i, removeEdgeRoutes as l, stackPlan as m, compose_exports as n, stackOverrideFile as o, stackDir as p, ComposePinNeedsPull as r, deployedStackSecrets as s, composeTarget as t, composeProject as u, pinnedRef as v, projectNetwork as w, sshAccess as x, composeServer as y };
 
-//# sourceMappingURL=compose-cHkF---f.mjs.map
+//# sourceMappingURL=compose-BFmdLig3.mjs.map