@geekmidas/cli 10.0.0-alpha.71 → 10.0.0-alpha.73

package/dist/SubscriberGenerator-DZk_pKDh.mjs

@@ -0,0 +1,432 @@
+import { u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
+import { n as runtimeFor } from "./EndpointGenerator-DftalLYg.mjs";
+import { dirname, join, relative } from "node:path";
+import { access, mkdir, writeFile } from "node:fs/promises";
+import { Subscriber } from "@geekmidas/constructs/subscribers";
+import { canonicalId, kebabCase, provideKey } from "@geekmidas/manifest";
+import { pathToFileURL } from "node:url";
+//#region src/types.ts
+/**
+* The backend a project gets when it says nothing, by where it deploys.
+*
+* Flat defaults could not be right for both: `upstash` on a single box means a
+* SaaS round-trip for a cache the database could have held, and `minio` on AWS
+* means running a bucket beside S3. So the default is a function of the target,
+* and an app that says nothing gets the obvious answer in both places — which
+* is the whole of what "zero config" can mean once there is more than one
+* target.
+*
+* `server` covers Dokploy and a bare host alike: the question these answer is
+* whether the app is next to a managed cloud or next to its own containers, and
+* on that question the two are the same.
+*
+* A per-construct, per-stage override is the layer above this — see
+* `constructs-outstanding.md` — so two buckets in one app can differ. This is
+* only what happens when nobody has said anything at all.
+*/
+const DEFAULT_CACHE = {
+	aws: "upstash",
+	server: "db"
+};
+/**
+* Which broker carries a declared queue or topic, by target.
+*
+* Whether there are events at all is the manifest's answer — a declared
+* `Topic` or `Queue` — so this only ever answers the second question. AWS
+* deploys them to SNS and SQS, and locally the AWS emulator stands in, so the
+* broker a developer runs is the one production has. A server has a Postgres
+* already, and pg-boss keeps its queues there.
+*/
+const DEFAULT_EVENTS = {
+	aws: "sns",
+	server: "pgboss"
+};
+/** Where a bucket lives when nobody said — see {@link DEFAULT_CACHE}. */
+const DEFAULT_STORAGE = {
+	aws: "s3",
+	server: "minio"
+};
+//#endregion
+//#region src/reconcile/fakes.ts
+/**
+* External APIs' fakes, read from where the convention puts them.
+*
+* `test/fakes/<id>.ts` default-exports `fake.app(…)` or `fake.image(…)`. The
+* construct never names it — that is what keeps a fake out of a deployed
+* bundle — so this is the one place it is found, by the same rule that finds a
+* database's factory in `test/factories/<id>.ts`.
+*/
+/** Where a project keeps its external APIs' fakes, relative to its root. */
+const DEFAULT_FAKES_DIR = "test/fakes";
+/** The marker `fake.app` and `fake.image` set — the same registered symbol. */
+const FAKE = Symbol.for("@geekmidas/constructs/fake");
+/**
+* The fake for every external API the manifest declares, keyed by id.
+*
+* @throws {NoFake} when an external API has no file, since a local stage would
+* otherwise have nothing to call.
+* @throws {NotAFake} when the file's default export is not one.
+*/
+async function readFakes(root, manifest) {
+	const fakes = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== "external-api") continue;
+		const file = await fakeFile(join(root, DEFAULT_FAKES_DIR), id);
+		const value = (await import(pathToFileURL(file).href)).default;
+		if (!isFakeExport(value)) throw new NotAFake(file);
+		fakes[id] = {
+			file,
+			...value.kind === "image" ? {
+				image: value.image,
+				port: value.port
+			} : {},
+			credentials: JSON.stringify(value.credentials)
+		};
+	}
+	return fakes;
+}
+/** The first of `<id>.ts`, `.mts`, `.js`, `.mjs` that exists. */
+async function fakeFile(folder, id) {
+	const base = join(folder, kebabCase(id));
+	for (const extension of [
+		".ts",
+		".mts",
+		".js",
+		".mjs"
+	]) {
+		const file = `${base}${extension}`;
+		if (await access(file).then(() => true, () => false)) return file;
+	}
+	throw new NoFake(id, `${base}.ts`);
+}
+function isFakeExport(value) {
+	return typeof value === "object" && value !== null && value[FAKE] === true;
+}
+/** An external API with no fake for a local stage to call. */
+var NoFake = class extends Error {
+	id;
+	file;
+	constructor(id, file) {
+		super(`'${id}' is an external API, and a local stage calls its fake rather than the provider — but there is none. Create ${file}, default-exporting fake.app(…) or fake.image(…) from @geekmidas/constructs/external-api.`);
+		this.id = id;
+		this.file = file;
+		this.name = "NoFake";
+	}
+};
+/** A file in the fakes folder whose default export is not a fake. */
+var NotAFake = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is where a fake lives, and its default export is not one. Export default fake.app(handler, { credentials }) or fake.image(image, { port, credentials }).`);
+		this.file = file;
+		this.name = "NotAFake";
+	}
+};
+//#endregion
+//#region src/generators/SubscriberGenerator.ts
+var SubscriberGenerator = class extends ConstructGenerator {
+	isConstruct(value) {
+		return Subscriber.isSubscriber(value);
+	}
+	async build(context, constructs, outputDir, options) {
+		const target = options?.target ?? "aws";
+		const logger = console;
+		const subscriberInfos = [];
+		if (target === "server") {
+			await this.generateServerSubscribersFile(outputDir, constructs, context.eventsBackends?.includes("sns") ?? false);
+			logger.log(`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`);
+			return subscriberInfos;
+		}
+		if (constructs.length === 0) return subscriberInfos;
+		const subscribersDir = join(outputDir, "subscribers");
+		await mkdir(subscribersDir, { recursive: true });
+		for (const { key, construct, path } of constructs) {
+			const handlerFile = await this.generateSubscriberHandler(subscribersDir, path.relative, key, construct, context, construct.owner);
+			subscriberInfos.push({
+				name: key,
+				handler: relative(options?.root ?? process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				subscribedEvents: construct.subscribedEvents || [],
+				...construct.topicName ? {
+					transport: "topic",
+					topic: construct.topicName
+				} : {},
+				timeout: construct.timeout,
+				memorySize: construct.memorySize,
+				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
+				dependencies: construct.constructs
+			});
+			logger.log(`Generated subscriber handler: ${key}`);
+		}
+		return subscriberInfos;
+	}
+	async generateSubscriberHandler(outputDir, sourceFile, exportName, _subscriber, context, owner) {
+		const handlerFileName = `${exportName}.ts`;
+		const handlerPath = join(outputDir, handlerFileName);
+		const importPath = relative(dirname(handlerPath), sourceFile).replace(/\.ts$/, ".js");
+		const runtime = runtimeFor(context, dirname(handlerPath), owner);
+		const content = `import { AWSLambdaSubscriber } from '@geekmidas/constructs/aws';
+import { ${exportName} } from '${importPath}';
+${runtime.imports}
+${context.storageDrivers?.imports ?? ""}
+${runtime.bindings}
+${context.storageDrivers?.setup ? `\n// The handler registers the drivers its target needs.\n${context.storageDrivers.setup}\n` : ""}
+const adapter = new AWSLambdaSubscriber(envParser, ${exportName});
+
+export const handler = adapter.handler;
+`;
+		await writeFile(handlerPath, content);
+		return handlerPath;
+	}
+	async generateServerSubscribersFile(outputDir, subscribers, push) {
+		await mkdir(outputDir, { recursive: true });
+		const subscribersPath = join(outputDir, "subscribers.ts");
+		if (subscribers.length === 0) {
+			await writeFile(subscribersPath, `/**
+ * Generated subscribers setup — this app declares none.
+ */
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import type { Logger } from '@geekmidas/logger';
+
+export async function setupSubscribers(
+  _app: unknown,
+  _envParser: EnvironmentParser<any>,
+  _logger: Logger,
+): Promise<(port: number) => Promise<void>> {
+  return async () => {};
+}
+
+export function subscribersStatus(): { failed: string[]; connections: unknown[] } {
+  return { failed: [], connections: [] };
+}
+
+export async function stopSubscribers(): Promise<void> {}
+`);
+			return subscribersPath;
+		}
+		const importsByFile = /* @__PURE__ */ new Map();
+		for (const { path, key } of subscribers) {
+			const importPath = relative(dirname(subscribersPath), path.relative).replace(/\.ts$/, ".js");
+			importsByFile.set(importPath, [...importsByFile.get(importPath) ?? [], key]);
+		}
+		const content = `/**
+ * Generated subscribers setup.
+ *
+ * Each subscriber is run against the topic it is bound to, through that
+ * topic's own connection string:
+ *
+ * - **sns://** — pushed, not polled. The subscriber gets an HTTP route on this
+ *   server, and the route is subscribed to the topic with a filter policy of
+ *   the events it named, so SNS fans out to each subscriber. The route runs the
+ *   subscriber through the same adaptor a Lambda subscription does.
+ * - **anything else** (pgboss://, rabbitmq://, sqs://) — polled. On pg-boss
+ *   each subscriber drains a queue of its own, \`<topic>/<subscriber>\`, so
+ *   every subscriber sees every event; replicas of one subscriber share it.
+ *
+ * GKM_SUBSCRIBERS=off (\`gkm dev --no-subscribers\`) runs none of them.
+ * GKM_SUBSCRIBER_PUSH_URL is the address SNS pushes to; against the local
+ * emulator it defaults to this server through host.docker.internal.
+ */
+import { connect } from 'node:net';
+import type { EnvironmentParser } from '@geekmidas/envkit';
+import type { Logger } from '@geekmidas/logger';
+import { EventConnectionFactory, Subscriber } from '@geekmidas/events';
+import type { EventConnection } from '@geekmidas/events';
+import { ServiceDiscovery } from '@geekmidas/services';
+${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
+
+const subscribers = [
+${subscribers.map(({ key, construct }) => {
+			const connectionKey = construct.topicName ? provideKey(canonicalId(construct.topicName), "publisherConnectionString") : void 0;
+			return `  { id: '${key}', subscriber: ${key}, topic: ${construct.topicName ? `'${construct.topicName}'` : "undefined"}, connectionKey: ${connectionKey ? `'${connectionKey}'` : "undefined"} },`;
+		}).join("\n")}
+];
+
+// What was opened, and what could not be: a worker's health check reads both,
+// and its shutdown closes what was opened.
+const connections = new Map<string, EventConnection>();
+const failed: string[] = [];
+
+/** The route a subscriber's pushes arrive on. */
+export const SUBSCRIBER_ROUTE = (id: string) => \`/__gkm/subscribers/\${id}\`;
+
+/** Resolves once something is accepting connections on the port. */
+async function listening(port: number): Promise<void> {
+  for (let attempt = 0; attempt < 100; attempt++) {
+    const open = await new Promise<boolean>((resolve) => {
+      const socket = connect(port, '127.0.0.1');
+      socket.once('connect', () => { socket.end(); resolve(true); });
+      socket.once('error', () => resolve(false));
+    });
+    if (open) return;
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+}
+
+/**
+ * Mount each pushed subscriber's route and start each polled one. Returns what
+ * to run once the server is listening: subscribing a route makes SNS send its
+ * confirmation at once, so the route has to be reachable first.
+ */
+export async function setupSubscribers(
+  app: { post: (path: string, handler: (c: any) => unknown) => unknown },
+  envParser: EnvironmentParser<any>,
+  logger: Logger,
+): Promise<(port: number) => Promise<void>> {
+  if (process.env.GKM_SUBSCRIBERS === 'off') {
+    logger.info('Subscribers are off (--no-subscribers)');
+    return async () => {};
+  }
+
+  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);
+  const afterListening: ((port: number) => Promise<void>)[] = [];
+
+  for (const { id, subscriber, topic, connectionKey } of subscribers) {
+    const events = subscriber.subscribedEvents || [];
+    if (events.length === 0) {
+      logger.warn({ subscriber: id }, 'Subscriber has no subscribed events, skipping');
+      continue;
+    }
+    const connectionString = connectionKey ? process.env[connectionKey] : undefined;
+    if (!connectionString) {
+      logger.error(
+        { subscriber: id, connectionKey },
+        'No connection string for the topic this subscriber is bound to',
+      );
+      failed.push(id);
+      continue;
+    }
+
+    try {
+${push ? `      if (connectionString.startsWith('sns:')) {
+        const { SNSConnection, snsUrl, subscribeHttpEndpoint } = await import('@geekmidas/events/sns');
+        const { SnsPushSubscriberAdaptor } = await import('@geekmidas/constructs/subscribers');
+        const address = snsUrl.parse(connectionString);
+        const route = SUBSCRIBER_ROUTE(id);
+        const adaptor = new SnsPushSubscriberAdaptor(envParser, subscriber, {
+          topicArn: address.topicArn,
+          // An emulator signs nothing. Decided by the address this server was
+          // configured with, never by anything a request says about itself.
+          verify: !address.endpoint,
+          ...(address.endpoint ? { emulatorEndpoint: address.endpoint } : {}),
+        });
+
+        app.post(route, async (c: any) => {
+          const body = JSON.parse(await c.req.text());
+          const response = await adaptor.handle(body);
+          return c.json(response.body, response.status);
+        });
+
+        afterListening.push(async (port) => {
+          const base =
+            process.env.GKM_SUBSCRIBER_PUSH_URL ??
+            (address.endpoint ? \`http://host.docker.internal:\${port}\` : undefined);
+          if (!base) {
+            logger.error(
+              { subscriber: id },
+              'Set GKM_SUBSCRIBER_PUSH_URL to the public URL of this worker, which SNS pushes to',
+            );
+            return;
+          }
+          const connection = await SNSConnection.fromConnectionString(connectionString);
+          await subscribeHttpEndpoint(connection, {
+            endpoint: new URL(route, base).toString(),
+            events,
+          });
+          logger.info({ subscriber: id, events }, 'Subscriber subscribed for push');
+        });
+        continue;
+      }
+` : `      if (connectionString.startsWith('sns:')) {
+        // Built for a broker other than SNS, so this entry registered no SNS
+        // driver and has no push route to offer.
+        logger.error(
+          { subscriber: id, connectionKey },
+          'This build has no SNS driver: it was built for a target whose broker is not SNS',
+        );
+        failed.push(id);
+        continue;
+      }
+`}
+
+      let connection = connections.get(connectionString);
+      if (!connection) {
+        connection = await EventConnectionFactory.fromConnectionString(connectionString);
+        connections.set(connectionString, connection);
+      }
+      // Named, so a broker with one address for everything (pg-boss) gives
+      // this subscriber a queue of its own: fan-out, not competition.
+      const eventSubscriber = await Subscriber.fromConnection(connection, {
+        topic,
+        subscription: id,
+      });
+      const services = subscriber.services.length > 0
+        ? await serviceDiscovery.register(subscriber.services)
+        : {};
+      // The subscriber's database — the worker's, or its own — as \`db\`. A
+      // pushed subscriber gets it from the adaptor above instead.
+      const db = subscriber.databaseService
+        ? (await serviceDiscovery.register([subscriber.databaseService]))[
+            subscriber.databaseService.serviceName
+          ]
+        : undefined;
+
+      await eventSubscriber.subscribe(events, async (event) => {
+        try {
+          await subscriber.handler({
+            events: [event],
+            services: services as any,
+            logger: subscriber.logger,
+            db,
+          } as any);
+        } catch (error) {
+          logger.error({ err: error, event, subscriber: id }, 'Failed to process event');
+          // Rethrown so the transport keeps the event for a retry — as a queue
+          // consumer's failure does, and as a pushed subscriber's 500 does.
+          throw error;
+        }
+      });
+      logger.info({ subscriber: id, events }, 'Subscriber started polling');
+    } catch (error) {
+      // The message too: a missing module's code alone does not say which.
+      logger.error(
+        { err: error, subscriber: id },
+        'Failed to set up subscriber',
+      );
+      failed.push(id);
+    }
+  }
+
+  return async (port) => {
+    if (afterListening.length === 0) return;
+    await listening(port);
+    for (const subscribe of afterListening) {
+      await subscribe(port).catch((error) => {
+        logger.error({ err: error }, 'Failed to subscribe for push');
+      });
+    }
+  };
+}
+
+/** The subscribers that could not start, and the connections that did. */
+export function subscribersStatus(): { failed: string[]; connections: EventConnection[] } {
+  return { failed: [...failed], connections: [...connections.values()] };
+}
+
+/**
+ * Stop polling, let the events in flight finish, and close each broker
+ * connection — pg-boss's graceful stop does all three. The caller bounds it.
+ */
+export async function stopSubscribers(): Promise<void> {
+  const open = [...connections.values()];
+  connections.clear();
+  await Promise.all(open.map((connection) => connection.close()));
+}
+`;
+		await writeFile(subscribersPath, content);
+		return subscribersPath;
+	}
+};
+//#endregion
+export { DEFAULT_STORAGE as a, DEFAULT_EVENTS as i, readFakes as n, DEFAULT_CACHE as r, SubscriberGenerator as t };
+
+//# sourceMappingURL=SubscriberGenerator-DZk_pKDh.mjs.map

package/dist/SubscriberGenerator-DZk_pKDh.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriberGenerator-DZk_pKDh.mjs","names":[],"sources":["../src/types.ts","../src/reconcile/fakes.ts","../src/generators/SubscriberGenerator.ts"],"sourcesContent":["import type {\n\tDevConfig,\n\tSecretsConfig,\n\tStagesConfig,\n\tTestConfig,\n} from './workspace/types.js';\n\nexport type MainProvider = 'aws' | 'server';\n\nexport type Routes = string | string[];\n\n/**\n * Supported event backend types.\n *\n * - `pgboss`: Reuses PostgreSQL with a dedicated user/schema. Auto-enables db service.\n * - `sns`: Adds the AWS emulator (floci) container; each topic and queue is\n *   created on it and addressed by its own string.\n * - `rabbitmq`: Adds RabbitMQ container.\n *\n * Each topic and queue resolves its own `<ID>_PUBLISHER_CONNECTION_STRING`,\n * which its producers and its consumers both read. pg-boss and RabbitMQ also\n * resolve `EVENT_PUBLISHER_CONNECTION_STRING`, the one broker crons schedule\n * through.\n */\nexport type EventsBackend = 'pgboss' | 'sns' | 'rabbitmq';\n\n/**\n * Where a declared cache actually lives.\n *\n * A deployment choice, not an application one — the same code caches into any\n * of these — so it is config here beside `events` rather than a field on the\n * construct. Each backend is consistent between local and deployed, which is\n * the property worth having: a cache that behaves differently in the two places\n * is worse than a slower one.\n *\n * - `upstash` (default) — HTTP with a token. Reachable from a Lambda with no\n *   VPC and no connection pool, which is why it is the default; locally the\n *   `serverless-redis-http` proxy in front of Redis speaks the same protocol.\n * - `elasticache` — the Redis wire protocol, inside a VPC. Locally, plain Redis.\n * - `db` — a table in the database the app already declared. No infrastructure\n *   at all, and the same relationship pg-boss has to Postgres: it creates its\n *   own table on first use and needs a declared database to live in.\n */\nexport type CacheBackend = 'upstash' | 'elasticache' | 'db';\n\n/**\n * Where a declared bucket actually lives.\n *\n * The fourth of these selectors and the last to arrive, which is why\n * `UPLOADS_URL` had no answer on a container target: there was nothing to\n * choose with. Like the others it changes no application code — the `s3://`\n * scheme picks the driver, and every one of these speaks it.\n *\n * - `s3` — a real bucket. Nothing is created on the host; the URL is composed\n *   against credentials you already hold, the same way `resend` is an API key\n *   rather than infrastructure.\n * - `r2` — Cloudflare's, reached through the same S3 API and differing only in\n *   its endpoint.\n * - `minio` — a container. Everything the app declares lives on the box, which\n *   is what makes a single-host deploy self-contained, and what makes it a\n *   single disk with no replication. Locally this is what every backend is.\n */\nexport type StorageBackend = 'minio' | 's3' | 'r2';\n\n/**\n * The backend a project gets when it says nothing, by where it deploys.\n *\n * Flat defaults could not be right for both: `upstash` on a single box means a\n * SaaS round-trip for a cache the database could have held, and `minio` on AWS\n * means running a bucket beside S3. So the default is a function of the target,\n * and an app that says nothing gets the obvious answer in both places — which\n * is the whole of what \"zero config\" can mean once there is more than one\n * target.\n *\n * `server` covers Dokploy and a bare host alike: the question these answer is\n * whether the app is next to a managed cloud or next to its own containers, and\n * on that question the two are the same.\n *\n * A per-construct, per-stage override is the layer above this — see\n * `constructs-outstanding.md` — so two buckets in one app can differ. This is\n * only what happens when nobody has said anything at all.\n */\nexport const DEFAULT_CACHE: Record<MainProvider, CacheBackend> = {\n\t// Reachable from a Lambda with no VPC and no connection pool.\n\taws: 'upstash',\n\t// The database is already there and already has a connection pool open to\n\t// it. Anything else is a second service to run for a table.\n\tserver: 'db',\n};\n\n/**\n * Which broker carries a declared queue or topic, by target.\n *\n * Whether there are events at all is the manifest's answer — a declared\n * `Topic` or `Queue` — so this only ever answers the second question. AWS\n * deploys them to SNS and SQS, and locally the AWS emulator stands in, so the\n * broker a developer runs is the one production has. A server has a Postgres\n * already, and pg-boss keeps its queues there.\n */\nexport const DEFAULT_EVENTS: Record<MainProvider, EventsBackend> = {\n\taws: 'sns',\n\tserver: 'pgboss',\n};\n\n/** Where a bucket lives when nobody said — see {@link DEFAULT_CACHE}. */\nexport const DEFAULT_STORAGE: Record<MainProvider, StorageBackend> = {\n\taws: 's3',\n\tserver: 'minio',\n};\n\n/**\n * Who delivers a declared app's mail.\n *\n * Unlike a cache, this changes *nothing* about the client. Every backend speaks\n * SMTP, so the declaration's `smtp://` URL is true of all of them and only the\n * provisioner differs — which is the same reason the declaration has no\n * `provider` field and there is no `ses://` scheme.\n *\n * - `ses` (default) — the only backend that can be a *chain* of resources: an\n *   identity, a user, an access key, and an SMTP password derived from it,\n *   because SES issues IAM credentials rather than SMTP ones. Hand it a URL and\n *   it uses that instead, which is what you want when the credentials already\n *   exist — provisioning a second set of sending credentials for an identity\n *   that already has them is not a thing to do by default.\n * - `resend` — an API key you hold, composed into an SMTP URL. Nothing to\n *   provision: a SaaS account is not infrastructure.\n * - `smtp` — a URL supplied whole, for a relay somebody else runs.\n *\n * Locally every one of them is Mailpit, because locally none of it matters.\n */\nexport type EmailBackend = 'resend' | 'ses' | 'smtp';\n\n/**\n * Who delivers mail when nobody said.\n *\n * Flat, unlike the others, and deliberately: mail is a SaaS on every target.\n * There is no self-hosted preset to default a container deploy to — Mailpit is\n * a development inbox, not a sender — so `server` has no answer of its own to\n * give and would only be `ses` written twice.\n */\nexport const DEFAULT_EMAIL: EmailBackend = 'ses';\n\n/** Supported docker-compose service names */\nexport type ComposeServiceName =\n\t| 'postgres'\n\t| 'redis'\n\t| 'rabbitmq'\n\t| 'minio'\n\t| 'mailpit'\n\t| 'localstack';\n\nexport interface DockerConfig {\n\t/** Container registry URL (e.g., 'ghcr.io/myorg') */\n\tregistry?: string;\n\t/** Docker image name (default: derived from package.json name) */\n\timageName?: string;\n\t/** Base Docker image (default: 'node:22-alpine') */\n\tbaseImage?: string;\n\t/** Container port (default: 3000) */\n\tport?: number;\n}\n\nexport type Runtime = 'node' | 'bun';\n\nexport interface TelescopeConfig {\n\t/** Enable/disable telescope (default: true in development) */\n\tenabled?: boolean;\n\t/** Port for telescope to use (defaults to server port) */\n\tport?: number;\n\t/** Path prefix for telescope UI (default: /__telescope) */\n\tpath?: string;\n\t/** Ignore patterns for telescope (e.g., ['/health', '/metrics']) */\n\tignore?: string[];\n\t/** Record request/response bodies (default: true) */\n\trecordBody?: boolean;\n\t/** Maximum entries to keep in memory (default: 1000) */\n\tmaxEntries?: number;\n\t/** Enable WebSocket for real-time updates (default: true, requires @hono/node-ws for Node.js) */\n\twebsocket?: boolean;\n}\n\nexport interface OpenApiConfig {\n\t/** Enable OpenAPI generation (default: true) */\n\tenabled?: boolean;\n\t/** API title */\n\ttitle?: string;\n\t/** API version */\n\tversion?: string;\n\t/** API description */\n\tdescription?: string;\n}\n\nexport interface HooksConfig {\n\t/**\n\t * Path to a module exporting server lifecycle hooks.\n\t * The module should export `beforeSetup` and/or `afterSetup` functions.\n\t *\n\t * @example\n\t * ```typescript\n\t * // src/config/hooks.ts\n\t * import type { Hono } from 'hono';\n\t * import type { Logger } from '@geekmidas/logger';\n\t * import type { EnvironmentParser } from '@geekmidas/envkit';\n\t *\n\t * // Called BEFORE gkm endpoints are registered\n\t * export function beforeSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {\n\t *   app.use('*', cors());\n\t *   app.get('/custom/health', (c) => c.json({ status: 'ok' }));\n\t * }\n\t *\n\t * // Called AFTER gkm endpoints are registered\n\t * export function afterSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {\n\t *   app.notFound((c) => c.json({ error: 'Not found' }, 404));\n\t *   app.onError((err, c) => c.json({ error: err.message }, 500));\n\t * }\n\t * ```\n\t */\n\tserver?: string;\n}\n\nexport interface GkmConfig {\n\t/**\n\t * What this app is called, and therefore how everything it declares is named.\n\t *\n\t * The same field `sst.config.ts` carries, doing the same job: every physical\n\t * name is `{stage}-{name}-{construct}`, so `Database` in the `production`\n\t * stage of `kitchen-sink` is `production-kitchen-sink-database` on AWS and on\n\t * Dokploy alike. One statement, in the config, rather than a rule each\n\t * provider restates.\n\t *\n\t * `defineWorkspace` has always had this. A single-app config did not, so its\n\t * names fell back to whatever the directory happened to be called — the\n\t * monorepo's package name for the project and the app's for the application,\n\t * two accidents of layout standing in for a decision.\n\t *\n\t * Defaults to the package.json name with any scope stripped, then the\n\t * directory name.\n\t */\n\tname?: string;\n\t/** The project's stages: which one is local, which deploy */\n\tstages: StagesConfig;\n\t/** Encrypted secrets, and where deployed stages' secrets are stored */\n\tsecrets?: SecretsConfig;\n\t/** What `gkm test` hands a feature test: where the factories are. */\n\ttest?: TestConfig;\n\t/** How `gkm dev` is reached: the discovery endpoint's port and origins. */\n\tdev?: DevConfig;\n\t/**\n\t * Constructs glob pattern — one glob, every kind.\n\t *\n\t * What reconcile reads to derive the containers a stage needs: a database\n\t * implies Postgres, objects imply MinIO, mail implies Mailpit. A glob per\n\t * kind cannot find a resource, because a declared `ObjectStorage` has no\n\t * kind to be listed under.\n\t *\n\t * @example './src/**\\/*.ts'\n\t */\n\tconstructs: Routes;\n\t/**\n\t * Server lifecycle hooks for customizing the Hono app.\n\t * Allows adding custom routes, middleware, error handlers, etc.\n\t *\n\t * @example\n\t * hooks: {\n\t *   server: './src/config/hooks'\n\t * }\n\t */\n\thooks?: HooksConfig;\n\t/**\n\t * Telescope configuration for debugging/monitoring.\n\t * Can be:\n\t * - A string path to a module that exports a Telescope instance (recommended)\n\t * - A boolean to enable/disable with defaults\n\t * - A TelescopeConfig object for inline configuration\n\t */\n\ttelescope?: string | boolean | TelescopeConfig;\n\t/**\n\t * OpenAPI generation configuration.\n\t * Can be:\n\t * - A boolean to enable/disable with defaults (output: ./src/api/openapi.ts)\n\t * - An OpenApiConfig object for customization\n\t *\n\t * When enabled, OpenAPI spec is generated on startup and regenerated on route changes.\n\t *\n\t * @example\n\t * openapi: true\n\t *\n\t * @example\n\t * openapi: {\n\t *   output: './src/api/openapi.ts',\n\t *   title: 'My API',\n\t *   version: '1.0.0',\n\t * }\n\t */\n\topenapi?: boolean | OpenApiConfig;\n\t/** Runtime to use for dev server (default: 'node') */\n\truntime?: Runtime;\n\t/**\n\t * Environment file(s) to load for development.\n\t * Can be:\n\t * - A string path to a single env file (e.g., '.env.local')\n\t * - An array of paths to load in order (later files override earlier)\n\t * - Defaults to '.env' if not specified\n\t *\n\t * @example\n\t * env: '.env.local'\n\t *\n\t * @example\n\t * env: ['.env', '.env.local']\n\t */\n\tenv?: string | string[];\n\t/**\n\t * Docker deployment configuration.\n\t * Used by `gkm docker` and `gkm prepack` commands.\n\t *\n\t * @example\n\t * docker: {\n\t *   registry: 'ghcr.io/myorg',\n\t *   imageName: 'my-api',\n\t *   compose: {\n\t *     services: ['postgres', 'redis']\n\t *   }\n\t * }\n\t */\n\tdocker?: DockerConfig;\n\t/**\n\t * Where this app deploys, and what the target needs to know.\n\t *\n\t * Absent until now, which meant a single-app project could not configure a\n\t * Dokploy deploy at all: the wrap that turns one into a workspace hardcoded\n\t * `{ default: 'dokploy' }` and dropped everything else, so there was no\n\t * endpoint, no registry and no domain — and `resolveHost` failed with \"no\n\t * domain configured for stage\" on a config that had nowhere to put one.\n\t *\n\t * The same shape a workspace config uses, so moving from one to the other is\n\t * a rename rather than a rewrite.\n\t */\n\tdeploy?: import('./workspace/types').DeployConfig;\n}\n\nexport interface BuildOptions {\n\t/** Overrides the deploy target's: a Dockerfile builds a server regardless. */\n\tprovider?: MainProvider;\n\tenableOpenApi?: boolean;\n\t/** Build for production (no dev tools, bundled output) */\n\tproduction?: boolean;\n\t/** Skip bundling step in production build */\n\tskipBundle?: boolean;\n\t/** Stage for secrets injection (e.g., 'production', 'staging') */\n\tstage?: string;\n\t/**\n\t * When true, optional environment variables (those with `.optional()` or\n\t * `.default()` in the envParser) are suffixed with `?` within each\n\t * construct's `environment` array in the manifest (e.g. `PORT?`).\n\t * Defaults to false.\n\t */\n\tmarkOptional?: boolean;\n\t/**\n\t * Where the apps' own build scripts (turbo) run. Defaults to a\n\t * `LocalSandbox` on the workspace: this machine, with an allowlisted\n\t * environment.\n\t */\n\tsandbox?: import('./sandbox/sandbox').Sandbox;\n}\n\n/** Result from build command when secrets are injected */\nexport interface BuildResult {\n\t/** Ephemeral master key for deployment (only if stage was provided) */\n\tmasterKey?: string;\n}\n\n// The deployment manifest types are a shared, dependency-free data contract\n// in `@geekmidas/manifest`, re-exported here for back-compat with existing\n// `@geekmidas/cli` imports.\nexport type {\n\tCronInfo,\n\tFunctionInfo,\n\tQueueInfo,\n\tRouteInfo,\n\tSubscriberInfo,\n\tTopicInfo,\n} from '@geekmidas/manifest';\n","/**\n * External APIs' fakes, read from where the convention puts them.\n *\n * `test/fakes/<id>.ts` default-exports `fake.app(…)` or `fake.image(…)`. The\n * construct never names it — that is what keeps a fake out of a deployed\n * bundle — so this is the one place it is found, by the same rule that finds a\n * database's factory in `test/factories/<id>.ts`.\n */\n\nimport { access } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport { kebabCase } from '@geekmidas/manifest';\n\n/** Where a project keeps its external APIs' fakes, relative to its root. */\nexport const DEFAULT_FAKES_DIR = 'test/fakes';\n\n/** One external API's fake, as the local target needs it. */\nexport interface LocalFake {\n\t/** The file it was read from — what the harness and `gkm dev` import. */\n\tfile: string;\n\t/** The image to run, for a fake the provider publishes. */\n\timage?: string;\n\t/** The port that image listens on inside its container. */\n\tport?: number;\n\t/** What the fake accepts, as the JSON `<ID>_CREDENTIALS` holds. */\n\tcredentials: string;\n}\n\n/** The marker `fake.app` and `fake.image` set — the same registered symbol. */\nconst FAKE = Symbol.for('@geekmidas/constructs/fake');\n\ninterface FakeExport {\n\tkind: 'app' | 'image';\n\timage?: string;\n\tport?: number;\n\tcredentials: unknown;\n}\n\n/**\n * The fake for every external API the manifest declares, keyed by id.\n *\n * @throws {NoFake} when an external API has no file, since a local stage would\n * otherwise have nothing to call.\n * @throws {NotAFake} when the file's default export is not one.\n */\nexport async function readFakes(\n\troot: string,\n\tmanifest: ConstructManifest,\n): Promise<Record<string, LocalFake>> {\n\tconst fakes: Record<string, LocalFake> = {};\n\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\tif (declaration?.kind !== 'external-api') continue;\n\n\t\tconst file = await fakeFile(join(root, DEFAULT_FAKES_DIR), id);\n\t\tconst module = (await import(pathToFileURL(file).href)) as {\n\t\t\tdefault?: unknown;\n\t\t};\n\t\tconst value = module.default;\n\t\tif (!isFakeExport(value)) throw new NotAFake(file);\n\n\t\tfakes[id] = {\n\t\t\tfile,\n\t\t\t...(value.kind === 'image'\n\t\t\t\t? { image: value.image, port: value.port }\n\t\t\t\t: {}),\n\t\t\tcredentials: JSON.stringify(value.credentials),\n\t\t};\n\t}\n\n\treturn fakes;\n}\n\n/** The first of `<id>.ts`, `.mts`, `.js`, `.mjs` that exists. */\nasync function fakeFile(folder: string, id: string): Promise<string> {\n\tconst base = join(folder, kebabCase(id));\n\tfor (const extension of ['.ts', '.mts', '.js', '.mjs']) {\n\t\tconst file = `${base}${extension}`;\n\t\tconst exists = await access(file).then(\n\t\t\t() => true,\n\t\t\t() => false,\n\t\t);\n\t\tif (exists) return file;\n\t}\n\n\tthrow new NoFake(id, `${base}.ts`);\n}\n\nfunction isFakeExport(value: unknown): value is FakeExport {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\t(value as { [FAKE]?: unknown })[FAKE] === true\n\t);\n}\n\n/** An external API with no fake for a local stage to call. */\nexport class NoFake extends Error {\n\tconstructor(\n\t\treadonly id: string,\n\t\treadonly file: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${id}' is an external API, and a local stage calls its fake rather ` +\n\t\t\t\t`than the provider — but there is none. Create ${file}, ` +\n\t\t\t\t`default-exporting fake.app(…) or fake.image(…) from ` +\n\t\t\t\t`@geekmidas/constructs/external-api.`,\n\t\t);\n\t\tthis.name = 'NoFake';\n\t}\n}\n\n/** A file in the fakes folder whose default export is not a fake. */\nexport class NotAFake extends Error {\n\tconstructor(readonly file: string) {\n\t\tsuper(\n\t\t\t`${file} is where a fake lives, and its default export is not one. ` +\n\t\t\t\t`Export default fake.app(handler, { credentials }) or ` +\n\t\t\t\t`fake.image(image, { port, credentials }).`,\n\t\t);\n\t\tthis.name = 'NotAFake';\n\t}\n}\n","import { mkdir, writeFile } from 'node:fs/promises';\nimport { dirname, join, relative } from 'node:path';\nimport { Subscriber } from '@geekmidas/constructs/subscribers';\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\nimport type { BuildContext } from '../build/types';\nimport type { SubscriberInfo } from '../types';\nimport { runtimeFor } from './EndpointGenerator.js';\nimport {\n\tConstructGenerator,\n\ttype GeneratedConstruct,\n\ttype GeneratorOptions,\n} from './Generator';\n\nexport class SubscriberGenerator extends ConstructGenerator<\n\tSubscriber<any, any, any, any, any, any, any>,\n\tSubscriberInfo[]\n> {\n\tisConstruct(\n\t\tvalue: any,\n\t): value is Subscriber<any, any, any, any, any, any, any> {\n\t\treturn Subscriber.isSubscriber(value);\n\t}\n\n\tasync build(\n\t\tcontext: BuildContext,\n\t\tconstructs: GeneratedConstruct<\n\t\t\tSubscriber<any, any, any, any, any, any, any>\n\t\t>[],\n\t\toutputDir: string,\n\t\toptions?: GeneratorOptions,\n\t): Promise<SubscriberInfo[]> {\n\t\tconst target = options?.target ?? 'aws';\n\t\tconst logger = console;\n\t\tconst subscriberInfos: SubscriberInfo[] = [];\n\n\t\tif (target === 'server') {\n\t\t\t// Generate subscribers.ts for server-based polling (even if empty)\n\t\t\tawait this.generateServerSubscribersFile(\n\t\t\t\toutputDir,\n\t\t\t\tconstructs,\n\t\t\t\tcontext.eventsBackends?.includes('sns') ?? false,\n\t\t\t);\n\n\t\t\tlogger.log(\n\t\t\t\t`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`,\n\t\t\t);\n\n\t\t\t// Return empty array as server subscribers don't have individual handlers\n\t\t\treturn subscriberInfos;\n\t\t}\n\n\t\tif (constructs.length === 0) {\n\t\t\treturn subscriberInfos;\n\t\t}\n\n\t\t// Create subscribers subdirectory\n\t\tconst subscribersDir = join(outputDir, 'subscribers');\n\t\tawait mkdir(subscribersDir, { recursive: true });\n\n\t\t// Generate subscriber handlers\n\t\tfor (const { key, construct, path } of constructs) {\n\t\t\tconst handlerFile = await this.generateSubscriberHandler(\n\t\t\t\tsubscribersDir,\n\t\t\t\tpath.relative,\n\t\t\t\tkey,\n\t\t\t\tconstruct,\n\t\t\t\tcontext,\n\t\t\t\tconstruct.owner,\n\t\t\t);\n\n\t\t\tsubscriberInfos.push({\n\t\t\t\tname: key,\n\t\t\t\thandler: relative(options?.root ?? process.cwd(), handlerFile).replace(\n\t\t\t\t\t/\\.ts$/,\n\t\t\t\t\t'.handler',\n\t\t\t\t),\n\t\t\t\tsubscribedEvents: construct.subscribedEvents || [],\n\t\t\t\t// A subscriber bound to a topic (via `s.topic(topic)`) records the\n\t\t\t\t// binding so infra wires the SNS subscription.\n\t\t\t\t...(construct.topicName\n\t\t\t\t\t? { transport: 'topic' as const, topic: construct.topicName }\n\t\t\t\t\t: {}),\n\t\t\t\ttimeout: construct.timeout,\n\t\t\t\tmemorySize: construct.memorySize,\n\t\t\t\tenvironment: await construct.getEnvironment({\n\t\t\t\t\tmarkOptional: context.markOptional,\n\t\t\t\t}),\n\t\t\t\tdependencies: construct.constructs,\n\t\t\t});\n\n\t\t\tlogger.log(`Generated subscriber handler: ${key}`);\n\t\t}\n\n\t\treturn subscriberInfos;\n\t}\n\n\tprivate async generateSubscriberHandler(\n\t\toutputDir: string,\n\t\tsourceFile: string,\n\t\texportName: string,\n\t\t_subscriber: Subscriber<any, any, any, any, any, any, any>,\n\t\tcontext: BuildContext,\n\t\t/** The construct that owns this — its worker, or its surface. */\n\t\towner: string | undefined,\n\t): Promise<string> {\n\t\tconst handlerFileName = `${exportName}.ts`;\n\t\tconst handlerPath = join(outputDir, handlerFileName);\n\n\t\tconst relativePath = relative(dirname(handlerPath), sourceFile);\n\t\tconst importPath = relativePath.replace(/\\.ts$/, '.js');\n\n\t\t// Imports the construct that owns this, and binds `envParser` and\n\t\t// `logger` off it — the objects it was declared with, rather than a\n\t\t// module path printed in from config.\n\t\tconst runtime = runtimeFor(context, dirname(handlerPath), owner);\n\n\t\tconst content = `import { AWSLambdaSubscriber } from '@geekmidas/constructs/aws';\nimport { ${exportName} } from '${importPath}';\n${runtime.imports}\n${context.storageDrivers?.imports ?? ''}\n${runtime.bindings}\n${context.storageDrivers?.setup ? `\\n// The handler registers the drivers its target needs.\\n${context.storageDrivers.setup}\\n` : ''}\nconst adapter = new AWSLambdaSubscriber(envParser, ${exportName});\n\nexport const handler = adapter.handler;\n`;\n\n\t\tawait writeFile(handlerPath, content);\n\t\treturn handlerPath;\n\t}\n\n\tprivate async generateServerSubscribersFile(\n\t\toutputDir: string,\n\t\tsubscribers: GeneratedConstruct<\n\t\t\tSubscriber<any, any, any, any, any, any, any>\n\t\t>[],\n\t\t/**\n\t\t * The broker is SNS, so a subscriber is pushed to over HTTP. Only then is\n\t\t * the push code generated: it imports the SNS client, which a bundle for\n\t\t * any other broker must never have to resolve.\n\t\t */\n\t\tpush: boolean,\n\t): Promise<string> {\n\t\tawait mkdir(outputDir, { recursive: true });\n\t\tconst subscribersPath = join(outputDir, 'subscribers.ts');\n\n\t\t// Nothing to run, so nothing to import. Every app gets this file, and\n\t\t// `@geekmidas/events` is only installed by one that declared a Topic or\n\t\t// a Queue — importing it here crashed every dev server that had not.\n\t\tif (subscribers.length === 0) {\n\t\t\tawait writeFile(\n\t\t\t\tsubscribersPath,\n\t\t\t\t`/**\n * Generated subscribers setup — this app declares none.\n */\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Logger } from '@geekmidas/logger';\n\nexport async function setupSubscribers(\n  _app: unknown,\n  _envParser: EnvironmentParser<any>,\n  _logger: Logger,\n): Promise<(port: number) => Promise<void>> {\n  return async () => {};\n}\n\nexport function subscribersStatus(): { failed: string[]; connections: unknown[] } {\n  return { failed: [], connections: [] };\n}\n\nexport async function stopSubscribers(): Promise<void> {}\n`,\n\t\t\t);\n\t\t\treturn subscribersPath;\n\t\t}\n\n\t\tconst importsByFile = new Map<string, string[]>();\n\t\tfor (const { path, key } of subscribers) {\n\t\t\tconst importPath = relative(\n\t\t\t\tdirname(subscribersPath),\n\t\t\t\tpath.relative,\n\t\t\t).replace(/\\.ts$/, '.js');\n\t\t\timportsByFile.set(importPath, [\n\t\t\t\t...(importsByFile.get(importPath) ?? []),\n\t\t\t\tkey,\n\t\t\t]);\n\t\t}\n\t\tconst imports = Array.from(importsByFile.entries())\n\t\t\t.map(\n\t\t\t\t([importPath, exports]) =>\n\t\t\t\t\t`import { ${exports.join(', ')} } from '${importPath}';`,\n\t\t\t)\n\t\t\t.join('\\n');\n\n\t\t// Each subscriber reaches the topic it is bound to, by that topic's own\n\t\t// key — resolved here, at build time, from the binding.\n\t\tconst entries = subscribers\n\t\t\t.map(({ key, construct }) => {\n\t\t\t\tconst connectionKey = construct.topicName\n\t\t\t\t\t? provideKey(\n\t\t\t\t\t\t\tcanonicalId(construct.topicName),\n\t\t\t\t\t\t\t'publisherConnectionString',\n\t\t\t\t\t\t)\n\t\t\t\t\t: undefined;\n\t\t\t\treturn `  { id: '${key}', subscriber: ${key}, topic: ${\n\t\t\t\t\tconstruct.topicName ? `'${construct.topicName}'` : 'undefined'\n\t\t\t\t}, connectionKey: ${\n\t\t\t\t\tconnectionKey ? `'${connectionKey}'` : 'undefined'\n\t\t\t\t} },`;\n\t\t\t})\n\t\t\t.join('\\n');\n\n\t\tconst content = `/**\n * Generated subscribers setup.\n *\n * Each subscriber is run against the topic it is bound to, through that\n * topic's own connection string:\n *\n * - **sns://** — pushed, not polled. The subscriber gets an HTTP route on this\n *   server, and the route is subscribed to the topic with a filter policy of\n *   the events it named, so SNS fans out to each subscriber. The route runs the\n *   subscriber through the same adaptor a Lambda subscription does.\n * - **anything else** (pgboss://, rabbitmq://, sqs://) — polled. On pg-boss\n *   each subscriber drains a queue of its own, \\`<topic>/<subscriber>\\`, so\n *   every subscriber sees every event; replicas of one subscriber share it.\n *\n * GKM_SUBSCRIBERS=off (\\`gkm dev --no-subscribers\\`) runs none of them.\n * GKM_SUBSCRIBER_PUSH_URL is the address SNS pushes to; against the local\n * emulator it defaults to this server through host.docker.internal.\n */\nimport { connect } from 'node:net';\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Logger } from '@geekmidas/logger';\nimport { EventConnectionFactory, Subscriber } from '@geekmidas/events';\nimport type { EventConnection } from '@geekmidas/events';\nimport { ServiceDiscovery } from '@geekmidas/services';\n${imports}\n\nconst subscribers = [\n${entries}\n];\n\n// What was opened, and what could not be: a worker's health check reads both,\n// and its shutdown closes what was opened.\nconst connections = new Map<string, EventConnection>();\nconst failed: string[] = [];\n\n/** The route a subscriber's pushes arrive on. */\nexport const SUBSCRIBER_ROUTE = (id: string) => \\`/__gkm/subscribers/\\${id}\\`;\n\n/** Resolves once something is accepting connections on the port. */\nasync function listening(port: number): Promise<void> {\n  for (let attempt = 0; attempt < 100; attempt++) {\n    const open = await new Promise<boolean>((resolve) => {\n      const socket = connect(port, '127.0.0.1');\n      socket.once('connect', () => { socket.end(); resolve(true); });\n      socket.once('error', () => resolve(false));\n    });\n    if (open) return;\n    await new Promise((resolve) => setTimeout(resolve, 50));\n  }\n}\n\n/**\n * Mount each pushed subscriber's route and start each polled one. Returns what\n * to run once the server is listening: subscribing a route makes SNS send its\n * confirmation at once, so the route has to be reachable first.\n */\nexport async function setupSubscribers(\n  app: { post: (path: string, handler: (c: any) => unknown) => unknown },\n  envParser: EnvironmentParser<any>,\n  logger: Logger,\n): Promise<(port: number) => Promise<void>> {\n  if (process.env.GKM_SUBSCRIBERS === 'off') {\n    logger.info('Subscribers are off (--no-subscribers)');\n    return async () => {};\n  }\n\n  const serviceDiscovery = ServiceDiscovery.getInstance(envParser);\n  const afterListening: ((port: number) => Promise<void>)[] = [];\n\n  for (const { id, subscriber, topic, connectionKey } of subscribers) {\n    const events = subscriber.subscribedEvents || [];\n    if (events.length === 0) {\n      logger.warn({ subscriber: id }, 'Subscriber has no subscribed events, skipping');\n      continue;\n    }\n    const connectionString = connectionKey ? process.env[connectionKey] : undefined;\n    if (!connectionString) {\n      logger.error(\n        { subscriber: id, connectionKey },\n        'No connection string for the topic this subscriber is bound to',\n      );\n      failed.push(id);\n      continue;\n    }\n\n    try {\n${\n\tpush\n\t\t? `      if (connectionString.startsWith('sns:')) {\n        const { SNSConnection, snsUrl, subscribeHttpEndpoint } = await import('@geekmidas/events/sns');\n        const { SnsPushSubscriberAdaptor } = await import('@geekmidas/constructs/subscribers');\n        const address = snsUrl.parse(connectionString);\n        const route = SUBSCRIBER_ROUTE(id);\n        const adaptor = new SnsPushSubscriberAdaptor(envParser, subscriber, {\n          topicArn: address.topicArn,\n          // An emulator signs nothing. Decided by the address this server was\n          // configured with, never by anything a request says about itself.\n          verify: !address.endpoint,\n          ...(address.endpoint ? { emulatorEndpoint: address.endpoint } : {}),\n        });\n\n        app.post(route, async (c: any) => {\n          const body = JSON.parse(await c.req.text());\n          const response = await adaptor.handle(body);\n          return c.json(response.body, response.status);\n        });\n\n        afterListening.push(async (port) => {\n          const base =\n            process.env.GKM_SUBSCRIBER_PUSH_URL ??\n            (address.endpoint ? \\`http://host.docker.internal:\\${port}\\` : undefined);\n          if (!base) {\n            logger.error(\n              { subscriber: id },\n              'Set GKM_SUBSCRIBER_PUSH_URL to the public URL of this worker, which SNS pushes to',\n            );\n            return;\n          }\n          const connection = await SNSConnection.fromConnectionString(connectionString);\n          await subscribeHttpEndpoint(connection, {\n            endpoint: new URL(route, base).toString(),\n            events,\n          });\n          logger.info({ subscriber: id, events }, 'Subscriber subscribed for push');\n        });\n        continue;\n      }\n`\n\t\t: `      if (connectionString.startsWith('sns:')) {\n        // Built for a broker other than SNS, so this entry registered no SNS\n        // driver and has no push route to offer.\n        logger.error(\n          { subscriber: id, connectionKey },\n          'This build has no SNS driver: it was built for a target whose broker is not SNS',\n        );\n        failed.push(id);\n        continue;\n      }\n`\n}\n\n      let connection = connections.get(connectionString);\n      if (!connection) {\n        connection = await EventConnectionFactory.fromConnectionString(connectionString);\n        connections.set(connectionString, connection);\n      }\n      // Named, so a broker with one address for everything (pg-boss) gives\n      // this subscriber a queue of its own: fan-out, not competition.\n      const eventSubscriber = await Subscriber.fromConnection(connection, {\n        topic,\n        subscription: id,\n      });\n      const services = subscriber.services.length > 0\n        ? await serviceDiscovery.register(subscriber.services)\n        : {};\n      // The subscriber's database — the worker's, or its own — as \\`db\\`. A\n      // pushed subscriber gets it from the adaptor above instead.\n      const db = subscriber.databaseService\n        ? (await serviceDiscovery.register([subscriber.databaseService]))[\n            subscriber.databaseService.serviceName\n          ]\n        : undefined;\n\n      await eventSubscriber.subscribe(events, async (event) => {\n        try {\n          await subscriber.handler({\n            events: [event],\n            services: services as any,\n            logger: subscriber.logger,\n            db,\n          } as any);\n        } catch (error) {\n          logger.error({ err: error, event, subscriber: id }, 'Failed to process event');\n          // Rethrown so the transport keeps the event for a retry — as a queue\n          // consumer's failure does, and as a pushed subscriber's 500 does.\n          throw error;\n        }\n      });\n      logger.info({ subscriber: id, events }, 'Subscriber started polling');\n    } catch (error) {\n      // The message too: a missing module's code alone does not say which.\n      logger.error(\n        { err: error, subscriber: id },\n        'Failed to set up subscriber',\n      );\n      failed.push(id);\n    }\n  }\n\n  return async (port) => {\n    if (afterListening.length === 0) return;\n    await listening(port);\n    for (const subscribe of afterListening) {\n      await subscribe(port).catch((error) => {\n        logger.error({ err: error }, 'Failed to subscribe for push');\n      });\n    }\n  };\n}\n\n/** The subscribers that could not start, and the connections that did. */\nexport function subscribersStatus(): { failed: string[]; connections: EventConnection[] } {\n  return { failed: [...failed], connections: [...connections.values()] };\n}\n\n/**\n * Stop polling, let the events in flight finish, and close each broker\n * connection — pg-boss's graceful stop does all three. The caller bounds it.\n */\nexport async function stopSubscribers(): Promise<void> {\n  const open = [...connections.values()];\n  connections.clear();\n  await Promise.all(open.map((connection) => connection.close()));\n}\n`;\n\n\t\tawait writeFile(subscribersPath, content);\n\t\treturn subscribersPath;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,MAAa,gBAAoD;CAEhE,KAAK;CAGL,QAAQ;AACT;;;;;;;;;;AAWA,MAAa,iBAAsD;CAClE,KAAK;CACL,QAAQ;AACT;;AAGA,MAAa,kBAAwD;CACpE,KAAK;CACL,QAAQ;AACT;;;;;;;;;;;;AC5FA,MAAa,oBAAoB;;AAejC,MAAM,OAAO,OAAO,IAAI,4BAA4B;;;;;;;;AAgBpD,eAAsB,UACrB,MACA,UACqC;CACrC,MAAM,QAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EACzD,IAAI,aAAa,SAAS,gBAAgB;EAE1C,MAAM,OAAO,MAAM,SAAS,KAAK,MAAM,iBAAiB,GAAG,EAAE;EAI7D,MAAM,SAAQ,MAHQ,OAAO,cAAc,IAAI,CAAC,CAAC,MAAA,CAG5B;EACrB,IAAI,CAAC,aAAa,KAAK,GAAG,MAAM,IAAI,SAAS,IAAI;EAEjD,MAAM,MAAM;GACX;GACA,GAAI,MAAM,SAAS,UAChB;IAAE,OAAO,MAAM;IAAO,MAAM,MAAM;GAAK,IACvC,CAAC;GACJ,aAAa,KAAK,UAAU,MAAM,WAAW;EAC9C;CACD;CAEA,OAAO;AACR;;AAGA,eAAe,SAAS,QAAgB,IAA6B;CACpE,MAAM,OAAO,KAAK,QAAQ,UAAU,EAAE,CAAC;CACvC,KAAK,MAAM,aAAa;EAAC;EAAO;EAAQ;EAAO;CAAM,GAAG;EACvD,MAAM,OAAO,GAAG,OAAO;EAKvB,IAAI,MAJiB,OAAO,IAAI,CAAC,CAAC,WAC3B,YACA,KACP,GACY,OAAO;CACpB;CAEA,MAAM,IAAI,OAAO,IAAI,GAAG,KAAK,IAAI;AAClC;AAEA,SAAS,aAAa,OAAqC;CAC1D,OACC,OAAO,UAAU,YACjB,UAAU,QACT,MAA+B,UAAU;AAE5C;;AAGA,IAAa,SAAb,cAA4B,MAAM;CAEvB;CACA;CAFV,YACC,IACA,MACC;EACD,MACC,IAAI,GAAG,8GAC2C,KAAK,0FAGxD;EARS,KAAA,KAAA;EACA,KAAA,OAAA;EAQT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,WAAb,cAA8B,MAAM;CACd;CAArB,YAAY,MAAuB;EAClC,MACC,GAAG,KAAK,0JAGT;EALoB,KAAA,OAAA;EAMpB,KAAK,OAAO;CACb;AACD;;;AC/GA,IAAa,sBAAb,cAAyC,mBAGvC;CACD,YACC,OACyD;EACzD,OAAO,WAAW,aAAa,KAAK;CACrC;CAEA,MAAM,MACL,SACA,YAGA,WACA,SAC4B;EAC5B,MAAM,SAAS,SAAS,UAAU;EAClC,MAAM,SAAS;EACf,MAAM,kBAAoC,CAAC;EAE3C,IAAI,WAAW,UAAU;GAExB,MAAM,KAAK,8BACV,WACA,YACA,QAAQ,gBAAgB,SAAS,KAAK,KAAK,KAC5C;GAEA,OAAO,IACN,0CAA0C,WAAW,OAAO,4BAC7D;GAGA,OAAO;EACR;EAEA,IAAI,WAAW,WAAW,GACzB,OAAO;EAIR,MAAM,iBAAiB,KAAK,WAAW,aAAa;EACpD,MAAM,MAAM,gBAAgB,EAAE,WAAW,KAAK,CAAC;EAG/C,KAAK,MAAM,EAAE,KAAK,WAAW,UAAU,YAAY;GAClD,MAAM,cAAc,MAAM,KAAK,0BAC9B,gBACA,KAAK,UACL,KACA,WACA,SACA,UAAU,KACX;GAEA,gBAAgB,KAAK;IACpB,MAAM;IACN,SAAS,SAAS,SAAS,QAAQ,QAAQ,IAAI,GAAG,WAAW,CAAC,CAAC,QAC9D,SACA,UACD;IACA,kBAAkB,UAAU,oBAAoB,CAAC;IAGjD,GAAI,UAAU,YACX;KAAE,WAAW;KAAkB,OAAO,UAAU;IAAU,IAC1D,CAAC;IACJ,SAAS,UAAU;IACnB,YAAY,UAAU;IACtB,aAAa,MAAM,UAAU,eAAe,EAC3C,cAAc,QAAQ,aACvB,CAAC;IACD,cAAc,UAAU;GACzB,CAAC;GAED,OAAO,IAAI,iCAAiC,KAAK;EAClD;EAEA,OAAO;CACR;CAEA,MAAc,0BACb,WACA,YACA,YACA,aACA,SAEA,OACkB;EAClB,MAAM,kBAAkB,GAAG,WAAW;EACtC,MAAM,cAAc,KAAK,WAAW,eAAe;EAGnD,MAAM,aADe,SAAS,QAAQ,WAAW,GAAG,UACtB,CAAC,CAAC,QAAQ,SAAS,KAAK;EAKtD,MAAM,UAAU,WAAW,SAAS,QAAQ,WAAW,GAAG,KAAK;EAE/D,MAAM,UAAU;WACP,WAAW,WAAW,WAAW;EAC1C,QAAQ,QAAQ;EAChB,QAAQ,gBAAgB,WAAW,GAAG;EACtC,QAAQ,SAAS;EACjB,QAAQ,gBAAgB,QAAQ,6DAA6D,QAAQ,eAAe,MAAM,MAAM,GAAG;qDAChF,WAAW;;;;EAK9D,MAAM,UAAU,aAAa,OAAO;EACpC,OAAO;CACR;CAEA,MAAc,8BACb,WACA,aAQA,MACkB;EAClB,MAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;EAC1C,MAAM,kBAAkB,KAAK,WAAW,gBAAgB;EAKxD,IAAI,YAAY,WAAW,GAAG;GAC7B,MAAM,UACL,iBACA;;;;;;;;;;;;;;;;;;;CAoBD;GACA,OAAO;EACR;EAEA,MAAM,gCAAgB,IAAI,IAAsB;EAChD,KAAK,MAAM,EAAE,MAAM,SAAS,aAAa;GACxC,MAAM,aAAa,SAClB,QAAQ,eAAe,GACvB,KAAK,QACN,CAAC,CAAC,QAAQ,SAAS,KAAK;GACxB,cAAc,IAAI,YAAY,CAC7B,GAAI,cAAc,IAAI,UAAU,KAAK,CAAC,GACtC,GACD,CAAC;EACF;EA0BA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;EAzBA,MAAM,KAAK,cAAc,QAAQ,CAAC,CAAC,CACjD,KACC,CAAC,YAAY,aACb,YAAY,QAAQ,KAAK,IAAI,EAAE,WAAW,WAAW,GACvD,CAAC,CACA,KAAK,IA4CD,EAAE;;;EAxCQ,YACd,KAAK,EAAE,KAAK,gBAAgB;GAC5B,MAAM,gBAAgB,UAAU,YAC7B,WACA,YAAY,UAAU,SAAS,GAC/B,2BACD,IACC,KAAA;GACH,OAAO,YAAY,IAAI,iBAAiB,IAAI,WAC3C,UAAU,YAAY,IAAI,UAAU,UAAU,KAAK,YACnD,mBACA,gBAAgB,IAAI,cAAc,KAAK,YACvC;EACF,CAAC,CAAC,CACD,KAAK,IA6BD,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4DT,OACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwCA;;;;;;;;;;EAWH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6EC,MAAM,UAAU,iBAAiB,OAAO;EACxC,OAAO;CACR;AACD"}

package/dist/{add-XTLU19_E.mjs → add-BiPlBUq3.mjs}

@@ -1,10 +1,10 @@
 import { g as url, o as email } from "./schemas-D-xeKJDD.mjs";
-import { r as discover } from "./discover-Buwf1z4P.mjs";
+import { r as discover } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { k as assertDeployedStage } from "./workspace-C7NqCsQF.mjs";
 import { loadWorkspaceSettings } from "./config.mjs";
-import { G as constructGlobs, It as secretsStoreFor, R as requiredStageKeys, Zt as initStageSecrets, st as appEnvKeys } from "./state-BJFherj1.mjs";
-import { i as issueLine, o as loadCredentialSchemas } from "./credentialSchemas-BmYxnEz_.mjs";
+import { $ as constructGlobs, B as requiredStageKeys, Kt as secretsStoreFor, ht as appEnvKeys, sn as initStageSecrets } from "./state-DtS2HEfi.mjs";
+import { i as issueLine, o as loadCredentialSchemas } from "./credentialSchemas-BJqRJNK4.mjs";
 import { provideKey } from "@geekmidas/manifest";
 import prompts from "prompts";
 import { build, parse } from "@geekmidas/storage/s3-url";
@@ -563,4 +563,4 @@ async function askFields(ask, io, shape) {
 //#endregion
 export { secretsAddCommand };
 
-//# sourceMappingURL=add-XTLU19_E.mjs.map
+//# sourceMappingURL=add-BiPlBUq3.mjs.map