@cyc-seattle/platform 0.7.0 → 1.0.0

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { clusterProvider, type ClusterProviderArgs } from "./kubernetes";
-export { getPlatformOutputs, parsePlatformOutputs, platformOutputsSchema, readPlatformOutputs, stateBucket, type PlatformOutputs, type PlatformOutputsArgs, } from "./outputs";
-export { ScheduledJob, type ScheduledJobArgs } from "./scheduled-job";
-export { enableService } from "./services";
-export { WebService, type WebServiceArgs } from "./web-service";
-export { Workload, type PodArgs, type WorkloadArgs, type WorkloadVolume } from "./workload";
+export { clusterProvider, type ClusterProviderArgs } from "./kubernetes.ts";
+export { getPlatformOutputs, parsePlatformOutputs, platformOutputsSchema, readPlatformOutputs, stateBucket, type PlatformOutputs, type PlatformOutputsArgs, } from "./outputs.ts";
+export { ScheduledJob, type ScheduledJobArgs } from "./scheduled-job.ts";
+export { enableService } from "./services.ts";
+export { WebService, type WebServiceArgs } from "./web-service.ts";
+export { Workload, type PodArgs, type WorkloadArgs, type WorkloadVolume } from "./workload.ts";

package/dist/index.js

@@ -1,19 +1,6 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Workload = exports.WebService = exports.enableService = exports.ScheduledJob = exports.stateBucket = exports.readPlatformOutputs = exports.platformOutputsSchema = exports.parsePlatformOutputs = exports.getPlatformOutputs = exports.clusterProvider = void 0;
-var kubernetes_1 = require("./kubernetes");
-Object.defineProperty(exports, "clusterProvider", { enumerable: true, get: function () { return kubernetes_1.clusterProvider; } });
-var outputs_1 = require("./outputs");
-Object.defineProperty(exports, "getPlatformOutputs", { enumerable: true, get: function () { return outputs_1.getPlatformOutputs; } });
-Object.defineProperty(exports, "parsePlatformOutputs", { enumerable: true, get: function () { return outputs_1.parsePlatformOutputs; } });
-Object.defineProperty(exports, "platformOutputsSchema", { enumerable: true, get: function () { return outputs_1.platformOutputsSchema; } });
-Object.defineProperty(exports, "readPlatformOutputs", { enumerable: true, get: function () { return outputs_1.readPlatformOutputs; } });
-Object.defineProperty(exports, "stateBucket", { enumerable: true, get: function () { return outputs_1.stateBucket; } });
-var scheduled_job_1 = require("./scheduled-job");
-Object.defineProperty(exports, "ScheduledJob", { enumerable: true, get: function () { return scheduled_job_1.ScheduledJob; } });
-var services_1 = require("./services");
-Object.defineProperty(exports, "enableService", { enumerable: true, get: function () { return services_1.enableService; } });
-var web_service_1 = require("./web-service");
-Object.defineProperty(exports, "WebService", { enumerable: true, get: function () { return web_service_1.WebService; } });
-var workload_1 = require("./workload");
-Object.defineProperty(exports, "Workload", { enumerable: true, get: function () { return workload_1.Workload; } });
+export { clusterProvider } from "./kubernetes.js";
+export { getPlatformOutputs, parsePlatformOutputs, platformOutputsSchema, readPlatformOutputs, stateBucket, } from "./outputs.js";
+export { ScheduledJob } from "./scheduled-job.js";
+export { enableService } from "./services.js";
+export { WebService } from "./web-service.js";
+export { Workload } from "./workload.js";

package/dist/kubernetes.d.ts

@@ -1,6 +1,6 @@
 import * as k8s from "@pulumi/kubernetes";
 import * as pulumi from "@pulumi/pulumi";
-import type { PlatformOutputs } from "./outputs";
+import type { PlatformOutputs } from "./outputs.ts";
 export interface ClusterProviderArgs {
     /**
      * Keeps a kubeconfig that is unknown or changes, such as during a cluster update, from replacing

package/dist/kubernetes.js

@@ -1,48 +1,12 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.clusterProvider = clusterProvider;
-const k8s = __importStar(require("@pulumi/kubernetes"));
-const pulumi = __importStar(require("@pulumi/pulumi"));
+import * as k8s from "@pulumi/kubernetes";
+import * as pulumi from "@pulumi/pulumi";
 /**
  * A Kubernetes provider for the environment's cluster. Its kubeconfig runs gke-gcloud-auth-plugin
  * with Application Default Credentials, so it is the same on every run, unlike one that embeds an
  * access token. The plugin must be on PATH: `mise run install` adds it. The cluster stack passes
  * only the endpoint, because it writes the rest.
  */
-function clusterProvider(platform, name = "cluster", opts, args = {}) {
+export function clusterProvider(platform, name = "cluster", opts, args = {}) {
     // The DNS-based endpoint serves a publicly trusted certificate, so the kubeconfig needs no CA.
     const kubeconfig = pulumi.output(platform).clusterEndpoint.apply((endpoint) => JSON.stringify({
         apiVersion: "v1",

package/dist/outputs.js

@@ -1,71 +1,31 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.outputsObject = exports.platformOutputsSchema = void 0;
-exports.stateBucket = stateBucket;
-exports.parsePlatformOutputs = parsePlatformOutputs;
-exports.readPlatformOutputs = readPlatformOutputs;
-exports.getPlatformOutputs = getPlatformOutputs;
-const gcp = __importStar(require("@pulumi/gcp"));
-const pulumi = __importStar(require("@pulumi/pulumi"));
-const zod_1 = require("zod");
+import * as gcp from "@pulumi/gcp";
+import * as pulumi from "@pulumi/pulumi";
+import { z } from "zod";
 // The cluster stack writes this object to each environment's state bucket, because a StackReference
 // can't cross from a dev stack into prod's backend (cyc-seattle/isthmia#215).
-exports.platformOutputsSchema = zod_1.z.object({
-    project: zod_1.z.string().min(1),
-    projectNumber: zod_1.z.string().regex(/^\d+$/),
-    region: zod_1.z.string().min(1),
-    cluster: zod_1.z.string().min(1),
-    clusterEndpoint: zod_1.z.string().min(1),
-    namespace: zod_1.z.string().min(1),
-    gateway: zod_1.z.object({ name: zod_1.z.string().min(1), namespace: zod_1.z.string().min(1) }),
-    domain: zod_1.z.string().min(1),
-    sqlConnectionName: zod_1.z.string().min(1),
+export const platformOutputsSchema = z.object({
+    project: z.string().min(1),
+    projectNumber: z.string().regex(/^\d+$/),
+    region: z.string().min(1),
+    cluster: z.string().min(1),
+    clusterEndpoint: z.string().min(1),
+    namespace: z.string().min(1),
+    gateway: z.object({ name: z.string().min(1), namespace: z.string().min(1) }),
+    domain: z.string().min(1),
+    sqlConnectionName: z.string().min(1),
     /** The environment's Cloud SQL private IP, which pods reach directly. */
-    sqlHost: zod_1.z.string().min(1),
+    sqlHost: z.string().min(1),
     /** The shared Gateway's IPv4 address, for an app's own DNS records. */
-    gatewayAddress: zod_1.z.string().min(1),
-    registry: zod_1.z.string().min(1),
+    gatewayAddress: z.string().min(1),
+    registry: z.string().min(1),
 });
-exports.outputsObject = "platform/outputs.json";
+export const outputsObject = "platform/outputs.json";
 /** The state bucket of an environment, as `stacks/bootstrap/state.ts` names it. */
-function stateBucket(project, environment) {
+export function stateBucket(project, environment) {
     return `${project}-pulumi-${environment}`;
 }
 /** Parses and validates the outputs file's text. `source` names the file in error messages. */
-function parsePlatformOutputs(text, source) {
+export function parsePlatformOutputs(text, source) {
     let json;
     try {
         json = JSON.parse(text);
@@ -73,20 +33,20 @@ function parsePlatformOutputs(text, source) {
     catch (e) {
         throw new Error(`${source} is not valid JSON: ${e.message}`);
     }
-    const result = exports.platformOutputsSchema.safeParse(json);
+    const result = platformOutputsSchema.safeParse(json);
     if (!result.success) {
-        throw new Error(`${source} doesn't hold the platform outputs:\n${zod_1.z.prettifyError(result.error)}`);
+        throw new Error(`${source} doesn't hold the platform outputs:\n${z.prettifyError(result.error)}`);
     }
     return result.data;
 }
 /** Reads this environment's platform values from its state bucket. Most programs want `getPlatformOutputs`. */
-async function readPlatformOutputs(args = {}) {
+export async function readPlatformOutputs(args = {}) {
     const project = args.project ?? new pulumi.Config("gcp").require("project");
     const bucket = stateBucket(project, args.environment ?? pulumi.getStack());
-    const source = `gs://${bucket}/${exports.outputsObject}`;
+    const source = `gs://${bucket}/${outputsObject}`;
     let content;
     try {
-        ({ content } = await gcp.storage.getBucketObjectContent({ bucket, name: exports.outputsObject }));
+        ({ content } = await gcp.storage.getBucketObjectContent({ bucket, name: outputsObject }));
     }
     catch (e) {
         throw new Error(`Can't read ${source}. The cluster stack writes it.\n${e.message}`);
@@ -97,6 +57,6 @@ async function readPlatformOutputs(args = {}) {
     return parsePlatformOutputs(content, source);
 }
 /** Reads this environment's platform values from its state bucket. */
-function getPlatformOutputs(args = {}) {
+export function getPlatformOutputs(args = {}) {
     return pulumi.output(readPlatformOutputs(args));
 }

package/dist/scheduled-job.d.ts

@@ -1,5 +1,5 @@
 import * as pulumi from "@pulumi/pulumi";
-import { type PodArgs } from "./workload";
+import { type PodArgs } from "./workload.ts";
 export interface ScheduledJobArgs extends PodArgs {
     /** A cron schedule, such as `0 * * * *`. */
     schedule: string;

package/dist/scheduled-job.js

@@ -1,57 +1,21 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ScheduledJob = void 0;
-const k8s = __importStar(require("@pulumi/kubernetes"));
-const pulumi = __importStar(require("@pulumi/pulumi"));
-const workload_1 = require("./workload");
+import * as k8s from "@pulumi/kubernetes";
+import * as pulumi from "@pulumi/pulumi";
+import { checkRequests, podSpec, serviceAccount, workloadMember } from "./workload.js";
 /**
  * A CronJob with the platform's secure defaults, and a Kubernetes ServiceAccount, both named `name`.
  * A run never overlaps the one before it. Its pods get no IAM; grant roles to `member`.
  */
-class ScheduledJob extends pulumi.ComponentResource {
+export class ScheduledJob extends pulumi.ComponentResource {
     /** The pods' Workload Identity principal, for IAM grants. */
     member;
     serviceAccountName;
     constructor(name, args, opts) {
         super("cyc-seattle:platform:ScheduledJob", name, {}, opts);
-        (0, workload_1.checkRequests)("ScheduledJob", name, args.requests);
+        checkRequests("ScheduledJob", name, args.requests);
         const platform = pulumi.output(args.platform);
         const labels = { "app.kubernetes.io/name": name };
         const child = { parent: this, provider: args.provider };
-        const account = (0, workload_1.serviceAccount)(name, args, child);
+        const account = serviceAccount(name, args, child);
         new k8s.batch.v1.CronJob(name, {
             metadata: { name, namespace: platform.namespace, labels },
             spec: {
@@ -65,7 +29,7 @@ class ScheduledJob extends pulumi.ComponentResource {
                         backoffLimit: args.backoffLimit ?? 0,
                         template: {
                             metadata: { labels },
-                            spec: (0, workload_1.podSpec)(name, args, account.metadata.name).apply((spec) => ({
+                            spec: podSpec(name, args, account.metadata.name).apply((spec) => ({
                                 ...spec,
                                 restartPolicy: "Never",
                             })),
@@ -75,8 +39,7 @@ class ScheduledJob extends pulumi.ComponentResource {
             },
         }, child);
         this.serviceAccountName = account.metadata.name;
-        this.member = (0, workload_1.workloadMember)(platform, this.serviceAccountName);
+        this.member = workloadMember(platform, this.serviceAccountName);
         this.registerOutputs({ member: this.member, serviceAccountName: this.serviceAccountName });
     }
 }
-exports.ScheduledJob = ScheduledJob;

package/dist/services.js

@@ -1,40 +1,4 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.enableService = enableService;
-const gcp = __importStar(require("@pulumi/gcp"));
+import * as gcp from "@pulumi/gcp";
 const enabled = new Map();
 /**
  * Enables a Google Cloud API, memoized so repeated calls for the same API return the same resource.
@@ -42,7 +6,7 @@ const enabled = new Map();
  * therefore be created only after it is enabled. Enable each API from the file that uses it, rather
  * than maintaining a central list.
  */
-function enableService(service) {
+export function enableService(service) {
     const existing = enabled.get(service);
     if (existing) {
         return existing;

package/dist/web-service.d.ts

@@ -1,6 +1,6 @@
 import * as k8s from "@pulumi/kubernetes";
 import * as pulumi from "@pulumi/pulumi";
-import { type WorkloadArgs } from "./workload";
+import { type WorkloadArgs } from "./workload.ts";
 type Probe = k8s.types.input.core.v1.Probe;
 export interface WebServiceArgs extends WorkloadArgs {
     /** The public hostname. It must be in the environment's domain. */

package/dist/web-service.js

@@ -1,45 +1,8 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.WebService = void 0;
-exports.checkHostname = checkHostname;
-const k8s = __importStar(require("@pulumi/kubernetes"));
-const pulumi = __importStar(require("@pulumi/pulumi"));
-const workload_1 = require("./workload");
+import * as k8s from "@pulumi/kubernetes";
+import * as pulumi from "@pulumi/pulumi";
+import { checkRequests, deployment, workloadMember } from "./workload.js";
 /** Returns `hostname` if it is the environment's domain or a name under it, and throws otherwise. */
-function checkHostname(hostname, domain) {
+export function checkHostname(hostname, domain) {
     const host = hostname.toLowerCase();
     const base = domain.toLowerCase();
     if (host !== base && !host.endsWith(`.${base}`)) {
@@ -52,7 +15,7 @@ function checkHostname(hostname, domain) {
  * Kubernetes ServiceAccount, plus an HTTPRoute and a HealthCheckPolicy. Its pods get no IAM; grant
  * roles to `member`.
  */
-class WebService extends pulumi.ComponentResource {
+export class WebService extends pulumi.ComponentResource {
     /** The pods' Workload Identity principal, for IAM grants. */
     member;
     serviceAccountName;
@@ -61,7 +24,7 @@ class WebService extends pulumi.ComponentResource {
     url;
     constructor(name, args, opts) {
         super("cyc-seattle:platform:WebService", name, {}, opts);
-        (0, workload_1.checkRequests)("WebService", name, args.requests);
+        checkRequests("WebService", name, args.requests);
         if (!args.readinessProbe?.httpGet) {
             throw new Error(`WebService "${name}" needs an HTTP readiness probe.`);
         }
@@ -70,7 +33,7 @@ class WebService extends pulumi.ComponentResource {
         const hostname = platform.domain.apply((domain) => checkHostname(args.hostname, domain));
         const metadata = { name, namespace: platform.namespace, labels: { "app.kubernetes.io/name": name } };
         const child = { parent: this, provider: args.provider };
-        const { serviceAccount, service } = (0, workload_1.deployment)(this, name, args, args.port);
+        const { serviceAccount, service } = deployment(this, name, args, args.port);
         new k8s.apiextensions.CustomResource(name, {
             apiVersion: "gateway.networking.k8s.io/v1",
             kind: "HTTPRoute",
@@ -100,7 +63,7 @@ class WebService extends pulumi.ComponentResource {
             },
         }, child);
         this.serviceAccountName = serviceAccount.metadata.name;
-        this.member = (0, workload_1.workloadMember)(platform, this.serviceAccountName);
+        this.member = workloadMember(platform, this.serviceAccountName);
         this.host = name;
         this.url = pulumi.interpolate `https://${hostname}/`;
         this.registerOutputs({
@@ -111,4 +74,3 @@ class WebService extends pulumi.ComponentResource {
         });
     }
 }
-exports.WebService = WebService;

package/dist/workload.d.ts

@@ -1,6 +1,6 @@
 import * as k8s from "@pulumi/kubernetes";
 import * as pulumi from "@pulumi/pulumi";
-import type { PlatformOutputs } from "./outputs";
+import type { PlatformOutputs } from "./outputs.ts";
 type Probe = k8s.types.input.core.v1.Probe;
 type EnvVar = k8s.types.input.core.v1.EnvVar;
 type EnvFromSource = k8s.types.input.core.v1.EnvFromSource;

package/dist/workload.js

@@ -1,58 +1,17 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Workload = void 0;
-exports.workloadMember = workloadMember;
-exports.checkRequests = checkRequests;
-exports.serviceAccount = serviceAccount;
-exports.podSpec = podSpec;
-exports.deployment = deployment;
-const k8s = __importStar(require("@pulumi/kubernetes"));
-const pulumi = __importStar(require("@pulumi/pulumi"));
+import * as k8s from "@pulumi/kubernetes";
+import * as pulumi from "@pulumi/pulumi";
 /** The pods' Workload Identity principal, for IAM grants. */
-function workloadMember(platform, serviceAccountName) {
+export function workloadMember(platform, serviceAccountName) {
     return pulumi.interpolate `principal://iam.googleapis.com/projects/${platform.projectNumber}/locations/global/workloadIdentityPools/${platform.project}.svc.id.goog/subject/ns/${platform.namespace}/sa/${serviceAccountName}`;
 }
-function checkRequests(kind, name, requests) {
+export function checkRequests(kind, name, requests) {
     // The types already require them, but a JavaScript caller or a cast can skip them.
     if (!requests?.cpu || !requests?.memory) {
         throw new Error(`${kind} "${name}" needs CPU and memory requests.`);
     }
 }
 /** A ServiceAccount named `name` that mounts no token. */
-function serviceAccount(name, args, opts) {
+export function serviceAccount(name, args, opts) {
     const platform = pulumi.output(args.platform);
     return new k8s.core.v1.ServiceAccount(name, {
         metadata: {
@@ -65,7 +24,7 @@ function serviceAccount(name, args, opts) {
     }, opts);
 }
 /** A pod spec with the platform's secure defaults: non-root, read-only, no token, and Spot in dev only. */
-function podSpec(name, args, serviceAccountName, container = {}) {
+export function podSpec(name, args, serviceAccountName, container = {}) {
     const volumes = args.volumes ?? [];
     // The namespace is the environment's name.
     return pulumi.output(args.platform).namespace.apply((namespace) => ({
@@ -118,7 +77,7 @@ function podSpec(name, args, serviceAccountName, container = {}) {
  * The Deployment, ServiceAccount, and Service of a `Workload` or a `WebService`, as children of
  * `parent`. `http` is a `WebService`'s port, which its Service exposes as port 80.
  */
-function deployment(parent, name, args, http) {
+export function deployment(parent, name, args, http) {
     const platform = pulumi.output(args.platform);
     const labels = { "app.kubernetes.io/name": name };
     const metadata = { name, namespace: platform.namespace, labels };
@@ -185,7 +144,7 @@ function deployment(parent, name, args, http) {
  * A long-running process with no route: a Deployment, a Kubernetes ServiceAccount, and, when it has
  * ports, a ClusterIP Service, all named `name`. Its pods get no IAM; grant roles to `member`.
  */
-class Workload extends pulumi.ComponentResource {
+export class Workload extends pulumi.ComponentResource {
     /** The pods' Workload Identity principal, for IAM grants. */
     member;
     serviceAccountName;
@@ -201,4 +160,3 @@ class Workload extends pulumi.ComponentResource {
         this.registerOutputs({ member: this.member, serviceAccountName: this.serviceAccountName, host: this.host });
     }
 }
-exports.Workload = Workload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyc-seattle/platform",
-  "version": "0.7.0",
+  "version": "1.0.0",
   "description": "Pulumi components for CYC's shared Google Cloud platform: WebService, the platform outputs reader, and the stacks that build the platform",
   "author": "CYC Community Sailing Center",
   "license": "Apache-2.0",
@@ -16,9 +16,10 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=22.18"
   },
   "packageManager": "pnpm@10.34.7",
+  "type": "module",
   "prettier": "@cyc-seattle/ts-config/prettier",
   "exports": {
     ".": {