@geekmidas/cloud 1.0.1 → 1.1.1

package/README.md

@@ -1 +1,126 @@
 # @geekmidas/cloud
+
+SST (ion / Pulumi) integration for `@geekmidas` apps — opinionated, linkable
+constructs that map 1:1 to deployable units and **validate their environment
+before deploy**, plus the runtime helpers that resolve linked resources into
+environment variables.
+
+Two halves:
+
+- **`@geekmidas/cloud/sst`** — the **infra-time** constructs you instantiate in
+  `sst.config.ts` (`App`, `Stack`, `Function`, `Api`, `Cron`).
+- **`@geekmidas/cloud` / `@geekmidas/cloud/utils`** — the **runtime** helpers
+  (`buildResourceEnv`, `ResourceType`) that turn SST `Resource` links into flat
+  environment variables inside a Lambda.
+
+> Design notes and rationale live in [`docs/sst-constructs.md`](./docs/sst-constructs.md)
+> (constructs) and [`docs/sst-testing.md`](./docs/sst-testing.md) (testing).
+
+## Install
+
+```bash
+pnpm add @geekmidas/cloud
+```
+
+`./sst` targets **SST v4** (peer dependency `sst@^4`) and is distributed as raw
+TypeScript source — it extends the ambient `sst.aws.*` globals that only exist
+after `sst install` in your app.
+
+## `@geekmidas/cloud/sst`
+
+```ts
+import { App, Api, Function, Cron } from '@geekmidas/cloud/sst';
+```
+
+### App & Stack
+
+`App` is a plain synchronous construct; resolve the hosted zone once at the call
+site and pass it in. `app.stack(name)` creates a `Stack` bound to the app.
+
+```ts
+const { zoneId } = await aws.route53.getZone({ name: 'example.com' });
+
+const app = new App({
+  name: 'my-app',
+  stage: 'prod',
+  domain: 'example.com',
+  hostedZoneId: zoneId,
+  region: 'us-east-1',
+});
+
+const stack = app.stack('api');
+stack.logicalPrefixedName('handler'); // "prod-my-app-api-handler"
+stack.select({ prod: 'live', default: 'dev' }); // by-stage value with a default
+```
+
+### Function
+
+Extends `sst.aws.FunctionArgs` (native options pass through), merges standard
+env defaults, defaults to `nodejs24.x` + JSON logging, and **validates `envVars`
+against `links` at synth time** — attaching only the links a function needs
+(least privilege).
+
+```ts
+const fn = new Function(stack, 'Processor', {
+  handler: 'src/processor.handler',
+  links: [db, topic],
+  envVars: ['DATABASE_URL'], // validated against links; fails synth if missing
+});
+```
+
+### Api
+
+Extends `sst.aws.ApiGatewayV2Args` (CORS/domain/etc. pass through). Routes are a
+typed table with per-route env validation, least-privilege linking, and a typed
+authorizer model.
+
+```ts
+const api = new Api(stack, 'Api', {
+  links: [db],
+  authorizers: {
+    jwt:      { issuer: 'https://issuer', audiences: ['aud'] }, // 'jwt' → JWT settings
+    employee: { handler: 'src/employee-auth.handler' },         // custom → Lambda authorizer
+  },
+  routes: [
+    { method: 'GET',  path: '/me',  handler: 'me.handler',  authorizer: 'jwt' },
+    { method: 'GET',  path: '/adm', handler: 'adm.handler', authorizer: 'employee' },
+    { method: 'POST', path: '/pub', handler: 'pub.handler' }, // public (none)
+  ],
+});
+```
+
+A route's `authorizer` is type-constrained to `'iam' | 'none'` plus the declared
+authorizer names — an undeclared name is a compile error, and `jwt` requires JWT
+settings while custom authorizers require a `handler`.
+
+### Cron
+
+Wraps `sst.aws.CronV2` (`sst.aws.Cron` is deprecated). `processor` is a
+`Function` (or anything with an `arn`); `schedule` is a typed `rate(…)` /
+`cron(…)` / `at(…)`.
+
+```ts
+const cron = new Cron(stack, 'Nightly', { processor: fn, schedule: 'rate(1 day)' });
+```
+
+### From a `gkm build` manifest
+
+`gkm build` emits a deployment manifest (types in `@geekmidas/manifest`). Each
+construct has a static `fromManifest` factory that maps it straight into infra:
+
+```ts
+import routes from './.gkm/routes-manifest.json';
+
+const api     = Api.fromManifest(stack, 'Api', routes, { links: [db], authorizers });
+const workers = Function.fromManifest(stack, functionsManifest, { links: [db] });
+const crons   = Cron.fromManifest(stack, cronsManifest, { links: [db] });
+```
+
+## `@geekmidas/cloud/utils` (runtime)
+
+```ts
+import { buildResourceEnv } from '@geekmidas/cloud';
+```
+
+`buildResourceEnv` turns a record of SST `Resource` links into flat environment
+variables at runtime, using the shared `ResourceType` vocabulary.

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "@geekmidas/cloud",
-  "version": "1.0.1",
+  "version": "1.1.1",
   "type": "module",
+  "files": [
+    "dist",
+    "src/sst"
+  ],
   "exports": {
     ".": {
       "import": {
@@ -22,7 +26,8 @@
         "types": "./dist/utils/index.d.cts",
         "default": "./dist/utils/index.cjs"
       }
-    }
+    },
+    "./sst": "./src/sst/index.ts"
   },
   "repository": {
     "type": "git",
@@ -33,14 +38,22 @@
     "access": "public"
   },
   "dependencies": {
-    "lodash.snakecase": "~4.1.1"
+    "lodash.snakecase": "~4.1.1",
+    "@geekmidas/envkit": "1.1.1",
+    "@geekmidas/manifest": "0.1.1"
   },
   "devDependencies": {
     "@types/lodash.get": "~4.4.9",
     "@types/lodash.set": "~4.3.9",
-    "@types/lodash.snakecase": "~4.1.9"
+    "@types/lodash.snakecase": "~4.1.9",
+    "@types/node": "~24.9.1",
+    "sst": "4.15.2"
   },
   "peerDependencies": {
-    "sst": "~3.17.23"
+    "sst": "^4.15.2"
+  },
+  "scripts": {
+    "sst:install": "sst install",
+    "ts:check:sst": "tsc --noEmit -p src/sst/tsconfig.json 2>&1 | grep -E 'src/sst/.*error TS' && exit 1 || exit 0"
   }
 }

package/src/sst/Api.ts

@@ -0,0 +1,309 @@
+import path from 'node:path';
+import { EnvValidationError } from '@geekmidas/envkit/sst';
+import {
+	flattenManifestField,
+	type ManifestField,
+	type RouteInfo,
+} from '@geekmidas/manifest';
+import type { Function } from './Function';
+import { type GkmLinkable, ResourceType } from './Linkable';
+import { LinkedEnvironment } from './LinkedEnvironment';
+import type { StackType } from './Stack';
+
+/**
+ * `Api` — wraps SST's `sst.aws.ApiGatewayV2` (HTTP API) with a typed route
+ * table and per-route environment validation that fails at synth time (before
+ * deploy) when a route requires variables its links cannot provide. Native
+ * `ApiGatewayV2Args` (CORS, domain, …) pass through untouched.
+ *
+ * NOTE: this module is distributed as raw TypeScript source. It extends the
+ * ambient `sst.aws.*` globals that only exist inside an `sst install`ed app, so
+ * it cannot be type-checked or built in this repo (see docs §2). It targets
+ * SST v4 (ion); the route/auth shape follows the v3 reference and should be
+ * verified against v4 in a consuming app.
+ */
+export class Api<
+		TAuthorizers extends Record<string, unknown> = {},
+		TStage extends string = string,
+		TDomain extends string = string,
+	>
+	extends sst.aws.ApiGatewayV2
+	implements GkmLinkable
+{
+	readonly _id!: string;
+
+	get _type() {
+		return ResourceType.ApiGatewayV2;
+	}
+
+	constructor(
+		stack: StackType<TStage, TDomain>,
+		id: string,
+		props: ApiProps<TAuthorizers>,
+	) {
+		const {
+			links = [],
+			routes,
+			root = process.cwd(),
+			vpc,
+			environment: apiEnvironment,
+			runtime: apiRuntime = 'nodejs24.x',
+			authorizers,
+			...apiArgs
+		} = props;
+
+		// Pass the consumer's native `ApiGatewayV2Args` straight through — CORS,
+		// domain, access logs, etc. are entirely the consumer's call.
+		super(id, apiArgs);
+
+		this._id = id;
+
+		// Register each declared authorizer and map its name to the created id.
+		// The reserved `jwt` entry is a JWT authorizer; any other name is a Lambda
+		// authorizer (enforced by the `ApiAuthorizers` type via the `handler`).
+		const authorizerIds = new Map<string, $util.Output<string>>();
+		for (const [name, config] of Object.entries(authorizers ?? {}) as [
+			string,
+			JwtAuthorizer | LambdaAuthorizer,
+		][]) {
+			const authorizer =
+				'handler' in config
+					? this.addAuthorizer({
+							name,
+							lambda: {
+								// Accept a handler path, function args, or one of our
+								// `Function` constructs (passed through as its `arn`).
+								function:
+									typeof config.handler === 'object' && 'arn' in config.handler
+										? config.handler.arn
+										: config.handler,
+								identitySources: config.identitySources,
+								payload: config.payload,
+							},
+						})
+					: this.addAuthorizer({
+							name,
+							jwt: {
+								issuer: config.issuer,
+								audiences: config.audiences,
+								identitySource: config.identitySource,
+							},
+						});
+			authorizerIds.set(name, authorizer.id);
+		}
+
+		const relativeRoot = path.relative(process.cwd(), root);
+
+		const environment = {
+			...LinkedEnvironment.createBaseEnvironment(stack),
+			...apiEnvironment,
+		};
+
+		// Same links + whitelist for every route, so build the linker once; the
+		// failing route is identified via the per-route error context below.
+		const linked = new LinkedEnvironment(links, {
+			whitelist: Object.keys(environment),
+		});
+
+		const failures: EnvValidationError[] = [];
+
+		for (const route of routes) {
+			const routeKey = `${route.method} ${route.path}`;
+			const names = route.environment ?? [];
+
+			const result = linked.validator.validate(names);
+			if (!result.valid) {
+				failures.push(
+					new EnvValidationError({
+						missing: result.invalidVars,
+						available: linked.validator.availableVars,
+						linkVars: linked.validator.linkVars,
+						suggestions: result.suggestions,
+						context: `${id} ${routeKey}`,
+					}),
+				);
+			}
+
+			const link = linked.resolveLink(names);
+
+			const auth = Api.buildRouteAuth(
+				route,
+				authorizers as
+					| Record<string, JwtAuthorizer | LambdaAuthorizer>
+					| undefined,
+				authorizerIds,
+			);
+
+			this.route(
+				routeKey,
+				{
+					handler: path.join(relativeRoot, route.handler),
+					vpc,
+					environment,
+					link,
+					runtime: route.runtime ?? apiRuntime,
+					nodejs: route.nodejs,
+					timeout: route.timeout,
+					memory: route.memory,
+				},
+				auth,
+			);
+		}
+
+		// Fail the whole synth if any route is misconfigured, with one actionable
+		// message per offending route.
+		if (failures.length) {
+			throw new Error(failures.map((f) => f.message).join('\n\n'));
+		}
+	}
+
+	/**
+	 * Build an `Api` from a `gkm build` manifest's `routes` field (flat or
+	 * partitioned): each `RouteInfo` becomes a route (env vars, authorizer,
+	 * timeout/memory mapped). Supply `authorizers` (JWT/Lambda settings),
+	 * `links`, and any native args via `props`.
+	 *
+	 * ```ts
+	 * import { manifest } from './.gkm/manifest/aws';
+	 * Api.fromManifest(stack, 'Api', manifest.routes, { links: [db] });
+	 * ```
+	 */
+	static fromManifest<
+		TAuthorizers extends Record<string, unknown> = {},
+		TStage extends string = string,
+		TDomain extends string = string,
+	>(
+		stack: StackType<TStage, TDomain>,
+		id: string,
+		routes: ManifestField<RouteInfo>,
+		props: Omit<ApiProps<TAuthorizers>, 'routes'> = {},
+	): Api<TAuthorizers, TStage, TDomain> {
+		const routeTable = flattenManifestField(routes).map(
+			(route): Route<AuthorizerName<TAuthorizers>> => ({
+				method: route.method as Route['method'],
+				path: route.path,
+				handler: route.handler,
+				environment: route.environment,
+				authorizer: route.authorizer as AuthorizerName<TAuthorizers>,
+				timeout: route.timeout ? `${route.timeout} seconds` : undefined,
+				memory: route.memorySize ? `${route.memorySize} MB` : undefined,
+			}),
+		);
+		return new Api(stack, id, {
+			...props,
+			routes: routeTable,
+		} as ApiProps<TAuthorizers>);
+	}
+
+	/** Resolves a route's `authorizer` name to the SST `auth` option. */
+	private static buildRouteAuth(
+		route: Route<string>,
+		authorizers: Record<string, JwtAuthorizer | LambdaAuthorizer> | undefined,
+		authorizerIds: Map<string, $util.Output<string>>,
+	) {
+		const name = route.authorizer;
+		if (!name || name === 'none') return undefined;
+		if (name === 'iam') return { auth: { iam: true } };
+
+		const authorizerId = authorizerIds.get(name);
+		if (!authorizerId) return undefined;
+
+		const config = authorizers?.[name];
+		if (config && 'handler' in config) {
+			return { auth: { lambda: authorizerId } };
+		}
+		const jwt = config as JwtAuthorizer | undefined;
+		return {
+			auth: {
+				jwt: {
+					authorizer: authorizerId,
+					scopes: route.scopes ?? jwt?.scopes,
+				},
+			},
+		};
+	}
+}
+
+/** JWT authorizer settings — `issuer` and `audiences` are required. */
+export interface JwtAuthorizer {
+	issuer: $util.Input<string>;
+	audiences: $util.Input<$util.Input<string>[]>;
+	identitySource?: $util.Input<string>;
+	/** Default OAuth scopes required by routes that use this authorizer. */
+	scopes?: string[];
+}
+
+/**
+ * Lambda (request) authorizer — requires a `handler`: a handler path, full
+ * function args, or one of our `Function` constructs.
+ */
+export interface LambdaAuthorizer {
+	handler: string | sst.aws.FunctionArgs | Function;
+	identitySources?: $util.Input<$util.Input<string>[]>;
+	payload?: '1.0' | '2.0';
+}
+
+/**
+ * Authorizer config map. The reserved `jwt` key must be {@link JwtAuthorizer}
+ * settings; every other named authorizer must be a {@link LambdaAuthorizer}
+ * (enforced via the required `handler`).
+ */
+export type ApiAuthorizers<T> = {
+	[K in keyof T]: K extends 'jwt' ? JwtAuthorizer : LambdaAuthorizer;
+};
+
+/** Valid `authorizer` values for a route: the built-ins plus declared names. */
+export type AuthorizerName<T> = 'iam' | 'none' | (keyof T & string);
+
+export interface Route<TAuthorizer extends string = 'iam' | 'none'> {
+	method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'ALL';
+	path: string;
+	/** Handler entrypoint, resolved relative to `root` (default `cwd`). */
+	handler: string;
+	/** Required env vars for this route; validated against `links`. */
+	environment?: readonly string[];
+	/**
+	 * Authorization for this route:
+	 * - `iam` — AWS SigV4 signed requests
+	 * - `none` (default) — public
+	 * - a declared authorizer name (`jwt`, or a custom Lambda authorizer)
+	 */
+	authorizer?: TAuthorizer;
+	/** OAuth scopes for a `jwt` route (overrides the authorizer's defaults). */
+	scopes?: string[];
+	nodejs?: { install?: string[]; externals?: string[] };
+	/** Lambda runtime for this route. Overrides the API default (`nodejs24.x`). */
+	runtime?: sst.aws.FunctionArgs['runtime'];
+	/** Lambda timeout for this route, e.g. `30 seconds`. */
+	timeout?: sst.aws.FunctionArgs['timeout'];
+	/** Lambda memory for this route, e.g. `1024 MB`. */
+	memory?: sst.aws.FunctionArgs['memory'];
+}
+
+/**
+ * `ApiProps` extends SST's native `sst.aws.ApiGatewayV2Args`, so every native
+ * option (`cors`, `domain`, `accessLog`, `transform`, …) passes straight
+ * through untouched. We only add the route table, authorizers, and the
+ * linking/validation inputs on top.
+ */
+export interface ApiProps<TAuthorizers extends Record<string, unknown> = {}>
+	extends sst.aws.ApiGatewayV2Args {
+	routes: Route<AuthorizerName<TAuthorizers>>[];
+	/**
+	 * Named authorizers. The reserved `jwt` key configures a JWT authorizer; any
+	 * other name configures a Lambda authorizer (requires a `handler`). Route
+	 * `authorizer` values are constrained to these names plus `iam`/`none`.
+	 */
+	authorizers?: ApiAuthorizers<TAuthorizers>;
+	/** Pool of linkable resources routes may draw on. */
+	links?: GkmLinkable[];
+	/** Base directory for resolving route `handler` paths. Defaults to `cwd`. */
+	root?: string;
+	/** Env vars applied to every route, merged over the API defaults. */
+	environment?: Record<string, string>;
+	/** VPC to place each route's Lambda in. */
+	vpc?: sst.aws.Vpc;
+	/** Default Lambda runtime for every route. Defaults to `nodejs24.x`; a route
+	 * may override it. */
+	runtime?: sst.aws.FunctionArgs['runtime'];
+}

package/src/sst/App.ts

@@ -0,0 +1,80 @@
+import { prefixedName } from './naming';
+import { Stack } from './Stack';
+
+/**
+ * A by-stage value map with a required `default` fallback — the argument to
+ * {@link App.select} / {@link Stack.select}. Keys are stages (`TStage`).
+ */
+export type StageValues<TStage extends string, T> = Partial<
+	Record<TStage, T>
+> & {
+	default: T;
+};
+
+export interface AppProps<TStage extends string, TDomain extends string> {
+	/** Application name; part of resource name prefixes. */
+	name: string;
+	/** Deployment stage, e.g. `dev` or `prod`. */
+	stage: TStage;
+	/** Root domain backed by a Route53 hosted zone. */
+	domain: TDomain;
+	/**
+	 * Pre-resolved Route53 hosted zone id for `domain`. Resolve it once at the
+	 * call site (`aws.route53.getZone`, or `getZoneOutput` for a lazy `Output`)
+	 * and pass it in — the constructor stays synchronous (see docs §4).
+	 */
+	hostedZoneId: $util.Output<string> | string;
+	/** AWS region. */
+	region: string;
+}
+
+/**
+ * Application-level context: identity, deployment target, and a pre-resolved
+ * hosted zone. A plain synchronous constructor — zone resolution is the caller's
+ * responsibility, so every construct stays uniform (`new X(...)`).
+ */
+export class App<
+	TStage extends string = string,
+	TDomain extends string = string,
+> {
+	readonly name: string;
+	readonly stage: TStage;
+	readonly domain: TDomain;
+	readonly region: string;
+	readonly hostedZoneId: $util.Output<string> | string;
+
+	constructor(props: AppProps<TStage, TDomain>) {
+		this.name = props.name;
+		this.stage = props.stage;
+		this.domain = props.domain;
+		this.region = props.region;
+		this.hostedZoneId = props.hostedZoneId;
+	}
+
+	/** Create a {@link Stack} bound to this app (sugar for `new Stack(app, name)`). */
+	stack(name: string): Stack<TStage, TDomain> {
+		return new Stack(this, name);
+	}
+
+	/**
+	 * Picks a value for the current stage from a by-stage map, falling back to
+	 * `default`. e.g. `app.select({ prod: 'live', staging: 'test', default: 'dev' })`.
+	 */
+	select<T>(values: StageValues<TStage, T>): T {
+		return values[this.stage] ?? values.default;
+	}
+
+	getSubdomain<TSub extends string>(subdomain: TSub) {
+		return `${subdomain}.${this.domain}` as const;
+	}
+
+	getURL<TSub extends string>(subdomain?: TSub) {
+		const prefix = subdomain ? (`${subdomain}.` as const) : '';
+		return `https://${prefix}${this.domain}` as const;
+	}
+
+	/** Kebab-cased, stage/app-name-prefixed physical resource name. */
+	logicalPrefixedName(id: string): string {
+		return prefixedName([this.stage, this.name], id);
+	}
+}

package/src/sst/Cron.ts

@@ -0,0 +1,113 @@
+import {
+	type CronInfo,
+	flattenManifestField,
+	type ManifestField,
+} from '@geekmidas/manifest';
+import { Function } from './Function';
+import type { GkmLinkable } from './Linkable';
+import type { StackType } from './Stack';
+
+export type CronExpressionValue = number | '*' | '?' | `${number}/${number}`;
+export type CronExpressionDay =
+	| '?'
+	| 'SUN'
+	| 'MON'
+	| 'TUE'
+	| 'WED'
+	| 'THU'
+	| 'FRI'
+	| 'SAT';
+
+/**
+ * A 6-field cron expression body: `minute hour day-of-month month day-of-week year`.
+ */
+export type CronString =
+	`${CronExpressionValue} ${CronExpressionValue} ${CronExpressionValue} ${CronExpressionValue} ${CronExpressionDay} ${CronExpressionValue}`;
+export type CronExpression = `cron(${CronString})`;
+export type CronRate = `rate(${number} ${
+	| 'minute'
+	| 'minutes'
+	| 'hour'
+	| 'hours'
+	| 'day'
+	| 'days'})`;
+/** One-time `at(…)` schedule (e.g. `at(2025-06-01T10:00:00)`). */
+export type CronAt = `at(${string})`;
+export type CronSchedule = CronExpression | CronRate | CronAt;
+
+/**
+ * `Cron` — wraps `sst.aws.CronV2` to invoke a `Function` on a schedule.
+ * (`sst.aws.Cron` is deprecated in SST v4 in favour of
+ * [`CronV2`](https://sst.dev/docs/component/aws/cron-v2).)
+ *
+ * `CronProps` extends the native `sst.aws.CronV2Args` (so `enabled`, `timezone`,
+ * `transform`, etc. pass through), but replaces `function`/`schedule` with the
+ * friendlier `processor` (a `Function`, or anything exposing `arn`) and a fully
+ * type-checked `schedule`. A cron is not a link target, so it is not `Linkable`
+ * and carries no `_type` (see docs §11.3).
+ *
+ * Source-only (extends ambient `sst.aws.*`); see docs §2.
+ */
+export class Cron<
+	TStage extends string = string,
+	TDomain extends string = string,
+> extends sst.aws.CronV2 {
+	constructor(
+		_stack: StackType<TStage, TDomain>,
+		name: string,
+		props: CronProps,
+	) {
+		const { processor, schedule, ...cronArgs } = props;
+		super(name, {
+			...cronArgs,
+			schedule,
+			function: processor.arn,
+		});
+	}
+
+	/**
+	 * Build one `Cron` per entry in a `gkm build` manifest's `crons` field (flat
+	 * or partitioned). Each cron's handler becomes a validated `Function` (the
+	 * cron's target), so pass `links` for that function's env validation;
+	 * remaining `props` are CronV2 args.
+	 *
+	 * ```ts
+	 * Cron.fromManifest(stack, manifest.crons, { links: [db] });
+	 * ```
+	 */
+	static fromManifest<
+		TStage extends string = string,
+		TDomain extends string = string,
+	>(
+		stack: StackType<TStage, TDomain>,
+		crons: ManifestField<CronInfo>,
+		props: Omit<CronProps, 'processor' | 'schedule'> & {
+			links?: GkmLinkable[];
+		} = {},
+	): Cron<TStage, TDomain>[] {
+		const { links, ...cronArgs } = props;
+		return flattenManifestField(crons).map((cron) => {
+			const processor = new Function(stack, `${cron.name}Function`, {
+				name: stack.logicalPrefixedName(cron.name),
+				handler: cron.handler,
+				envVars: cron.environment,
+				links,
+				timeout: cron.timeout ? `${cron.timeout} seconds` : undefined,
+				memory: cron.memorySize ? `${cron.memorySize} MB` : undefined,
+			});
+			return new Cron(stack, cron.name, {
+				...cronArgs,
+				processor,
+				schedule: cron.schedule as CronSchedule,
+			});
+		});
+	}
+}
+
+export interface CronProps
+	extends Omit<sst.aws.CronV2Args, 'function' | 'schedule'> {
+	/** The function invoked on schedule — a `Function` (or anything with an `arn`). */
+	processor: Function | { arn: $util.Input<string> };
+	/** Cron `rate(…)`, `cron(…)`, or `at(…)` schedule, fully type-checked. */
+	schedule: CronSchedule;
+}