@geekmidas/cloud 10.0.0-alpha.11 → 10.0.0-alpha.111

package/src/sst/aws/Function.ts

@@ -1,9 +1,4 @@
 import type { EnvValidator, ValidationResult } from '@geekmidas/envkit/sst';
-import {
-	type FunctionInfo,
-	flattenManifestField,
-	type ManifestField,
-} from '@geekmidas/manifest';
 import { type GkmLinkable, ResourceType } from '../Linkable';
 import { LinkedEnvironment } from '../LinkedEnvironment';
 import type { StackType } from '../Stack';
@@ -66,9 +61,10 @@ export class Function<
 		super(id, {
 			...fnArgs,
 			environment: mergedEnvironment,
-			// Linking is managed via the `links`/`envVars` flow, so this overrides
-			// any native `link` passed through `fnArgs`.
-			link: linked.resolveLink(envVars),
+			// Resolved from `links` when `envVars` names what it needs; otherwise
+			// the `link` it was given — the edges a manifest declared.
+			link:
+				envVars.length > 0 ? linked.resolveLink(envVars) : (fnArgs.link ?? []),
 			runtime: runtime ?? 'nodejs24.x',
 			logging: logging ?? { format: 'json' },
 		});
@@ -78,40 +74,15 @@ export class Function<
 		this.envVars = envVars;
 	}
 
+	/** Its address, for whatever declared an edge to it. */
+	provides(): Record<string, $util.Input<string>> {
+		return { url: this.url };
+	}
+
 	/** Re-runs validation and returns the result (does not throw). */
 	validate(): ValidationResult {
 		return this.validator.validate(this.envVars);
 	}
-
-	/**
-	 * Build one `Function` per entry in a `gkm build` manifest's `functions`
-	 * field (flat or partitioned). Shared `props` (e.g. `links`) apply to every
-	 * function.
-	 *
-	 * ```ts
-	 * Function.fromManifest(stack, manifest.functions, { links: [db] });
-	 * ```
-	 */
-	static fromManifest<
-		TStage extends string = string,
-		TDomain extends string = string,
-	>(
-		stack: StackType<TStage, TDomain>,
-		functions: ManifestField<FunctionInfo>,
-		props: Omit<FunctionProps, 'handler'> = {},
-	): Function<TStage, TDomain>[] {
-		return flattenManifestField(functions).map(
-			(fn) =>
-				new Function(stack, fn.name, {
-					...props,
-					name: stack.logicalPrefixedName(fn.name),
-					handler: fn.handler,
-					envVars: fn.environment,
-					timeout: fn.timeout ? `${fn.timeout} seconds` : undefined,
-					memory: fn.memorySize ? `${fn.memorySize} MB` : undefined,
-				}),
-		);
-	}
 }
 
 export interface FunctionProps extends sst.aws.FunctionArgs {

package/src/sst/aws/Queue.ts

@@ -11,7 +11,8 @@ import type { StackType } from '../Stack';
  * work queue. Link it to a producer and the runtime resolves `<NAME>_URL`,
  * `<NAME>_ARN`, and a `<NAME>_PUBLISHER_CONNECTION_STRING` (`sqs://?queueUrl=…`)
  * that `@geekmidas/events`'s `Publisher.fromConnectionString` consumes. Its
- * single consumer is wired by `QueueSubscriber`.
+ * one consumer — the handler the queue was declared with — is subscribed by
+ * {@link Queue.consume}.
  *
  * SST's native `Queue` link exposes only `url`, so `getSSTLink` is overridden to
  * also expose `arn` (what the resolver needs). `QueueProps` extends
@@ -73,6 +74,26 @@ export class Queue<
 		};
 	}
 
+	/**
+	 * Subscribe the queue's one consumer: a Lambda running `handler`, linked to
+	 * what the consumer depends on and to this queue itself.
+	 *
+	 * A queue has exactly one consumer, so this is called once per queue — by
+	 * `fromManifest`, from the handler the build wrote for it.
+	 */
+	consume(consumer: QueueConsumer) {
+		return this.subscribe(
+			{
+				handler: consumer.handler,
+				link: [this, ...(consumer.link ?? [])],
+				runtime: 'nodejs24.x',
+				...(consumer.vpc ? { vpc: consumer.vpc } : {}),
+				...(consumer.timeout ? { timeout: consumer.timeout } : {}),
+			},
+			consumer.batchSize ? { batch: { size: consumer.batchSize } } : {},
+		);
+	}
+
 	override getSSTLink() {
 		const link = super.getSSTLink();
 		return {
@@ -82,6 +103,18 @@ export class Queue<
 	}
 }
 
+/** The queue's one consumer, as {@link Queue.consume} subscribes it. */
+export interface QueueConsumer {
+	/** The built handler — `apps/api/.gkm/aws/queues/emails.handler`. */
+	handler: string;
+	/** What the consumer depends on; the queue itself is always linked. */
+	link?: unknown[];
+	/** The database's network, when the consumer reaches one. */
+	vpc?: sst.aws.Vpc;
+	timeout?: `${number} seconds` | `${number} minutes`;
+	batchSize?: number;
+}
+
 export interface QueueProps extends sst.aws.QueueArgs {
 	/**
 	 * The physical queue name, where the auto-generated one will not do.

package/src/sst/aws/RestApiSurface.ts

@@ -4,20 +4,10 @@ import type { StackType } from '../Stack';
 /**
  * `RestApiSurface` — an HTTP API, and the infra half of the `rest-api` kind.
  *
- * Deliberately *not* `Api`, which takes a route table and validates each
- * route's environment at synth. That component is the endpoint pipeline's, and
- * it needs routes; this one is the manifest's, and the manifest's `rest-api`
- * node currently carries `endpoints: []` for an application's own API.
- *
- * So what this provisions is the surface and nothing on it. An API Gateway with
- * no routes 404s everything, which is the honest state of things — and it is
- * still worth provisioning, because the *address* is what everything downstream
- * needs: a site inlines it as `VITE_API_URL`, an auth server puts it on its
- * trusted-origin list, and the cookie domain derives from it. Those are blocked
- * on the API existing, not on it answering.
- *
- * The two collapse into one component when the endpoint merge lands and the
- * surface node carries its routes.
+ * Provisioned before its routes, because its *address* is what everything
+ * downstream needs: a site inlines it as `VITE_API_URL`, an auth server puts it
+ * on its trusted-origin list, and the cookie domain derives from it. The routes
+ * are mounted once everything they link to exists — see {@link mount}.
  */
 
 export interface RestApiSurfaceProps extends sst.aws.ApiGatewayV2Args {
@@ -82,6 +72,25 @@ export class RestApiSurface<
 		};
 	}
 
+	/**
+	 * Mount one endpoint: a Lambda running the handler the build wrote for it,
+	 * linked to exactly what that endpoint depends on.
+	 */
+	mount(endpoint: SurfaceRoute) {
+		return this.route(
+			`${endpoint.method} ${endpoint.path}`,
+			{
+				handler: endpoint.handler,
+				link: endpoint.link ?? [],
+				runtime: 'nodejs24.x',
+				...(endpoint.vpc ? { vpc: endpoint.vpc } : {}),
+			},
+			// `iam` is the one authorizer the gateway enforces itself; every other
+			// is the endpoint's own, checked in the handler.
+			endpoint.authorizer === 'iam' ? { auth: { iam: true } } : {},
+		);
+	}
+
 	override getSSTLink() {
 		const link = super.getSSTLink();
 		return {
@@ -90,3 +99,16 @@ export class RestApiSurface<
 		};
 	}
 }
+
+/** One endpoint, as {@link RestApiSurface.mount} mounts it. */
+export interface SurfaceRoute {
+	method: string;
+	path: string;
+	/** The built handler — `apps/api/.gkm/aws/routes/getUser.handler`. */
+	handler: string;
+	/** What the endpoint depends on, and nothing else. */
+	link?: unknown[];
+	/** The database's network, when the endpoint reaches one. */
+	vpc?: sst.aws.Vpc;
+	authorizer?: string;
+}

package/src/sst/aws/Secret.ts

@@ -15,8 +15,10 @@ import type { StackType } from '../Stack';
  * signing key, the thing that stores it, and the thing that reads it are three
  * different systems deployed, and one derived string locally.
  *
- * Usable on its own. `Stack.fromManifest` translates a manifest into these, but
- * the component takes an ordinary placeholder so it works in a hand-written
+ * Usable on its own. `Stack.fromManifest` translates a manifest into these, and
+ * hands each a generated placeholder, so a manifest's secret is generated on
+ * its first deploy rather than set by hand; the component on its own takes
+ * whatever placeholder it is given, so it works in a hand-written
  * `sst.config.ts` with no manifest anywhere.
  */
 export class Secret<
@@ -72,5 +74,5 @@ export interface SecretProps {
 	 * letting the deploy fail — is the correct handling for a real secret. It
 	 * exists for the values that are secrets by habit rather than by need.
 	 */
-	placeholder?: string;
+	placeholder?: $util.Input<string>;
 }

package/src/sst/aws/bootstrap/handler.ts

@@ -28,6 +28,11 @@ export interface BootstrapTenant {
 	runtime: string;
 	owner: string;
 	reader?: string;
+	/**
+	 * The database's own roles rather than a tenant's: its owner may create in
+	 * the database, for trusted extensions.
+	 */
+	ownsDatabase?: boolean;
 	passwords: { runtime: string; owner: string; reader?: string };
 }
 
@@ -75,7 +80,11 @@ export async function handler(event: BootstrapEvent): Promise<BootstrapResult> {
 
 	try {
 		for (const tenant of event.tenants) {
-			for (const statement of roleStatements(tenant)) {
+			const spec = {
+				...tenant,
+				...(tenant.ownsDatabase ? { database: event.master.database } : {}),
+			};
+			for (const statement of roleStatements(spec)) {
 				if (statement.exists) {
 					const { rows } = await client.query(
 						statement.exists.sql,