@geekmidas/cloud 10.0.0-alpha.11 → 10.0.0-alpha.111

package/src/sst/fromManifest.ts

@@ -19,6 +19,8 @@ import type {
 	Declaration,
 	DeclarationKind,
 	Dependency,
+	SecretDeclaration,
+	SecretFormat,
 	SiteDeclaration,
 } from '@geekmidas/manifest';
 import {
@@ -26,11 +28,16 @@ import {
 	cookieDomain,
 	DEFAULT_POSTGRES_VERSION,
 	dependentsOf,
+	mobileOrigins,
 	PUBLIC,
 	PUBLIC_PREFIX,
 	providedKeyFor,
 	provisionOrder,
+	SECRET_LENGTH,
+	SECRET_SYMBOLS,
+	schemeBase,
 } from '@geekmidas/manifest';
+import { RandomPassword } from '@pulumi/random';
 import {
 	Cache,
 	CacheIsAmbiguous,
@@ -39,15 +46,19 @@ import {
 	withCacheTable,
 } from './aws/Cache';
 import { Credential } from './aws/Credential';
-import { Database, DatabaseNeedsVpc } from './aws/Database';
+import { Cron, type CronSchedule } from './aws/Cron';
+import { Database, DatabaseNeedsVpc, type DatabaseProps } from './aws/Database';
 import { DatabaseBootstrap } from './aws/DatabaseBootstrap';
 import { DatabaseReader, DatabaseSchema } from './aws/DerivedDatabase';
 import { Email, EmailNeedsSender } from './aws/Email';
+import { Encryption, type EncryptionProps } from './aws/Encryption';
+import { ExternalApi, type ExternalApiProps } from './aws/ExternalApi';
 import { FileServer } from './aws/FileServer';
+import { Function } from './aws/Function';
 import { ObjectStorage } from './aws/ObjectStorage';
 import { Queue } from './aws/Queue';
 import { RestApiSurface } from './aws/RestApiSurface';
-import { Secret } from './aws/Secret';
+import { Secret, type SecretProps } from './aws/Secret';
 import { StaticSite } from './aws/StaticSite';
 import { Topic } from './aws/Topic';
 import {
@@ -56,6 +67,7 @@ import {
 	UnresolvedDependency,
 } from './errors';
 import type { GkmLinkable } from './Linkable';
+import type { ManifestBackends, ManifestOverrides } from './overrides';
 import type { StackType } from './Stack';
 
 /**
@@ -98,8 +110,8 @@ export interface ProvisionContext {
 	/**
 	 * Where a declared cache lives, and who delivers mail.
 	 *
-	 * Deployment choices rather than declarations, for the same reason
-	 * `services.events` is: the same application code caches into any of them and
+	 * Deployment choices rather than declarations, for the same reason the
+	 * event broker is: the same application code caches into any of them and
 	 * sends through any of them. They reach the provisioner here because it is
 	 * the only place that knows both the choice and the manifest.
 	 */
@@ -133,21 +145,6 @@ type Provisioner = (
 	context: ProvisionContext,
 ) => Provisioned;
 
-/**
- * Provider-specific props, per construct id.
- *
- * Neutral options — `versioned`, and later `cdn` — travel in the declaration,
- * because the app legitimately has an opinion about them. Anything with S3 in
- * its name does not belong in application code, so lifecycle rules, CORS, and
- * canned ACLs are supplied here, in the deploy layer, keyed by the id they
- * apply to and typed against the component that receives them.
- *
- * A third escape hatch needs no API at all: `fromManifest` returns the
- * components, so `provisioned.Uploads.nodes.bucket` is reachable for anything
- * neither route covers.
- */
-export type ComponentOverrides = Record<string, Record<string, unknown>>;
-
 /**
  * Which component provisions which kind.
  *
@@ -220,7 +217,11 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			// rather than whatever Aurora defaults to that month. Local ran 18
 			// while this ran 17.7, and neither was written down anywhere.
 			version: String(d.version ?? DEFAULT_POSTGRES_VERSION),
-			...(props as unknown as sst.aws.PostgresArgs),
+			// `DatabaseProps`, not `sst.aws.PostgresArgs`: the database needs the
+			// `Vpc` component itself (its bootstrap function runs in the same VPC
+			// and needs the security groups too), where RDS would accept bare
+			// subnet ids. TS 7 checks the spread; 6 let the wider type through.
+			...(props as unknown as Omit<DatabaseProps, 'schema'>),
 		});
 
 		// A database needs its own roles, not just its tenants'. Registering only
@@ -232,13 +233,21 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			const bootstrap = bootstrapFor(cluster, d.id, context);
 			const runtime = roleNameFor(d, context);
 
-			bootstrap?.add({
+			const credentials = bootstrap?.add({
 				id: d.id,
 				schema: d.schema,
 				runtime,
 				owner: ownerRole(runtime),
+				ownsDatabase: true,
 				...(hasReader(d.id, context) ? { reader: readerRole(runtime) } : {}),
 			});
+
+			// Registering the role was half of it: its handlers have to connect as
+			// it too, or the DDL creates a role nothing uses and every handler
+			// linked to the database still holds the master.
+			if (credentials) {
+				cluster.connectAs({ user: runtime, password: credentials.runtime });
+			}
 		}
 
 		return cluster;
@@ -363,17 +372,12 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 	},
 
 	/**
-	 * The surface, without its routes.
-	 *
-	 * An API Gateway with no routes 404s everything, and that is the honest
-	 * state: the *surface* is what this kind declares, and mounting handlers on
-	 * it is the endpoint merge that has not landed — routes still reach the
-	 * deploy target through the separate `RouteInfo[]` pipeline.
+	 * The surface, without its routes yet.
 	 *
-	 * Provisioning it anyway is not ceremony. Its address is what a site inlines
-	 * as `VITE_API_URL`, what an auth server puts on its trusted-origin list, and
-	 * what the cookie domain derives from — so everything downstream of the API
-	 * is blocked on the API *existing*, not on it answering.
+	 * Its address is what a site inlines as `VITE_API_URL`, what an auth server
+	 * puts on its trusted-origin list, and what the cookie domain derives from —
+	 * so it is provisioned in order, and its endpoints are mounted by
+	 * {@link mountRoutes} once everything they link to exists.
 	 */
 	'rest-api': (stack, d, props, context) =>
 		new RestApiSurface(stack, d.id, {
@@ -381,10 +385,41 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			callers: context.callers?.get(d.id)?.promise,
 		}),
 
-	secret: (stack, d, props) => new Secret(stack, d.id, props),
+	// Generated on the first deploy and kept in the stage's state, as a server
+	// stage keeps it in its secrets: every later deploy reads the same value
+	// back. One set with `sst secret set` wins over it.
+	secret: (stack, d, props) =>
+		new Secret(stack, d.id, {
+			placeholder: generatedSecret(d.id, d as SecretDeclaration),
+			...(props as SecretProps),
+		}),
 
 	// The same storage as a secret, under a different role — see the component.
 	credential: (stack, d, props) => new Credential(stack, d.id, props),
+
+	// In the stage's region, as mail is: a key in another region is a key
+	// every call crosses the world to reach.
+	encryption: (stack, d, props) =>
+		new Encryption(stack, d.id, {
+			...(props as Partial<EncryptionProps>),
+			region:
+				(props as Partial<EncryptionProps>).region ??
+				$app.providers?.aws?.region ??
+				'us-east-1',
+		}),
+
+	// Nothing to provision: the URL this stage calls, and the credentials kept
+	// as a secret.
+	'external-api': (stack, d, props) => {
+		if (d.kind !== 'external-api') {
+			throw new UnknownDeclarationKind(d.kind, []);
+		}
+
+		return new ExternalApi(stack, d.id, {
+			...(props as Partial<ExternalApiProps>),
+			url: d.url,
+		});
+	},
 };
 
 /**
@@ -565,9 +600,7 @@ function rootCluster(component: Provisioned): Database {
  * printed: one line per route, naming what it can reach.
  *
  * A surface with no routes says so rather than printing nothing, because "no
- * routes yet" and "this printed nothing" look identical otherwise — and for an
- * application's own API that is currently the true state, pending the endpoint
- * merge.
+ * routes" and "this printed nothing" look identical otherwise.
  *
  * Pure, so what gets printed can be asserted without a deploy.
  */
@@ -636,6 +669,8 @@ async function callersOf(
 	id: string,
 	manifest: ConstructManifest,
 	provisioned: ProvisionedManifest,
+	/** The app's name — a mobile caller's scheme base when it gives none. */
+	project: string,
 ): Promise<{ trustedOrigins: string; cookieDomain?: string }> {
 	// Every address here is a Pulumi output, not a string — a CloudFront domain
 	// and an API Gateway endpoint are both known only after their resource
@@ -660,8 +695,17 @@ async function callersOf(
 	const own = await resolved(provisioned[id]?.provides().url);
 	const domain = cookieDomain([...(own ? [own] : []), ...origins]);
 
+	// A mobile caller is reached by its scheme — the bare one, deployed: what
+	// the store build registers.
+	const schemes = dependentsOf(manifest, id).flatMap((caller) => {
+		const app = manifest[caller];
+		return app?.kind === 'mobile-app'
+			? mobileOrigins(schemeBase(project, app.scheme))
+			: [];
+	});
+
 	return {
-		trustedOrigins: origins.join(','),
+		trustedOrigins: [...origins, ...schemes].join(','),
 		...(domain ? { cookieDomain: domain } : {}),
 	};
 }
@@ -711,6 +755,170 @@ export function isServed(id: string, manifest: ConstructManifest): boolean {
 	);
 }
 
+/**
+ * Kinds the in-order pass skips.
+ *
+ * - `mobile-app` ships through EAS and the stores. It is in the manifest for
+ *   what it makes the surfaces trust, which `callersOf` reads off the graph.
+ * - `worker` is a process, not a resource: what it runs is provisioned as
+ *   what it is — a queue's consumer by {@link subscribeConsumers}.
+ * - `cron` and `function` are Lambdas linked to what they depend on, so they
+ *   are provisioned once all of it exists, by {@link provisionCompute}.
+ * - `telemetry` provisions nothing: where it goes is the stage's
+ *   `deploy.telemetry`, a provider somebody else runs.
+ */
+export const PROVISIONED_ELSEWHERE: ReadonlySet<DeclarationKind> =
+	new Set<DeclarationKind>([
+		'mobile-app',
+		'worker',
+		'cron',
+		'function',
+		'telemetry',
+	]);
+
+/**
+ * Every function and cron: a Lambda running the handler the build wrote,
+ * linked to exactly what it depends on, in the database's network when it
+ * reaches one. A cron is that Lambda on its schedule; a function is reached
+ * at its URL, which only callers granted IAM access can invoke.
+ *
+ * After everything else is provisioned, because each links to things
+ * `provisionOrder` does not order before it.
+ */
+export function provisionCompute(
+	stack: StackType,
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): Cron[] {
+	const crons: Cron[] = [];
+
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'function' && declaration?.kind !== 'cron') {
+			continue;
+		}
+
+		const { link } = resolveEdges(declaration.dependencies, provisioned);
+		const vpc = vpcFor(link);
+		const lambda = new Function(
+			stack,
+			declaration.kind === 'cron' ? `${id}Function` : id,
+			{
+				name: stack.logicalPrefixedName(id),
+				handler: declaration.handler,
+				link,
+				...(vpc ? { vpc } : {}),
+				...(declaration.kind === 'function'
+					? { url: { authorization: 'iam' } }
+					: {}),
+			},
+		);
+
+		if (declaration.kind === 'cron') {
+			crons.push(
+				new Cron(stack, id, {
+					processor: lambda,
+					schedule: declaration.schedule as CronSchedule,
+				}),
+			);
+			continue;
+		}
+
+		assertProvides(
+			id,
+			declaration.provides,
+			Object.keys(lambda.provides()).map((role) =>
+				providedKeyFor(id, declaration.kind, role),
+			),
+		);
+		provisioned[id] = lambda;
+	}
+
+	return crons;
+}
+
+/** A provisioned queue: what {@link subscribeConsumers} subscribes through. */
+interface Consumable {
+	consume(consumer: {
+		handler: string;
+		link?: unknown[];
+		vpc?: sst.aws.Vpc;
+	}): unknown;
+}
+
+/**
+ * The network a function has to run in to reach what it links to.
+ *
+ * A database is private to its VPC, so a handler linked to one — or to a
+ * schema tenant or reader of one — runs inside it, or its connection times out.
+ */
+export function vpcFor(link: readonly Provisioned[]): sst.aws.Vpc | undefined {
+	for (const component of link) {
+		const cluster = rootCluster(component);
+		if (cluster instanceof Database) return cluster.vpc;
+	}
+
+	return undefined;
+}
+
+/**
+ * Mount every surface's endpoints — the handlers the build wrote, each linked
+ * to exactly what that endpoint depends on.
+ *
+ * After every construct is provisioned, for the reason consumers are: an
+ * endpoint links to things `provisionOrder` does not order before its surface.
+ */
+export function mountRoutes(
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): void {
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'rest-api') continue;
+
+		const surface = provisioned[id];
+		if (!(surface instanceof RestApiSurface)) continue;
+
+		for (const endpoint of declaration.endpoints) {
+			const { link } = resolveEdges(endpoint.dependencies, provisioned);
+			const vpc = vpcFor(link);
+			surface.mount({
+				method: endpoint.method,
+				path: endpoint.path,
+				handler: endpoint.handler,
+				link,
+				...(vpc ? { vpc } : {}),
+				...(endpoint.authorizer ? { authorizer: endpoint.authorizer } : {}),
+			});
+		}
+	}
+}
+
+/**
+ * Subscribe every queue's one consumer — the handler the build wrote for it,
+ * linked to what that consumer depends on.
+ *
+ * After every construct is provisioned, because a consumer links to things
+ * that `provisionOrder` does not order before the queue.
+ */
+export function subscribeConsumers(
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): void {
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'queue') continue;
+
+		const queue = provisioned[id] as unknown as Consumable | undefined;
+		if (!queue) continue;
+
+		const { link } = resolveEdges(declaration.worker.dependencies, provisioned);
+		const vpc = vpcFor(link);
+		queue.consume({
+			handler: declaration.worker.handler,
+			link,
+			...(vpc ? { vpc } : {}),
+		});
+	}
+}
+
 /** The provisioner for a kind. Pure — the lookup is testable without Pulumi. */
 export function provisionerFor(kind: DeclarationKind): Provisioner {
 	const provisioner = PROVISIONERS[kind];
@@ -749,20 +957,34 @@ export function assertProvides(
  * tenant, a read replica, and the surface over a bucket all resolve an address
  * off something else, and a pass in map order would find it half the time.
  */
-export function fromManifest(
+export function fromManifest<
+	const M extends ConstructManifest,
+	const B extends ManifestBackends = {},
+>(
 	stack: StackType,
-	manifest: ConstructManifest,
-	overrides: ComponentOverrides = {},
+	manifest: M,
+	/**
+	 * Provider-specific props, per construct id — typed from the manifest, so
+	 * only its ids are keys, each takes what its kind's component reads, and
+	 * what the synth cannot guess (a database's `vpc`, mail's `from`) is
+	 * required. See {@link ManifestOverrides}.
+	 *
+	 * Neutral options — `versioned`, `fifo` — travel in the declaration,
+	 * because the app legitimately has an opinion about them. Anything with S3
+	 * in its name does not belong in application code, so it is supplied here.
+	 * A third escape hatch needs no API: the components are returned, so
+	 * `provisioned.Uploads.nodes.bucket` is reachable for anything else.
+	 */
+	overrides: ManifestOverrides<M, B>,
 	/**
 	 * The backend choices that are config rather than declaration.
 	 *
 	 * Defaulted the same way the local target defaults them, so a stage deployed
-	 * without saying gets the same backend a developer ran against.
+	 * without saying gets the same backend a developer ran against. Typed
+	 * literally, because the backend decides what is required above: an
+	 * ElastiCache cache needs a `vpc`, Resend or SMTP mail a `url`.
 	 */
-	backends: {
-		cache?: 'upstash' | 'elasticache' | 'db';
-		email?: 'resend' | 'ses' | 'smtp';
-	} = {},
+	backends: B = {} as B,
 ): ProvisionedManifest {
 	const provisioned: ProvisionedManifest = {};
 
@@ -799,11 +1021,12 @@ export function fromManifest(
 	for (const id of [...rest, ...sites]) {
 		const declaration = manifest[id];
 		if (!declaration) continue;
+		if (PROVISIONED_ELSEWHERE.has(declaration.kind)) continue;
 
 		const component = provisionerFor(declaration.kind)(
 			stack,
 			declaration,
-			overrides[id] ?? {},
+			(overrides as Record<string, Record<string, unknown>>)[id] ?? {},
 			context,
 		);
 
@@ -822,6 +1045,12 @@ export function fromManifest(
 		provisioned[id] = component;
 	}
 
+	// The functions and crons, each queue's one consumer and each surface's
+	// endpoints, once everything they link to exists.
+	provisionCompute(stack, manifest, provisioned);
+	subscribeConsumers(manifest, provisioned);
+	mountRoutes(manifest, provisioned);
+
 	for (const line of describeRoutes(manifest)) console.log(line);
 
 	// Now everything exists, so every surface's callers can be resolved — the
@@ -829,7 +1058,7 @@ export function fromManifest(
 	for (const [id, deferred] of callers) {
 		// Resolved with the promise itself: the addresses it needs are Pulumi
 		// outputs, so the answer arrives when they do.
-		deferred.resolve(callersOf(id, manifest, provisioned));
+		deferred.resolve(callersOf(id, manifest, provisioned, $app.name));
 	}
 
 	// Last, and only now: the roles exist as passwords and secrets from the
@@ -844,6 +1073,30 @@ export function fromManifest(
 	return provisioned;
 }
 
+/**
+ * A secret in its declared format — the alphabet `drawSecret` draws from on
+ * every other stage, with one symbol guaranteed as it guarantees one.
+ *
+ * The format is fixed at the first deploy, as a server stage's is: changing it
+ * would replace the password, and every later deploy is meant to read back the
+ * one it had.
+ */
+function generatedSecret(id: string, format: SecretFormat) {
+	const symbols = [...new Set(format.symbols ?? SECRET_SYMBOLS)].join('');
+
+	return new RandomPassword(
+		`${id}Generated`,
+		{
+			length: format.length ?? SECRET_LENGTH,
+			special: symbols.length > 0,
+			...(symbols ? { overrideSpecial: symbols, minSpecial: 1 } : {}),
+		},
+		{
+			ignoreChanges: ['length', 'special', 'overrideSpecial', 'minSpecial'],
+		},
+	).result;
+}
+
 /** What one function receives from its edges. */
 export interface ResolvedEdges {
 	/** The components it may reach. SST turns these into IAM *and* injects their

package/src/sst/index.ts

@@ -34,6 +34,7 @@ export {
 } from './aws/DatabaseBootstrap';
 export { DatabaseReader, DatabaseSchema } from './aws/DerivedDatabase';
 export { Email, EmailNeedsUrl, type EmailProps } from './aws/Email';
+export { Encryption, type EncryptionProps } from './aws/Encryption';
 export { FileServer, type FileServerProps } from './aws/FileServer';
 export { Function, type FunctionProps } from './aws/Function';
 export {
@@ -61,7 +62,6 @@ export {
 } from './errors';
 export {
 	assertProvides,
-	type ComponentOverrides,
 	describeRoutes,
 	fromManifest,
 	isServed,
@@ -75,4 +75,9 @@ export {
 } from './fromManifest';
 export { type GkmLinkable, ResourceType } from './Linkable';
 export { kebab, prefixedName, regionOfArn } from './naming';
+export type {
+	ManifestBackends,
+	ManifestOverrides,
+	OverrideFor,
+} from './overrides';
 export { Stack, type StackType } from './Stack';

package/src/sst/overrides.ts

@@ -0,0 +1,133 @@
+/**
+ * What a deploy can say about each construct, inferred from the manifest.
+ *
+ * `fromManifest` used to take `Record<string, Record<string, unknown>>`, so a
+ * misspelt id, a prop the component never reads, and a missing VPC all passed
+ * the type checker — the first two silently, the last at synth, mid-deploy.
+ * The manifest is emitted `as const`, so every id's kind is known statically,
+ * and the kind decides what can be overridden:
+ *
+ * - only the manifest's own ids are keys;
+ * - each takes the props its kind's provisioner reads, minus those the
+ *   declaration already decides (a site's `path`, a file server's `origin`);
+ * - what the synth refuses to guess is required — a database's `vpc`, mail's
+ *   `from`, and, by backend, an ElastiCache `vpc` or a non-SES mail `url`;
+ * - a kind with nothing to override takes no key at all.
+ */
+
+import type { ConstructManifest, DeclarationKind } from '@geekmidas/manifest';
+import type { CacheProps } from './aws/Cache';
+import type { CredentialProps } from './aws/Credential';
+import type { DatabaseProps } from './aws/Database';
+import type { EncryptionProps } from './aws/Encryption';
+import type { ExternalApiProps } from './aws/ExternalApi';
+import type { FileServerProps } from './aws/FileServer';
+import type { ObjectStorageProps } from './aws/ObjectStorage';
+import type { QueueProps } from './aws/Queue';
+import type { SecretProps } from './aws/Secret';
+import type { StaticSiteProps } from './aws/StaticSite';
+import type { TopicProps } from './aws/Topic';
+
+/** The backend choices that are config rather than declaration. */
+export interface ManifestBackends {
+	cache?: 'upstash' | 'elasticache' | 'db';
+	email?: 'resend' | 'ses' | 'smtp';
+}
+
+/** The backend a choice resolves to — the provisioner's default when unset. */
+type CacheBackendOf<B extends ManifestBackends> =
+	B['cache'] extends NonNullable<ManifestBackends['cache']>
+		? B['cache']
+		: 'upstash';
+type EmailBackendOf<B extends ManifestBackends> =
+	B['email'] extends NonNullable<ManifestBackends['email']>
+		? B['email']
+		: 'ses';
+
+type CacheOverride<Backend> = Backend extends 'elasticache'
+	? { vpc: NonNullable<CacheProps['vpc']> }
+	: Backend extends 'upstash'
+		? { url?: CacheProps['url']; region?: string }
+		: never;
+
+type EmailOverride<Backend> = {
+	/** Every provider rejects an unverified sender, so there is no default. */
+	from: $util.Input<string>;
+	region?: $util.Input<string>;
+} & (Backend extends 'ses'
+	? { url?: $util.Input<string> }
+	: // Resend and a relay are accounts somebody created: their URL is theirs.
+		{ url: $util.Input<string> });
+
+/**
+ * What one declaration takes, by its kind and the backends; `never` for a kind
+ * with nothing to override, which drops its id from the keys.
+ */
+export type OverrideFor<D, B extends ManifestBackends = {}> = D extends {
+	kind: infer K extends DeclarationKind;
+}
+	? K extends 'objects'
+		? Partial<ObjectStorageProps>
+		: K extends 'file-server'
+			? Partial<Omit<FileServerProps, 'origin'>>
+			: K extends 'site'
+				? Partial<Omit<StaticSiteProps, 'path' | 'variant' | 'environment'>>
+				: K extends 'queue'
+					? Partial<Omit<QueueProps, 'fifo'>>
+					: K extends 'topic'
+						? Partial<TopicProps>
+						: K extends 'database'
+							? Omit<DatabaseProps, 'schema' | 'version'>
+							: K extends 'cache'
+								? // In a database: same address, one more table, nothing to say.
+									D extends { of: string }
+									? never
+									: CacheOverride<CacheBackendOf<B>>
+								: K extends 'email'
+									? EmailOverride<EmailBackendOf<B>>
+									: K extends 'rest-api'
+										? Partial<sst.aws.ApiGatewayV2Args>
+										: K extends 'secret'
+											? SecretProps
+											: K extends 'credential'
+												? CredentialProps
+												: K extends 'encryption'
+													? Partial<EncryptionProps>
+													: K extends 'external-api'
+														? Omit<ExternalApiProps, 'url'>
+														: // Derived databases, compute, mobile apps, OIDC.
+															never
+	: never;
+
+/** Whether `{}` satisfies an override — whether the id can be left out. */
+type IsOptional<T> = {} extends T ? true : false;
+
+type Overridable<M, B extends ManifestBackends> = {
+	[Id in keyof M]: [OverrideFor<M[Id], B>] extends [never] ? never : Id;
+}[keyof M];
+
+type RequiredIds<M, B extends ManifestBackends> = {
+	[Id in Overridable<M, B>]: IsOptional<OverrideFor<M[Id], B>> extends true
+		? never
+		: Id;
+}[Overridable<M, B>];
+
+/**
+ * The overrides a manifest accepts, keyed by its own construct ids.
+ *
+ * A manifest typed only as `ConstructManifest` — ids unknown — falls back to
+ * the untyped record, and the provisioners' synth-time checks still apply.
+ */
+export type ManifestOverrides<
+	M extends ConstructManifest,
+	B extends ManifestBackends = {},
+> = string extends keyof M
+	? Record<string, Record<string, unknown>>
+	: {
+			[Id in RequiredIds<M, B>]: OverrideFor<M[Id], B>;
+		} & {
+			[Id in Exclude<Overridable<M, B>, RequiredIds<M, B>>]?: OverrideFor<
+				M[Id],
+				B
+			>;
+		};