@geekmidas/cloud 10.0.0-alpha.12 → 10.0.0-alpha.121

package/src/sst/aws/Queue.ts

@@ -11,7 +11,8 @@ import type { StackType } from '../Stack';
  * work queue. Link it to a producer and the runtime resolves `<NAME>_URL`,
  * `<NAME>_ARN`, and a `<NAME>_PUBLISHER_CONNECTION_STRING` (`sqs://?queueUrl=…`)
  * that `@geekmidas/events`'s `Publisher.fromConnectionString` consumes. Its
- * single consumer is wired by `QueueSubscriber`.
+ * one consumer — the handler the queue was declared with — is subscribed by
+ * {@link Queue.consume}.
  *
  * SST's native `Queue` link exposes only `url`, so `getSSTLink` is overridden to
  * also expose `arn` (what the resolver needs). `QueueProps` extends
@@ -73,6 +74,26 @@ export class Queue<
 		};
 	}
 
+	/**
+	 * Subscribe the queue's one consumer: a Lambda running `handler`, linked to
+	 * what the consumer depends on and to this queue itself.
+	 *
+	 * A queue has exactly one consumer, so this is called once per queue — by
+	 * `fromManifest`, from the handler the build wrote for it.
+	 */
+	consume(consumer: QueueConsumer) {
+		return this.subscribe(
+			{
+				handler: consumer.handler,
+				link: [this, ...(consumer.link ?? [])],
+				runtime: 'nodejs24.x',
+				...(consumer.vpc ? { vpc: consumer.vpc } : {}),
+				...(consumer.timeout ? { timeout: consumer.timeout } : {}),
+			},
+			consumer.batchSize ? { batch: { size: consumer.batchSize } } : {},
+		);
+	}
+
 	override getSSTLink() {
 		const link = super.getSSTLink();
 		return {
@@ -82,6 +103,18 @@ export class Queue<
 	}
 }
 
+/** The queue's one consumer, as {@link Queue.consume} subscribes it. */
+export interface QueueConsumer {
+	/** The built handler — `apps/api/.gkm/aws/queues/emails.handler`. */
+	handler: string;
+	/** What the consumer depends on; the queue itself is always linked. */
+	link?: unknown[];
+	/** The database's network, when the consumer reaches one. */
+	vpc?: sst.aws.Vpc;
+	timeout?: `${number} seconds` | `${number} minutes`;
+	batchSize?: number;
+}
+
 export interface QueueProps extends sst.aws.QueueArgs {
 	/**
 	 * The physical queue name, where the auto-generated one will not do.

package/src/sst/aws/RestApiSurface.ts

@@ -4,20 +4,10 @@ import type { StackType } from '../Stack';
 /**
  * `RestApiSurface` — an HTTP API, and the infra half of the `rest-api` kind.
  *
- * Deliberately *not* `Api`, which takes a route table and validates each
- * route's environment at synth. That component is the endpoint pipeline's, and
- * it needs routes; this one is the manifest's, and the manifest's `rest-api`
- * node currently carries `endpoints: []` for an application's own API.
- *
- * So what this provisions is the surface and nothing on it. An API Gateway with
- * no routes 404s everything, which is the honest state of things — and it is
- * still worth provisioning, because the *address* is what everything downstream
- * needs: a site inlines it as `VITE_API_URL`, an auth server puts it on its
- * trusted-origin list, and the cookie domain derives from it. Those are blocked
- * on the API existing, not on it answering.
- *
- * The two collapse into one component when the endpoint merge lands and the
- * surface node carries its routes.
+ * Provisioned before its routes, because its *address* is what everything
+ * downstream needs: a site inlines it as `VITE_API_URL`, an auth server puts it
+ * on its trusted-origin list, and the cookie domain derives from it. The routes
+ * are mounted once everything they link to exists — see {@link mount}.
  */
 
 export interface RestApiSurfaceProps extends sst.aws.ApiGatewayV2Args {
@@ -82,6 +72,25 @@ export class RestApiSurface<
 		};
 	}
 
+	/**
+	 * Mount one endpoint: a Lambda running the handler the build wrote for it,
+	 * linked to exactly what that endpoint depends on.
+	 */
+	mount(endpoint: SurfaceRoute) {
+		return this.route(
+			`${endpoint.method} ${endpoint.path}`,
+			{
+				handler: endpoint.handler,
+				link: endpoint.link ?? [],
+				runtime: 'nodejs24.x',
+				...(endpoint.vpc ? { vpc: endpoint.vpc } : {}),
+			},
+			// `iam` is the one authorizer the gateway enforces itself; every other
+			// is the endpoint's own, checked in the handler.
+			endpoint.authorizer === 'iam' ? { auth: { iam: true } } : {},
+		);
+	}
+
 	override getSSTLink() {
 		const link = super.getSSTLink();
 		return {
@@ -90,3 +99,16 @@ export class RestApiSurface<
 		};
 	}
 }
+
+/** One endpoint, as {@link RestApiSurface.mount} mounts it. */
+export interface SurfaceRoute {
+	method: string;
+	path: string;
+	/** The built handler — `apps/api/.gkm/aws/routes/getUser.handler`. */
+	handler: string;
+	/** What the endpoint depends on, and nothing else. */
+	link?: unknown[];
+	/** The database's network, when the endpoint reaches one. */
+	vpc?: sst.aws.Vpc;
+	authorizer?: string;
+}

package/src/sst/aws/Secret.ts

@@ -15,8 +15,10 @@ import type { StackType } from '../Stack';
  * signing key, the thing that stores it, and the thing that reads it are three
  * different systems deployed, and one derived string locally.
  *
- * Usable on its own. `Stack.fromManifest` translates a manifest into these, but
- * the component takes an ordinary placeholder so it works in a hand-written
+ * Usable on its own. `Stack.fromManifest` translates a manifest into these, and
+ * hands each a generated placeholder, so a manifest's secret is generated on
+ * its first deploy rather than set by hand; the component on its own takes
+ * whatever placeholder it is given, so it works in a hand-written
  * `sst.config.ts` with no manifest anywhere.
  */
 export class Secret<
@@ -72,5 +74,5 @@ export interface SecretProps {
 	 * letting the deploy fail — is the correct handling for a real secret. It
 	 * exists for the values that are secrets by habit rather than by need.
 	 */
-	placeholder?: string;
+	placeholder?: $util.Input<string>;
 }

package/src/sst/aws/bootstrap/handler.ts

@@ -28,6 +28,13 @@ export interface BootstrapTenant {
 	runtime: string;
 	owner: string;
 	reader?: string;
+	/**
+	 * The database's own roles rather than a tenant's: its owner may create in
+	 * the database, for trusted extensions.
+	 */
+	ownsDatabase?: boolean;
+	/** Extensions the database declared, created as the master. */
+	extensions?: readonly string[];
 	passwords: { runtime: string; owner: string; reader?: string };
 }
 
@@ -75,7 +82,11 @@ export async function handler(event: BootstrapEvent): Promise<BootstrapResult> {
 
 	try {
 		for (const tenant of event.tenants) {
-			for (const statement of roleStatements(tenant)) {
+			const spec = {
+				...tenant,
+				...(tenant.ownsDatabase ? { database: event.master.database } : {}),
+			};
+			for (const statement of roleStatements(spec)) {
 				if (statement.exists) {
 					const { rows } = await client.query(
 						statement.exists.sql,

package/src/sst/fromManifest.ts

@@ -19,6 +19,8 @@ import type {
 	Declaration,
 	DeclarationKind,
 	Dependency,
+	SecretDeclaration,
+	SecretFormat,
 	SiteDeclaration,
 } from '@geekmidas/manifest';
 import {
@@ -26,11 +28,16 @@ import {
 	cookieDomain,
 	DEFAULT_POSTGRES_VERSION,
 	dependentsOf,
+	mobileOrigins,
 	PUBLIC,
 	PUBLIC_PREFIX,
 	providedKeyFor,
 	provisionOrder,
+	SECRET_LENGTH,
+	SECRET_SYMBOLS,
+	schemeBase,
 } from '@geekmidas/manifest';
+import { RandomPassword } from '@pulumi/random';
 import {
 	Cache,
 	CacheIsAmbiguous,
@@ -39,15 +46,19 @@ import {
 	withCacheTable,
 } from './aws/Cache';
 import { Credential } from './aws/Credential';
-import { Database, DatabaseNeedsVpc } from './aws/Database';
+import { Cron, type CronSchedule } from './aws/Cron';
+import { Database, DatabaseNeedsVpc, type DatabaseProps } from './aws/Database';
 import { DatabaseBootstrap } from './aws/DatabaseBootstrap';
 import { DatabaseReader, DatabaseSchema } from './aws/DerivedDatabase';
 import { Email, EmailNeedsSender } from './aws/Email';
+import { Encryption, type EncryptionProps } from './aws/Encryption';
+import { ExternalApi, type ExternalApiProps } from './aws/ExternalApi';
 import { FileServer } from './aws/FileServer';
+import { Function } from './aws/Function';
 import { ObjectStorage } from './aws/ObjectStorage';
 import { Queue } from './aws/Queue';
 import { RestApiSurface } from './aws/RestApiSurface';
-import { Secret } from './aws/Secret';
+import { Secret, type SecretProps } from './aws/Secret';
 import { StaticSite } from './aws/StaticSite';
 import { Topic } from './aws/Topic';
 import {
@@ -56,6 +67,7 @@ import {
 	UnresolvedDependency,
 } from './errors';
 import type { GkmLinkable } from './Linkable';
+import type { ManifestBackends, ManifestOverrides } from './overrides';
 import type { StackType } from './Stack';
 
 /**
@@ -133,21 +145,6 @@ type Provisioner = (
 	context: ProvisionContext,
 ) => Provisioned;
 
-/**
- * Provider-specific props, per construct id.
- *
- * Neutral options — `versioned`, and later `cdn` — travel in the declaration,
- * because the app legitimately has an opinion about them. Anything with S3 in
- * its name does not belong in application code, so lifecycle rules, CORS, and
- * canned ACLs are supplied here, in the deploy layer, keyed by the id they
- * apply to and typed against the component that receives them.
- *
- * A third escape hatch needs no API at all: `fromManifest` returns the
- * components, so `provisioned.Uploads.nodes.bucket` is reachable for anything
- * neither route covers.
- */
-export type ComponentOverrides = Record<string, Record<string, unknown>>;
-
 /**
  * Which component provisions which kind.
  *
@@ -220,7 +217,11 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			// rather than whatever Aurora defaults to that month. Local ran 18
 			// while this ran 17.7, and neither was written down anywhere.
 			version: String(d.version ?? DEFAULT_POSTGRES_VERSION),
-			...(props as unknown as sst.aws.PostgresArgs),
+			// `DatabaseProps`, not `sst.aws.PostgresArgs`: the database needs the
+			// `Vpc` component itself (its bootstrap function runs in the same VPC
+			// and needs the security groups too), where RDS would accept bare
+			// subnet ids. TS 7 checks the spread; 6 let the wider type through.
+			...(props as unknown as Omit<DatabaseProps, 'schema'>),
 		});
 
 		// A database needs its own roles, not just its tenants'. Registering only
@@ -232,13 +233,24 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			const bootstrap = bootstrapFor(cluster, d.id, context);
 			const runtime = roleNameFor(d, context);
 
-			bootstrap?.add({
+			const credentials = bootstrap?.add({
 				id: d.id,
 				schema: d.schema,
 				runtime,
 				owner: ownerRole(runtime),
+				ownsDatabase: true,
+				// RDS ships PostGIS, so the image is not a question here — only the
+				// `CREATE EXTENSION`, which the master can run and the owner cannot.
+				...(d.extensions?.length ? { extensions: d.extensions } : {}),
 				...(hasReader(d.id, context) ? { reader: readerRole(runtime) } : {}),
 			});
+
+			// Registering the role was half of it: its handlers have to connect as
+			// it too, or the DDL creates a role nothing uses and every handler
+			// linked to the database still holds the master.
+			if (credentials) {
+				cluster.connectAs({ user: runtime, password: credentials.runtime });
+			}
 		}
 
 		return cluster;
@@ -363,17 +375,12 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 	},
 
 	/**
-	 * The surface, without its routes.
-	 *
-	 * An API Gateway with no routes 404s everything, and that is the honest
-	 * state: the *surface* is what this kind declares, and mounting handlers on
-	 * it is the endpoint merge that has not landed — routes still reach the
-	 * deploy target through the separate `RouteInfo[]` pipeline.
+	 * The surface, without its routes yet.
 	 *
-	 * Provisioning it anyway is not ceremony. Its address is what a site inlines
-	 * as `VITE_API_URL`, what an auth server puts on its trusted-origin list, and
-	 * what the cookie domain derives from — so everything downstream of the API
-	 * is blocked on the API *existing*, not on it answering.
+	 * Its address is what a site inlines as `VITE_API_URL`, what an auth server
+	 * puts on its trusted-origin list, and what the cookie domain derives from —
+	 * so it is provisioned in order, and its endpoints are mounted by
+	 * {@link mountRoutes} once everything they link to exists.
 	 */
 	'rest-api': (stack, d, props, context) =>
 		new RestApiSurface(stack, d.id, {
@@ -381,10 +388,41 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			callers: context.callers?.get(d.id)?.promise,
 		}),
 
-	secret: (stack, d, props) => new Secret(stack, d.id, props),
+	// Generated on the first deploy and kept in the stage's state, as a server
+	// stage keeps it in its secrets: every later deploy reads the same value
+	// back. One set with `sst secret set` wins over it.
+	secret: (stack, d, props) =>
+		new Secret(stack, d.id, {
+			placeholder: generatedSecret(d.id, d as SecretDeclaration),
+			...(props as SecretProps),
+		}),
 
 	// The same storage as a secret, under a different role — see the component.
 	credential: (stack, d, props) => new Credential(stack, d.id, props),
+
+	// In the stage's region, as mail is: a key in another region is a key
+	// every call crosses the world to reach.
+	encryption: (stack, d, props) =>
+		new Encryption(stack, d.id, {
+			...(props as Partial<EncryptionProps>),
+			region:
+				(props as Partial<EncryptionProps>).region ??
+				$app.providers?.aws?.region ??
+				'us-east-1',
+		}),
+
+	// Nothing to provision: the URL this stage calls, and the credentials kept
+	// as a secret.
+	'external-api': (stack, d, props) => {
+		if (d.kind !== 'external-api') {
+			throw new UnknownDeclarationKind(d.kind, []);
+		}
+
+		return new ExternalApi(stack, d.id, {
+			...(props as Partial<ExternalApiProps>),
+			url: d.url,
+		});
+	},
 };
 
 /**
@@ -565,9 +603,7 @@ function rootCluster(component: Provisioned): Database {
  * printed: one line per route, naming what it can reach.
  *
  * A surface with no routes says so rather than printing nothing, because "no
- * routes yet" and "this printed nothing" look identical otherwise — and for an
- * application's own API that is currently the true state, pending the endpoint
- * merge.
+ * routes" and "this printed nothing" look identical otherwise.
  *
  * Pure, so what gets printed can be asserted without a deploy.
  */
@@ -636,6 +672,8 @@ async function callersOf(
 	id: string,
 	manifest: ConstructManifest,
 	provisioned: ProvisionedManifest,
+	/** The app's name — a mobile caller's scheme base when it gives none. */
+	project: string,
 ): Promise<{ trustedOrigins: string; cookieDomain?: string }> {
 	// Every address here is a Pulumi output, not a string — a CloudFront domain
 	// and an API Gateway endpoint are both known only after their resource
@@ -660,8 +698,17 @@ async function callersOf(
 	const own = await resolved(provisioned[id]?.provides().url);
 	const domain = cookieDomain([...(own ? [own] : []), ...origins]);
 
+	// A mobile caller is reached by its scheme — the bare one, deployed: what
+	// the store build registers.
+	const schemes = dependentsOf(manifest, id).flatMap((caller) => {
+		const app = manifest[caller];
+		return app?.kind === 'mobile-app'
+			? mobileOrigins(schemeBase(project, app.scheme))
+			: [];
+	});
+
 	return {
-		trustedOrigins: origins.join(','),
+		trustedOrigins: [...origins, ...schemes].join(','),
 		...(domain ? { cookieDomain: domain } : {}),
 	};
 }
@@ -711,6 +758,170 @@ export function isServed(id: string, manifest: ConstructManifest): boolean {
 	);
 }
 
+/**
+ * Kinds the in-order pass skips.
+ *
+ * - `mobile-app` ships through EAS and the stores. It is in the manifest for
+ *   what it makes the surfaces trust, which `callersOf` reads off the graph.
+ * - `worker` is a process, not a resource: what it runs is provisioned as
+ *   what it is — a queue's consumer by {@link subscribeConsumers}.
+ * - `cron` and `function` are Lambdas linked to what they depend on, so they
+ *   are provisioned once all of it exists, by {@link provisionCompute}.
+ * - `telemetry` provisions nothing: where it goes is the stage's
+ *   `deploy.telemetry`, a provider somebody else runs.
+ */
+export const PROVISIONED_ELSEWHERE: ReadonlySet<DeclarationKind> =
+	new Set<DeclarationKind>([
+		'mobile-app',
+		'worker',
+		'cron',
+		'function',
+		'telemetry',
+	]);
+
+/**
+ * Every function and cron: a Lambda running the handler the build wrote,
+ * linked to exactly what it depends on, in the database's network when it
+ * reaches one. A cron is that Lambda on its schedule; a function is reached
+ * at its URL, which only callers granted IAM access can invoke.
+ *
+ * After everything else is provisioned, because each links to things
+ * `provisionOrder` does not order before it.
+ */
+export function provisionCompute(
+	stack: StackType,
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): Cron[] {
+	const crons: Cron[] = [];
+
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'function' && declaration?.kind !== 'cron') {
+			continue;
+		}
+
+		const { link } = resolveEdges(declaration.dependencies, provisioned);
+		const vpc = vpcFor(link);
+		const lambda = new Function(
+			stack,
+			declaration.kind === 'cron' ? `${id}Function` : id,
+			{
+				name: stack.logicalPrefixedName(id),
+				handler: declaration.handler,
+				link,
+				...(vpc ? { vpc } : {}),
+				...(declaration.kind === 'function'
+					? { url: { authorization: 'iam' } }
+					: {}),
+			},
+		);
+
+		if (declaration.kind === 'cron') {
+			crons.push(
+				new Cron(stack, id, {
+					processor: lambda,
+					schedule: declaration.schedule as CronSchedule,
+				}),
+			);
+			continue;
+		}
+
+		assertProvides(
+			id,
+			declaration.provides,
+			Object.keys(lambda.provides()).map((role) =>
+				providedKeyFor(id, declaration.kind, role),
+			),
+		);
+		provisioned[id] = lambda;
+	}
+
+	return crons;
+}
+
+/** A provisioned queue: what {@link subscribeConsumers} subscribes through. */
+interface Consumable {
+	consume(consumer: {
+		handler: string;
+		link?: unknown[];
+		vpc?: sst.aws.Vpc;
+	}): unknown;
+}
+
+/**
+ * The network a function has to run in to reach what it links to.
+ *
+ * A database is private to its VPC, so a handler linked to one — or to a
+ * schema tenant or reader of one — runs inside it, or its connection times out.
+ */
+export function vpcFor(link: readonly Provisioned[]): sst.aws.Vpc | undefined {
+	for (const component of link) {
+		const cluster = rootCluster(component);
+		if (cluster instanceof Database) return cluster.vpc;
+	}
+
+	return undefined;
+}
+
+/**
+ * Mount every surface's endpoints — the handlers the build wrote, each linked
+ * to exactly what that endpoint depends on.
+ *
+ * After every construct is provisioned, for the reason consumers are: an
+ * endpoint links to things `provisionOrder` does not order before its surface.
+ */
+export function mountRoutes(
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): void {
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'rest-api') continue;
+
+		const surface = provisioned[id];
+		if (!(surface instanceof RestApiSurface)) continue;
+
+		for (const endpoint of declaration.endpoints) {
+			const { link } = resolveEdges(endpoint.dependencies, provisioned);
+			const vpc = vpcFor(link);
+			surface.mount({
+				method: endpoint.method,
+				path: endpoint.path,
+				handler: endpoint.handler,
+				link,
+				...(vpc ? { vpc } : {}),
+				...(endpoint.authorizer ? { authorizer: endpoint.authorizer } : {}),
+			});
+		}
+	}
+}
+
+/**
+ * Subscribe every queue's one consumer — the handler the build wrote for it,
+ * linked to what that consumer depends on.
+ *
+ * After every construct is provisioned, because a consumer links to things
+ * that `provisionOrder` does not order before the queue.
+ */
+export function subscribeConsumers(
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): void {
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'queue') continue;
+
+		const queue = provisioned[id] as unknown as Consumable | undefined;
+		if (!queue) continue;
+
+		const { link } = resolveEdges(declaration.worker.dependencies, provisioned);
+		const vpc = vpcFor(link);
+		queue.consume({
+			handler: declaration.worker.handler,
+			link,
+			...(vpc ? { vpc } : {}),
+		});
+	}
+}
+
 /** The provisioner for a kind. Pure — the lookup is testable without Pulumi. */
 export function provisionerFor(kind: DeclarationKind): Provisioner {
 	const provisioner = PROVISIONERS[kind];
@@ -749,20 +960,34 @@ export function assertProvides(
  * tenant, a read replica, and the surface over a bucket all resolve an address
  * off something else, and a pass in map order would find it half the time.
  */
-export function fromManifest(
+export function fromManifest<
+	const M extends ConstructManifest,
+	const B extends ManifestBackends = {},
+>(
 	stack: StackType,
-	manifest: ConstructManifest,
-	overrides: ComponentOverrides = {},
+	manifest: M,
+	/**
+	 * Provider-specific props, per construct id — typed from the manifest, so
+	 * only its ids are keys, each takes what its kind's component reads, and
+	 * what the synth cannot guess (a database's `vpc`, mail's `from`) is
+	 * required. See {@link ManifestOverrides}.
+	 *
+	 * Neutral options — `versioned`, `fifo` — travel in the declaration,
+	 * because the app legitimately has an opinion about them. Anything with S3
+	 * in its name does not belong in application code, so it is supplied here.
+	 * A third escape hatch needs no API: the components are returned, so
+	 * `provisioned.Uploads.nodes.bucket` is reachable for anything else.
+	 */
+	overrides: ManifestOverrides<M, B>,
 	/**
 	 * The backend choices that are config rather than declaration.
 	 *
 	 * Defaulted the same way the local target defaults them, so a stage deployed
-	 * without saying gets the same backend a developer ran against.
+	 * without saying gets the same backend a developer ran against. Typed
+	 * literally, because the backend decides what is required above: an
+	 * ElastiCache cache needs a `vpc`, Resend or SMTP mail a `url`.
 	 */
-	backends: {
-		cache?: 'upstash' | 'elasticache' | 'db';
-		email?: 'resend' | 'ses' | 'smtp';
-	} = {},
+	backends: B = {} as B,
 ): ProvisionedManifest {
 	const provisioned: ProvisionedManifest = {};
 
@@ -799,11 +1024,12 @@ export function fromManifest(
 	for (const id of [...rest, ...sites]) {
 		const declaration = manifest[id];
 		if (!declaration) continue;
+		if (PROVISIONED_ELSEWHERE.has(declaration.kind)) continue;
 
 		const component = provisionerFor(declaration.kind)(
 			stack,
 			declaration,
-			overrides[id] ?? {},
+			(overrides as Record<string, Record<string, unknown>>)[id] ?? {},
 			context,
 		);
 
@@ -822,6 +1048,12 @@ export function fromManifest(
 		provisioned[id] = component;
 	}
 
+	// The functions and crons, each queue's one consumer and each surface's
+	// endpoints, once everything they link to exists.
+	provisionCompute(stack, manifest, provisioned);
+	subscribeConsumers(manifest, provisioned);
+	mountRoutes(manifest, provisioned);
+
 	for (const line of describeRoutes(manifest)) console.log(line);
 
 	// Now everything exists, so every surface's callers can be resolved — the
@@ -829,7 +1061,7 @@ export function fromManifest(
 	for (const [id, deferred] of callers) {
 		// Resolved with the promise itself: the addresses it needs are Pulumi
 		// outputs, so the answer arrives when they do.
-		deferred.resolve(callersOf(id, manifest, provisioned));
+		deferred.resolve(callersOf(id, manifest, provisioned, $app.name));
 	}
 
 	// Last, and only now: the roles exist as passwords and secrets from the
@@ -844,6 +1076,30 @@ export function fromManifest(
 	return provisioned;
 }
 
+/**
+ * A secret in its declared format — the alphabet `drawSecret` draws from on
+ * every other stage, with one symbol guaranteed as it guarantees one.
+ *
+ * The format is fixed at the first deploy, as a server stage's is: changing it
+ * would replace the password, and every later deploy is meant to read back the
+ * one it had.
+ */
+function generatedSecret(id: string, format: SecretFormat) {
+	const symbols = [...new Set(format.symbols ?? SECRET_SYMBOLS)].join('');
+
+	return new RandomPassword(
+		`${id}Generated`,
+		{
+			length: format.length ?? SECRET_LENGTH,
+			special: symbols.length > 0,
+			...(symbols ? { overrideSpecial: symbols, minSpecial: 1 } : {}),
+		},
+		{
+			ignoreChanges: ['length', 'special', 'overrideSpecial', 'minSpecial'],
+		},
+	).result;
+}
+
 /** What one function receives from its edges. */
 export interface ResolvedEdges {
 	/** The components it may reach. SST turns these into IAM *and* injects their