@geekmidas/cloud 10.0.0-alpha.5 → 10.0.0-alpha.50

package/src/sst/aws/bootstrap/handler.ts

@@ -28,6 +28,11 @@ export interface BootstrapTenant {
 	runtime: string;
 	owner: string;
 	reader?: string;
+	/**
+	 * The database's own roles rather than a tenant's: its owner may create in
+	 * the database, for trusted extensions.
+	 */
+	ownsDatabase?: boolean;
 	passwords: { runtime: string; owner: string; reader?: string };
 }
 
@@ -75,7 +80,11 @@ export async function handler(event: BootstrapEvent): Promise<BootstrapResult> {
 
 	try {
 		for (const tenant of event.tenants) {
-			for (const statement of roleStatements(tenant)) {
+			const spec = {
+				...tenant,
+				...(tenant.ownsDatabase ? { database: event.master.database } : {}),
+			};
+			for (const statement of roleStatements(spec)) {
 				if (statement.exists) {
 					const { rows } = await client.query(
 						statement.exists.sql,

package/src/sst/fromManifest.ts

@@ -26,10 +26,12 @@ import {
 	cookieDomain,
 	DEFAULT_POSTGRES_VERSION,
 	dependentsOf,
+	mobileOrigins,
 	PUBLIC,
 	PUBLIC_PREFIX,
 	providedKeyFor,
 	provisionOrder,
+	schemeBase,
 } from '@geekmidas/manifest';
 import {
 	Cache,
@@ -39,11 +41,15 @@ import {
 	withCacheTable,
 } from './aws/Cache';
 import { Credential } from './aws/Credential';
-import { Database, DatabaseNeedsVpc } from './aws/Database';
+import { Cron, type CronSchedule } from './aws/Cron';
+import { Database, DatabaseNeedsVpc, type DatabaseProps } from './aws/Database';
 import { DatabaseBootstrap } from './aws/DatabaseBootstrap';
 import { DatabaseReader, DatabaseSchema } from './aws/DerivedDatabase';
 import { Email, EmailNeedsSender } from './aws/Email';
+import { Encryption, type EncryptionProps } from './aws/Encryption';
+import { ExternalApi, type ExternalApiProps } from './aws/ExternalApi';
 import { FileServer } from './aws/FileServer';
+import { Function } from './aws/Function';
 import { ObjectStorage } from './aws/ObjectStorage';
 import { Queue } from './aws/Queue';
 import { RestApiSurface } from './aws/RestApiSurface';
@@ -98,8 +104,8 @@ export interface ProvisionContext {
 	/**
 	 * Where a declared cache lives, and who delivers mail.
 	 *
-	 * Deployment choices rather than declarations, for the same reason
-	 * `services.events` is: the same application code caches into any of them and
+	 * Deployment choices rather than declarations, for the same reason the
+	 * event broker is: the same application code caches into any of them and
 	 * sends through any of them. They reach the provisioner here because it is
 	 * the only place that knows both the choice and the manifest.
 	 */
@@ -220,7 +226,11 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			// rather than whatever Aurora defaults to that month. Local ran 18
 			// while this ran 17.7, and neither was written down anywhere.
 			version: String(d.version ?? DEFAULT_POSTGRES_VERSION),
-			...(props as unknown as sst.aws.PostgresArgs),
+			// `DatabaseProps`, not `sst.aws.PostgresArgs`: the database needs the
+			// `Vpc` component itself (its bootstrap function runs in the same VPC
+			// and needs the security groups too), where RDS would accept bare
+			// subnet ids. TS 7 checks the spread; 6 let the wider type through.
+			...(props as unknown as Omit<DatabaseProps, 'schema'>),
 		});
 
 		// A database needs its own roles, not just its tenants'. Registering only
@@ -232,13 +242,21 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			const bootstrap = bootstrapFor(cluster, d.id, context);
 			const runtime = roleNameFor(d, context);
 
-			bootstrap?.add({
+			const credentials = bootstrap?.add({
 				id: d.id,
 				schema: d.schema,
 				runtime,
 				owner: ownerRole(runtime),
+				ownsDatabase: true,
 				...(hasReader(d.id, context) ? { reader: readerRole(runtime) } : {}),
 			});
+
+			// Registering the role was half of it: its handlers have to connect as
+			// it too, or the DDL creates a role nothing uses and every handler
+			// linked to the database still holds the master.
+			if (credentials) {
+				cluster.connectAs({ user: runtime, password: credentials.runtime });
+			}
 		}
 
 		return cluster;
@@ -363,17 +381,12 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 	},
 
 	/**
-	 * The surface, without its routes.
-	 *
-	 * An API Gateway with no routes 404s everything, and that is the honest
-	 * state: the *surface* is what this kind declares, and mounting handlers on
-	 * it is the endpoint merge that has not landed — routes still reach the
-	 * deploy target through the separate `RouteInfo[]` pipeline.
+	 * The surface, without its routes yet.
 	 *
-	 * Provisioning it anyway is not ceremony. Its address is what a site inlines
-	 * as `VITE_API_URL`, what an auth server puts on its trusted-origin list, and
-	 * what the cookie domain derives from — so everything downstream of the API
-	 * is blocked on the API *existing*, not on it answering.
+	 * Its address is what a site inlines as `VITE_API_URL`, what an auth server
+	 * puts on its trusted-origin list, and what the cookie domain derives from —
+	 * so it is provisioned in order, and its endpoints are mounted by
+	 * {@link mountRoutes} once everything they link to exists.
 	 */
 	'rest-api': (stack, d, props, context) =>
 		new RestApiSurface(stack, d.id, {
@@ -385,6 +398,30 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 
 	// The same storage as a secret, under a different role — see the component.
 	credential: (stack, d, props) => new Credential(stack, d.id, props),
+
+	// In the stage's region, as mail is: a key in another region is a key
+	// every call crosses the world to reach.
+	encryption: (stack, d, props) =>
+		new Encryption(stack, d.id, {
+			...(props as Partial<EncryptionProps>),
+			region:
+				(props as Partial<EncryptionProps>).region ??
+				$app.providers?.aws?.region ??
+				'us-east-1',
+		}),
+
+	// Nothing to provision: the URL this stage calls, and the credentials kept
+	// as a secret.
+	'external-api': (stack, d, props) => {
+		if (d.kind !== 'external-api') {
+			throw new UnknownDeclarationKind(d.kind, []);
+		}
+
+		return new ExternalApi(stack, d.id, {
+			...(props as Partial<ExternalApiProps>),
+			url: d.url,
+		});
+	},
 };
 
 /**
@@ -565,9 +602,7 @@ function rootCluster(component: Provisioned): Database {
  * printed: one line per route, naming what it can reach.
  *
  * A surface with no routes says so rather than printing nothing, because "no
- * routes yet" and "this printed nothing" look identical otherwise — and for an
- * application's own API that is currently the true state, pending the endpoint
- * merge.
+ * routes" and "this printed nothing" look identical otherwise.
  *
  * Pure, so what gets printed can be asserted without a deploy.
  */
@@ -636,6 +671,8 @@ async function callersOf(
 	id: string,
 	manifest: ConstructManifest,
 	provisioned: ProvisionedManifest,
+	/** The app's name — a mobile caller's scheme base when it gives none. */
+	project: string,
 ): Promise<{ trustedOrigins: string; cookieDomain?: string }> {
 	// Every address here is a Pulumi output, not a string — a CloudFront domain
 	// and an API Gateway endpoint are both known only after their resource
@@ -660,8 +697,17 @@ async function callersOf(
 	const own = await resolved(provisioned[id]?.provides().url);
 	const domain = cookieDomain([...(own ? [own] : []), ...origins]);
 
+	// A mobile caller is reached by its scheme — the bare one, deployed: what
+	// the store build registers.
+	const schemes = dependentsOf(manifest, id).flatMap((caller) => {
+		const app = manifest[caller];
+		return app?.kind === 'mobile-app'
+			? mobileOrigins(schemeBase(project, app.scheme))
+			: [];
+	});
+
 	return {
-		trustedOrigins: origins.join(','),
+		trustedOrigins: [...origins, ...schemes].join(','),
 		...(domain ? { cookieDomain: domain } : {}),
 	};
 }
@@ -711,6 +757,162 @@ export function isServed(id: string, manifest: ConstructManifest): boolean {
 	);
 }
 
+/**
+ * Kinds the in-order pass skips.
+ *
+ * - `mobile-app` ships through EAS and the stores. It is in the manifest for
+ *   what it makes the surfaces trust, which `callersOf` reads off the graph.
+ * - `worker` is a process, not a resource: what it runs is provisioned as
+ *   what it is — a queue's consumer by {@link subscribeConsumers}.
+ * - `cron` and `function` are Lambdas linked to what they depend on, so they
+ *   are provisioned once all of it exists, by {@link provisionCompute}.
+ */
+export const PROVISIONED_ELSEWHERE: ReadonlySet<DeclarationKind> =
+	new Set<DeclarationKind>(['mobile-app', 'worker', 'cron', 'function']);
+
+/**
+ * Every function and cron: a Lambda running the handler the build wrote,
+ * linked to exactly what it depends on, in the database's network when it
+ * reaches one. A cron is that Lambda on its schedule; a function is reached
+ * at its URL, which only callers granted IAM access can invoke.
+ *
+ * After everything else is provisioned, because each links to things
+ * `provisionOrder` does not order before it.
+ */
+export function provisionCompute(
+	stack: StackType,
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): Cron[] {
+	const crons: Cron[] = [];
+
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'function' && declaration?.kind !== 'cron') {
+			continue;
+		}
+
+		const { link } = resolveEdges(declaration.dependencies, provisioned);
+		const vpc = vpcFor(link);
+		const lambda = new Function(
+			stack,
+			declaration.kind === 'cron' ? `${id}Function` : id,
+			{
+				name: stack.logicalPrefixedName(id),
+				handler: declaration.handler,
+				link,
+				...(vpc ? { vpc } : {}),
+				...(declaration.kind === 'function'
+					? { url: { authorization: 'iam' } }
+					: {}),
+			},
+		);
+
+		if (declaration.kind === 'cron') {
+			crons.push(
+				new Cron(stack, id, {
+					processor: lambda,
+					schedule: declaration.schedule as CronSchedule,
+				}),
+			);
+			continue;
+		}
+
+		assertProvides(
+			id,
+			declaration.provides,
+			Object.keys(lambda.provides()).map((role) =>
+				providedKeyFor(id, declaration.kind, role),
+			),
+		);
+		provisioned[id] = lambda;
+	}
+
+	return crons;
+}
+
+/** A provisioned queue: what {@link subscribeConsumers} subscribes through. */
+interface Consumable {
+	consume(consumer: {
+		handler: string;
+		link?: unknown[];
+		vpc?: sst.aws.Vpc;
+	}): unknown;
+}
+
+/**
+ * The network a function has to run in to reach what it links to.
+ *
+ * A database is private to its VPC, so a handler linked to one — or to a
+ * schema tenant or reader of one — runs inside it, or its connection times out.
+ */
+export function vpcFor(link: readonly Provisioned[]): sst.aws.Vpc | undefined {
+	for (const component of link) {
+		const cluster = rootCluster(component);
+		if (cluster instanceof Database) return cluster.vpc;
+	}
+
+	return undefined;
+}
+
+/**
+ * Mount every surface's endpoints — the handlers the build wrote, each linked
+ * to exactly what that endpoint depends on.
+ *
+ * After every construct is provisioned, for the reason consumers are: an
+ * endpoint links to things `provisionOrder` does not order before its surface.
+ */
+export function mountRoutes(
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): void {
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'rest-api') continue;
+
+		const surface = provisioned[id];
+		if (!(surface instanceof RestApiSurface)) continue;
+
+		for (const endpoint of declaration.endpoints) {
+			const { link } = resolveEdges(endpoint.dependencies, provisioned);
+			const vpc = vpcFor(link);
+			surface.mount({
+				method: endpoint.method,
+				path: endpoint.path,
+				handler: endpoint.handler,
+				link,
+				...(vpc ? { vpc } : {}),
+				...(endpoint.authorizer ? { authorizer: endpoint.authorizer } : {}),
+			});
+		}
+	}
+}
+
+/**
+ * Subscribe every queue's one consumer — the handler the build wrote for it,
+ * linked to what that consumer depends on.
+ *
+ * After every construct is provisioned, because a consumer links to things
+ * that `provisionOrder` does not order before the queue.
+ */
+export function subscribeConsumers(
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): void {
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'queue') continue;
+
+		const queue = provisioned[id] as unknown as Consumable | undefined;
+		if (!queue) continue;
+
+		const { link } = resolveEdges(declaration.worker.dependencies, provisioned);
+		const vpc = vpcFor(link);
+		queue.consume({
+			handler: declaration.worker.handler,
+			link,
+			...(vpc ? { vpc } : {}),
+		});
+	}
+}
+
 /** The provisioner for a kind. Pure — the lookup is testable without Pulumi. */
 export function provisionerFor(kind: DeclarationKind): Provisioner {
 	const provisioner = PROVISIONERS[kind];
@@ -799,6 +1001,7 @@ export function fromManifest(
 	for (const id of [...rest, ...sites]) {
 		const declaration = manifest[id];
 		if (!declaration) continue;
+		if (PROVISIONED_ELSEWHERE.has(declaration.kind)) continue;
 
 		const component = provisionerFor(declaration.kind)(
 			stack,
@@ -822,6 +1025,12 @@ export function fromManifest(
 		provisioned[id] = component;
 	}
 
+	// The functions and crons, each queue's one consumer and each surface's
+	// endpoints, once everything they link to exists.
+	provisionCompute(stack, manifest, provisioned);
+	subscribeConsumers(manifest, provisioned);
+	mountRoutes(manifest, provisioned);
+
 	for (const line of describeRoutes(manifest)) console.log(line);
 
 	// Now everything exists, so every surface's callers can be resolved — the
@@ -829,7 +1038,7 @@ export function fromManifest(
 	for (const [id, deferred] of callers) {
 		// Resolved with the promise itself: the addresses it needs are Pulumi
 		// outputs, so the answer arrives when they do.
-		deferred.resolve(callersOf(id, manifest, provisioned));
+		deferred.resolve(callersOf(id, manifest, provisioned, $app.name));
 	}
 
 	// Last, and only now: the roles exist as passwords and secrets from the

package/src/sst/index.ts

@@ -34,6 +34,7 @@ export {
 } from './aws/DatabaseBootstrap';
 export { DatabaseReader, DatabaseSchema } from './aws/DerivedDatabase';
 export { Email, EmailNeedsUrl, type EmailProps } from './aws/Email';
+export { Encryption, type EncryptionProps } from './aws/Encryption';
 export { FileServer, type FileServerProps } from './aws/FileServer';
 export { Function, type FunctionProps } from './aws/Function';
 export {

package/dist/index-B5CZ1xVf.d.cts

@@ -1,64 +0,0 @@
-//#region src/utils/index.d.ts
-declare function getLocalIpAddress(): string | null;
-declare function environmentCase(name: string): string;
-declare enum ResourceType {
-  ApiGatewayV2 = "sst.aws.ApiGatewayV2",
-  Postgres = "sst.aws.Postgres",
-  Function = "sst.aws.Function",
-  ObjectStorage = "sst.aws.Bucket",
-  Vpc = "sst.aws.Vpc",
-  Secret = "sst.sst.Secret",
-  SSTSecret = "sst:sst:Secret",
-  SSTFunction = "sst:sst:Function",
-  SSTApiGatewayV2 = "sst:aws:ApiGatewayV2",
-  SSTPostgres = "sst:aws:Postgres",
-  SSTObjectStorage = "sst:aws:Bucket",
-  SnsTopic = "sst:aws:SnsTopic",
-}
-declare function buildResourceEnv(record: Record<string, Resource | string>): Record<string, string>;
-/**
- * SST links a resource under one of two spellings — `sst.aws.Bucket` when it
- * comes from the state file, `sst:aws:Bucket` when it comes from the runtime —
- * and `processors` has always handled both. Only the dotted half was admitted
- * here, so the colon half could not be passed to `buildResourceEnv` without a
- * cast, and `SnsTopic` was missing from `Resource` altogether despite being the
- * only thing that produces `*_ARN`.
- */
-type ApiGatewayV2 = {
-  type: ResourceType.ApiGatewayV2 | ResourceType.SSTApiGatewayV2;
-  url: string;
-};
-type Postgres = {
-  database: string;
-  host: string;
-  password: string;
-  port: number;
-  type: ResourceType.Postgres | ResourceType.SSTPostgres;
-  username: string;
-};
-type Function = {
-  name: string;
-  type: ResourceType.Function | ResourceType.SSTFunction;
-};
-type Bucket = {
-  name: string;
-  type: ResourceType.ObjectStorage | ResourceType.SSTObjectStorage;
-};
-type SnsTopic = {
-  arn: string;
-  type: ResourceType.SnsTopic;
-};
-type Vpc = {
-  bastion: string;
-  type: ResourceType.Vpc;
-};
-type Secret = {
-  type: ResourceType.Secret | ResourceType.SSTSecret;
-  value: string;
-};
-type Resource = ApiGatewayV2 | Postgres | Function | Bucket | SnsTopic | Vpc | Secret;
-type ResourceProcessor<K extends Resource> = (name: string, value: K) => Record<string, string | number>;
-//# sourceMappingURL=index.d.ts.map
-//#endregion
-export { ApiGatewayV2, Bucket, Function, Postgres, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, Vpc, buildResourceEnv, environmentCase, getLocalIpAddress };
-//# sourceMappingURL=index-B5CZ1xVf.d.cts.map

package/dist/index-B5CZ1xVf.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-B5CZ1xVf.d.cts","names":[],"sources":["../src/utils/index.ts"],"sourcesContent":[],"mappings":";iBAGgB,iBAAA,CAAA;AAAA,iBAcA,eAAA,CAdiB,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAcjB,aAOJ,YAAA;EAAA,YAAA,GAAY,sBAAA;EA+DR,QAAA,GAAA,kBAAgB;EAAA,QAAA,GAAA,kBAAA;EAAA,aACR,GAAA,gBAAA;EAAQ,GAAvB,GAAA,aAAA;EAAM,MACZ,GAAA,gBAAA;EAAM,SAAA,GAAA,gBAAA;EA0BG,WAAA,GAAA,kBAAY;EAAA,eAAA,GAAA,sBAAA;EAAA,WACjB,GAAA,kBAAa;EAAY,gBAAgB,GAAA,gBAAA;EAAe,QAAA,GAAA,kBAAA;AAI/D;AAAoB,iBAjCJ,gBAAA,CAiCI,MAAA,EAhCX,MAgCW,CAAA,MAAA,EAhCI,QAgCJ,GAAA,MAAA,CAAA,CAAA,EA/BjB,MA+BiB,CAAA,MAAA,EAAA,MAAA,CAAA;;;AAKmC;AAIvD;;;;AAEuD;AAG3C,KAnBA,YAAA,GAmBM;EAAA,IAAA,EAlBX,YAAA,CAAa,YAkBF,GAlBiB,YAAA,CAAa,eAkB9B;EAAA,GAEX,EAAA,MAAA;CAA0B;AAAgC,KAhBrD,QAAA,GAgBqD;EAGrD,QAAA,EAAA,MAAQ;EAKR,IAAA,EAAG,MAAA;EAKH,QAAA,EAAM,MAAA;EAAA,IAAA,EAAA,MAAA;EAAA,IACX,EAzBA,YAAA,CAAa,QAyBA,GAzBW,YAAA,CAAa,WAyBxB;EAAM,QAAG,EAAA,MAAa;AAAS,CAAA;AAIvC,KAzBA,QAAA,GAyBQ;EAAA,IAAA,EAAA,MAAA;EAAA,IACjB,EAxBI,YAAA,CAAa,QAwBjB,GAxB4B,YAAA,CAAa,WAwBzC;CAAY;AAEZ,KAvBS,MAAA,GAuBT;EAAQ,IACR,EAAA,MAAA;EAAM,IACN,EAvBI,YAAA,CAAa,aAuBjB,GAvBiC,YAAA,CAAa,gBAuB9C;CAAQ;AAER,KAtBS,QAAA,GAsBT;EAAM,GAAA,EAAA,MAAA;EAEG,IAAA,EAtBL,YAAA,CAAa,QAsBS;CAAA;AAAW,KAnB5B,GAAA,GAmB4B;EAAQ,OAExC,EAAA,MAAA;EAAC,IACJ,EApBE,YAAA,CAAa,GAoBf;AAAM,CAAA;KAjBC,MAAA;QACL,YAAA,CAAa,SAAS,YAAA,CAAa;;;KAI9B,QAAA,GACT,eACA,WACA,WACA,SACA,WACA,MACA;KAES,4BAA4B,kCAEhC,MACH"}

package/dist/index-DhHRjduZ.d.mts

@@ -1,64 +0,0 @@
-//#region src/utils/index.d.ts
-declare function getLocalIpAddress(): string | null;
-declare function environmentCase(name: string): string;
-declare enum ResourceType {
-  ApiGatewayV2 = "sst.aws.ApiGatewayV2",
-  Postgres = "sst.aws.Postgres",
-  Function = "sst.aws.Function",
-  ObjectStorage = "sst.aws.Bucket",
-  Vpc = "sst.aws.Vpc",
-  Secret = "sst.sst.Secret",
-  SSTSecret = "sst:sst:Secret",
-  SSTFunction = "sst:sst:Function",
-  SSTApiGatewayV2 = "sst:aws:ApiGatewayV2",
-  SSTPostgres = "sst:aws:Postgres",
-  SSTObjectStorage = "sst:aws:Bucket",
-  SnsTopic = "sst:aws:SnsTopic",
-}
-declare function buildResourceEnv(record: Record<string, Resource | string>): Record<string, string>;
-/**
- * SST links a resource under one of two spellings — `sst.aws.Bucket` when it
- * comes from the state file, `sst:aws:Bucket` when it comes from the runtime —
- * and `processors` has always handled both. Only the dotted half was admitted
- * here, so the colon half could not be passed to `buildResourceEnv` without a
- * cast, and `SnsTopic` was missing from `Resource` altogether despite being the
- * only thing that produces `*_ARN`.
- */
-type ApiGatewayV2 = {
-  type: ResourceType.ApiGatewayV2 | ResourceType.SSTApiGatewayV2;
-  url: string;
-};
-type Postgres = {
-  database: string;
-  host: string;
-  password: string;
-  port: number;
-  type: ResourceType.Postgres | ResourceType.SSTPostgres;
-  username: string;
-};
-type Function = {
-  name: string;
-  type: ResourceType.Function | ResourceType.SSTFunction;
-};
-type Bucket = {
-  name: string;
-  type: ResourceType.ObjectStorage | ResourceType.SSTObjectStorage;
-};
-type SnsTopic = {
-  arn: string;
-  type: ResourceType.SnsTopic;
-};
-type Vpc = {
-  bastion: string;
-  type: ResourceType.Vpc;
-};
-type Secret = {
-  type: ResourceType.Secret | ResourceType.SSTSecret;
-  value: string;
-};
-type Resource = ApiGatewayV2 | Postgres | Function | Bucket | SnsTopic | Vpc | Secret;
-type ResourceProcessor<K extends Resource> = (name: string, value: K) => Record<string, string | number>;
-//# sourceMappingURL=index.d.ts.map
-//#endregion
-export { ApiGatewayV2, Bucket, Function, Postgres, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, Vpc, buildResourceEnv, environmentCase, getLocalIpAddress };
-//# sourceMappingURL=index-DhHRjduZ.d.mts.map

package/dist/index-DhHRjduZ.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-DhHRjduZ.d.mts","names":[],"sources":["../src/utils/index.ts"],"sourcesContent":[],"mappings":";iBAGgB,iBAAA,CAAA;AAAA,iBAcA,eAAA,CAdiB,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAcjB,aAOJ,YAAA;EAAA,YAAA,GAAY,sBAAA;EA+DR,QAAA,GAAA,kBAAgB;EAAA,QAAA,GAAA,kBAAA;EAAA,aACR,GAAA,gBAAA;EAAQ,GAAvB,GAAA,aAAA;EAAM,MACZ,GAAA,gBAAA;EAAM,SAAA,GAAA,gBAAA;EA0BG,WAAA,GAAA,kBAAY;EAAA,eAAA,GAAA,sBAAA;EAAA,WACjB,GAAA,kBAAa;EAAY,gBAAgB,GAAA,gBAAA;EAAe,QAAA,GAAA,kBAAA;AAI/D;AAAoB,iBAjCJ,gBAAA,CAiCI,MAAA,EAhCX,MAgCW,CAAA,MAAA,EAhCI,QAgCJ,GAAA,MAAA,CAAA,CAAA,EA/BjB,MA+BiB,CAAA,MAAA,EAAA,MAAA,CAAA;;;AAKmC;AAIvD;;;;AAEuD;AAG3C,KAnBA,YAAA,GAmBM;EAAA,IAAA,EAlBX,YAAA,CAAa,YAkBF,GAlBiB,YAAA,CAAa,eAkB9B;EAAA,GAEX,EAAA,MAAA;CAA0B;AAAgC,KAhBrD,QAAA,GAgBqD;EAGrD,QAAA,EAAA,MAAQ;EAKR,IAAA,EAAG,MAAA;EAKH,QAAA,EAAM,MAAA;EAAA,IAAA,EAAA,MAAA;EAAA,IACX,EAzBA,YAAA,CAAa,QAyBA,GAzBW,YAAA,CAAa,WAyBxB;EAAM,QAAG,EAAA,MAAa;AAAS,CAAA;AAIvC,KAzBA,QAAA,GAyBQ;EAAA,IAAA,EAAA,MAAA;EAAA,IACjB,EAxBI,YAAA,CAAa,QAwBjB,GAxB4B,YAAA,CAAa,WAwBzC;CAAY;AAEZ,KAvBS,MAAA,GAuBT;EAAQ,IACR,EAAA,MAAA;EAAM,IACN,EAvBI,YAAA,CAAa,aAuBjB,GAvBiC,YAAA,CAAa,gBAuB9C;CAAQ;AAER,KAtBS,QAAA,GAsBT;EAAM,GAAA,EAAA,MAAA;EAEG,IAAA,EAtBL,YAAA,CAAa,QAsBS;CAAA;AAAW,KAnB5B,GAAA,GAmB4B;EAAQ,OAExC,EAAA,MAAA;EAAC,IACJ,EApBE,YAAA,CAAa,GAoBf;AAAM,CAAA;KAjBC,MAAA;QACL,YAAA,CAAa,SAAS,YAAA,CAAa;;;KAI9B,QAAA,GACT,eACA,WACA,WACA,SACA,WACA,MACA;KAES,4BAA4B,kCAEhC,MACH"}

package/dist/utils-B1a2UuEO.cjs

@@ -1,129 +0,0 @@
-//#region rolldown:runtime
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-
-//#endregion
-const node_os = __toESM(require("node:os"));
-const lodash_snakecase = __toESM(require("lodash.snakecase"));
-
-//#region src/utils/index.ts
-function getLocalIpAddress() {
-	const networkInterfaces = node_os.default.networkInterfaces();
-	for (const interfaceName in networkInterfaces) {
-		const addresses = networkInterfaces[interfaceName] || [];
-		for (const addressInfo of addresses) if (addressInfo.family === "IPv4" && !addressInfo.internal) return addressInfo.address;
-	}
-	return null;
-}
-function environmentCase(name) {
-	return (0, lodash_snakecase.default)(name).toUpperCase().replace(/_\d+/g, (r) => {
-		return r.replace("_", "");
-	});
-}
-let ResourceType = /* @__PURE__ */ function(ResourceType$1) {
-	ResourceType$1["ApiGatewayV2"] = "sst.aws.ApiGatewayV2";
-	ResourceType$1["Postgres"] = "sst.aws.Postgres";
-	ResourceType$1["Function"] = "sst.aws.Function";
-	ResourceType$1["ObjectStorage"] = "sst.aws.Bucket";
-	ResourceType$1["Vpc"] = "sst.aws.Vpc";
-	ResourceType$1["Secret"] = "sst.sst.Secret";
-	ResourceType$1["SSTSecret"] = "sst:sst:Secret";
-	ResourceType$1["SSTFunction"] = "sst:sst:Function";
-	ResourceType$1["SSTApiGatewayV2"] = "sst:aws:ApiGatewayV2";
-	ResourceType$1["SSTPostgres"] = "sst:aws:Postgres";
-	ResourceType$1["SSTObjectStorage"] = "sst:aws:Bucket";
-	ResourceType$1["SnsTopic"] = "sst:aws:SnsTopic";
-	return ResourceType$1;
-}({});
-const secret = (name, value) => ({ [environmentCase(name)]: value.value });
-const postgres = (key, value) => {
-	const prefix = `${environmentCase(key)}`;
-	return {
-		[`${prefix}_NAME`]: value.database,
-		[`${prefix}_HOST`]: value.host,
-		[`${prefix}_PASSWORD`]: value.password,
-		[`${prefix}_PORT`]: value.port,
-		[`${prefix}_USERNAME`]: value.username
-	};
-};
-const bucket = (name, value) => {
-	const prefix = `${environmentCase(name)}`;
-	return { [`${prefix}_NAME`]: value.name };
-};
-const topic = (name, value) => {
-	const prefix = `${environmentCase(name)}`;
-	const key = `${prefix}_ARN`;
-	return { [key]: value.arn };
-};
-const noop = (_name, _value) => ({});
-const processors = {
-	[ResourceType.ApiGatewayV2]: noop,
-	[ResourceType.Function]: noop,
-	[ResourceType.Vpc]: noop,
-	[ResourceType.Secret]: secret,
-	[ResourceType.Postgres]: postgres,
-	[ResourceType.ObjectStorage]: bucket,
-	[ResourceType.SSTSecret]: secret,
-	[ResourceType.SSTObjectStorage]: bucket,
-	[ResourceType.SSTFunction]: noop,
-	[ResourceType.SSTPostgres]: postgres,
-	[ResourceType.SSTApiGatewayV2]: noop,
-	[ResourceType.SnsTopic]: topic
-};
-function buildResourceEnv(record) {
-	const env = {};
-	for (const [k, value] of Object.entries(record)) {
-		if (typeof value === "string") {
-			env[environmentCase(k)] = value;
-			continue;
-		}
-		const processor = processors[value.type];
-		if (processor) Object.assign(env, processor(k, value));
-	}
-	return env;
-}
-
-//#endregion
-Object.defineProperty(exports, 'ResourceType', {
-  enumerable: true,
-  get: function () {
-    return ResourceType;
-  }
-});
-Object.defineProperty(exports, 'buildResourceEnv', {
-  enumerable: true,
-  get: function () {
-    return buildResourceEnv;
-  }
-});
-Object.defineProperty(exports, 'environmentCase', {
-  enumerable: true,
-  get: function () {
-    return environmentCase;
-  }
-});
-Object.defineProperty(exports, 'getLocalIpAddress', {
-  enumerable: true,
-  get: function () {
-    return getLocalIpAddress;
-  }
-});
-//# sourceMappingURL=utils-B1a2UuEO.cjs.map

package/dist/utils-B1a2UuEO.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils-B1a2UuEO.cjs","names":["name: string","value: Secret","key: string","value: Postgres","value: Bucket","value: SnsTopic","_name: string","_value: any","processors: Record<ResourceType, ResourceProcessor<any>>","record: Record<string, Resource | string>","env: Record<string, string>"],"sources":["../src/utils/index.ts"],"sourcesContent":["import os from 'node:os';\nimport snakecase from 'lodash.snakecase';\n\nexport function getLocalIpAddress() {\n\tconst networkInterfaces = os.networkInterfaces();\n\tfor (const interfaceName in networkInterfaces) {\n\t\tconst addresses = networkInterfaces[interfaceName] || [];\n\t\tfor (const addressInfo of addresses) {\n\t\t\t// Look for an IPv4 address that is not internal (loopback)\n\t\t\tif (addressInfo.family === 'IPv4' && !addressInfo.internal) {\n\t\t\t\treturn addressInfo.address;\n\t\t\t}\n\t\t}\n\t}\n\treturn null; // No suitable IP address found\n}\n\nexport function environmentCase(name: string) {\n\treturn snakecase(name)\n\t\t.toUpperCase()\n\t\t.replace(/_\\d+/g, (r) => {\n\t\t\treturn r.replace('_', '');\n\t\t});\n}\nexport enum ResourceType {\n\tApiGatewayV2 = 'sst.aws.ApiGatewayV2',\n\tPostgres = 'sst.aws.Postgres',\n\tFunction = 'sst.aws.Function',\n\tObjectStorage = 'sst.aws.Bucket',\n\tVpc = 'sst.aws.Vpc',\n\tSecret = 'sst.sst.Secret',\n\tSSTSecret = 'sst:sst:Secret',\n\tSSTFunction = 'sst:sst:Function',\n\tSSTApiGatewayV2 = 'sst:aws:ApiGatewayV2',\n\tSSTPostgres = 'sst:aws:Postgres',\n\tSSTObjectStorage = 'sst:aws:Bucket',\n\tSnsTopic = 'sst:aws:SnsTopic',\n}\n\nconst secret = (name: string, value: Secret) => ({\n\t[environmentCase(name)]: value.value,\n});\nconst postgres = (key: string, value: Postgres) => {\n\tconst prefix = `${environmentCase(key)}`;\n\treturn {\n\t\t[`${prefix}_NAME`]: value.database,\n\t\t[`${prefix}_HOST`]: value.host,\n\t\t[`${prefix}_PASSWORD`]: value.password,\n\t\t[`${prefix}_PORT`]: value.port,\n\t\t[`${prefix}_USERNAME`]: value.username,\n\t};\n};\n\nconst bucket = (name: string, value: Bucket) => {\n\tconst prefix = `${environmentCase(name)}`;\n\treturn {\n\t\t[`${prefix}_NAME`]: value.name,\n\t};\n};\n\nconst topic = (name: string, value: SnsTopic) => {\n\tconst prefix = `${environmentCase(name)}`;\n\tconst key = `${prefix}_ARN`;\n\n\treturn {\n\t\t[key]: value.arn,\n\t};\n};\n\nconst noop = (_name: string, _value: any) => ({});\n\nconst processors: Record<ResourceType, ResourceProcessor<any>> = {\n\t[ResourceType.ApiGatewayV2]: noop,\n\t[ResourceType.Function]: noop,\n\t[ResourceType.Vpc]: noop,\n\t[ResourceType.Secret]: secret,\n\t[ResourceType.Postgres]: postgres,\n\t[ResourceType.ObjectStorage]: bucket,\n\n\t[ResourceType.SSTSecret]: secret,\n\t[ResourceType.SSTObjectStorage]: bucket,\n\t[ResourceType.SSTFunction]: noop,\n\t[ResourceType.SSTPostgres]: postgres,\n\t[ResourceType.SSTApiGatewayV2]: noop,\n\t[ResourceType.SnsTopic]: topic,\n};\n\nexport function buildResourceEnv(\n\trecord: Record<string, Resource | string>,\n): Record<string, string> {\n\tconst env: Record<string, string> = {};\n\tfor (const [k, value] of Object.entries(record)) {\n\t\tif (typeof value === 'string') {\n\t\t\tenv[environmentCase(k)] = value;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst processor = processors[value.type];\n\t\tif (processor) {\n\t\t\tObject.assign(env, processor(k, value));\n\t\t} else {\n\t\t}\n\t}\n\n\treturn env;\n}\n\n/**\n * SST links a resource under one of two spellings — `sst.aws.Bucket` when it\n * comes from the state file, `sst:aws:Bucket` when it comes from the runtime —\n * and `processors` has always handled both. Only the dotted half was admitted\n * here, so the colon half could not be passed to `buildResourceEnv` without a\n * cast, and `SnsTopic` was missing from `Resource` altogether despite being the\n * only thing that produces `*_ARN`.\n */\nexport type ApiGatewayV2 = {\n\ttype: ResourceType.ApiGatewayV2 | ResourceType.SSTApiGatewayV2;\n\turl: string;\n};\n\nexport type Postgres = {\n\tdatabase: string;\n\thost: string;\n\tpassword: string;\n\tport: number;\n\ttype: ResourceType.Postgres | ResourceType.SSTPostgres;\n\tusername: string;\n};\n\nexport type Function = {\n\tname: string;\n\ttype: ResourceType.Function | ResourceType.SSTFunction;\n};\n\nexport type Bucket = {\n\tname: string;\n\ttype: ResourceType.ObjectStorage | ResourceType.SSTObjectStorage;\n};\n\nexport type SnsTopic = {\n\tarn: string;\n\ttype: ResourceType.SnsTopic;\n};\n\nexport type Vpc = {\n\tbastion: string;\n\ttype: ResourceType.Vpc;\n};\n\nexport type Secret = {\n\ttype: ResourceType.Secret | ResourceType.SSTSecret;\n\tvalue: string;\n};\n\nexport type Resource =\n\t| ApiGatewayV2\n\t| Postgres\n\t| Function\n\t| Bucket\n\t| SnsTopic\n\t| Vpc\n\t| Secret;\n\nexport type ResourceProcessor<K extends Resource> = (\n\tname: string,\n\tvalue: K,\n) => Record<string, string | number>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,SAAgB,oBAAoB;CACnC,MAAM,oBAAoB,gBAAG,mBAAmB;AAChD,MAAK,MAAM,iBAAiB,mBAAmB;EAC9C,MAAM,YAAY,kBAAkB,kBAAkB,CAAE;AACxD,OAAK,MAAM,eAAe,UAEzB,KAAI,YAAY,WAAW,WAAW,YAAY,SACjD,QAAO,YAAY;CAGrB;AACD,QAAO;AACP;AAED,SAAgB,gBAAgBA,MAAc;AAC7C,QAAO,8BAAU,KAAK,CACpB,aAAa,CACb,QAAQ,SAAS,CAAC,MAAM;AACxB,SAAO,EAAE,QAAQ,KAAK,GAAG;CACzB,EAAC;AACH;AACD,IAAY,wDAAL;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACA;AAED,MAAM,SAAS,CAACA,MAAcC,WAAmB,GAC/C,gBAAgB,KAAK,GAAG,MAAM,MAC/B;AACD,MAAM,WAAW,CAACC,KAAaC,UAAoB;CAClD,MAAM,UAAU,EAAE,gBAAgB,IAAI,CAAC;AACvC,QAAO;IACJ,EAAE,OAAO,SAAS,MAAM;IACxB,EAAE,OAAO,SAAS,MAAM;IACxB,EAAE,OAAO,aAAa,MAAM;IAC5B,EAAE,OAAO,SAAS,MAAM;IACxB,EAAE,OAAO,aAAa,MAAM;CAC9B;AACD;AAED,MAAM,SAAS,CAACH,MAAcI,UAAkB;CAC/C,MAAM,UAAU,EAAE,gBAAgB,KAAK,CAAC;AACxC,QAAO,IACJ,EAAE,OAAO,SAAS,MAAM,KAC1B;AACD;AAED,MAAM,QAAQ,CAACJ,MAAcK,UAAoB;CAChD,MAAM,UAAU,EAAE,gBAAgB,KAAK,CAAC;CACxC,MAAM,OAAO,EAAE,OAAO;AAEtB,QAAO,GACL,MAAM,MAAM,IACb;AACD;AAED,MAAM,OAAO,CAACC,OAAeC,YAAiB,CAAE;AAEhD,MAAMC,aAA2D;EAC/D,aAAa,eAAe;EAC5B,aAAa,WAAW;EACxB,aAAa,MAAM;EACnB,aAAa,SAAS;EACtB,aAAa,WAAW;EACxB,aAAa,gBAAgB;EAE7B,aAAa,YAAY;EACzB,aAAa,mBAAmB;EAChC,aAAa,cAAc;EAC3B,aAAa,cAAc;EAC3B,aAAa,kBAAkB;EAC/B,aAAa,WAAW;AACzB;AAED,SAAgB,iBACfC,QACyB;CACzB,MAAMC,MAA8B,CAAE;AACtC,MAAK,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,QAAQ,OAAO,EAAE;AAChD,aAAW,UAAU,UAAU;AAC9B,OAAI,gBAAgB,EAAE,IAAI;AAC1B;EACA;EAED,MAAM,YAAY,WAAW,MAAM;AACnC,MAAI,UACH,QAAO,OAAO,KAAK,UAAU,GAAG,MAAM,CAAC;CAGxC;AAED,QAAO;AACP"}