@geekmidas/cloud 10.0.0-alpha.9 → 10.0.0-alpha.91

package/src/sst/aws/Function.ts

@@ -1,9 +1,4 @@
 import type { EnvValidator, ValidationResult } from '@geekmidas/envkit/sst';
-import {
-	type FunctionInfo,
-	flattenManifestField,
-	type ManifestField,
-} from '@geekmidas/manifest';
 import { type GkmLinkable, ResourceType } from '../Linkable';
 import { LinkedEnvironment } from '../LinkedEnvironment';
 import type { StackType } from '../Stack';
@@ -66,9 +61,10 @@ export class Function<
 		super(id, {
 			...fnArgs,
 			environment: mergedEnvironment,
-			// Linking is managed via the `links`/`envVars` flow, so this overrides
-			// any native `link` passed through `fnArgs`.
-			link: linked.resolveLink(envVars),
+			// Resolved from `links` when `envVars` names what it needs; otherwise
+			// the `link` it was given — the edges a manifest declared.
+			link:
+				envVars.length > 0 ? linked.resolveLink(envVars) : (fnArgs.link ?? []),
 			runtime: runtime ?? 'nodejs24.x',
 			logging: logging ?? { format: 'json' },
 		});
@@ -78,40 +74,15 @@ export class Function<
 		this.envVars = envVars;
 	}
 
+	/** Its address, for whatever declared an edge to it. */
+	provides(): Record<string, $util.Input<string>> {
+		return { url: this.url };
+	}
+
 	/** Re-runs validation and returns the result (does not throw). */
 	validate(): ValidationResult {
 		return this.validator.validate(this.envVars);
 	}
-
-	/**
-	 * Build one `Function` per entry in a `gkm build` manifest's `functions`
-	 * field (flat or partitioned). Shared `props` (e.g. `links`) apply to every
-	 * function.
-	 *
-	 * ```ts
-	 * Function.fromManifest(stack, manifest.functions, { links: [db] });
-	 * ```
-	 */
-	static fromManifest<
-		TStage extends string = string,
-		TDomain extends string = string,
-	>(
-		stack: StackType<TStage, TDomain>,
-		functions: ManifestField<FunctionInfo>,
-		props: Omit<FunctionProps, 'handler'> = {},
-	): Function<TStage, TDomain>[] {
-		return flattenManifestField(functions).map(
-			(fn) =>
-				new Function(stack, fn.name, {
-					...props,
-					name: stack.logicalPrefixedName(fn.name),
-					handler: fn.handler,
-					envVars: fn.environment,
-					timeout: fn.timeout ? `${fn.timeout} seconds` : undefined,
-					memory: fn.memorySize ? `${fn.memorySize} MB` : undefined,
-				}),
-		);
-	}
 }
 
 export interface FunctionProps extends sst.aws.FunctionArgs {

package/src/sst/aws/Queue.ts

@@ -11,7 +11,8 @@ import type { StackType } from '../Stack';
  * work queue. Link it to a producer and the runtime resolves `<NAME>_URL`,
  * `<NAME>_ARN`, and a `<NAME>_PUBLISHER_CONNECTION_STRING` (`sqs://?queueUrl=…`)
  * that `@geekmidas/events`'s `Publisher.fromConnectionString` consumes. Its
- * single consumer is wired by `QueueSubscriber`.
+ * one consumer — the handler the queue was declared with — is subscribed by
+ * {@link Queue.consume}.
  *
  * SST's native `Queue` link exposes only `url`, so `getSSTLink` is overridden to
  * also expose `arn` (what the resolver needs). `QueueProps` extends
@@ -73,6 +74,26 @@ export class Queue<
 		};
 	}
 
+	/**
+	 * Subscribe the queue's one consumer: a Lambda running `handler`, linked to
+	 * what the consumer depends on and to this queue itself.
+	 *
+	 * A queue has exactly one consumer, so this is called once per queue — by
+	 * `fromManifest`, from the handler the build wrote for it.
+	 */
+	consume(consumer: QueueConsumer) {
+		return this.subscribe(
+			{
+				handler: consumer.handler,
+				link: [this, ...(consumer.link ?? [])],
+				runtime: 'nodejs24.x',
+				...(consumer.vpc ? { vpc: consumer.vpc } : {}),
+				...(consumer.timeout ? { timeout: consumer.timeout } : {}),
+			},
+			consumer.batchSize ? { batch: { size: consumer.batchSize } } : {},
+		);
+	}
+
 	override getSSTLink() {
 		const link = super.getSSTLink();
 		return {
@@ -82,6 +103,18 @@ export class Queue<
 	}
 }
 
+/** The queue's one consumer, as {@link Queue.consume} subscribes it. */
+export interface QueueConsumer {
+	/** The built handler — `apps/api/.gkm/aws/queues/emails.handler`. */
+	handler: string;
+	/** What the consumer depends on; the queue itself is always linked. */
+	link?: unknown[];
+	/** The database's network, when the consumer reaches one. */
+	vpc?: sst.aws.Vpc;
+	timeout?: `${number} seconds` | `${number} minutes`;
+	batchSize?: number;
+}
+
 export interface QueueProps extends sst.aws.QueueArgs {
 	/**
 	 * The physical queue name, where the auto-generated one will not do.

package/src/sst/aws/RestApiSurface.ts

@@ -4,20 +4,10 @@ import type { StackType } from '../Stack';
 /**
  * `RestApiSurface` — an HTTP API, and the infra half of the `rest-api` kind.
  *
- * Deliberately *not* `Api`, which takes a route table and validates each
- * route's environment at synth. That component is the endpoint pipeline's, and
- * it needs routes; this one is the manifest's, and the manifest's `rest-api`
- * node currently carries `endpoints: []` for an application's own API.
- *
- * So what this provisions is the surface and nothing on it. An API Gateway with
- * no routes 404s everything, which is the honest state of things — and it is
- * still worth provisioning, because the *address* is what everything downstream
- * needs: a site inlines it as `VITE_API_URL`, an auth server puts it on its
- * trusted-origin list, and the cookie domain derives from it. Those are blocked
- * on the API existing, not on it answering.
- *
- * The two collapse into one component when the endpoint merge lands and the
- * surface node carries its routes.
+ * Provisioned before its routes, because its *address* is what everything
+ * downstream needs: a site inlines it as `VITE_API_URL`, an auth server puts it
+ * on its trusted-origin list, and the cookie domain derives from it. The routes
+ * are mounted once everything they link to exists — see {@link mount}.
  */
 
 export interface RestApiSurfaceProps extends sst.aws.ApiGatewayV2Args {
@@ -82,6 +72,25 @@ export class RestApiSurface<
 		};
 	}
 
+	/**
+	 * Mount one endpoint: a Lambda running the handler the build wrote for it,
+	 * linked to exactly what that endpoint depends on.
+	 */
+	mount(endpoint: SurfaceRoute) {
+		return this.route(
+			`${endpoint.method} ${endpoint.path}`,
+			{
+				handler: endpoint.handler,
+				link: endpoint.link ?? [],
+				runtime: 'nodejs24.x',
+				...(endpoint.vpc ? { vpc: endpoint.vpc } : {}),
+			},
+			// `iam` is the one authorizer the gateway enforces itself; every other
+			// is the endpoint's own, checked in the handler.
+			endpoint.authorizer === 'iam' ? { auth: { iam: true } } : {},
+		);
+	}
+
 	override getSSTLink() {
 		const link = super.getSSTLink();
 		return {
@@ -90,3 +99,16 @@ export class RestApiSurface<
 		};
 	}
 }
+
+/** One endpoint, as {@link RestApiSurface.mount} mounts it. */
+export interface SurfaceRoute {
+	method: string;
+	path: string;
+	/** The built handler — `apps/api/.gkm/aws/routes/getUser.handler`. */
+	handler: string;
+	/** What the endpoint depends on, and nothing else. */
+	link?: unknown[];
+	/** The database's network, when the endpoint reaches one. */
+	vpc?: sst.aws.Vpc;
+	authorizer?: string;
+}

package/src/sst/aws/bootstrap/handler.ts

@@ -28,6 +28,11 @@ export interface BootstrapTenant {
 	runtime: string;
 	owner: string;
 	reader?: string;
+	/**
+	 * The database's own roles rather than a tenant's: its owner may create in
+	 * the database, for trusted extensions.
+	 */
+	ownsDatabase?: boolean;
 	passwords: { runtime: string; owner: string; reader?: string };
 }
 
@@ -75,7 +80,11 @@ export async function handler(event: BootstrapEvent): Promise<BootstrapResult> {
 
 	try {
 		for (const tenant of event.tenants) {
-			for (const statement of roleStatements(tenant)) {
+			const spec = {
+				...tenant,
+				...(tenant.ownsDatabase ? { database: event.master.database } : {}),
+			};
+			for (const statement of roleStatements(spec)) {
 				if (statement.exists) {
 					const { rows } = await client.query(
 						statement.exists.sql,

package/src/sst/fromManifest.ts

@@ -26,10 +26,12 @@ import {
 	cookieDomain,
 	DEFAULT_POSTGRES_VERSION,
 	dependentsOf,
+	mobileOrigins,
 	PUBLIC,
 	PUBLIC_PREFIX,
 	providedKeyFor,
 	provisionOrder,
+	schemeBase,
 } from '@geekmidas/manifest';
 import {
 	Cache,
@@ -39,11 +41,15 @@ import {
 	withCacheTable,
 } from './aws/Cache';
 import { Credential } from './aws/Credential';
-import { Database, DatabaseNeedsVpc } from './aws/Database';
+import { Cron, type CronSchedule } from './aws/Cron';
+import { Database, DatabaseNeedsVpc, type DatabaseProps } from './aws/Database';
 import { DatabaseBootstrap } from './aws/DatabaseBootstrap';
 import { DatabaseReader, DatabaseSchema } from './aws/DerivedDatabase';
 import { Email, EmailNeedsSender } from './aws/Email';
+import { Encryption, type EncryptionProps } from './aws/Encryption';
+import { ExternalApi, type ExternalApiProps } from './aws/ExternalApi';
 import { FileServer } from './aws/FileServer';
+import { Function } from './aws/Function';
 import { ObjectStorage } from './aws/ObjectStorage';
 import { Queue } from './aws/Queue';
 import { RestApiSurface } from './aws/RestApiSurface';
@@ -56,6 +62,7 @@ import {
 	UnresolvedDependency,
 } from './errors';
 import type { GkmLinkable } from './Linkable';
+import type { ManifestBackends, ManifestOverrides } from './overrides';
 import type { StackType } from './Stack';
 
 /**
@@ -98,8 +105,8 @@ export interface ProvisionContext {
 	/**
 	 * Where a declared cache lives, and who delivers mail.
 	 *
-	 * Deployment choices rather than declarations, for the same reason
-	 * `services.events` is: the same application code caches into any of them and
+	 * Deployment choices rather than declarations, for the same reason the
+	 * event broker is: the same application code caches into any of them and
 	 * sends through any of them. They reach the provisioner here because it is
 	 * the only place that knows both the choice and the manifest.
 	 */
@@ -133,21 +140,6 @@ type Provisioner = (
 	context: ProvisionContext,
 ) => Provisioned;
 
-/**
- * Provider-specific props, per construct id.
- *
- * Neutral options — `versioned`, and later `cdn` — travel in the declaration,
- * because the app legitimately has an opinion about them. Anything with S3 in
- * its name does not belong in application code, so lifecycle rules, CORS, and
- * canned ACLs are supplied here, in the deploy layer, keyed by the id they
- * apply to and typed against the component that receives them.
- *
- * A third escape hatch needs no API at all: `fromManifest` returns the
- * components, so `provisioned.Uploads.nodes.bucket` is reachable for anything
- * neither route covers.
- */
-export type ComponentOverrides = Record<string, Record<string, unknown>>;
-
 /**
  * Which component provisions which kind.
  *
@@ -220,7 +212,11 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			// rather than whatever Aurora defaults to that month. Local ran 18
 			// while this ran 17.7, and neither was written down anywhere.
 			version: String(d.version ?? DEFAULT_POSTGRES_VERSION),
-			...(props as unknown as sst.aws.PostgresArgs),
+			// `DatabaseProps`, not `sst.aws.PostgresArgs`: the database needs the
+			// `Vpc` component itself (its bootstrap function runs in the same VPC
+			// and needs the security groups too), where RDS would accept bare
+			// subnet ids. TS 7 checks the spread; 6 let the wider type through.
+			...(props as unknown as Omit<DatabaseProps, 'schema'>),
 		});
 
 		// A database needs its own roles, not just its tenants'. Registering only
@@ -232,13 +228,21 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			const bootstrap = bootstrapFor(cluster, d.id, context);
 			const runtime = roleNameFor(d, context);
 
-			bootstrap?.add({
+			const credentials = bootstrap?.add({
 				id: d.id,
 				schema: d.schema,
 				runtime,
 				owner: ownerRole(runtime),
+				ownsDatabase: true,
 				...(hasReader(d.id, context) ? { reader: readerRole(runtime) } : {}),
 			});
+
+			// Registering the role was half of it: its handlers have to connect as
+			// it too, or the DDL creates a role nothing uses and every handler
+			// linked to the database still holds the master.
+			if (credentials) {
+				cluster.connectAs({ user: runtime, password: credentials.runtime });
+			}
 		}
 
 		return cluster;
@@ -363,17 +367,12 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 	},
 
 	/**
-	 * The surface, without its routes.
-	 *
-	 * An API Gateway with no routes 404s everything, and that is the honest
-	 * state: the *surface* is what this kind declares, and mounting handlers on
-	 * it is the endpoint merge that has not landed — routes still reach the
-	 * deploy target through the separate `RouteInfo[]` pipeline.
+	 * The surface, without its routes yet.
 	 *
-	 * Provisioning it anyway is not ceremony. Its address is what a site inlines
-	 * as `VITE_API_URL`, what an auth server puts on its trusted-origin list, and
-	 * what the cookie domain derives from — so everything downstream of the API
-	 * is blocked on the API *existing*, not on it answering.
+	 * Its address is what a site inlines as `VITE_API_URL`, what an auth server
+	 * puts on its trusted-origin list, and what the cookie domain derives from —
+	 * so it is provisioned in order, and its endpoints are mounted by
+	 * {@link mountRoutes} once everything they link to exists.
 	 */
 	'rest-api': (stack, d, props, context) =>
 		new RestApiSurface(stack, d.id, {
@@ -385,6 +384,30 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 
 	// The same storage as a secret, under a different role — see the component.
 	credential: (stack, d, props) => new Credential(stack, d.id, props),
+
+	// In the stage's region, as mail is: a key in another region is a key
+	// every call crosses the world to reach.
+	encryption: (stack, d, props) =>
+		new Encryption(stack, d.id, {
+			...(props as Partial<EncryptionProps>),
+			region:
+				(props as Partial<EncryptionProps>).region ??
+				$app.providers?.aws?.region ??
+				'us-east-1',
+		}),
+
+	// Nothing to provision: the URL this stage calls, and the credentials kept
+	// as a secret.
+	'external-api': (stack, d, props) => {
+		if (d.kind !== 'external-api') {
+			throw new UnknownDeclarationKind(d.kind, []);
+		}
+
+		return new ExternalApi(stack, d.id, {
+			...(props as Partial<ExternalApiProps>),
+			url: d.url,
+		});
+	},
 };
 
 /**
@@ -565,9 +588,7 @@ function rootCluster(component: Provisioned): Database {
  * printed: one line per route, naming what it can reach.
  *
  * A surface with no routes says so rather than printing nothing, because "no
- * routes yet" and "this printed nothing" look identical otherwise — and for an
- * application's own API that is currently the true state, pending the endpoint
- * merge.
+ * routes" and "this printed nothing" look identical otherwise.
  *
  * Pure, so what gets printed can be asserted without a deploy.
  */
@@ -636,6 +657,8 @@ async function callersOf(
 	id: string,
 	manifest: ConstructManifest,
 	provisioned: ProvisionedManifest,
+	/** The app's name — a mobile caller's scheme base when it gives none. */
+	project: string,
 ): Promise<{ trustedOrigins: string; cookieDomain?: string }> {
 	// Every address here is a Pulumi output, not a string — a CloudFront domain
 	// and an API Gateway endpoint are both known only after their resource
@@ -660,8 +683,17 @@ async function callersOf(
 	const own = await resolved(provisioned[id]?.provides().url);
 	const domain = cookieDomain([...(own ? [own] : []), ...origins]);
 
+	// A mobile caller is reached by its scheme — the bare one, deployed: what
+	// the store build registers.
+	const schemes = dependentsOf(manifest, id).flatMap((caller) => {
+		const app = manifest[caller];
+		return app?.kind === 'mobile-app'
+			? mobileOrigins(schemeBase(project, app.scheme))
+			: [];
+	});
+
 	return {
-		trustedOrigins: origins.join(','),
+		trustedOrigins: [...origins, ...schemes].join(','),
 		...(domain ? { cookieDomain: domain } : {}),
 	};
 }
@@ -711,6 +743,170 @@ export function isServed(id: string, manifest: ConstructManifest): boolean {
 	);
 }
 
+/**
+ * Kinds the in-order pass skips.
+ *
+ * - `mobile-app` ships through EAS and the stores. It is in the manifest for
+ *   what it makes the surfaces trust, which `callersOf` reads off the graph.
+ * - `worker` is a process, not a resource: what it runs is provisioned as
+ *   what it is — a queue's consumer by {@link subscribeConsumers}.
+ * - `cron` and `function` are Lambdas linked to what they depend on, so they
+ *   are provisioned once all of it exists, by {@link provisionCompute}.
+ * - `telemetry` provisions nothing: where it goes is the stage's
+ *   `deploy.telemetry`, a provider somebody else runs.
+ */
+export const PROVISIONED_ELSEWHERE: ReadonlySet<DeclarationKind> =
+	new Set<DeclarationKind>([
+		'mobile-app',
+		'worker',
+		'cron',
+		'function',
+		'telemetry',
+	]);
+
+/**
+ * Every function and cron: a Lambda running the handler the build wrote,
+ * linked to exactly what it depends on, in the database's network when it
+ * reaches one. A cron is that Lambda on its schedule; a function is reached
+ * at its URL, which only callers granted IAM access can invoke.
+ *
+ * After everything else is provisioned, because each links to things
+ * `provisionOrder` does not order before it.
+ */
+export function provisionCompute(
+	stack: StackType,
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): Cron[] {
+	const crons: Cron[] = [];
+
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'function' && declaration?.kind !== 'cron') {
+			continue;
+		}
+
+		const { link } = resolveEdges(declaration.dependencies, provisioned);
+		const vpc = vpcFor(link);
+		const lambda = new Function(
+			stack,
+			declaration.kind === 'cron' ? `${id}Function` : id,
+			{
+				name: stack.logicalPrefixedName(id),
+				handler: declaration.handler,
+				link,
+				...(vpc ? { vpc } : {}),
+				...(declaration.kind === 'function'
+					? { url: { authorization: 'iam' } }
+					: {}),
+			},
+		);
+
+		if (declaration.kind === 'cron') {
+			crons.push(
+				new Cron(stack, id, {
+					processor: lambda,
+					schedule: declaration.schedule as CronSchedule,
+				}),
+			);
+			continue;
+		}
+
+		assertProvides(
+			id,
+			declaration.provides,
+			Object.keys(lambda.provides()).map((role) =>
+				providedKeyFor(id, declaration.kind, role),
+			),
+		);
+		provisioned[id] = lambda;
+	}
+
+	return crons;
+}
+
+/** A provisioned queue: what {@link subscribeConsumers} subscribes through. */
+interface Consumable {
+	consume(consumer: {
+		handler: string;
+		link?: unknown[];
+		vpc?: sst.aws.Vpc;
+	}): unknown;
+}
+
+/**
+ * The network a function has to run in to reach what it links to.
+ *
+ * A database is private to its VPC, so a handler linked to one — or to a
+ * schema tenant or reader of one — runs inside it, or its connection times out.
+ */
+export function vpcFor(link: readonly Provisioned[]): sst.aws.Vpc | undefined {
+	for (const component of link) {
+		const cluster = rootCluster(component);
+		if (cluster instanceof Database) return cluster.vpc;
+	}
+
+	return undefined;
+}
+
+/**
+ * Mount every surface's endpoints — the handlers the build wrote, each linked
+ * to exactly what that endpoint depends on.
+ *
+ * After every construct is provisioned, for the reason consumers are: an
+ * endpoint links to things `provisionOrder` does not order before its surface.
+ */
+export function mountRoutes(
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): void {
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'rest-api') continue;
+
+		const surface = provisioned[id];
+		if (!(surface instanceof RestApiSurface)) continue;
+
+		for (const endpoint of declaration.endpoints) {
+			const { link } = resolveEdges(endpoint.dependencies, provisioned);
+			const vpc = vpcFor(link);
+			surface.mount({
+				method: endpoint.method,
+				path: endpoint.path,
+				handler: endpoint.handler,
+				link,
+				...(vpc ? { vpc } : {}),
+				...(endpoint.authorizer ? { authorizer: endpoint.authorizer } : {}),
+			});
+		}
+	}
+}
+
+/**
+ * Subscribe every queue's one consumer — the handler the build wrote for it,
+ * linked to what that consumer depends on.
+ *
+ * After every construct is provisioned, because a consumer links to things
+ * that `provisionOrder` does not order before the queue.
+ */
+export function subscribeConsumers(
+	manifest: ConstructManifest,
+	provisioned: ProvisionedManifest,
+): void {
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration?.kind !== 'queue') continue;
+
+		const queue = provisioned[id] as unknown as Consumable | undefined;
+		if (!queue) continue;
+
+		const { link } = resolveEdges(declaration.worker.dependencies, provisioned);
+		const vpc = vpcFor(link);
+		queue.consume({
+			handler: declaration.worker.handler,
+			link,
+			...(vpc ? { vpc } : {}),
+		});
+	}
+}
+
 /** The provisioner for a kind. Pure — the lookup is testable without Pulumi. */
 export function provisionerFor(kind: DeclarationKind): Provisioner {
 	const provisioner = PROVISIONERS[kind];
@@ -749,20 +945,34 @@ export function assertProvides(
  * tenant, a read replica, and the surface over a bucket all resolve an address
  * off something else, and a pass in map order would find it half the time.
  */
-export function fromManifest(
+export function fromManifest<
+	const M extends ConstructManifest,
+	const B extends ManifestBackends = {},
+>(
 	stack: StackType,
-	manifest: ConstructManifest,
-	overrides: ComponentOverrides = {},
+	manifest: M,
+	/**
+	 * Provider-specific props, per construct id — typed from the manifest, so
+	 * only its ids are keys, each takes what its kind's component reads, and
+	 * what the synth cannot guess (a database's `vpc`, mail's `from`) is
+	 * required. See {@link ManifestOverrides}.
+	 *
+	 * Neutral options — `versioned`, `fifo` — travel in the declaration,
+	 * because the app legitimately has an opinion about them. Anything with S3
+	 * in its name does not belong in application code, so it is supplied here.
+	 * A third escape hatch needs no API: the components are returned, so
+	 * `provisioned.Uploads.nodes.bucket` is reachable for anything else.
+	 */
+	overrides: ManifestOverrides<M, B>,
 	/**
 	 * The backend choices that are config rather than declaration.
 	 *
 	 * Defaulted the same way the local target defaults them, so a stage deployed
-	 * without saying gets the same backend a developer ran against.
+	 * without saying gets the same backend a developer ran against. Typed
+	 * literally, because the backend decides what is required above: an
+	 * ElastiCache cache needs a `vpc`, Resend or SMTP mail a `url`.
 	 */
-	backends: {
-		cache?: 'upstash' | 'elasticache' | 'db';
-		email?: 'resend' | 'ses' | 'smtp';
-	} = {},
+	backends: B = {} as B,
 ): ProvisionedManifest {
 	const provisioned: ProvisionedManifest = {};
 
@@ -799,11 +1009,12 @@ export function fromManifest(
 	for (const id of [...rest, ...sites]) {
 		const declaration = manifest[id];
 		if (!declaration) continue;
+		if (PROVISIONED_ELSEWHERE.has(declaration.kind)) continue;
 
 		const component = provisionerFor(declaration.kind)(
 			stack,
 			declaration,
-			overrides[id] ?? {},
+			(overrides as Record<string, Record<string, unknown>>)[id] ?? {},
 			context,
 		);
 
@@ -822,6 +1033,12 @@ export function fromManifest(
 		provisioned[id] = component;
 	}
 
+	// The functions and crons, each queue's one consumer and each surface's
+	// endpoints, once everything they link to exists.
+	provisionCompute(stack, manifest, provisioned);
+	subscribeConsumers(manifest, provisioned);
+	mountRoutes(manifest, provisioned);
+
 	for (const line of describeRoutes(manifest)) console.log(line);
 
 	// Now everything exists, so every surface's callers can be resolved — the
@@ -829,7 +1046,7 @@ export function fromManifest(
 	for (const [id, deferred] of callers) {
 		// Resolved with the promise itself: the addresses it needs are Pulumi
 		// outputs, so the answer arrives when they do.
-		deferred.resolve(callersOf(id, manifest, provisioned));
+		deferred.resolve(callersOf(id, manifest, provisioned, $app.name));
 	}
 
 	// Last, and only now: the roles exist as passwords and secrets from the

package/src/sst/index.ts

@@ -34,6 +34,7 @@ export {
 } from './aws/DatabaseBootstrap';
 export { DatabaseReader, DatabaseSchema } from './aws/DerivedDatabase';
 export { Email, EmailNeedsUrl, type EmailProps } from './aws/Email';
+export { Encryption, type EncryptionProps } from './aws/Encryption';
 export { FileServer, type FileServerProps } from './aws/FileServer';
 export { Function, type FunctionProps } from './aws/Function';
 export {
@@ -61,7 +62,6 @@ export {
 } from './errors';
 export {
 	assertProvides,
-	type ComponentOverrides,
 	describeRoutes,
 	fromManifest,
 	isServed,
@@ -75,4 +75,9 @@ export {
 } from './fromManifest';
 export { type GkmLinkable, ResourceType } from './Linkable';
 export { kebab, prefixedName, regionOfArn } from './naming';
+export type {
+	ManifestBackends,
+	ManifestOverrides,
+	OverrideFor,
+} from './overrides';
 export { Stack, type StackType } from './Stack';