@geekmidas/cloud 9.0.2 → 10.0.0-alpha.1

package/dist/{index-ByEJy40r.d.cts → index-B5CZ1xVf.d.cts}

@@ -5,19 +5,27 @@ declare enum ResourceType {
   ApiGatewayV2 = "sst.aws.ApiGatewayV2",
   Postgres = "sst.aws.Postgres",
   Function = "sst.aws.Function",
-  Bucket = "sst.aws.Bucket",
+  ObjectStorage = "sst.aws.Bucket",
   Vpc = "sst.aws.Vpc",
   Secret = "sst.sst.Secret",
   SSTSecret = "sst:sst:Secret",
   SSTFunction = "sst:sst:Function",
   SSTApiGatewayV2 = "sst:aws:ApiGatewayV2",
   SSTPostgres = "sst:aws:Postgres",
-  SSTBucket = "sst:aws:Bucket",
+  SSTObjectStorage = "sst:aws:Bucket",
   SnsTopic = "sst:aws:SnsTopic",
 }
 declare function buildResourceEnv(record: Record<string, Resource | string>): Record<string, string>;
+/**
+ * SST links a resource under one of two spellings — `sst.aws.Bucket` when it
+ * comes from the state file, `sst:aws:Bucket` when it comes from the runtime —
+ * and `processors` has always handled both. Only the dotted half was admitted
+ * here, so the colon half could not be passed to `buildResourceEnv` without a
+ * cast, and `SnsTopic` was missing from `Resource` altogether despite being the
+ * only thing that produces `*_ARN`.
+ */
 type ApiGatewayV2 = {
-  type: ResourceType.ApiGatewayV2;
+  type: ResourceType.ApiGatewayV2 | ResourceType.SSTApiGatewayV2;
   url: string;
 };
 type Postgres = {
@@ -25,16 +33,16 @@ type Postgres = {
   host: string;
   password: string;
   port: number;
-  type: ResourceType.Postgres;
+  type: ResourceType.Postgres | ResourceType.SSTPostgres;
   username: string;
 };
 type Function = {
   name: string;
-  type: ResourceType.Function;
+  type: ResourceType.Function | ResourceType.SSTFunction;
 };
 type Bucket = {
   name: string;
-  type: ResourceType.Bucket;
+  type: ResourceType.ObjectStorage | ResourceType.SSTObjectStorage;
 };
 type SnsTopic = {
   arn: string;
@@ -45,12 +53,12 @@ type Vpc = {
   type: ResourceType.Vpc;
 };
 type Secret = {
-  type: ResourceType.Secret;
+  type: ResourceType.Secret | ResourceType.SSTSecret;
   value: string;
 };
-type Resource = ApiGatewayV2 | Postgres | Function | Bucket | Vpc | Secret;
+type Resource = ApiGatewayV2 | Postgres | Function | Bucket | SnsTopic | Vpc | Secret;
 type ResourceProcessor<K extends Resource> = (name: string, value: K) => Record<string, string | number>;
 //# sourceMappingURL=index.d.ts.map
 //#endregion
 export { ApiGatewayV2, Bucket, Function, Postgres, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, Vpc, buildResourceEnv, environmentCase, getLocalIpAddress };
-//# sourceMappingURL=index-ByEJy40r.d.cts.map
+//# sourceMappingURL=index-B5CZ1xVf.d.cts.map

package/dist/index-B5CZ1xVf.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-B5CZ1xVf.d.cts","names":[],"sources":["../src/utils/index.ts"],"sourcesContent":[],"mappings":";iBAGgB,iBAAA,CAAA;AAAA,iBAcA,eAAA,CAdiB,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAcjB,aAOJ,YAAA;EAAA,YAAA,GAAY,sBAAA;EA+DR,QAAA,GAAA,kBAAgB;EAAA,QAAA,GAAA,kBAAA;EAAA,aACR,GAAA,gBAAA;EAAQ,GAAvB,GAAA,aAAA;EAAM,MACZ,GAAA,gBAAA;EAAM,SAAA,GAAA,gBAAA;EA0BG,WAAA,GAAA,kBAAY;EAAA,eAAA,GAAA,sBAAA;EAAA,WACjB,GAAA,kBAAa;EAAY,gBAAgB,GAAA,gBAAA;EAAe,QAAA,GAAA,kBAAA;AAI/D;AAAoB,iBAjCJ,gBAAA,CAiCI,MAAA,EAhCX,MAgCW,CAAA,MAAA,EAhCI,QAgCJ,GAAA,MAAA,CAAA,CAAA,EA/BjB,MA+BiB,CAAA,MAAA,EAAA,MAAA,CAAA;;;AAKmC;AAIvD;;;;AAEuD;AAG3C,KAnBA,YAAA,GAmBM;EAAA,IAAA,EAlBX,YAAA,CAAa,YAkBF,GAlBiB,YAAA,CAAa,eAkB9B;EAAA,GAEX,EAAA,MAAA;CAA0B;AAAgC,KAhBrD,QAAA,GAgBqD;EAGrD,QAAA,EAAA,MAAQ;EAKR,IAAA,EAAG,MAAA;EAKH,QAAA,EAAM,MAAA;EAAA,IAAA,EAAA,MAAA;EAAA,IACX,EAzBA,YAAA,CAAa,QAyBA,GAzBW,YAAA,CAAa,WAyBxB;EAAM,QAAG,EAAA,MAAa;AAAS,CAAA;AAIvC,KAzBA,QAAA,GAyBQ;EAAA,IAAA,EAAA,MAAA;EAAA,IACjB,EAxBI,YAAA,CAAa,QAwBjB,GAxB4B,YAAA,CAAa,WAwBzC;CAAY;AAEZ,KAvBS,MAAA,GAuBT;EAAQ,IACR,EAAA,MAAA;EAAM,IACN,EAvBI,YAAA,CAAa,aAuBjB,GAvBiC,YAAA,CAAa,gBAuB9C;CAAQ;AAER,KAtBS,QAAA,GAsBT;EAAM,GAAA,EAAA,MAAA;EAEG,IAAA,EAtBL,YAAA,CAAa,QAsBS;CAAA;AAAW,KAnB5B,GAAA,GAmB4B;EAAQ,OAExC,EAAA,MAAA;EAAC,IACJ,EApBE,YAAA,CAAa,GAoBf;AAAM,CAAA;KAjBC,MAAA;QACL,YAAA,CAAa,SAAS,YAAA,CAAa;;;KAI9B,QAAA,GACT,eACA,WACA,WACA,SACA,WACA,MACA;KAES,4BAA4B,kCAEhC,MACH"}

package/dist/{index-DZ0QrJQr.d.mts → index-DhHRjduZ.d.mts}

@@ -5,19 +5,27 @@ declare enum ResourceType {
   ApiGatewayV2 = "sst.aws.ApiGatewayV2",
   Postgres = "sst.aws.Postgres",
   Function = "sst.aws.Function",
-  Bucket = "sst.aws.Bucket",
+  ObjectStorage = "sst.aws.Bucket",
   Vpc = "sst.aws.Vpc",
   Secret = "sst.sst.Secret",
   SSTSecret = "sst:sst:Secret",
   SSTFunction = "sst:sst:Function",
   SSTApiGatewayV2 = "sst:aws:ApiGatewayV2",
   SSTPostgres = "sst:aws:Postgres",
-  SSTBucket = "sst:aws:Bucket",
+  SSTObjectStorage = "sst:aws:Bucket",
   SnsTopic = "sst:aws:SnsTopic",
 }
 declare function buildResourceEnv(record: Record<string, Resource | string>): Record<string, string>;
+/**
+ * SST links a resource under one of two spellings — `sst.aws.Bucket` when it
+ * comes from the state file, `sst:aws:Bucket` when it comes from the runtime —
+ * and `processors` has always handled both. Only the dotted half was admitted
+ * here, so the colon half could not be passed to `buildResourceEnv` without a
+ * cast, and `SnsTopic` was missing from `Resource` altogether despite being the
+ * only thing that produces `*_ARN`.
+ */
 type ApiGatewayV2 = {
-  type: ResourceType.ApiGatewayV2;
+  type: ResourceType.ApiGatewayV2 | ResourceType.SSTApiGatewayV2;
   url: string;
 };
 type Postgres = {
@@ -25,16 +33,16 @@ type Postgres = {
   host: string;
   password: string;
   port: number;
-  type: ResourceType.Postgres;
+  type: ResourceType.Postgres | ResourceType.SSTPostgres;
   username: string;
 };
 type Function = {
   name: string;
-  type: ResourceType.Function;
+  type: ResourceType.Function | ResourceType.SSTFunction;
 };
 type Bucket = {
   name: string;
-  type: ResourceType.Bucket;
+  type: ResourceType.ObjectStorage | ResourceType.SSTObjectStorage;
 };
 type SnsTopic = {
   arn: string;
@@ -45,12 +53,12 @@ type Vpc = {
   type: ResourceType.Vpc;
 };
 type Secret = {
-  type: ResourceType.Secret;
+  type: ResourceType.Secret | ResourceType.SSTSecret;
   value: string;
 };
-type Resource = ApiGatewayV2 | Postgres | Function | Bucket | Vpc | Secret;
+type Resource = ApiGatewayV2 | Postgres | Function | Bucket | SnsTopic | Vpc | Secret;
 type ResourceProcessor<K extends Resource> = (name: string, value: K) => Record<string, string | number>;
 //# sourceMappingURL=index.d.ts.map
 //#endregion
 export { ApiGatewayV2, Bucket, Function, Postgres, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, Vpc, buildResourceEnv, environmentCase, getLocalIpAddress };
-//# sourceMappingURL=index-DZ0QrJQr.d.mts.map
+//# sourceMappingURL=index-DhHRjduZ.d.mts.map

package/dist/index-DhHRjduZ.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-DhHRjduZ.d.mts","names":[],"sources":["../src/utils/index.ts"],"sourcesContent":[],"mappings":";iBAGgB,iBAAA,CAAA;AAAA,iBAcA,eAAA,CAdiB,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAcjB,aAOJ,YAAA;EAAA,YAAA,GAAY,sBAAA;EA+DR,QAAA,GAAA,kBAAgB;EAAA,QAAA,GAAA,kBAAA;EAAA,aACR,GAAA,gBAAA;EAAQ,GAAvB,GAAA,aAAA;EAAM,MACZ,GAAA,gBAAA;EAAM,SAAA,GAAA,gBAAA;EA0BG,WAAA,GAAA,kBAAY;EAAA,eAAA,GAAA,sBAAA;EAAA,WACjB,GAAA,kBAAa;EAAY,gBAAgB,GAAA,gBAAA;EAAe,QAAA,GAAA,kBAAA;AAI/D;AAAoB,iBAjCJ,gBAAA,CAiCI,MAAA,EAhCX,MAgCW,CAAA,MAAA,EAhCI,QAgCJ,GAAA,MAAA,CAAA,CAAA,EA/BjB,MA+BiB,CAAA,MAAA,EAAA,MAAA,CAAA;;;AAKmC;AAIvD;;;;AAEuD;AAG3C,KAnBA,YAAA,GAmBM;EAAA,IAAA,EAlBX,YAAA,CAAa,YAkBF,GAlBiB,YAAA,CAAa,eAkB9B;EAAA,GAEX,EAAA,MAAA;CAA0B;AAAgC,KAhBrD,QAAA,GAgBqD;EAGrD,QAAA,EAAA,MAAQ;EAKR,IAAA,EAAG,MAAA;EAKH,QAAA,EAAM,MAAA;EAAA,IAAA,EAAA,MAAA;EAAA,IACX,EAzBA,YAAA,CAAa,QAyBA,GAzBW,YAAA,CAAa,WAyBxB;EAAM,QAAG,EAAA,MAAa;AAAS,CAAA;AAIvC,KAzBA,QAAA,GAyBQ;EAAA,IAAA,EAAA,MAAA;EAAA,IACjB,EAxBI,YAAA,CAAa,QAwBjB,GAxB4B,YAAA,CAAa,WAwBzC;CAAY;AAEZ,KAvBS,MAAA,GAuBT;EAAQ,IACR,EAAA,MAAA;EAAM,IACN,EAvBI,YAAA,CAAa,aAuBjB,GAvBiC,YAAA,CAAa,gBAuB9C;CAAQ;AAER,KAtBS,QAAA,GAsBT;EAAM,GAAA,EAAA,MAAA;EAEG,IAAA,EAtBL,YAAA,CAAa,QAsBS;CAAA;AAAW,KAnB5B,GAAA,GAmB4B;EAAQ,OAExC,EAAA,MAAA;EAAC,IACJ,EApBE,YAAA,CAAa,GAoBf;AAAM,CAAA;KAjBC,MAAA;QACL,YAAA,CAAa,SAAS,YAAA,CAAa;;;KAI9B,QAAA,GACT,eACA,WACA,WACA,SACA,WACA,MACA;KAES,4BAA4B,kCAEhC,MACH"}

package/dist/index.cjs

@@ -1,3 +1,3 @@
-const require_utils = require('./utils-CtMjuIMR.cjs');
+const require_utils = require('./utils-B1a2UuEO.cjs');
 
 exports.buildResourceEnv = require_utils.buildResourceEnv;

package/dist/index.d.cts

@@ -1,2 +1,2 @@
-import { buildResourceEnv } from "./index-ByEJy40r.cjs";
+import { buildResourceEnv } from "./index-B5CZ1xVf.cjs";
 export { buildResourceEnv };

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { buildResourceEnv } from "./index-DZ0QrJQr.mjs";
+import { buildResourceEnv } from "./index-DhHRjduZ.mjs";
 export { buildResourceEnv };

package/dist/index.mjs

@@ -1,3 +1,3 @@
-import { buildResourceEnv } from "./utils-BdKG20_m.mjs";
+import { buildResourceEnv } from "./utils-DMOXJ27j.mjs";
 
 export { buildResourceEnv };

package/dist/utils/index.cjs

@@ -1,4 +1,4 @@
-const require_utils = require('../utils-CtMjuIMR.cjs');
+const require_utils = require('../utils-B1a2UuEO.cjs');
 
 exports.ResourceType = require_utils.ResourceType;
 exports.buildResourceEnv = require_utils.buildResourceEnv;

package/dist/utils/index.d.cts

@@ -1,2 +1,2 @@
-import { ApiGatewayV2, Bucket, Function, Postgres, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, Vpc, buildResourceEnv, environmentCase, getLocalIpAddress } from "../index-ByEJy40r.cjs";
+import { ApiGatewayV2, Bucket, Function, Postgres, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, Vpc, buildResourceEnv, environmentCase, getLocalIpAddress } from "../index-B5CZ1xVf.cjs";
 export { ApiGatewayV2, Bucket, Function, Postgres, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, Vpc, buildResourceEnv, environmentCase, getLocalIpAddress };

package/dist/utils/index.d.mts

@@ -1,2 +1,2 @@
-import { ApiGatewayV2, Bucket, Function, Postgres, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, Vpc, buildResourceEnv, environmentCase, getLocalIpAddress } from "../index-DZ0QrJQr.mjs";
+import { ApiGatewayV2, Bucket, Function, Postgres, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, Vpc, buildResourceEnv, environmentCase, getLocalIpAddress } from "../index-DhHRjduZ.mjs";
 export { ApiGatewayV2, Bucket, Function, Postgres, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, Vpc, buildResourceEnv, environmentCase, getLocalIpAddress };

package/dist/utils/index.mjs

@@ -1,3 +1,3 @@
-import { ResourceType, buildResourceEnv, environmentCase, getLocalIpAddress } from "../utils-BdKG20_m.mjs";
+import { ResourceType, buildResourceEnv, environmentCase, getLocalIpAddress } from "../utils-DMOXJ27j.mjs";
 
 export { ResourceType, buildResourceEnv, environmentCase, getLocalIpAddress };

package/dist/{utils-CtMjuIMR.cjs → utils-B1a2UuEO.cjs}

@@ -42,14 +42,14 @@ let ResourceType = /* @__PURE__ */ function(ResourceType$1) {
 	ResourceType$1["ApiGatewayV2"] = "sst.aws.ApiGatewayV2";
 	ResourceType$1["Postgres"] = "sst.aws.Postgres";
 	ResourceType$1["Function"] = "sst.aws.Function";
-	ResourceType$1["Bucket"] = "sst.aws.Bucket";
+	ResourceType$1["ObjectStorage"] = "sst.aws.Bucket";
 	ResourceType$1["Vpc"] = "sst.aws.Vpc";
 	ResourceType$1["Secret"] = "sst.sst.Secret";
 	ResourceType$1["SSTSecret"] = "sst:sst:Secret";
 	ResourceType$1["SSTFunction"] = "sst:sst:Function";
 	ResourceType$1["SSTApiGatewayV2"] = "sst:aws:ApiGatewayV2";
 	ResourceType$1["SSTPostgres"] = "sst:aws:Postgres";
-	ResourceType$1["SSTBucket"] = "sst:aws:Bucket";
+	ResourceType$1["SSTObjectStorage"] = "sst:aws:Bucket";
 	ResourceType$1["SnsTopic"] = "sst:aws:SnsTopic";
 	return ResourceType$1;
 }({});
@@ -80,9 +80,9 @@ const processors = {
 	[ResourceType.Vpc]: noop,
 	[ResourceType.Secret]: secret,
 	[ResourceType.Postgres]: postgres,
-	[ResourceType.Bucket]: bucket,
+	[ResourceType.ObjectStorage]: bucket,
 	[ResourceType.SSTSecret]: secret,
-	[ResourceType.SSTBucket]: bucket,
+	[ResourceType.SSTObjectStorage]: bucket,
 	[ResourceType.SSTFunction]: noop,
 	[ResourceType.SSTPostgres]: postgres,
 	[ResourceType.SSTApiGatewayV2]: noop,
@@ -126,4 +126,4 @@ Object.defineProperty(exports, 'getLocalIpAddress', {
     return getLocalIpAddress;
   }
 });
-//# sourceMappingURL=utils-CtMjuIMR.cjs.map
+//# sourceMappingURL=utils-B1a2UuEO.cjs.map

package/dist/utils-B1a2UuEO.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-B1a2UuEO.cjs","names":["name: string","value: Secret","key: string","value: Postgres","value: Bucket","value: SnsTopic","_name: string","_value: any","processors: Record<ResourceType, ResourceProcessor<any>>","record: Record<string, Resource | string>","env: Record<string, string>"],"sources":["../src/utils/index.ts"],"sourcesContent":["import os from 'node:os';\nimport snakecase from 'lodash.snakecase';\n\nexport function getLocalIpAddress() {\n\tconst networkInterfaces = os.networkInterfaces();\n\tfor (const interfaceName in networkInterfaces) {\n\t\tconst addresses = networkInterfaces[interfaceName] || [];\n\t\tfor (const addressInfo of addresses) {\n\t\t\t// Look for an IPv4 address that is not internal (loopback)\n\t\t\tif (addressInfo.family === 'IPv4' && !addressInfo.internal) {\n\t\t\t\treturn addressInfo.address;\n\t\t\t}\n\t\t}\n\t}\n\treturn null; // No suitable IP address found\n}\n\nexport function environmentCase(name: string) {\n\treturn snakecase(name)\n\t\t.toUpperCase()\n\t\t.replace(/_\\d+/g, (r) => {\n\t\t\treturn r.replace('_', '');\n\t\t});\n}\nexport enum ResourceType {\n\tApiGatewayV2 = 'sst.aws.ApiGatewayV2',\n\tPostgres = 'sst.aws.Postgres',\n\tFunction = 'sst.aws.Function',\n\tObjectStorage = 'sst.aws.Bucket',\n\tVpc = 'sst.aws.Vpc',\n\tSecret = 'sst.sst.Secret',\n\tSSTSecret = 'sst:sst:Secret',\n\tSSTFunction = 'sst:sst:Function',\n\tSSTApiGatewayV2 = 'sst:aws:ApiGatewayV2',\n\tSSTPostgres = 'sst:aws:Postgres',\n\tSSTObjectStorage = 'sst:aws:Bucket',\n\tSnsTopic = 'sst:aws:SnsTopic',\n}\n\nconst secret = (name: string, value: Secret) => ({\n\t[environmentCase(name)]: value.value,\n});\nconst postgres = (key: string, value: Postgres) => {\n\tconst prefix = `${environmentCase(key)}`;\n\treturn {\n\t\t[`${prefix}_NAME`]: value.database,\n\t\t[`${prefix}_HOST`]: value.host,\n\t\t[`${prefix}_PASSWORD`]: value.password,\n\t\t[`${prefix}_PORT`]: value.port,\n\t\t[`${prefix}_USERNAME`]: value.username,\n\t};\n};\n\nconst bucket = (name: string, value: Bucket) => {\n\tconst prefix = `${environmentCase(name)}`;\n\treturn {\n\t\t[`${prefix}_NAME`]: value.name,\n\t};\n};\n\nconst topic = (name: string, value: SnsTopic) => {\n\tconst prefix = `${environmentCase(name)}`;\n\tconst key = `${prefix}_ARN`;\n\n\treturn {\n\t\t[key]: value.arn,\n\t};\n};\n\nconst noop = (_name: string, _value: any) => ({});\n\nconst processors: Record<ResourceType, ResourceProcessor<any>> = {\n\t[ResourceType.ApiGatewayV2]: noop,\n\t[ResourceType.Function]: noop,\n\t[ResourceType.Vpc]: noop,\n\t[ResourceType.Secret]: secret,\n\t[ResourceType.Postgres]: postgres,\n\t[ResourceType.ObjectStorage]: bucket,\n\n\t[ResourceType.SSTSecret]: secret,\n\t[ResourceType.SSTObjectStorage]: bucket,\n\t[ResourceType.SSTFunction]: noop,\n\t[ResourceType.SSTPostgres]: postgres,\n\t[ResourceType.SSTApiGatewayV2]: noop,\n\t[ResourceType.SnsTopic]: topic,\n};\n\nexport function buildResourceEnv(\n\trecord: Record<string, Resource | string>,\n): Record<string, string> {\n\tconst env: Record<string, string> = {};\n\tfor (const [k, value] of Object.entries(record)) {\n\t\tif (typeof value === 'string') {\n\t\t\tenv[environmentCase(k)] = value;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst processor = processors[value.type];\n\t\tif (processor) {\n\t\t\tObject.assign(env, processor(k, value));\n\t\t} else {\n\t\t}\n\t}\n\n\treturn env;\n}\n\n/**\n * SST links a resource under one of two spellings — `sst.aws.Bucket` when it\n * comes from the state file, `sst:aws:Bucket` when it comes from the runtime —\n * and `processors` has always handled both. Only the dotted half was admitted\n * here, so the colon half could not be passed to `buildResourceEnv` without a\n * cast, and `SnsTopic` was missing from `Resource` altogether despite being the\n * only thing that produces `*_ARN`.\n */\nexport type ApiGatewayV2 = {\n\ttype: ResourceType.ApiGatewayV2 | ResourceType.SSTApiGatewayV2;\n\turl: string;\n};\n\nexport type Postgres = {\n\tdatabase: string;\n\thost: string;\n\tpassword: string;\n\tport: number;\n\ttype: ResourceType.Postgres | ResourceType.SSTPostgres;\n\tusername: string;\n};\n\nexport type Function = {\n\tname: string;\n\ttype: ResourceType.Function | ResourceType.SSTFunction;\n};\n\nexport type Bucket = {\n\tname: string;\n\ttype: ResourceType.ObjectStorage | ResourceType.SSTObjectStorage;\n};\n\nexport type SnsTopic = {\n\tarn: string;\n\ttype: ResourceType.SnsTopic;\n};\n\nexport type Vpc = {\n\tbastion: string;\n\ttype: ResourceType.Vpc;\n};\n\nexport type Secret = {\n\ttype: ResourceType.Secret | ResourceType.SSTSecret;\n\tvalue: string;\n};\n\nexport type Resource =\n\t| ApiGatewayV2\n\t| Postgres\n\t| Function\n\t| Bucket\n\t| SnsTopic\n\t| Vpc\n\t| Secret;\n\nexport type ResourceProcessor<K extends Resource> = (\n\tname: string,\n\tvalue: K,\n) => Record<string, string | number>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,SAAgB,oBAAoB;CACnC,MAAM,oBAAoB,gBAAG,mBAAmB;AAChD,MAAK,MAAM,iBAAiB,mBAAmB;EAC9C,MAAM,YAAY,kBAAkB,kBAAkB,CAAE;AACxD,OAAK,MAAM,eAAe,UAEzB,KAAI,YAAY,WAAW,WAAW,YAAY,SACjD,QAAO,YAAY;CAGrB;AACD,QAAO;AACP;AAED,SAAgB,gBAAgBA,MAAc;AAC7C,QAAO,8BAAU,KAAK,CACpB,aAAa,CACb,QAAQ,SAAS,CAAC,MAAM;AACxB,SAAO,EAAE,QAAQ,KAAK,GAAG;CACzB,EAAC;AACH;AACD,IAAY,wDAAL;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACA;AAED,MAAM,SAAS,CAACA,MAAcC,WAAmB,GAC/C,gBAAgB,KAAK,GAAG,MAAM,MAC/B;AACD,MAAM,WAAW,CAACC,KAAaC,UAAoB;CAClD,MAAM,UAAU,EAAE,gBAAgB,IAAI,CAAC;AACvC,QAAO;IACJ,EAAE,OAAO,SAAS,MAAM;IACxB,EAAE,OAAO,SAAS,MAAM;IACxB,EAAE,OAAO,aAAa,MAAM;IAC5B,EAAE,OAAO,SAAS,MAAM;IACxB,EAAE,OAAO,aAAa,MAAM;CAC9B;AACD;AAED,MAAM,SAAS,CAACH,MAAcI,UAAkB;CAC/C,MAAM,UAAU,EAAE,gBAAgB,KAAK,CAAC;AACxC,QAAO,IACJ,EAAE,OAAO,SAAS,MAAM,KAC1B;AACD;AAED,MAAM,QAAQ,CAACJ,MAAcK,UAAoB;CAChD,MAAM,UAAU,EAAE,gBAAgB,KAAK,CAAC;CACxC,MAAM,OAAO,EAAE,OAAO;AAEtB,QAAO,GACL,MAAM,MAAM,IACb;AACD;AAED,MAAM,OAAO,CAACC,OAAeC,YAAiB,CAAE;AAEhD,MAAMC,aAA2D;EAC/D,aAAa,eAAe;EAC5B,aAAa,WAAW;EACxB,aAAa,MAAM;EACnB,aAAa,SAAS;EACtB,aAAa,WAAW;EACxB,aAAa,gBAAgB;EAE7B,aAAa,YAAY;EACzB,aAAa,mBAAmB;EAChC,aAAa,cAAc;EAC3B,aAAa,cAAc;EAC3B,aAAa,kBAAkB;EAC/B,aAAa,WAAW;AACzB;AAED,SAAgB,iBACfC,QACyB;CACzB,MAAMC,MAA8B,CAAE;AACtC,MAAK,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,QAAQ,OAAO,EAAE;AAChD,aAAW,UAAU,UAAU;AAC9B,OAAI,gBAAgB,EAAE,IAAI;AAC1B;EACA;EAED,MAAM,YAAY,WAAW,MAAM;AACnC,MAAI,UACH,QAAO,OAAO,KAAK,UAAU,GAAG,MAAM,CAAC;CAGxC;AAED,QAAO;AACP"}

package/dist/{utils-BdKG20_m.mjs → utils-DMOXJ27j.mjs}

@@ -19,14 +19,14 @@ let ResourceType = /* @__PURE__ */ function(ResourceType$1) {
 	ResourceType$1["ApiGatewayV2"] = "sst.aws.ApiGatewayV2";
 	ResourceType$1["Postgres"] = "sst.aws.Postgres";
 	ResourceType$1["Function"] = "sst.aws.Function";
-	ResourceType$1["Bucket"] = "sst.aws.Bucket";
+	ResourceType$1["ObjectStorage"] = "sst.aws.Bucket";
 	ResourceType$1["Vpc"] = "sst.aws.Vpc";
 	ResourceType$1["Secret"] = "sst.sst.Secret";
 	ResourceType$1["SSTSecret"] = "sst:sst:Secret";
 	ResourceType$1["SSTFunction"] = "sst:sst:Function";
 	ResourceType$1["SSTApiGatewayV2"] = "sst:aws:ApiGatewayV2";
 	ResourceType$1["SSTPostgres"] = "sst:aws:Postgres";
-	ResourceType$1["SSTBucket"] = "sst:aws:Bucket";
+	ResourceType$1["SSTObjectStorage"] = "sst:aws:Bucket";
 	ResourceType$1["SnsTopic"] = "sst:aws:SnsTopic";
 	return ResourceType$1;
 }({});
@@ -57,9 +57,9 @@ const processors = {
 	[ResourceType.Vpc]: noop,
 	[ResourceType.Secret]: secret,
 	[ResourceType.Postgres]: postgres,
-	[ResourceType.Bucket]: bucket,
+	[ResourceType.ObjectStorage]: bucket,
 	[ResourceType.SSTSecret]: secret,
-	[ResourceType.SSTBucket]: bucket,
+	[ResourceType.SSTObjectStorage]: bucket,
 	[ResourceType.SSTFunction]: noop,
 	[ResourceType.SSTPostgres]: postgres,
 	[ResourceType.SSTApiGatewayV2]: noop,
@@ -80,4 +80,4 @@ function buildResourceEnv(record) {
 
 //#endregion
 export { ResourceType, buildResourceEnv, environmentCase, getLocalIpAddress };
-//# sourceMappingURL=utils-BdKG20_m.mjs.map
+//# sourceMappingURL=utils-DMOXJ27j.mjs.map

package/dist/utils-DMOXJ27j.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-DMOXJ27j.mjs","names":["name: string","value: Secret","key: string","value: Postgres","value: Bucket","value: SnsTopic","_name: string","_value: any","processors: Record<ResourceType, ResourceProcessor<any>>","record: Record<string, Resource | string>","env: Record<string, string>"],"sources":["../src/utils/index.ts"],"sourcesContent":["import os from 'node:os';\nimport snakecase from 'lodash.snakecase';\n\nexport function getLocalIpAddress() {\n\tconst networkInterfaces = os.networkInterfaces();\n\tfor (const interfaceName in networkInterfaces) {\n\t\tconst addresses = networkInterfaces[interfaceName] || [];\n\t\tfor (const addressInfo of addresses) {\n\t\t\t// Look for an IPv4 address that is not internal (loopback)\n\t\t\tif (addressInfo.family === 'IPv4' && !addressInfo.internal) {\n\t\t\t\treturn addressInfo.address;\n\t\t\t}\n\t\t}\n\t}\n\treturn null; // No suitable IP address found\n}\n\nexport function environmentCase(name: string) {\n\treturn snakecase(name)\n\t\t.toUpperCase()\n\t\t.replace(/_\\d+/g, (r) => {\n\t\t\treturn r.replace('_', '');\n\t\t});\n}\nexport enum ResourceType {\n\tApiGatewayV2 = 'sst.aws.ApiGatewayV2',\n\tPostgres = 'sst.aws.Postgres',\n\tFunction = 'sst.aws.Function',\n\tObjectStorage = 'sst.aws.Bucket',\n\tVpc = 'sst.aws.Vpc',\n\tSecret = 'sst.sst.Secret',\n\tSSTSecret = 'sst:sst:Secret',\n\tSSTFunction = 'sst:sst:Function',\n\tSSTApiGatewayV2 = 'sst:aws:ApiGatewayV2',\n\tSSTPostgres = 'sst:aws:Postgres',\n\tSSTObjectStorage = 'sst:aws:Bucket',\n\tSnsTopic = 'sst:aws:SnsTopic',\n}\n\nconst secret = (name: string, value: Secret) => ({\n\t[environmentCase(name)]: value.value,\n});\nconst postgres = (key: string, value: Postgres) => {\n\tconst prefix = `${environmentCase(key)}`;\n\treturn {\n\t\t[`${prefix}_NAME`]: value.database,\n\t\t[`${prefix}_HOST`]: value.host,\n\t\t[`${prefix}_PASSWORD`]: value.password,\n\t\t[`${prefix}_PORT`]: value.port,\n\t\t[`${prefix}_USERNAME`]: value.username,\n\t};\n};\n\nconst bucket = (name: string, value: Bucket) => {\n\tconst prefix = `${environmentCase(name)}`;\n\treturn {\n\t\t[`${prefix}_NAME`]: value.name,\n\t};\n};\n\nconst topic = (name: string, value: SnsTopic) => {\n\tconst prefix = `${environmentCase(name)}`;\n\tconst key = `${prefix}_ARN`;\n\n\treturn {\n\t\t[key]: value.arn,\n\t};\n};\n\nconst noop = (_name: string, _value: any) => ({});\n\nconst processors: Record<ResourceType, ResourceProcessor<any>> = {\n\t[ResourceType.ApiGatewayV2]: noop,\n\t[ResourceType.Function]: noop,\n\t[ResourceType.Vpc]: noop,\n\t[ResourceType.Secret]: secret,\n\t[ResourceType.Postgres]: postgres,\n\t[ResourceType.ObjectStorage]: bucket,\n\n\t[ResourceType.SSTSecret]: secret,\n\t[ResourceType.SSTObjectStorage]: bucket,\n\t[ResourceType.SSTFunction]: noop,\n\t[ResourceType.SSTPostgres]: postgres,\n\t[ResourceType.SSTApiGatewayV2]: noop,\n\t[ResourceType.SnsTopic]: topic,\n};\n\nexport function buildResourceEnv(\n\trecord: Record<string, Resource | string>,\n): Record<string, string> {\n\tconst env: Record<string, string> = {};\n\tfor (const [k, value] of Object.entries(record)) {\n\t\tif (typeof value === 'string') {\n\t\t\tenv[environmentCase(k)] = value;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst processor = processors[value.type];\n\t\tif (processor) {\n\t\t\tObject.assign(env, processor(k, value));\n\t\t} else {\n\t\t}\n\t}\n\n\treturn env;\n}\n\n/**\n * SST links a resource under one of two spellings — `sst.aws.Bucket` when it\n * comes from the state file, `sst:aws:Bucket` when it comes from the runtime —\n * and `processors` has always handled both. Only the dotted half was admitted\n * here, so the colon half could not be passed to `buildResourceEnv` without a\n * cast, and `SnsTopic` was missing from `Resource` altogether despite being the\n * only thing that produces `*_ARN`.\n */\nexport type ApiGatewayV2 = {\n\ttype: ResourceType.ApiGatewayV2 | ResourceType.SSTApiGatewayV2;\n\turl: string;\n};\n\nexport type Postgres = {\n\tdatabase: string;\n\thost: string;\n\tpassword: string;\n\tport: number;\n\ttype: ResourceType.Postgres | ResourceType.SSTPostgres;\n\tusername: string;\n};\n\nexport type Function = {\n\tname: string;\n\ttype: ResourceType.Function | ResourceType.SSTFunction;\n};\n\nexport type Bucket = {\n\tname: string;\n\ttype: ResourceType.ObjectStorage | ResourceType.SSTObjectStorage;\n};\n\nexport type SnsTopic = {\n\tarn: string;\n\ttype: ResourceType.SnsTopic;\n};\n\nexport type Vpc = {\n\tbastion: string;\n\ttype: ResourceType.Vpc;\n};\n\nexport type Secret = {\n\ttype: ResourceType.Secret | ResourceType.SSTSecret;\n\tvalue: string;\n};\n\nexport type Resource =\n\t| ApiGatewayV2\n\t| Postgres\n\t| Function\n\t| Bucket\n\t| SnsTopic\n\t| Vpc\n\t| Secret;\n\nexport type ResourceProcessor<K extends Resource> = (\n\tname: string,\n\tvalue: K,\n) => Record<string, string | number>;\n"],"mappings":";;;;AAGA,SAAgB,oBAAoB;CACnC,MAAM,oBAAoB,GAAG,mBAAmB;AAChD,MAAK,MAAM,iBAAiB,mBAAmB;EAC9C,MAAM,YAAY,kBAAkB,kBAAkB,CAAE;AACxD,OAAK,MAAM,eAAe,UAEzB,KAAI,YAAY,WAAW,WAAW,YAAY,SACjD,QAAO,YAAY;CAGrB;AACD,QAAO;AACP;AAED,SAAgB,gBAAgBA,MAAc;AAC7C,QAAO,UAAU,KAAK,CACpB,aAAa,CACb,QAAQ,SAAS,CAAC,MAAM;AACxB,SAAO,EAAE,QAAQ,KAAK,GAAG;CACzB,EAAC;AACH;AACD,IAAY,wDAAL;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACA;AAED,MAAM,SAAS,CAACA,MAAcC,WAAmB,GAC/C,gBAAgB,KAAK,GAAG,MAAM,MAC/B;AACD,MAAM,WAAW,CAACC,KAAaC,UAAoB;CAClD,MAAM,UAAU,EAAE,gBAAgB,IAAI,CAAC;AACvC,QAAO;IACJ,EAAE,OAAO,SAAS,MAAM;IACxB,EAAE,OAAO,SAAS,MAAM;IACxB,EAAE,OAAO,aAAa,MAAM;IAC5B,EAAE,OAAO,SAAS,MAAM;IACxB,EAAE,OAAO,aAAa,MAAM;CAC9B;AACD;AAED,MAAM,SAAS,CAACH,MAAcI,UAAkB;CAC/C,MAAM,UAAU,EAAE,gBAAgB,KAAK,CAAC;AACxC,QAAO,IACJ,EAAE,OAAO,SAAS,MAAM,KAC1B;AACD;AAED,MAAM,QAAQ,CAACJ,MAAcK,UAAoB;CAChD,MAAM,UAAU,EAAE,gBAAgB,KAAK,CAAC;CACxC,MAAM,OAAO,EAAE,OAAO;AAEtB,QAAO,GACL,MAAM,MAAM,IACb;AACD;AAED,MAAM,OAAO,CAACC,OAAeC,YAAiB,CAAE;AAEhD,MAAMC,aAA2D;EAC/D,aAAa,eAAe;EAC5B,aAAa,WAAW;EACxB,aAAa,MAAM;EACnB,aAAa,SAAS;EACtB,aAAa,WAAW;EACxB,aAAa,gBAAgB;EAE7B,aAAa,YAAY;EACzB,aAAa,mBAAmB;EAChC,aAAa,cAAc;EAC3B,aAAa,cAAc;EAC3B,aAAa,kBAAkB;EAC/B,aAAa,WAAW;AACzB;AAED,SAAgB,iBACfC,QACyB;CACzB,MAAMC,MAA8B,CAAE;AACtC,MAAK,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,QAAQ,OAAO,EAAE;AAChD,aAAW,UAAU,UAAU;AAC9B,OAAI,gBAAgB,EAAE,IAAI;AAC1B;EACA;EAED,MAAM,YAAY,WAAW,MAAM;AACnC,MAAI,UACH,QAAO,OAAO,KAAK,UAAU,GAAG,MAAM,CAAC;CAGxC;AAED,QAAO;AACP"}

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@geekmidas/cloud",
-  "version": "9.0.2",
+  "version": "10.0.0-alpha.1",
   "type": "module",
   "files": [
     "dist",
-    "src/sst"
+    "src/sst",
+    "src/dokploy"
   ],
   "exports": {
     ".": {
@@ -27,7 +28,8 @@
         "default": "./dist/utils/index.cjs"
       }
     },
-    "./sst": "./src/sst/index.ts"
+    "./sst": "./src/sst/index.ts",
+    "./dokploy": "./src/dokploy/index.ts"
   },
   "repository": {
     "type": "git",
@@ -39,21 +41,56 @@
   },
   "dependencies": {
     "lodash.snakecase": "~4.1.1",
-    "@geekmidas/envkit": "9.0.2",
-    "@geekmidas/manifest": "9.0.2"
+    "@geekmidas/envkit": "10.0.0-alpha.1",
+    "@geekmidas/manifest": "10.0.0-alpha.1"
   },
   "devDependencies": {
     "@types/lodash.get": "~4.4.9",
     "@types/lodash.set": "~4.3.9",
     "@types/lodash.snakecase": "~4.1.9",
     "@types/node": "~24.9.1",
+    "@types/pg": "~8.15.5",
     "sst": "4.15.2"
   },
   "peerDependencies": {
-    "sst": "^4.15.2"
+    "sst": "^4.15.2",
+    "pg": "^8.13.0",
+    "@pulumi/aws": "^7.20.0",
+    "@pulumi/random": "^4.16.6",
+    "@pulumi/pulumi": "^3.215.0",
+    "@geekmidas/manifest": "^10.0.0-alpha.1",
+    "@geekmidas/storage": "^10.0.0-alpha.1",
+    "@geekmidas/events": "^10.0.0-alpha.1",
+    "@geekmidas/db": "^10.0.0-alpha.1"
+  },
+  "peerDependenciesMeta": {
+    "@geekmidas/manifest": {
+      "optional": true
+    },
+    "@geekmidas/storage": {
+      "optional": true
+    },
+    "@geekmidas/events": {
+      "optional": true
+    },
+    "@geekmidas/db": {
+      "optional": true
+    },
+    "pg": {
+      "optional": true
+    },
+    "@pulumi/aws": {
+      "optional": true
+    },
+    "@pulumi/random": {
+      "optional": true
+    },
+    "@pulumi/pulumi": {
+      "optional": true
+    }
   },
   "scripts": {
-    "sst:install": "sst install",
+    "sst:install": "node -e \"process.exit(require('fs').existsSync('sst.config.ts')?0:1)\" && sst install || true",
     "ts:check:sst": "tsc --noEmit -p src/sst/tsconfig.json 2>&1 | grep -E 'src/sst/.*error TS' && exit 1 || exit 0"
   }
 }

package/src/dokploy/Application.ts

@@ -0,0 +1,259 @@
+import { dynamic, type Input, type Output } from '@pulumi/pulumi';
+
+/**
+ * A Dokploy application, as a Pulumi resource.
+ *
+ * **A prototype, and the point of it is the shape rather than the coverage.**
+ * One resource, to see whether wrapping Dokploy's REST API in a dynamic provider
+ * is worth doing for the rest — because if it is, a whole subsystem goes away.
+ *
+ * ## Why this is worth trying
+ *
+ * `packages/cli/src/deploy/` is a deployment engine written by hand: it calls
+ * the API, and it remembers what it created in `deploy/state.ts` and
+ * `SSMStateProvider` so the next deploy can find the same resources. That second
+ * half is the interesting one, because *remembering what you created* is the
+ * entire job of a Pulumi state file. A provider does not need it.
+ *
+ * What else falls out: `pulumi preview` starts working for the server target,
+ * and `fromManifest` becomes one shape across both targets — a table of
+ * provisioners — rather than an SST adapter beside a bespoke engine.
+ *
+ * ## Why it is a dynamic provider and not a real one
+ *
+ * A real Pulumi provider is a plugin binary with a schema, usually generated
+ * from a Terraform provider that does not exist here. A dynamic provider is a
+ * TypeScript object with `create`/`read`/`update`/`delete`, running in-process
+ * during the deploy. SST itself uses this exact escape hatch wherever official
+ * coverage stops — `vercel/providers/dns-record.ts`,
+ * `cloudflare/providers/kv-data.ts` — which is the precedent worth leaning on.
+ *
+ * ## The three things that make it risky
+ *
+ * 1. **The provider is serialised into state.** Pulumi captures the functions
+ *    below and stores them, so they must be self-contained — no reaching for an
+ *    import from the surrounding module at call time. That is why the API token
+ *    is an *input* rather than something closed over, and why `fetch` is used
+ *    directly instead of `DokployApi`, which would have to serialise with it.
+ * 2. **`delete` runs on destroy, and orphans are silent.** Today's engine fails
+ *    loudly when it cannot find something; a provider that gets destroy wrong
+ *    leaves resources behind that Pulumi believes it removed. This is the half
+ *    to be most careful with, and the reason a prototype exists at all.
+ * 3. **`diff` is yours.** Without it, preview cannot say what a change will do —
+ *    which is one of the main reasons for doing this.
+ *
+ * ## Not verified
+ *
+ * No Dokploy instance has run this. The shape type-checks and the decisions are
+ * assertable; nothing has been created or destroyed against a real server.
+ */
+
+interface ApplicationInputs {
+	/** Where the Dokploy server answers, e.g. `https://dokploy.example.com`. */
+	endpoint: string;
+	/**
+	 * The API token.
+	 *
+	 * An input rather than a captured variable, because the provider's functions
+	 * are serialised into state and a closure over module scope does not survive
+	 * that. SST's own dynamic providers pass credentials the same way.
+	 */
+	apiToken: string;
+	name: string;
+	projectId: string;
+	environmentId: string;
+}
+
+interface ApplicationOutputs extends ApplicationInputs {
+	applicationId: string;
+	appName: string;
+}
+
+/**
+ * Dokploy's app name rule, applied where the name is decided.
+ *
+ * The existing client does this inline at the create call; here it is a function
+ * because `diff` has to ask whether a *changed* name produces a changed app
+ * name, and duplicating the expression is how those two answers drift apart.
+ */
+export function appNameFor(name: string): string {
+	return name.toLowerCase().replace(/[^a-z0-9-]/g, '-');
+}
+
+/**
+ * What a change costs — pure, so preview's behaviour can be asserted without a
+ * Dokploy server.
+ *
+ * The name is the interesting one: Dokploy derives `appName` from it, and
+ * changing that is not an update but a different application, so the old one has
+ * to go. Saying so here is what makes `pulumi preview` warn *before* the
+ * destroy rather than reporting it after.
+ */
+export function diffApplication(
+	olds: { name: string; projectId: string; environmentId: string },
+	news: { name: string; projectId: string; environmentId: string },
+): { changes: boolean; replaces: string[]; deleteBeforeReplace: boolean } {
+	const replaces: string[] = [];
+
+	if (appNameFor(olds.name) !== appNameFor(news.name)) replaces.push('name');
+	if (olds.projectId !== news.projectId) replaces.push('projectId');
+	if (olds.environmentId !== news.environmentId) replaces.push('environmentId');
+
+	return {
+		changes: replaces.length > 0 || olds.name !== news.name,
+		replaces,
+		// Create the replacement before removing the old one. A Dokploy project
+		// can hold both for a moment; it cannot hold a gap where the application
+		// used to be.
+		deleteBeforeReplace: false,
+	};
+}
+
+const provider: dynamic.ResourceProvider<
+	ApplicationInputs,
+	ApplicationOutputs
+> = {
+	async create(inputs) {
+		const application = await call<{
+			applicationId: string;
+			appName: string;
+		}>(inputs, 'application.create', {
+			name: inputs.name,
+			projectId: inputs.projectId,
+			environmentId: inputs.environmentId,
+			appName: appNameFor(inputs.name),
+		});
+
+		return {
+			// Pulumi's own id for the resource. Using Dokploy's makes the two
+			// agree, so a state file read by a human names the same thing the
+			// Dokploy UI does.
+			id: application.applicationId,
+			outs: { ...inputs, ...application },
+		};
+	},
+
+	/**
+	 * Refresh from the server.
+	 *
+	 * Returning no id is how a provider says "this is gone", which is what
+	 * lets `pulumi refresh` notice something deleted in the Dokploy UI rather
+	 * than failing on the next update against a resource that is not there.
+	 */
+	async read(id, props) {
+		const application = await call<{
+			applicationId: string;
+			appName: string;
+		} | null>(
+			props as ApplicationInputs,
+			`application.one?applicationId=${id}`,
+			undefined,
+		);
+
+		if (!application) return { id: undefined };
+
+		return { id, props: { ...(props as ApplicationOutputs), ...application } };
+	},
+
+	/**
+	 * What a change costs.
+	 *
+	 * The name is the interesting one: Dokploy derives `appName` from it, and
+	 * changing that is not an update — it is a different application, so the
+	 * old one has to go. Saying so here is what makes `pulumi preview` warn
+	 * before the destroy rather than after.
+	 */
+	async diff(_id, olds, news) {
+		return diffApplication(olds, news);
+	},
+
+	async update(id, _olds, news) {
+		await call(news, 'application.update', {
+			applicationId: id,
+			name: news.name,
+		});
+
+		return {
+			outs: { ...news, applicationId: id, appName: appNameFor(news.name) },
+		};
+	},
+
+	/**
+	 * Remove it, and treat "already gone" as success.
+	 *
+	 * A destroy that fails because somebody removed the application by hand
+	 * leaves the stack unable to make progress, which is worse than the thing
+	 * it is protecting against — the resource is absent either way, which is
+	 * what was asked for.
+	 */
+	async delete(id, props) {
+		try {
+			await call(props, 'application.remove', { applicationId: id });
+		} catch (error) {
+			if (!isNotFound(error)) throw error;
+		}
+	},
+};
+
+/**
+ * One call to Dokploy.
+ *
+ * Written out rather than reusing `DokployApi` because the provider's functions
+ * are serialised into state: a class imported from another module would have to
+ * serialise too, and the failure when it cannot is obscure. `fetch` is a global.
+ */
+async function call<T>(
+	auth: { endpoint: string; apiToken: string },
+	path: string,
+	body?: Record<string, unknown>,
+): Promise<T> {
+	const response = await fetch(`${auth.endpoint}/api/trpc/${path}`, {
+		method: body ? 'POST' : 'GET',
+		headers: {
+			'x-api-key': auth.apiToken,
+			'content-type': 'application/json',
+		},
+		...(body ? { body: JSON.stringify(body) } : {}),
+	});
+
+	if (!response.ok) {
+		const detail = await response.text().catch(() => '');
+		throw new Error(
+			`Dokploy ${path} failed: ${response.status} ${response.statusText}${
+				detail ? ` — ${detail}` : ''
+			}`,
+		);
+	}
+
+	return (await response.json()) as T;
+}
+
+/** Whether an error means the thing is already absent. */
+function isNotFound(error: unknown): boolean {
+	return error instanceof Error && /\b404\b/.test(error.message);
+}
+
+export interface ApplicationArgs {
+	endpoint: Input<string>;
+	apiToken: Input<string>;
+	name: Input<string>;
+	projectId: Input<string>;
+	environmentId: Input<string>;
+}
+
+export class Application extends dynamic.Resource {
+	declare readonly applicationId: Output<string>;
+	declare readonly appName: Output<string>;
+
+	constructor(name: string, args: ApplicationArgs, opts?: object) {
+		super(
+			provider,
+			name,
+			// The outputs have to be declared as undefined inputs or Pulumi will
+			// not populate them — a quiet rule, and the usual first thing to get
+			// wrong with a dynamic provider.
+			{ ...args, applicationId: undefined, appName: undefined },
+			opts,
+		);
+	}
+}