@geekmidas/constructs 10.0.0-alpha.1 → 10.0.0-alpha.100

package/dist/subscribers/index.mjs

@@ -1,106 +1,116 @@
-import { Construct, ConstructType } from "../Construct-CdhThxDI.mjs";
-import { idsOf, servicesOf } from "../construct-interface-Z4CpS8tK.mjs";
-import { cloneWith } from "../clone-DblgEZZa.mjs";
-import { DEFAULT_LOGGER } from "@geekmidas/logger/console";
-
-//#region src/subscribers/Subscriber.ts
-var Subscriber = class extends Construct {
-	__IS_SUBSCRIBER__ = true;
-	static isSubscriber(obj) {
-		return Boolean(obj && obj.__IS_SUBSCRIBER__ === true && obj.type === ConstructType.Subscriber);
-	}
-	constructor(handler, timeout = 3e4, _subscribedEvents, outputSchema, services = [], logger = DEFAULT_LOGGER, publisherService, topicName, constructs = []) {
-		super(ConstructType.Subscriber, logger, services, [], publisherService, outputSchema, timeout, void 0, void 0, constructs);
-		this.handler = handler;
-		this.timeout = timeout;
-		this._subscribedEvents = _subscribedEvents;
-		this.outputSchema = outputSchema;
-		this.services = services;
-		this.logger = logger;
-		this.publisherService = publisherService;
-		this.topicName = topicName;
-	}
-	get subscribedEvents() {
-		return this._subscribedEvents;
-	}
-};
-
-//#endregion
-//#region src/subscribers/SubscriberBuilder.ts
-var SubscriberBuilder = class {
-	_subscribedEvents = [];
-	_timeout;
-	outputSchema;
-	_services = [];
-	/** The construct ids `.dependsOn()` named — what the manifest records. */
-	_constructs = [];
-	_logger = DEFAULT_LOGGER;
-	_publisher;
-	_topicName;
-	constructor() {
-		this._timeout = 3e4;
-	}
-	/**
-	* Bind this subscriber to a {@link Topic} — the preferred way to type and wire
-	* a fan-out consumer. It supplies the subscribable event types (and their
-	* payloads) from the topic's contract and records the binding for the manifest,
-	* so infra wires the SNS subscription.
-	*
-	* Prefer this over typing via a hand-written publisher service: a consumer does
-	* not publish, so binding a topic does *not* require the topic's publisher
-	* connection string (least privilege). Use `.publisher(...)` only when the
-	* subscriber actually publishes follow-up events.
-	*/
-	topic(topic) {
-		return cloneWith(this, { _topicName: topic.name });
+import { n as Subscriber, t as SubscriberBuilder } from "../SubscriberBuilder-CDy4nHCz.mjs";
+import { n as subscribedEvents, r as subscriberContext, t as runSubscriber } from "../runSubscriber-BHvJ8POr.mjs";
+import { carrierFromAttributes, consumeTraced } from "@geekmidas/events";
+import { wrapError } from "@geekmidas/errors";
+import { runWithRequestContext } from "@geekmidas/services";
+import { confirmSnsSubscription, toSnsEvent, verifySnsMessage } from "@geekmidas/events/sns";
+//#region src/subscribers/SnsPushSubscriberAdaptor.ts
+/**
+* A topic subscriber run by SNS pushing to an HTTP endpoint, rather than by a
+* poller.
+*
+* The notification is read as the Lambda event SNS would have invoked a
+* function with, and run through the same parsing, services and handler as the
+* Lambda adaptor — without its middy wrapper, which is Lambda's alone: a
+* server serving this route has no reason to install `@middy/core`.
+*/
+var SnsPushSubscriberAdaptor = class {
+	envParser;
+	subscriber;
+	options;
+	constructor(envParser, subscriber, options) {
+		this.envParser = envParser;
+		this.subscriber = subscriber;
+		this.options = options;
 	}
-	timeout(timeout) {
-		return cloneWith(this, { _timeout: timeout });
+	async handle(body) {
+		const message = body;
+		if (typeof message?.Type !== "string" || !message.TopicArn) return refuse(400, "not an SNS message");
+		if (message.TopicArn !== this.options.topicArn) return refuse(403, `not subscribed to ${message.TopicArn}`);
+		if (this.options.verify) try {
+			await verifySnsMessage(message);
+		} catch (error) {
+			this.subscriber.logger.warn({
+				err: error,
+				topicArn: message.TopicArn
+			}, "Refused an SNS message that did not verify");
+			return refuse(403, error.name);
+		}
+		switch (message.Type) {
+			case "SubscriptionConfirmation":
+				await confirmSnsSubscription(this.options.emulatorEndpoint && message.SubscribeURL ? {
+					...message,
+					SubscribeURL: throughEndpoint(message.SubscribeURL, this.options.emulatorEndpoint)
+				} : message);
+				this.subscriber.logger.info({ topicArn: message.TopicArn }, "Confirmed SNS subscription");
+				return {
+					status: 200,
+					body: { status: "confirmed" }
+				};
+			case "Notification": try {
+				await this.notify(message);
+				return {
+					status: 200,
+					body: { status: "ok" }
+				};
+			} catch (error) {
+				return refuse(500, error.name);
+			}
+			default: return {
+				status: 200,
+				body: { status: "ignored" }
+			};
+		}
 	}
-	output(schema) {
-		return cloneWith(this, { outputSchema: schema });
+	async notify(message) {
+		const requestId = message.MessageId;
+		const logger = this.subscriber.logger.child({ requestId });
+		await runWithRequestContext({
+			logger,
+			requestId,
+			startTime: Date.now(),
+			operation: `subscriber ${this.subscriber.topicName ?? "sns"}`
+		}, () => consumeTraced({
+			system: "aws_sns",
+			destination: this.subscriber.topicName ?? message.TopicArn.split(":").pop() ?? message.TopicArn,
+			type: message.MessageAttributes?.type?.Value,
+			messageId: message.MessageId
+		}, carrierFromAttributes(message.MessageAttributes), () => this.run(message, logger)));
 	}
-	/**
-	* Depend on constructs — a database, a bucket, a mail sender, a queue, a
-	* topic.
-	*
-	* It records the edge and dissolves each construct's client into the
-	* handler's service record under the construct's own id, so
-	* `.dependsOn([uploads])` is what makes `services.uploads` exist and type.
-	*
-	* Constructs only. A `Service` does not match the shape, which is what keeps
-	* env sniffing confined to `.services()` and the explicit lift.
-	*/
-	dependsOn(constructs) {
-		const services = servicesOf(constructs);
-		return cloneWith(this, {
-			_services: [...this._services, ...services],
-			_constructs: idsOf(constructs, this._constructs)
-		});
-	}
-	services(services) {
-		return cloneWith(this, { _services: [...this._services, ...services] });
-	}
-	logger(logger) {
-		return cloneWith(this, { _logger: logger });
-	}
-	publisher(publisher) {
-		return cloneWith(this, { _publisher: publisher });
-	}
-	subscribe(event) {
-		const eventsToAdd = Array.isArray(event) ? event : [event];
-		return cloneWith(this, { _subscribedEvents: [...this._subscribedEvents, ...eventsToAdd] });
-	}
-	handle(fn) {
-		const subscriber = new Subscriber(fn, this._timeout, this._subscribedEvents, this.outputSchema, this._services, this._logger, this._publisher, this._topicName, this._constructs);
-		return subscriber;
+	async run(message, logger) {
+		try {
+			const { services, db } = await subscriberContext(this.subscriber, this.envParser);
+			const events = subscribedEvents(this.subscriber, toSnsEvent(message), logger);
+			await runSubscriber(this.subscriber, {
+				events,
+				services,
+				logger,
+				db
+			});
+		} catch (error) {
+			logger.error(error, "Error processing subscriber");
+			throw wrapError(error);
+		}
 	}
 };
-
+/** `url`, sent to `endpoint`'s origin instead of its own. */
+function throughEndpoint(url, endpoint) {
+	const target = new URL(url);
+	const origin = new URL(endpoint);
+	target.protocol = origin.protocol;
+	target.host = origin.host;
+	return target.toString();
+}
+function refuse(status, error) {
+	return {
+		status,
+		body: {
+			status: "refused",
+			error
+		}
+	};
+}
 //#endregion
-//#region src/subscribers/index.ts
-const s = new SubscriberBuilder();
+export { SnsPushSubscriberAdaptor, Subscriber, SubscriberBuilder };
 
-//#endregion
-export { Subscriber, SubscriberBuilder, s };
 //# sourceMappingURL=index.mjs.map

package/dist/subscribers/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["obj: any","handler: SubscriberHandler<\n\t\t\tTEventPublisher,\n\t\t\tTSubscribedEvents,\n\t\t\tTServices,\n\t\t\tTLogger,\n\t\t\tOutSchema\n\t\t>","timeout: number","_subscribedEvents?: TSubscribedEvents","outputSchema?: OutSchema","services: TServices","logger: TLogger","publisherService?: Service<\n\t\t\tTEventPublisherServiceName,\n\t\t\tTEventPublisher\n\t\t>","topicName?: string","constructs: string[]","topic: Topic<TName, TEvents>","timeout: number","schema: T","constructs: T","services: T","logger: T","publisher: Service<TName, T>","event: TEvent","fn: SubscriberHandler<\n\t\t\tTEventPublisher,\n\t\t\tTSubscribedEvents,\n\t\t\tTServices,\n\t\t\tTLogger,\n\t\t\tOutSchema\n\t\t>"],"sources":["../../src/subscribers/Subscriber.ts","../../src/subscribers/SubscriberBuilder.ts","../../src/subscribers/index.ts"],"sourcesContent":["import type {\n\tEventPublisher,\n\tExtractPublisherMessage,\n} from '@geekmidas/events';\nimport type { Logger } from '@geekmidas/logger';\nimport { DEFAULT_LOGGER } from '@geekmidas/logger/console';\nimport type { InferStandardSchema } from '@geekmidas/schema';\nimport type { Service, ServiceRecord } from '@geekmidas/services';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { Construct, ConstructType } from '../Construct';\n\n// Helper type to extract payload types for subscribed events\ntype ExtractEventPayloads<\n\tTPublisher extends EventPublisher<any> | undefined,\n\tTEventTypes extends any[],\n> = TPublisher extends EventPublisher<any>\n\t? Extract<ExtractPublisherMessage<TPublisher>, { type: TEventTypes[number] }>\n\t: never;\n\nexport class Subscriber<\n\tTServices extends Service[] = [],\n\tTLogger extends Logger = Logger,\n\tOutSchema extends StandardSchemaV1 | undefined = undefined,\n\tTEventPublisher extends EventPublisher<any> | undefined = undefined,\n\tTEventPublisherServiceName extends string = string,\n\tTSubscribedEvents extends\n\t\tExtractPublisherMessage<TEventPublisher>['type'][] = ExtractPublisherMessage<TEventPublisher>['type'][],\n> extends Construct<\n\tTLogger,\n\tTEventPublisherServiceName,\n\tTEventPublisher,\n\tOutSchema,\n\tTServices\n> {\n\t__IS_SUBSCRIBER__ = true;\n\n\tstatic isSubscriber(\n\t\tobj: any,\n\t): obj is Subscriber<any, any, any, any, any, any> {\n\t\treturn Boolean(\n\t\t\tobj &&\n\t\t\t\tobj.__IS_SUBSCRIBER__ === true &&\n\t\t\t\tobj.type === ConstructType.Subscriber,\n\t\t);\n\t}\n\n\tconstructor(\n\t\tpublic readonly handler: SubscriberHandler<\n\t\t\tTEventPublisher,\n\t\t\tTSubscribedEvents,\n\t\t\tTServices,\n\t\t\tTLogger,\n\t\t\tOutSchema\n\t\t>,\n\t\tpublic override readonly timeout: number = 30000,\n\t\tprotected _subscribedEvents?: TSubscribedEvents,\n\t\tpublic override readonly outputSchema?: OutSchema,\n\t\tpublic override readonly services: TServices = [] as unknown as TServices,\n\t\tpublic override readonly logger: TLogger = DEFAULT_LOGGER as TLogger,\n\t\tpublic override readonly publisherService?: Service<\n\t\t\tTEventPublisherServiceName,\n\t\t\tTEventPublisher\n\t\t>,\n\t\t/**\n\t\t * The name of the {@link Topic} this subscriber binds to (via\n\t\t * `s.topic(topic)`), recorded for the manifest so infra wires the SNS\n\t\t * subscription. Undefined when the subscriber's events are typed from a\n\t\t * (hand-written) publisher instead.\n\t\t */\n\t\tpublic readonly topicName?: string,\n\t\t/**\n\t\t * The construct ids `.dependsOn()` named — last, so no existing positional\n\t\t * argument moves.\n\t\t */\n\t\tconstructs: string[] = [],\n\t) {\n\t\tsuper(\n\t\t\tConstructType.Subscriber,\n\t\t\tlogger,\n\t\t\tservices,\n\t\t\t[],\n\t\t\tpublisherService,\n\t\t\toutputSchema,\n\t\t\ttimeout,\n\t\t\tundefined, // memorySize\n\t\t\tundefined, // auditorStorageService\n\t\t\tconstructs,\n\t\t);\n\t}\n\n\tget subscribedEvents(): TSubscribedEvents | undefined {\n\t\treturn this._subscribedEvents;\n\t}\n}\n\n// Handler type for subscribers that receives an array of events\nexport type SubscriberHandler<\n\tTEventPublisher extends EventPublisher<any> | undefined,\n\tTSubscribedEvents extends ExtractPublisherMessage<TEventPublisher>['type'][],\n\tTServices extends Service[] = [],\n\tTLogger extends Logger = Logger,\n\tOutSchema extends StandardSchemaV1 | undefined = undefined,\n> = (\n\tctx: SubscriberContext<\n\t\tTEventPublisher,\n\t\tTSubscribedEvents,\n\t\tTServices,\n\t\tTLogger\n\t>,\n) => OutSchema extends StandardSchemaV1\n\t? InferStandardSchema<OutSchema> | Promise<InferStandardSchema<OutSchema>>\n\t: any | Promise<any>;\n\n// Context type for subscriber handlers\nexport type SubscriberContext<\n\tTEventPublisher extends EventPublisher<any> | undefined,\n\tTSubscribedEvents extends ExtractPublisherMessage<TEventPublisher>['type'][],\n\tTServices extends Service[] = [],\n\tTLogger extends Logger = Logger,\n> = {\n\tevents: ExtractEventPayloads<TEventPublisher, TSubscribedEvents>[];\n\tservices: ServiceRecord<TServices>;\n\tlogger: TLogger;\n};\n","import type {\n\tEventPublisher,\n\tExtractPublisherMessage,\n} from '@geekmidas/events';\nimport type { Logger } from '@geekmidas/logger';\nimport { DEFAULT_LOGGER } from '@geekmidas/logger/console';\nimport type { Service } from '@geekmidas/services';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { cloneWith } from '../clone';\nimport {\n\ttype Consumable,\n\tidsOf,\n\ttype ServicesOf,\n\tservicesOf,\n} from '../construct-interface';\nimport type { Topic, TopicEvents, TopicMessage } from '../topic/Topic';\nimport { Subscriber, type SubscriberHandler } from './Subscriber';\n\nexport class SubscriberBuilder<\n\tTServices extends Service[] = [],\n\tTLogger extends Logger = Logger,\n\tOutSchema extends StandardSchemaV1 | undefined = undefined,\n\tTEventPublisher extends EventPublisher<any> | undefined = undefined,\n\tTEventPublisherServiceName extends string = string,\n\tTSubscribedEvents extends any[] = [],\n> {\n\tprivate _subscribedEvents: TSubscribedEvents = [] as any;\n\tprivate _timeout?: number;\n\tprivate outputSchema?: OutSchema;\n\tprivate _services: TServices = [] as Service[] as TServices;\n\t/** The construct ids `.dependsOn()` named — what the manifest records. */\n\tpublic _constructs: string[] = [];\n\tprivate _logger: TLogger = DEFAULT_LOGGER;\n\tprivate _publisher?: Service<TEventPublisherServiceName, TEventPublisher>;\n\tprivate _topicName?: string;\n\n\tconstructor() {\n\t\tthis._timeout = 30000; // Default timeout\n\t}\n\n\t/**\n\t * Bind this subscriber to a {@link Topic} — the preferred way to type and wire\n\t * a fan-out consumer. It supplies the subscribable event types (and their\n\t * payloads) from the topic's contract and records the binding for the manifest,\n\t * so infra wires the SNS subscription.\n\t *\n\t * Prefer this over typing via a hand-written publisher service: a consumer does\n\t * not publish, so binding a topic does *not* require the topic's publisher\n\t * connection string (least privilege). Use `.publisher(...)` only when the\n\t * subscriber actually publishes follow-up events.\n\t */\n\ttopic<TName extends string, TEvents extends TopicEvents>(\n\t\ttopic: Topic<TName, TEvents>,\n\t): SubscriberBuilder<\n\t\tTServices,\n\t\tTLogger,\n\t\tOutSchema,\n\t\tEventPublisher<TopicMessage<TEvents>>,\n\t\tTEventPublisherServiceName,\n\t\tTSubscribedEvents\n\t> {\n\t\treturn cloneWith(this, {\n\t\t\t_topicName: topic.name,\n\t\t}) as unknown as SubscriberBuilder<\n\t\t\tTServices,\n\t\t\tTLogger,\n\t\t\tOutSchema,\n\t\t\tEventPublisher<TopicMessage<TEvents>>,\n\t\t\tTEventPublisherServiceName,\n\t\t\tTSubscribedEvents\n\t\t>;\n\t}\n\n\ttimeout(timeout: number): this {\n\t\treturn cloneWith(this, { _timeout: timeout });\n\t}\n\n\toutput<T extends StandardSchemaV1>(\n\t\tschema: T,\n\t): SubscriberBuilder<\n\t\tTServices,\n\t\tTLogger,\n\t\tT,\n\t\tTEventPublisher,\n\t\tTEventPublisherServiceName,\n\t\tTSubscribedEvents\n\t> {\n\t\treturn cloneWith(this, {\n\t\t\toutputSchema: schema as unknown as OutSchema,\n\t\t}) as any;\n\t}\n\n\t/**\n\t * Depend on constructs — a database, a bucket, a mail sender, a queue, a\n\t * topic.\n\t *\n\t * It records the edge and dissolves each construct's client into the\n\t * handler's service record under the construct's own id, so\n\t * `.dependsOn([uploads])` is what makes `services.uploads` exist and type.\n\t *\n\t * Constructs only. A `Service` does not match the shape, which is what keeps\n\t * env sniffing confined to `.services()` and the explicit lift.\n\t */\n\tdependsOn<const T extends readonly Consumable[]>(\n\t\tconstructs: T,\n\t): SubscriberBuilder<\n\t\t[...TServices, ...ServicesOf<T>],\n\t\tTLogger,\n\t\tOutSchema,\n\t\tTEventPublisher,\n\t\tTEventPublisherServiceName,\n\t\tTSubscribedEvents\n\t> {\n\t\t// Both halves of the edge, from one call and one clone: the services the\n\t\t// handler runs with, and the ids the manifest records. Recording them\n\t\t// separately is what let them drift apart.\n\t\t//\n\t\t// `servicesOf` is the half that validates, so it runs first — recording\n\t\t// ids ahead of it left a caught `NotAConstruct` with `undefined` already\n\t\t// on a `string[]`.\n\t\tconst services = servicesOf(constructs) as unknown as Service[];\n\n\t\treturn cloneWith(this, {\n\t\t\t_services: [...this._services, ...services],\n\t\t\t_constructs: idsOf(constructs, this._constructs),\n\t\t}) as unknown as SubscriberBuilder<\n\t\t\t[...TServices, ...ServicesOf<T>],\n\t\t\tTLogger,\n\t\t\tOutSchema,\n\t\t\tTEventPublisher,\n\t\t\tTEventPublisherServiceName,\n\t\t\tTSubscribedEvents\n\t\t>;\n\t}\n\n\tservices<T extends Service[]>(\n\t\tservices: T,\n\t): SubscriberBuilder<\n\t\t[...TServices, ...T],\n\t\tTLogger,\n\t\tOutSchema,\n\t\tTEventPublisher,\n\t\tTEventPublisherServiceName,\n\t\tTSubscribedEvents\n\t> {\n\t\treturn cloneWith(this, {\n\t\t\t_services: [...this._services, ...services] as any,\n\t\t}) as any;\n\t}\n\n\tlogger<T extends Logger>(\n\t\tlogger: T,\n\t): SubscriberBuilder<\n\t\tTServices,\n\t\tT,\n\t\tOutSchema,\n\t\tTEventPublisher,\n\t\tTEventPublisherServiceName,\n\t\tTSubscribedEvents\n\t> {\n\t\treturn cloneWith(this, { _logger: logger as unknown as TLogger }) as any;\n\t}\n\n\tpublisher<T extends EventPublisher<any>, TName extends string>(\n\t\tpublisher: Service<TName, T>,\n\t): SubscriberBuilder<\n\t\tTServices,\n\t\tTLogger,\n\t\tOutSchema,\n\t\tT,\n\t\tTName,\n\t\tTSubscribedEvents\n\t> {\n\t\treturn cloneWith(this, { _publisher: publisher as any }) as any;\n\t}\n\n\tsubscribe<\n\t\tTEvent extends TEventPublisher extends EventPublisher<any>\n\t\t\t?\n\t\t\t\t\t| ExtractPublisherMessage<TEventPublisher>['type']\n\t\t\t\t\t| ExtractPublisherMessage<TEventPublisher>['type'][]\n\t\t\t: never,\n\t>(\n\t\tevent: TEvent,\n\t): SubscriberBuilder<\n\t\tTServices,\n\t\tTLogger,\n\t\tOutSchema,\n\t\tTEventPublisher,\n\t\tTEventPublisherServiceName,\n\t\tTEvent extends any[]\n\t\t\t? [...TSubscribedEvents, ...TEvent]\n\t\t\t: [...TSubscribedEvents, TEvent]\n\t> {\n\t\tconst eventsToAdd = Array.isArray(event) ? event : [event];\n\t\treturn cloneWith(this, {\n\t\t\t_subscribedEvents: [...this._subscribedEvents, ...eventsToAdd] as any,\n\t\t}) as any;\n\t}\n\n\thandle(\n\t\tfn: SubscriberHandler<\n\t\t\tTEventPublisher,\n\t\t\tTSubscribedEvents,\n\t\t\tTServices,\n\t\t\tTLogger,\n\t\t\tOutSchema\n\t\t>,\n\t): Subscriber<\n\t\tTServices,\n\t\tTLogger,\n\t\tOutSchema,\n\t\tTEventPublisher,\n\t\tTEventPublisherServiceName,\n\t\tTSubscribedEvents\n\t> {\n\t\tconst subscriber = new Subscriber(\n\t\t\tfn,\n\t\t\tthis._timeout,\n\t\t\tthis._subscribedEvents,\n\t\t\tthis.outputSchema,\n\t\t\tthis._services,\n\t\t\tthis._logger,\n\t\t\tthis._publisher,\n\t\t\tthis._topicName,\n\t\t\tthis._constructs,\n\t\t);\n\n\t\t// No reset: `.handle()` reads this builder and leaves it alone, so a\n\t\t// configured base stays usable for the next subscriber.\n\t\treturn subscriber;\n\t}\n}\n","import { SubscriberBuilder } from './SubscriberBuilder';\n\nexport { Subscriber } from './Subscriber';\nexport { SubscriberBuilder };\n\nexport const s = new SubscriberBuilder();\n"],"mappings":";;;;;;AAmBA,IAAa,aAAb,cAQU,UAMR;CACD,oBAAoB;CAEpB,OAAO,aACNA,KACkD;AAClD,SAAO,QACN,OACC,IAAI,sBAAsB,QAC1B,IAAI,SAAS,cAAc,WAC5B;CACD;CAED,YACiBC,SAOSC,UAAkB,KACjCC,mBACeC,cACAC,WAAsB,CAAE,GACxBC,SAAkB,gBAClBC,kBAUTC,WAKhBC,aAAuB,CAAE,GACxB;AACD,QACC,cAAc,YACd,QACA,UACA,CAAE,GACF,kBACA,cACA,yBAGA,WACA;EAxCe;EAOS;EACf;EACe;EACA;EACA;EACA;EAUT;CAmBhB;CAED,IAAI,mBAAkD;AACrD,SAAO,KAAK;CACZ;AACD;;;;AC3ED,IAAa,oBAAb,MAOE;CACD,AAAQ,oBAAuC,CAAE;CACjD,AAAQ;CACR,AAAQ;CACR,AAAQ,YAAuB,CAAE;;CAEjC,AAAO,cAAwB,CAAE;CACjC,AAAQ,UAAmB;CAC3B,AAAQ;CACR,AAAQ;CAER,cAAc;AACb,OAAK,WAAW;CAChB;;;;;;;;;;;;CAaD,MACCC,OAQC;AACD,SAAO,UAAU,MAAM,EACtB,YAAY,MAAM,KAClB,EAAC;CAQF;CAED,QAAQC,SAAuB;AAC9B,SAAO,UAAU,MAAM,EAAE,UAAU,QAAS,EAAC;CAC7C;CAED,OACCC,QAQC;AACD,SAAO,UAAU,MAAM,EACtB,cAAc,OACd,EAAC;CACF;;;;;;;;;;;;CAaD,UACCC,YAQC;EAQD,MAAM,WAAW,WAAW,WAAW;AAEvC,SAAO,UAAU,MAAM;GACtB,WAAW,CAAC,GAAG,KAAK,WAAW,GAAG,QAAS;GAC3C,aAAa,MAAM,YAAY,KAAK,YAAY;EAChD,EAAC;CAQF;CAED,SACCC,UAQC;AACD,SAAO,UAAU,MAAM,EACtB,WAAW,CAAC,GAAG,KAAK,WAAW,GAAG,QAAS,EAC3C,EAAC;CACF;CAED,OACCC,QAQC;AACD,SAAO,UAAU,MAAM,EAAE,SAAS,OAA8B,EAAC;CACjE;CAED,UACCC,WAQC;AACD,SAAO,UAAU,MAAM,EAAE,YAAY,UAAkB,EAAC;CACxD;CAED,UAOCC,OAUC;EACD,MAAM,cAAc,MAAM,QAAQ,MAAM,GAAG,QAAQ,CAAC,KAAM;AAC1D,SAAO,UAAU,MAAM,EACtB,mBAAmB,CAAC,GAAG,KAAK,mBAAmB,GAAG,WAAY,EAC9D,EAAC;CACF;CAED,OACCC,IAcC;EACD,MAAM,aAAa,IAAI,WACtB,IACA,KAAK,UACL,KAAK,mBACL,KAAK,cACL,KAAK,WACL,KAAK,SACL,KAAK,YACL,KAAK,YACL,KAAK;AAKN,SAAO;CACP;AACD;;;;ACnOD,MAAa,IAAI,IAAI"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/subscribers/SnsPushSubscriberAdaptor.ts"],"sourcesContent":["import type { EnvironmentParser } from '@geekmidas/envkit';\nimport { wrapError } from '@geekmidas/errors';\nimport { carrierFromAttributes, consumeTraced } from '@geekmidas/events';\nimport {\n\tconfirmSnsSubscription,\n\ttype SnsHttpMessage,\n\ttoSnsEvent,\n\tverifySnsMessage,\n} from '@geekmidas/events/sns';\nimport { runWithRequestContext } from '@geekmidas/services';\nimport {\n\trunSubscriber,\n\tsubscribedEvents,\n\tsubscriberContext,\n} from './runSubscriber';\nimport type { Subscriber } from './Subscriber';\n\nexport interface SnsPushOptions {\n\t/** The topic this subscriber is subscribed to. Anything else is refused. */\n\ttopicArn: string;\n\t/**\n\t * Verify each message's signature. Off only against an emulator, which\n\t * signs nothing — decided by the connection string's endpoint, never by\n\t * anything the request says about itself.\n\t */\n\tverify: boolean;\n\t/**\n\t * The emulator's address, as this server was configured with it. An\n\t * emulator names itself in `SubscribeURL` by the port it listens on inside\n\t * its container, which is not the port published to the host — so against\n\t * one, the confirmation is sent here instead. From configuration, never\n\t * from the request.\n\t */\n\temulatorEndpoint?: string;\n}\n\n/** What to answer SNS with. A non-2xx tells SNS to retry. */\nexport interface SnsPushResponse {\n\tstatus: 200 | 400 | 403 | 500;\n\tbody: { status: string; error?: string };\n}\n\n/**\n * A topic subscriber run by SNS pushing to an HTTP endpoint, rather than by a\n * poller.\n *\n * The notification is read as the Lambda event SNS would have invoked a\n * function with, and run through the same parsing, services and handler as the\n * Lambda adaptor — without its middy wrapper, which is Lambda's alone: a\n * server serving this route has no reason to install `@middy/core`.\n */\nexport class SnsPushSubscriberAdaptor {\n\tconstructor(\n\t\tprivate readonly envParser: EnvironmentParser<{}>,\n\t\treadonly subscriber: Subscriber<any, any, any, any, any, any, any>,\n\t\tprivate readonly options: SnsPushOptions,\n\t) {}\n\n\tasync handle(body: unknown): Promise<SnsPushResponse> {\n\t\tconst message = body as SnsHttpMessage;\n\t\tif (typeof message?.Type !== 'string' || !message.TopicArn) {\n\t\t\treturn refuse(400, 'not an SNS message');\n\t\t}\n\t\t// Checked before the signature: a genuine message for another topic is\n\t\t// still not this subscriber's to confirm or to handle.\n\t\tif (message.TopicArn !== this.options.topicArn) {\n\t\t\treturn refuse(403, `not subscribed to ${message.TopicArn}`);\n\t\t}\n\n\t\tif (this.options.verify) {\n\t\t\ttry {\n\t\t\t\tawait verifySnsMessage(message);\n\t\t\t} catch (error) {\n\t\t\t\tthis.subscriber.logger.warn(\n\t\t\t\t\t{ err: error, topicArn: message.TopicArn },\n\t\t\t\t\t'Refused an SNS message that did not verify',\n\t\t\t\t);\n\t\t\t\treturn refuse(403, (error as Error).name);\n\t\t\t}\n\t\t}\n\n\t\tswitch (message.Type) {\n\t\t\tcase 'SubscriptionConfirmation':\n\t\t\t\tawait confirmSnsSubscription(\n\t\t\t\t\tthis.options.emulatorEndpoint && message.SubscribeURL\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t...message,\n\t\t\t\t\t\t\t\tSubscribeURL: throughEndpoint(\n\t\t\t\t\t\t\t\t\tmessage.SubscribeURL,\n\t\t\t\t\t\t\t\t\tthis.options.emulatorEndpoint,\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: message,\n\t\t\t\t);\n\t\t\t\tthis.subscriber.logger.info(\n\t\t\t\t\t{ topicArn: message.TopicArn },\n\t\t\t\t\t'Confirmed SNS subscription',\n\t\t\t\t);\n\t\t\t\treturn { status: 200, body: { status: 'confirmed' } };\n\t\t\tcase 'Notification':\n\t\t\t\ttry {\n\t\t\t\t\tawait this.notify(message);\n\t\t\t\t\treturn { status: 200, body: { status: 'ok' } };\n\t\t\t\t} catch (error) {\n\t\t\t\t\t// Already logged. A 500 makes SNS retry, which is the point of\n\t\t\t\t\t// answering at all.\n\t\t\t\t\treturn refuse(500, (error as Error).name);\n\t\t\t\t}\n\t\t\tdefault:\n\t\t\t\treturn { status: 200, body: { status: 'ignored' } };\n\t\t}\n\t}\n\n\tprivate async notify(message: SnsHttpMessage): Promise<void> {\n\t\tconst requestId = message.MessageId;\n\t\tconst logger = this.subscriber.logger.child({ requestId });\n\n\t\tawait runWithRequestContext(\n\t\t\t{\n\t\t\t\tlogger,\n\t\t\t\trequestId,\n\t\t\t\tstartTime: Date.now(),\n\t\t\t\toperation: `subscriber ${this.subscriber.topicName ?? 'sns'}`,\n\t\t\t},\n\t\t\t// A CONSUMER span, child of the publisher's: SNS hands the trace\n\t\t\t// context on in the message attributes it was published with.\n\t\t\t() =>\n\t\t\t\tconsumeTraced(\n\t\t\t\t\t{\n\t\t\t\t\t\tsystem: 'aws_sns',\n\t\t\t\t\t\tdestination:\n\t\t\t\t\t\t\tthis.subscriber.topicName ??\n\t\t\t\t\t\t\tmessage.TopicArn.split(':').pop() ??\n\t\t\t\t\t\t\tmessage.TopicArn,\n\t\t\t\t\t\ttype: message.MessageAttributes?.type?.Value,\n\t\t\t\t\t\tmessageId: message.MessageId,\n\t\t\t\t\t},\n\t\t\t\t\tcarrierFromAttributes(message.MessageAttributes),\n\t\t\t\t\t() => this.run(message, logger),\n\t\t\t\t),\n\t\t);\n\t}\n\n\tprivate async run(\n\t\tmessage: SnsHttpMessage,\n\t\tlogger: Subscriber<any, any, any, any, any, any, any>['logger'],\n\t): Promise<void> {\n\t\ttry {\n\t\t\tconst { services, db } = await subscriberContext(\n\t\t\t\tthis.subscriber,\n\t\t\t\tthis.envParser,\n\t\t\t);\n\t\t\tconst events = subscribedEvents(\n\t\t\t\tthis.subscriber,\n\t\t\t\ttoSnsEvent(message),\n\t\t\t\tlogger,\n\t\t\t);\n\t\t\tawait runSubscriber(this.subscriber, {\n\t\t\t\tevents,\n\t\t\t\tservices,\n\t\t\t\tlogger,\n\t\t\t\tdb,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tlogger.error(error as object, 'Error processing subscriber');\n\t\t\tthrow wrapError(error);\n\t\t}\n\t}\n}\n\n/** `url`, sent to `endpoint`'s origin instead of its own. */\nfunction throughEndpoint(url: string, endpoint: string): string {\n\tconst target = new URL(url);\n\tconst origin = new URL(endpoint);\n\ttarget.protocol = origin.protocol;\n\ttarget.host = origin.host;\n\treturn target.toString();\n}\n\nfunction refuse(\n\tstatus: SnsPushResponse['status'],\n\terror: string,\n): SnsPushResponse {\n\treturn { status, body: { status: 'refused', error } };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmDA,IAAa,2BAAb,MAAsC;CAEnB;CACR;CACQ;CAHlB,YACC,WACA,YACA,SACC;EAHgB,KAAA,YAAA;EACR,KAAA,aAAA;EACQ,KAAA,UAAA;CACf;CAEH,MAAM,OAAO,MAAyC;EACrD,MAAM,UAAU;EAChB,IAAI,OAAO,SAAS,SAAS,YAAY,CAAC,QAAQ,UACjD,OAAO,OAAO,KAAK,oBAAoB;EAIxC,IAAI,QAAQ,aAAa,KAAK,QAAQ,UACrC,OAAO,OAAO,KAAK,qBAAqB,QAAQ,UAAU;EAG3D,IAAI,KAAK,QAAQ,QAChB,IAAI;GACH,MAAM,iBAAiB,OAAO;EAC/B,SAAS,OAAO;GACf,KAAK,WAAW,OAAO,KACtB;IAAE,KAAK;IAAO,UAAU,QAAQ;GAAS,GACzC,4CACD;GACA,OAAO,OAAO,KAAM,MAAgB,IAAI;EACzC;EAGD,QAAQ,QAAQ,MAAhB;GACC,KAAK;IACJ,MAAM,uBACL,KAAK,QAAQ,oBAAoB,QAAQ,eACtC;KACA,GAAG;KACH,cAAc,gBACb,QAAQ,cACR,KAAK,QAAQ,gBACd;IACD,IACC,OACJ;IACA,KAAK,WAAW,OAAO,KACtB,EAAE,UAAU,QAAQ,SAAS,GAC7B,4BACD;IACA,OAAO;KAAE,QAAQ;KAAK,MAAM,EAAE,QAAQ,YAAY;IAAE;GACrD,KAAK,gBACJ,IAAI;IACH,MAAM,KAAK,OAAO,OAAO;IACzB,OAAO;KAAE,QAAQ;KAAK,MAAM,EAAE,QAAQ,KAAK;IAAE;GAC9C,SAAS,OAAO;IAGf,OAAO,OAAO,KAAM,MAAgB,IAAI;GACzC;GACD,SACC,OAAO;IAAE,QAAQ;IAAK,MAAM,EAAE,QAAQ,UAAU;GAAE;EACpD;CACD;CAEA,MAAc,OAAO,SAAwC;EAC5D,MAAM,YAAY,QAAQ;EAC1B,MAAM,SAAS,KAAK,WAAW,OAAO,MAAM,EAAE,UAAU,CAAC;EAEzD,MAAM,sBACL;GACC;GACA;GACA,WAAW,KAAK,IAAI;GACpB,WAAW,cAAc,KAAK,WAAW,aAAa;EACvD,SAIC,cACC;GACC,QAAQ;GACR,aACC,KAAK,WAAW,aAChB,QAAQ,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAChC,QAAQ;GACT,MAAM,QAAQ,mBAAmB,MAAM;GACvC,WAAW,QAAQ;EACpB,GACA,sBAAsB,QAAQ,iBAAiB,SACzC,KAAK,IAAI,SAAS,MAAM,CAC/B,CACF;CACD;CAEA,MAAc,IACb,SACA,QACgB;EAChB,IAAI;GACH,MAAM,EAAE,UAAU,OAAO,MAAM,kBAC9B,KAAK,YACL,KAAK,SACN;GACA,MAAM,SAAS,iBACd,KAAK,YACL,WAAW,OAAO,GAClB,MACD;GACA,MAAM,cAAc,KAAK,YAAY;IACpC;IACA;IACA;IACA;GACD,CAAC;EACF,SAAS,OAAO;GACf,OAAO,MAAM,OAAiB,6BAA6B;GAC3D,MAAM,UAAU,KAAK;EACtB;CACD;AACD;;AAGA,SAAS,gBAAgB,KAAa,UAA0B;CAC/D,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,MAAM,SAAS,IAAI,IAAI,QAAQ;CAC/B,OAAO,WAAW,OAAO;CACzB,OAAO,OAAO,OAAO;CACrB,OAAO,OAAO,SAAS;AACxB;AAEA,SAAS,OACR,QACA,OACkB;CAClB,OAAO;EAAE;EAAQ,MAAM;GAAE,QAAQ;GAAW;EAAM;CAAE;AACrD"}

package/dist/surfaceEnv-CNimK76p.cjs

@@ -0,0 +1,56 @@
+let _geekmidas_envkit = require("@geekmidas/envkit");
+let _geekmidas_envkit_credentials = require("@geekmidas/envkit/credentials");
+//#region src/endpoints/surfaceEnv.ts
+/**
+* The environment parser an endpoint runs with.
+*
+* Three facts, in order:
+*
+* 1. An endpoint built from a surface carries whatever parser that surface was
+*    given. This is the whole point of `api.get()` — the handler already has
+*    the thing, so nothing has to be named in config and nothing has to be
+*    printed into generated code.
+* 2. A surface that named none gets this default, which is what every
+*    application's own `config/env.ts` was: `process.env` merged with the
+*    credentials `gkm dev`/`gkm exec` injected. It was boilerplate identical in
+*    every project, and mandatory, which is a poor combination.
+* 3. An endpoint with no surface at all — a test, an MSW handler — gets the
+*    same default. Nothing has to opt in.
+*
+* Named a parser only when it is genuinely different: a merged secret source, a
+* fixture, a parser that reads from somewhere other than the process.
+*/
+let fallback;
+/**
+* The default parser, built once.
+*
+* Once because `Credentials` resolves through `globalThis` and decryption is
+* not free, and because two parsers over the same environment are two caches of
+* the same answer.
+*/
+function defaultEnvParser() {
+	if (!fallback) fallback = new _geekmidas_envkit.EnvironmentParser({
+		...process.env,
+		..._geekmidas_envkit_credentials.Credentials
+	});
+	return fallback;
+}
+/** The parser for an endpoint, from its surface or the default. */
+function envParserFor(surface) {
+	return surface?.envParser ?? defaultEnvParser();
+}
+//#endregion
+Object.defineProperty(exports, "defaultEnvParser", {
+	enumerable: true,
+	get: function() {
+		return defaultEnvParser;
+	}
+});
+Object.defineProperty(exports, "envParserFor", {
+	enumerable: true,
+	get: function() {
+		return envParserFor;
+	}
+});
+
+//# sourceMappingURL=surfaceEnv-CNimK76p.cjs.map

package/dist/surfaceEnv-CNimK76p.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"surfaceEnv-CNimK76p.cjs","names":["EnvironmentParser","Credentials"],"sources":["../src/endpoints/surfaceEnv.ts"],"sourcesContent":["/**\n * The environment parser an endpoint runs with.\n *\n * Three facts, in order:\n *\n * 1. An endpoint built from a surface carries whatever parser that surface was\n *    given. This is the whole point of `api.get()` — the handler already has\n *    the thing, so nothing has to be named in config and nothing has to be\n *    printed into generated code.\n * 2. A surface that named none gets this default, which is what every\n *    application's own `config/env.ts` was: `process.env` merged with the\n *    credentials `gkm dev`/`gkm exec` injected. It was boilerplate identical in\n *    every project, and mandatory, which is a poor combination.\n * 3. An endpoint with no surface at all — a test, an MSW handler — gets the\n *    same default. Nothing has to opt in.\n *\n * Named a parser only when it is genuinely different: a merged secret source, a\n * fixture, a parser that reads from somewhere other than the process.\n */\n\nimport { EnvironmentParser } from '@geekmidas/envkit';\nimport { Credentials } from '@geekmidas/envkit/credentials';\nimport type { EndpointSurface } from './Endpoint';\n\nlet fallback: EnvironmentParser<{}> | undefined;\n\n/**\n * The default parser, built once.\n *\n * Once because `Credentials` resolves through `globalThis` and decryption is\n * not free, and because two parsers over the same environment are two caches of\n * the same answer.\n */\nexport function defaultEnvParser(): EnvironmentParser<{}> {\n\tif (!fallback) {\n\t\tfallback = new EnvironmentParser({ ...process.env, ...Credentials });\n\t}\n\n\treturn fallback;\n}\n\n/** The parser for an endpoint, from its surface or the default. */\nexport function envParserFor(\n\tsurface: EndpointSurface | undefined,\n): EnvironmentParser<{}> {\n\treturn surface?.envParser ?? defaultEnvParser();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAI;;;;;;;;AASJ,SAAgB,mBAA0C;CACzD,IAAI,CAAC,UACJ,WAAW,IAAIA,kBAAAA,kBAAkB;EAAE,GAAG,QAAQ;EAAK,GAAGC,8BAAAA;CAAY,CAAC;CAGpE,OAAO;AACR;;AAGA,SAAgB,aACf,SACwB;CACxB,OAAO,SAAS,aAAa,iBAAiB;AAC/C"}

package/dist/surfaceEnv-wMT5QzgZ.mjs

@@ -0,0 +1,45 @@
+import { EnvironmentParser } from "@geekmidas/envkit";
+import { Credentials } from "@geekmidas/envkit/credentials";
+//#region src/endpoints/surfaceEnv.ts
+/**
+* The environment parser an endpoint runs with.
+*
+* Three facts, in order:
+*
+* 1. An endpoint built from a surface carries whatever parser that surface was
+*    given. This is the whole point of `api.get()` — the handler already has
+*    the thing, so nothing has to be named in config and nothing has to be
+*    printed into generated code.
+* 2. A surface that named none gets this default, which is what every
+*    application's own `config/env.ts` was: `process.env` merged with the
+*    credentials `gkm dev`/`gkm exec` injected. It was boilerplate identical in
+*    every project, and mandatory, which is a poor combination.
+* 3. An endpoint with no surface at all — a test, an MSW handler — gets the
+*    same default. Nothing has to opt in.
+*
+* Named a parser only when it is genuinely different: a merged secret source, a
+* fixture, a parser that reads from somewhere other than the process.
+*/
+let fallback;
+/**
+* The default parser, built once.
+*
+* Once because `Credentials` resolves through `globalThis` and decryption is
+* not free, and because two parsers over the same environment are two caches of
+* the same answer.
+*/
+function defaultEnvParser() {
+	if (!fallback) fallback = new EnvironmentParser({
+		...process.env,
+		...Credentials
+	});
+	return fallback;
+}
+/** The parser for an endpoint, from its surface or the default. */
+function envParserFor(surface) {
+	return surface?.envParser ?? defaultEnvParser();
+}
+//#endregion
+export { envParserFor as n, defaultEnvParser as t };
+
+//# sourceMappingURL=surfaceEnv-wMT5QzgZ.mjs.map

package/dist/surfaceEnv-wMT5QzgZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"surfaceEnv-wMT5QzgZ.mjs","names":[],"sources":["../src/endpoints/surfaceEnv.ts"],"sourcesContent":["/**\n * The environment parser an endpoint runs with.\n *\n * Three facts, in order:\n *\n * 1. An endpoint built from a surface carries whatever parser that surface was\n *    given. This is the whole point of `api.get()` — the handler already has\n *    the thing, so nothing has to be named in config and nothing has to be\n *    printed into generated code.\n * 2. A surface that named none gets this default, which is what every\n *    application's own `config/env.ts` was: `process.env` merged with the\n *    credentials `gkm dev`/`gkm exec` injected. It was boilerplate identical in\n *    every project, and mandatory, which is a poor combination.\n * 3. An endpoint with no surface at all — a test, an MSW handler — gets the\n *    same default. Nothing has to opt in.\n *\n * Named a parser only when it is genuinely different: a merged secret source, a\n * fixture, a parser that reads from somewhere other than the process.\n */\n\nimport { EnvironmentParser } from '@geekmidas/envkit';\nimport { Credentials } from '@geekmidas/envkit/credentials';\nimport type { EndpointSurface } from './Endpoint';\n\nlet fallback: EnvironmentParser<{}> | undefined;\n\n/**\n * The default parser, built once.\n *\n * Once because `Credentials` resolves through `globalThis` and decryption is\n * not free, and because two parsers over the same environment are two caches of\n * the same answer.\n */\nexport function defaultEnvParser(): EnvironmentParser<{}> {\n\tif (!fallback) {\n\t\tfallback = new EnvironmentParser({ ...process.env, ...Credentials });\n\t}\n\n\treturn fallback;\n}\n\n/** The parser for an endpoint, from its surface or the default. */\nexport function envParserFor(\n\tsurface: EndpointSurface | undefined,\n): EnvironmentParser<{}> {\n\treturn surface?.envParser ?? defaultEnvParser();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAI;;;;;;;;AASJ,SAAgB,mBAA0C;CACzD,IAAI,CAAC,UACJ,WAAW,IAAI,kBAAkB;EAAE,GAAG,QAAQ;EAAK,GAAG;CAAY,CAAC;CAGpE,OAAO;AACR;;AAGA,SAAgB,aACf,SACwB;CACxB,OAAO,SAAS,aAAa,iBAAiB;AAC/C"}

package/dist/telemetry-B48RLjyk.d.cts

@@ -0,0 +1,40 @@
+import { i as Declarable } from "./construct-interface-B1AfqRl4.cjs";
+import { ConstructName, Declaration } from "@geekmidas/manifest";
+//#region src/telemetry.d.ts
+interface TelemetryConfig {
+  /**
+   * Request paths no span is recorded for, on every surface that uses this —
+   * health checks, by default the only noise worth naming. A trailing `*`
+   * matches a prefix. One route on one surface says so itself:
+   * `.telemetry({ ignore: true })`.
+   */
+  ignorePaths?: readonly string[];
+  /**
+   * Resource attributes every span and log record carries —
+   * `{ 'service.namespace': 'shop' }`. The service's name is not one of
+   * them: it is the app's, set per process.
+   */
+  attributes?: Readonly<Record<string, string>>;
+}
+declare class Telemetry<TName extends string = string> implements Declarable<TName> {
+  readonly id: TName;
+  readonly ignorePaths: readonly string[];
+  readonly attributes: Readonly<Record<string, string>>;
+  constructor(id: ConstructName<TName>, config?: TelemetryConfig);
+  /**
+   * One node, providing OpenTelemetry's own variables. No address of its
+   * own: where the telemetry goes is the deploy's, so it is resolved by the
+   * target for each stage, never declared here.
+   */
+  declare(): Declaration[];
+}
+/** Per-route telemetry, on the endpoint builder — `.telemetry({ ignore: true })`. */
+interface EndpointTelemetry {
+  /** Record no span for this route. */
+  ignore?: boolean;
+  /** Attributes this route's request span carries. */
+  attributes?: Readonly<Record<string, string>>;
+}
+//#endregion
+export { Telemetry as n, TelemetryConfig as r, EndpointTelemetry as t };
+//# sourceMappingURL=telemetry-B48RLjyk.d.cts.map

package/dist/telemetry-B48RLjyk.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-B48RLjyk.d.cts","names":[],"sources":["../src/telemetry.ts"],"mappings":";;;UAkCiB;;;;;;;EAOhB;;;;;;EAMA,aAAa,SAAS;;cAGV,UAAU,0CACX,WAAW;WAEb,IAAI;WACJ;WACA,YAAY,SAAS;EAE9B,YAAY,IAAI,cAAc,QAAQ,SAAQ;;;;;;EAW9C,WAAW;;;UAgBK;;EAEhB;;EAEA,aAAa,SAAS"}

package/dist/telemetry-DRtT1_0A.d.mts

@@ -0,0 +1,40 @@
+import { i as Declarable } from "./construct-interface-DluK3_da.mjs";
+import { ConstructName, Declaration } from "@geekmidas/manifest";
+//#region src/telemetry.d.ts
+interface TelemetryConfig {
+  /**
+   * Request paths no span is recorded for, on every surface that uses this —
+   * health checks, by default the only noise worth naming. A trailing `*`
+   * matches a prefix. One route on one surface says so itself:
+   * `.telemetry({ ignore: true })`.
+   */
+  ignorePaths?: readonly string[];
+  /**
+   * Resource attributes every span and log record carries —
+   * `{ 'service.namespace': 'shop' }`. The service's name is not one of
+   * them: it is the app's, set per process.
+   */
+  attributes?: Readonly<Record<string, string>>;
+}
+declare class Telemetry<TName extends string = string> implements Declarable<TName> {
+  readonly id: TName;
+  readonly ignorePaths: readonly string[];
+  readonly attributes: Readonly<Record<string, string>>;
+  constructor(id: ConstructName<TName>, config?: TelemetryConfig);
+  /**
+   * One node, providing OpenTelemetry's own variables. No address of its
+   * own: where the telemetry goes is the deploy's, so it is resolved by the
+   * target for each stage, never declared here.
+   */
+  declare(): Declaration[];
+}
+/** Per-route telemetry, on the endpoint builder — `.telemetry({ ignore: true })`. */
+interface EndpointTelemetry {
+  /** Record no span for this route. */
+  ignore?: boolean;
+  /** Attributes this route's request span carries. */
+  attributes?: Readonly<Record<string, string>>;
+}
+//#endregion
+export { Telemetry as n, TelemetryConfig as r, EndpointTelemetry as t };
+//# sourceMappingURL=telemetry-DRtT1_0A.d.mts.map

package/dist/telemetry-DRtT1_0A.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-DRtT1_0A.d.mts","names":[],"sources":["../src/telemetry.ts"],"mappings":";;;UAkCiB;;;;;;;EAOhB;;;;;;EAMA,aAAa,SAAS;;cAGV,UAAU,0CACX,WAAW;WAEb,IAAI;WACJ;WACA,YAAY,SAAS;EAE9B,YAAY,IAAI,cAAc,QAAQ,SAAQ;;;;;;EAW9C,WAAW;;;UAgBK;;EAEhB;;EAEA,aAAa,SAAS"}

package/dist/telemetry.cjs

@@ -0,0 +1,56 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _geekmidas_manifest = require("@geekmidas/manifest");
+//#region src/telemetry.ts
+/**
+* `Telemetry` — what an application emits, declared.
+*
+* Traces and logs over OTLP, from every process that is given it. The
+* construct says *what* is emitted — which requests are noise, which
+* attributes every span carries — and never where it goes or how much of it:
+* the provider and the sample rate are the deploy's, per stage
+* (`deploy.telemetry` in `gkm.config.ts`), and locally `gkm dev` runs
+* OpenObserve and sends everything there.
+*
+* ```ts
+* export const telemetry = new Telemetry('Telemetry', {
+*   ignorePaths: ['/health', '/ready'],
+*   attributes: { 'service.namespace': 'shop' },
+* });
+*
+* // passed like the logger: a fact about the process
+* new RestApi('Api', { path: 'apps/api', defaultAuthorizer: 'none', telemetry });
+* new Worker('Jobs', { logger, telemetry });
+* ```
+*
+* Each process given it is an edge to this node, so the `OTEL_*` keys it
+* provides reach exactly those processes, and the build of each one fails
+* without the OpenTelemetry packages it needs.
+*/
+var Telemetry = class {
+	id;
+	ignorePaths;
+	attributes;
+	constructor(id, config = {}) {
+		this.id = (0, _geekmidas_manifest.canonicalId)(id);
+		this.ignorePaths = [...config.ignorePaths ?? []];
+		this.attributes = { ...config.attributes };
+	}
+	/**
+	* One node, providing OpenTelemetry's own variables. No address of its
+	* own: where the telemetry goes is the deploy's, so it is resolved by the
+	* target for each stage, never declared here.
+	*/
+	declare() {
+		return [{
+			kind: "telemetry",
+			id: this.id,
+			...this.ignorePaths.length ? { ignorePaths: this.ignorePaths } : {},
+			...Object.keys(this.attributes).length ? { attributes: this.attributes } : {},
+			provides: [..._geekmidas_manifest.TELEMETRY_KEYS]
+		}];
+	}
+};
+//#endregion
+exports.Telemetry = Telemetry;
+
+//# sourceMappingURL=telemetry.cjs.map

package/dist/telemetry.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.cjs","names":["canonicalId","TELEMETRY_KEYS"],"sources":["../src/telemetry.ts"],"sourcesContent":["/**\n * `Telemetry` — what an application emits, declared.\n *\n * Traces and logs over OTLP, from every process that is given it. The\n * construct says *what* is emitted — which requests are noise, which\n * attributes every span carries — and never where it goes or how much of it:\n * the provider and the sample rate are the deploy's, per stage\n * (`deploy.telemetry` in `gkm.config.ts`), and locally `gkm dev` runs\n * OpenObserve and sends everything there.\n *\n * ```ts\n * export const telemetry = new Telemetry('Telemetry', {\n *   ignorePaths: ['/health', '/ready'],\n *   attributes: { 'service.namespace': 'shop' },\n * });\n *\n * // passed like the logger: a fact about the process\n * new RestApi('Api', { path: 'apps/api', defaultAuthorizer: 'none', telemetry });\n * new Worker('Jobs', { logger, telemetry });\n * ```\n *\n * Each process given it is an edge to this node, so the `OTEL_*` keys it\n * provides reach exactly those processes, and the build of each one fails\n * without the OpenTelemetry packages it needs.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tTELEMETRY_KEYS,\n} from '@geekmidas/manifest';\nimport type { Declarable } from './construct-interface';\n\nexport interface TelemetryConfig {\n\t/**\n\t * Request paths no span is recorded for, on every surface that uses this —\n\t * health checks, by default the only noise worth naming. A trailing `*`\n\t * matches a prefix. One route on one surface says so itself:\n\t * `.telemetry({ ignore: true })`.\n\t */\n\tignorePaths?: readonly string[];\n\t/**\n\t * Resource attributes every span and log record carries —\n\t * `{ 'service.namespace': 'shop' }`. The service's name is not one of\n\t * them: it is the app's, set per process.\n\t */\n\tattributes?: Readonly<Record<string, string>>;\n}\n\nexport class Telemetry<TName extends string = string>\n\timplements Declarable<TName>\n{\n\treadonly id: TName;\n\treadonly ignorePaths: readonly string[];\n\treadonly attributes: Readonly<Record<string, string>>;\n\n\tconstructor(id: ConstructName<TName>, config: TelemetryConfig = {}) {\n\t\tthis.id = canonicalId(id as string) as TName;\n\t\tthis.ignorePaths = [...(config.ignorePaths ?? [])];\n\t\tthis.attributes = { ...config.attributes };\n\t}\n\n\t/**\n\t * One node, providing OpenTelemetry's own variables. No address of its\n\t * own: where the telemetry goes is the deploy's, so it is resolved by the\n\t * target for each stage, never declared here.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'telemetry',\n\t\t\t\tid: this.id,\n\t\t\t\t...(this.ignorePaths.length ? { ignorePaths: this.ignorePaths } : {}),\n\t\t\t\t...(Object.keys(this.attributes).length\n\t\t\t\t\t? { attributes: this.attributes }\n\t\t\t\t\t: {}),\n\t\t\t\tprovides: [...TELEMETRY_KEYS],\n\t\t\t},\n\t\t];\n\t}\n}\n\n/** Per-route telemetry, on the endpoint builder — `.telemetry({ ignore: true })`. */\nexport interface EndpointTelemetry {\n\t/** Record no span for this route. */\n\tignore?: boolean;\n\t/** Attributes this route's request span carries. */\n\tattributes?: Readonly<Record<string, string>>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,IAAa,YAAb,MAEA;CACC;CACA;CACA;CAEA,YAAY,IAA0B,SAA0B,CAAC,GAAG;EACnE,KAAK,MAAA,GAAKA,oBAAAA,YAAAA,CAAY,EAAY;EAClC,KAAK,cAAc,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;EACjD,KAAK,aAAa,EAAE,GAAG,OAAO,WAAW;CAC1C;;;;;;CAOA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,GAAI,KAAK,YAAY,SAAS,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;GACnE,GAAI,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,SAC9B,EAAE,YAAY,KAAK,WAAW,IAC9B,CAAC;GACJ,UAAU,CAAC,GAAGC,oBAAAA,cAAc;EAC7B,CACD;CACD;AACD"}

package/dist/telemetry.d.cts

@@ -0,0 +1,2 @@
+import { n as Telemetry, r as TelemetryConfig, t as EndpointTelemetry } from "./telemetry-B48RLjyk.cjs";
+export { EndpointTelemetry, Telemetry, TelemetryConfig };

package/dist/telemetry.d.mts

@@ -0,0 +1,2 @@
+import { n as Telemetry, r as TelemetryConfig, t as EndpointTelemetry } from "./telemetry-DRtT1_0A.mjs";
+export { EndpointTelemetry, Telemetry, TelemetryConfig };

package/dist/telemetry.mjs

@@ -0,0 +1,55 @@
+import { TELEMETRY_KEYS, canonicalId } from "@geekmidas/manifest";
+//#region src/telemetry.ts
+/**
+* `Telemetry` — what an application emits, declared.
+*
+* Traces and logs over OTLP, from every process that is given it. The
+* construct says *what* is emitted — which requests are noise, which
+* attributes every span carries — and never where it goes or how much of it:
+* the provider and the sample rate are the deploy's, per stage
+* (`deploy.telemetry` in `gkm.config.ts`), and locally `gkm dev` runs
+* OpenObserve and sends everything there.
+*
+* ```ts
+* export const telemetry = new Telemetry('Telemetry', {
+*   ignorePaths: ['/health', '/ready'],
+*   attributes: { 'service.namespace': 'shop' },
+* });
+*
+* // passed like the logger: a fact about the process
+* new RestApi('Api', { path: 'apps/api', defaultAuthorizer: 'none', telemetry });
+* new Worker('Jobs', { logger, telemetry });
+* ```
+*
+* Each process given it is an edge to this node, so the `OTEL_*` keys it
+* provides reach exactly those processes, and the build of each one fails
+* without the OpenTelemetry packages it needs.
+*/
+var Telemetry = class {
+	id;
+	ignorePaths;
+	attributes;
+	constructor(id, config = {}) {
+		this.id = canonicalId(id);
+		this.ignorePaths = [...config.ignorePaths ?? []];
+		this.attributes = { ...config.attributes };
+	}
+	/**
+	* One node, providing OpenTelemetry's own variables. No address of its
+	* own: where the telemetry goes is the deploy's, so it is resolved by the
+	* target for each stage, never declared here.
+	*/
+	declare() {
+		return [{
+			kind: "telemetry",
+			id: this.id,
+			...this.ignorePaths.length ? { ignorePaths: this.ignorePaths } : {},
+			...Object.keys(this.attributes).length ? { attributes: this.attributes } : {},
+			provides: [...TELEMETRY_KEYS]
+		}];
+	}
+};
+//#endregion
+export { Telemetry };
+
+//# sourceMappingURL=telemetry.mjs.map

package/dist/telemetry.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.mjs","names":[],"sources":["../src/telemetry.ts"],"sourcesContent":["/**\n * `Telemetry` — what an application emits, declared.\n *\n * Traces and logs over OTLP, from every process that is given it. The\n * construct says *what* is emitted — which requests are noise, which\n * attributes every span carries — and never where it goes or how much of it:\n * the provider and the sample rate are the deploy's, per stage\n * (`deploy.telemetry` in `gkm.config.ts`), and locally `gkm dev` runs\n * OpenObserve and sends everything there.\n *\n * ```ts\n * export const telemetry = new Telemetry('Telemetry', {\n *   ignorePaths: ['/health', '/ready'],\n *   attributes: { 'service.namespace': 'shop' },\n * });\n *\n * // passed like the logger: a fact about the process\n * new RestApi('Api', { path: 'apps/api', defaultAuthorizer: 'none', telemetry });\n * new Worker('Jobs', { logger, telemetry });\n * ```\n *\n * Each process given it is an edge to this node, so the `OTEL_*` keys it\n * provides reach exactly those processes, and the build of each one fails\n * without the OpenTelemetry packages it needs.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tTELEMETRY_KEYS,\n} from '@geekmidas/manifest';\nimport type { Declarable } from './construct-interface';\n\nexport interface TelemetryConfig {\n\t/**\n\t * Request paths no span is recorded for, on every surface that uses this —\n\t * health checks, by default the only noise worth naming. A trailing `*`\n\t * matches a prefix. One route on one surface says so itself:\n\t * `.telemetry({ ignore: true })`.\n\t */\n\tignorePaths?: readonly string[];\n\t/**\n\t * Resource attributes every span and log record carries —\n\t * `{ 'service.namespace': 'shop' }`. The service's name is not one of\n\t * them: it is the app's, set per process.\n\t */\n\tattributes?: Readonly<Record<string, string>>;\n}\n\nexport class Telemetry<TName extends string = string>\n\timplements Declarable<TName>\n{\n\treadonly id: TName;\n\treadonly ignorePaths: readonly string[];\n\treadonly attributes: Readonly<Record<string, string>>;\n\n\tconstructor(id: ConstructName<TName>, config: TelemetryConfig = {}) {\n\t\tthis.id = canonicalId(id as string) as TName;\n\t\tthis.ignorePaths = [...(config.ignorePaths ?? [])];\n\t\tthis.attributes = { ...config.attributes };\n\t}\n\n\t/**\n\t * One node, providing OpenTelemetry's own variables. No address of its\n\t * own: where the telemetry goes is the deploy's, so it is resolved by the\n\t * target for each stage, never declared here.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'telemetry',\n\t\t\t\tid: this.id,\n\t\t\t\t...(this.ignorePaths.length ? { ignorePaths: this.ignorePaths } : {}),\n\t\t\t\t...(Object.keys(this.attributes).length\n\t\t\t\t\t? { attributes: this.attributes }\n\t\t\t\t\t: {}),\n\t\t\t\tprovides: [...TELEMETRY_KEYS],\n\t\t\t},\n\t\t];\n\t}\n}\n\n/** Per-route telemetry, on the endpoint builder — `.telemetry({ ignore: true })`. */\nexport interface EndpointTelemetry {\n\t/** Record no span for this route. */\n\tignore?: boolean;\n\t/** Attributes this route's request span carries. */\n\tattributes?: Readonly<Record<string, string>>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,IAAa,YAAb,MAEA;CACC;CACA;CACA;CAEA,YAAY,IAA0B,SAA0B,CAAC,GAAG;EACnE,KAAK,KAAK,YAAY,EAAY;EAClC,KAAK,cAAc,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;EACjD,KAAK,aAAa,EAAE,GAAG,OAAO,WAAW;CAC1C;;;;;;CAOA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,GAAI,KAAK,YAAY,SAAS,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;GACnE,GAAI,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,SAC9B,EAAE,YAAY,KAAK,WAAW,IAC9B,CAAC;GACJ,UAAU,CAAC,GAAG,cAAc;EAC7B,CACD;CACD;AACD"}