@geekmidas/constructs 10.0.0-alpha.12 → 10.0.0-alpha.120

package/dist/kysely-CukArHJ0.cjs

@@ -0,0 +1,384 @@
+const require_rolldown_runtime = require("./rolldown-runtime-y5ARvAq5.cjs");
+const require_shutdown = require("./shutdown-BMJmAhSt.cjs");
+const require_cache = require("./cache.cjs");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let _geekmidas_services = require("@geekmidas/services");
+let _opentelemetry_api = require("@opentelemetry/api");
+let kysely = require("kysely");
+let pg = require("pg");
+pg = require_rolldown_runtime.__toESM(pg, 1);
+/** Every pool opened and not yet closed, so a shutdown can end them all. */
+const open = /* @__PURE__ */ new Set();
+require_shutdown.onShutdown(() => closeDatabasePools());
+/**
+* A pool for one URL, with its schema actually on the search path.
+*
+* `?search_path=` is not a libpq parameter — a URL carrying it connects
+* happily and then resolves every unqualified name against `public`, which is
+* how a schema tenant silently writes its tables into the database it was
+* separated from. Postgres takes it as a startup option instead, so the URL
+* keeps the readable form the target derives and this turns it into the thing
+* the server understands.
+*/
+function openPool(url, options = {}) {
+	const parsed = new URL(url);
+	const searchPath = parsed.searchParams.get("search_path");
+	parsed.searchParams.delete("search_path");
+	const pool = new pg.default.Pool({
+		connectionString: parsed.toString(),
+		...searchPath ? { options: `-c search_path=${searchPath}` } : {},
+		fallback_application_name: applicationName()
+	});
+	pool.on("error", (error) => {
+		const logger = (0, _geekmidas_services.currentRequestContext)()?.logger;
+		if (logger) logger.warn({ err: error }, "Idle database connection lost");
+		else console.warn("Idle database connection lost:", error.message);
+	});
+	const target = connectionAttributes(parsed);
+	pool.on("connect", (client) => {
+		if (options.queryTags !== false) tagQueries(client);
+		traceQueries(client, target);
+	});
+	open.add(pool);
+	const end = pool.end.bind(pool);
+	pool.end = (async () => {
+		open.delete(pool);
+		await end();
+	});
+	return pool;
+}
+/**
+* End every pool opened, waiting for checked-out connections to come back.
+* For a server's shutdown, after it has stopped taking requests.
+*/
+async function closeDatabasePools() {
+	await Promise.all([...open].map((pool) => pool.end()));
+}
+/**
+* Who this process is, as Postgres will show it: the Lambda function, else the
+* app — `GKM_APP_NAME` where an entry sets it, `gkm dev`'s app tag otherwise.
+* Postgres keeps 63 bytes of it.
+*/
+function applicationName(env = process.env) {
+	return env.AWS_LAMBDA_FUNCTION_NAME || env.GKM_APP_NAME || env.GKM_DEV_APP?.split("#").pop() || void 0;
+}
+/**
+* The comment that says what ran a query: the request's operation and id, and
+* the active span as a W3C `traceparent` — the query's own span when it runs
+* through a traced client, since the span wraps the tagging. '' with neither.
+*
+* The keys are in sqlcommenter's sorted order. Values keep only characters
+* that cannot end a comment or a quoted value — `*` and `'` among those
+* dropped — so a route cannot inject SQL through it.
+*/
+function queryTag() {
+	const request = (0, _geekmidas_services.currentRequestContext)();
+	const span = _opentelemetry_api.trace.getActiveSpan()?.spanContext();
+	const tags = [
+		["operation", request?.operation],
+		["request_id", request?.requestId],
+		["traceparent", span && (0, _opentelemetry_api.isSpanContextValid)(span) ? traceparent(span) : ""]
+	].filter((tag) => Boolean(tag[1]));
+	if (tags.length === 0) return "";
+	const clean = (value) => value.replace(/[^\w ./:{}@-]/g, "");
+	return ` /*${tags.map(([key, value]) => `${key}='${clean(value)}'`).join(",")}*/`;
+}
+/** A span as W3C trace context's `traceparent`, version 00. */
+function traceparent(span) {
+	const flags = (span.traceFlags & 255).toString(16).padStart(2, "0");
+	return `00-${span.traceId}-${span.spanId}-${flags}`;
+}
+/**
+* Append {@link queryTag} to everything `client` runs: a SQL string — what
+* Kysely sends — or a query object such as a cursor's.
+*/
+function tagQueries(client) {
+	const query = client.query.bind(client);
+	client.query = ((first, ...rest) => {
+		const tag = queryTag();
+		if (tag && typeof first === "string") return query(first + tag, ...rest);
+		if (tag && first && typeof first === "object" && typeof first.text === "string") {
+			const config = first;
+			config.text += tag;
+		}
+		return query(first, ...rest);
+	});
+}
+/** What every span of one pool says about where it connects. */
+function connectionAttributes(url) {
+	const name = decodeURIComponent(url.pathname.slice(1));
+	return {
+		"db.system": "postgresql",
+		...name && { "db.name": name },
+		"server.address": url.hostname,
+		"server.port": Number(url.port || 5432)
+	};
+}
+const TRACER = "@geekmidas/constructs";
+/** `select`, `insert`, … — the first keyword, or `with`'s main statement. */
+const OPERATION = /^\s*(?:\/\*.*?\*\/\s*)?(\w+)/s;
+/** The table a statement is about, when it names one where it usually does. */
+const TABLE = /\b(?:from|into|update|join)\s+((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?)/i;
+/**
+* What a statement does and to which table, parsed cheaply from its first
+* characters: `select "orders"`, `insert "public"."users"`. A statement the
+* patterns cannot read leaves `table` unset.
+*/
+function describeStatement(text) {
+	const head = text.length > 512 ? text.slice(0, 512) : text;
+	const operation = OPERATION.exec(head)?.[1]?.toLowerCase();
+	const table = TABLE.exec(head)?.[1]?.replace(/"/g, "");
+	return {
+		...operation && { operation },
+		...table && { table }
+	};
+}
+/**
+* A span around everything `client` runs — `<operation> <table>`, or
+* `db.query` when the statement does not say.
+*
+* The statement text goes on the span only for a parameterized query — values
+* passed separately, as Kysely always does — and truncated. Parameter values
+* never do. A bare string with no values could hold anything a caller
+* concatenated into it, so it gets no text at all.
+*/
+function traceQueries(client, connection) {
+	const query = client.query.bind(client);
+	client.query = ((first, ...rest) => {
+		const config = first && typeof first === "object" ? first : void 0;
+		const text = typeof first === "string" ? first : typeof config?.text === "string" ? config.text : void 0;
+		const values = typeof first === "string" ? rest[0] : config?.values;
+		const { operation, table } = text ? describeStatement(text) : {};
+		const span = _opentelemetry_api.trace.getTracer(TRACER).startSpan(operation && table ? `${operation} ${table}` : "db.query", {
+			kind: _opentelemetry_api.SpanKind.CLIENT,
+			attributes: {
+				...connection,
+				...operation && { "db.operation": operation },
+				...table && { "db.sql.table": table },
+				...text && Array.isArray(values) && { "db.statement": text.length > 2048 ? text.slice(0, 2048) : text }
+			}
+		});
+		const end = (error) => {
+			if (error) {
+				if (error instanceof Error) span.recordException(error);
+				span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
+			}
+			span.end();
+		};
+		const last = rest[rest.length - 1];
+		if (typeof last === "function") {
+			const args = [...rest];
+			args[args.length - 1] = (error, ...result) => {
+				end(error);
+				return last(error, ...result);
+			};
+			return _opentelemetry_api.context.with(_opentelemetry_api.trace.setSpan(_opentelemetry_api.context.active(), span), () => query(first, ...args));
+		}
+		let result;
+		try {
+			result = _opentelemetry_api.context.with(_opentelemetry_api.trace.setSpan(_opentelemetry_api.context.active(), span), () => query(first, ...rest));
+		} catch (error) {
+			end(error);
+			throw error;
+		}
+		if (result && typeof result.then === "function") result.then(() => end(), (error) => end(error));
+		else if (result && typeof result.once === "function") {
+			const emitter = result;
+			emitter.once("end", () => end());
+			emitter.once("error", (error) => end(error));
+		} else end();
+		return result;
+	});
+}
+//#endregion
+//#region src/database/kysely.ts
+/**
+* `KyselyDatabase` — a declared Postgres database, typed by its schema.
+*
+* It declares a logical database, a schema, and the roles that reach it, and
+* hands back a Kysely client built from the one URL the adapter supplied. It
+* names no cloud: `--target=aws` fills that URL from RDS, local dev from the
+* Postgres container.
+*
+* Transactions and RLS context are the execution wrapper's job — it opens the
+* transaction and puts it in `ctx.db`. This construct does not resolve
+* connections per request.
+*/
+/** The schema a database uses when it does not say otherwise. */
+const DEFAULT_SCHEMA = "app";
+/**
+* @typeParam DB - the database's schema.
+* @typeParam TName - the canonical id. TypeScript has no partial
+* type-argument inference, so `new KyselyDatabase<OrdersDB>('orders')` leaves
+* this at its default and the service key widens to `string`. `db` still types
+* through `.database()`, which infers from the service.
+*/
+var KyselyDatabase = class KyselyDatabase {
+	options;
+	id;
+	service;
+	/**
+	* Declared once and read by both `declare()` and `connect()`, so the key the
+	* build publishes and the key the client reads cannot drift.
+	*/
+	config;
+	schemaName;
+	roles;
+	runtime;
+	derivedFrom;
+	constructor(id, options = {}, derivedFrom) {
+		this.options = options;
+		const canonical = (0, _geekmidas_manifest.canonicalId)(id);
+		this.id = canonical;
+		this.config = {
+			url: (0, _geekmidas_manifest.provideKey)(canonical, "url"),
+			ownerUrl: (0, _geekmidas_manifest.provideKey)(canonical, "ownerUrl")
+		};
+		this.schemaName = options.schema ?? DEFAULT_SCHEMA;
+		this.roles = options.roles ?? true;
+		this.runtime = options.image ? { image: options.image } : { version: options.version ?? _geekmidas_manifest.DEFAULT_POSTGRES_VERSION };
+		this.derivedFrom = derivedFrom;
+		this.service = {
+			serviceName: (0, _geekmidas_manifest.serviceKey)(canonical),
+			register: (registerOptions) => this.connect(registerOptions)
+		};
+	}
+	declare() {
+		if (this.derivedFrom) {
+			const { kind, of, schema } = this.derivedFrom;
+			return [kind === "database-schema" ? {
+				kind,
+				id: this.id,
+				of,
+				schema: schema ?? this.schemaName,
+				provides: [this.config.url]
+			} : {
+				kind,
+				id: this.id,
+				of,
+				provides: [this.config.url]
+			}];
+		}
+		return [{
+			kind: "database",
+			id: this.id,
+			engine: "postgres",
+			schema: this.schemaName,
+			...this.runtime,
+			...this.options.extensions?.length ? { extensions: [...new Set(this.options.extensions)] } : {},
+			provides: [this.config.url],
+			...this.roles ? {} : { roles: false }
+		}];
+	}
+	/**
+	* A read-only endpoint on this database.
+	*
+	* Read-only is enforced by the reader role's grants rather than by which
+	* endpoint it resolves to, so falling back to the writer where no replica
+	* exists is safe rather than a silently writable connection behind a name
+	* that says reader. There is no `writer()`: the database *is* the writer, so
+	* a replica can never be reached by accident.
+	*
+	* The return type is narrower than this class on purpose — see
+	* {@link ReadOnlyDatabase}.
+	*/
+	reader() {
+		return new KyselyDatabase(`${this.id}Reader`, this.options, {
+			kind: "database-reader",
+			of: this.id
+		});
+	}
+	/**
+	* A cache that lives in this database.
+	*
+	* The same strengthening `schema()` is over a second database: `new
+	* Cache('Sessions')` says the app caches and leaves where to the deployment,
+	* while this says it caches *here* — which is a fact about the application
+	* and so belongs in its code.
+	*
+	* What it buys beyond being explicit: the table's schema and the role that
+	* reaches it come from this database rather than from a second convention,
+	* and the backend no longer has to guess which database "the database" meant
+	* when an app declares two.
+	*
+	* A cache is not a `KyselyDatabase`, so this returns a `Cache` — the client
+	* is a key/value store, not a query builder, and typing it as the parent
+	* would be a convenience that lies.
+	*/
+	cache(id = `${this.id}Cache`, options = {}) {
+		return new require_cache.Cache(id, {
+			of: this.id,
+			...options.table ? { table: options.table } : {}
+		});
+	}
+	/**
+	* A second schema in this database, with its own role(s) and its own URL —
+	* so this database's role holds no grant on those tables at all.
+	*
+	* Typed separately because a tenant has its own tables: the point is that
+	* `auth.selectFrom('sessions')` type-checks and
+	* `orders.selectFrom('sessions')` does not.
+	*/
+	schema(id, options = {}) {
+		return new KyselyDatabase(id, options, {
+			kind: "database-schema",
+			of: this.id,
+			schema: options.schema ?? id.toLowerCase()
+		});
+	}
+	/**
+	* A connection as the *owner* role — the one that may create, alter and drop.
+	*
+	* A `Service` rather than part of the construct, and deliberately so: a
+	* construct is what `.dependsOn()` accepts, and nothing should be able to
+	* depend on this. A migrator asks for it by name; a handler cannot ask at
+	* all, which is the security property the role split exists for.
+	*
+	* Falls back to the runtime URL where no owner URL was published — the
+	* `roles: false` downgrade, where there is only one credential and it is the
+	* cluster master's.
+	*/
+	get owner() {
+		return {
+			serviceName: `${(0, _geekmidas_manifest.serviceKey)(this.id)}Owner`,
+			register: (options) => this.connect(options, { owner: true })
+		};
+	}
+	/**
+	* What this database's clients are built with besides a dialect — the
+	* plugins and logging it was declared with.
+	*
+	* Public so that whatever opens a connection to it outside \`connect()\` —
+	* a test's transaction — builds the same client. A test that dropped the
+	* plugins would write \`createdAt\` where production writes \`created_at\`.
+	*/
+	get clientConfig() {
+		const { schema: _schema, roles: _roles, version: _version, image: _image, extensions: _extensions, queryTags: _queryTags, ...kysely$1 } = this.options;
+		return kysely$1;
+	}
+	async connect(options, as = {}) {
+		const { url, ownerUrl } = options.envParser.create((get) => ({
+			url: get(this.config.url).string(),
+			ownerUrl: get(this.config.ownerUrl).string().optional()
+		})).parse();
+		return new kysely.Kysely({
+			...this.clientConfig,
+			dialect: new kysely.PostgresDialect({ pool: openPool(as.owner ? ownerUrl ?? url : url, { queryTags: this.options.queryTags }) })
+		});
+	}
+};
+//#endregion
+Object.defineProperty(exports, "KyselyDatabase", {
+	enumerable: true,
+	get: function() {
+		return KyselyDatabase;
+	}
+});
+Object.defineProperty(exports, "closeDatabasePools", {
+	enumerable: true,
+	get: function() {
+		return closeDatabasePools;
+	}
+});
+
+//# sourceMappingURL=kysely-CukArHJ0.cjs.map

package/dist/kysely-CukArHJ0.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"kysely-CukArHJ0.cjs","names":["onShutdown","currentRequestContext","trace","isSpanContextValid","SpanKind","SpanStatusCode","context","canonicalId","provideKey","DEFAULT_POSTGRES_VERSION","serviceKey","Cache","kysely","Kysely","PostgresDialect"],"sources":["../src/database/pool.ts","../src/database/kysely.ts"],"sourcesContent":["/**\n * The `pg` pools a database construct opens, and what every one of them gets:\n *\n * - **A name.** `application_name` is what `pg_stat_activity` shows beside a\n *   connection. Without one, a database at `max_connections` cannot say who\n *   holds them. It is a *fallback*, so `PGAPPNAME` or `?application_name=` in\n *   the URL still win.\n * - **Tagged queries.** Inside a request, each query ends in a comment naming\n *   what ran it — `/*operation='POST /orders',request_id='…'*\\/` — in the\n *   sqlcommenter form, and inside a trace the query's own span as\n *   `traceparent='00-<trace>-<span>-<flags>'`. It shows in\n *   `pg_stat_activity.query`, in the server's slow-query and `auto_explain`\n *   logs, and costs no round trip; `pg_stat_statements` ignores comments, so\n *   its grouping is unchanged.\n * - **A listener for idle-client errors.** When the server ends an idle\n *   connection (`idle_session_timeout`, a failover, an admin), the pool emits\n *   `'error'`. With no listener that is an uncaught exception that kills the\n *   process — for a client the pool has already discarded.\n * - **A span per query.** Through the global OpenTelemetry tracer, so a no-op\n *   without a provider. `pg` is bundled into a production entry, where no\n *   instrumentation can hook its module load — so the client is wrapped here,\n *   as the tags are. See {@link traceQueries}.\n * - **A way to close.** {@link closeDatabasePools} ends every pool opened, so a\n *   server shutting down releases its connections instead of holding them\n *   until the process dies.\n */\n\nimport { currentRequestContext } from '@geekmidas/services';\nimport {\n\ttype Attributes,\n\tcontext,\n\tisSpanContextValid,\n\tSpanKind,\n\tSpanStatusCode,\n\ttrace,\n} from '@opentelemetry/api';\nimport pg from 'pg';\nimport { onShutdown } from '../shutdown';\n\nexport interface DatabasePoolOptions {\n\t/** Tag queries with what ran them and the trace they ran in. Default true. */\n\tqueryTags?: boolean;\n}\n\n/** The longest statement text a query span carries. */\nexport const MAX_STATEMENT_LENGTH = 2048;\n\n/** Every pool opened and not yet closed, so a shutdown can end them all. */\nconst open = new Set<pg.Pool>();\nonShutdown(() => closeDatabasePools());\n\n/**\n * A pool for one URL, with its schema actually on the search path.\n *\n * `?search_path=` is not a libpq parameter — a URL carrying it connects\n * happily and then resolves every unqualified name against `public`, which is\n * how a schema tenant silently writes its tables into the database it was\n * separated from. Postgres takes it as a startup option instead, so the URL\n * keeps the readable form the target derives and this turns it into the thing\n * the server understands.\n */\nexport function openPool(\n\turl: string,\n\toptions: DatabasePoolOptions = {},\n): pg.Pool {\n\tconst parsed = new URL(url);\n\tconst searchPath = parsed.searchParams.get('search_path');\n\tparsed.searchParams.delete('search_path');\n\n\tconst pool = new pg.Pool({\n\t\tconnectionString: parsed.toString(),\n\t\t...(searchPath ? { options: `-c search_path=${searchPath}` } : {}),\n\t\tfallback_application_name: applicationName(),\n\t});\n\n\tpool.on('error', (error) => {\n\t\tconst logger = currentRequestContext()?.logger;\n\t\tif (logger) logger.warn({ err: error }, 'Idle database connection lost');\n\t\telse console.warn('Idle database connection lost:', error.message);\n\t});\n\tconst target = connectionAttributes(parsed);\n\tpool.on('connect', (client) => {\n\t\t// Tags first, so the span wraps them: it records the statement as the\n\t\t// application wrote it rather than with the comment on the end, and it\n\t\t// is the active span when the tag is written — so the `traceparent` a\n\t\t// query carries names the query's own span.\n\t\tif (options.queryTags !== false) tagQueries(client);\n\t\ttraceQueries(client, target);\n\t});\n\n\topen.add(pool);\n\tconst end = pool.end.bind(pool);\n\tpool.end = (async () => {\n\t\topen.delete(pool);\n\t\tawait end();\n\t}) as typeof pool.end;\n\n\treturn pool;\n}\n\n/**\n * End every pool opened, waiting for checked-out connections to come back.\n * For a server's shutdown, after it has stopped taking requests.\n */\nexport async function closeDatabasePools(): Promise<void> {\n\tawait Promise.all([...open].map((pool) => pool.end()));\n}\n\n/**\n * Who this process is, as Postgres will show it: the Lambda function, else the\n * app — `GKM_APP_NAME` where an entry sets it, `gkm dev`'s app tag otherwise.\n * Postgres keeps 63 bytes of it.\n */\nexport function applicationName(\n\tenv: NodeJS.ProcessEnv = process.env,\n): string | undefined {\n\treturn (\n\t\tenv.AWS_LAMBDA_FUNCTION_NAME ||\n\t\tenv.GKM_APP_NAME ||\n\t\tenv.GKM_DEV_APP?.split('#').pop() ||\n\t\tundefined\n\t);\n}\n\n/**\n * The comment that says what ran a query: the request's operation and id, and\n * the active span as a W3C `traceparent` — the query's own span when it runs\n * through a traced client, since the span wraps the tagging. '' with neither.\n *\n * The keys are in sqlcommenter's sorted order. Values keep only characters\n * that cannot end a comment or a quoted value — `*` and `'` among those\n * dropped — so a route cannot inject SQL through it.\n */\nexport function queryTag(): string {\n\tconst request = currentRequestContext();\n\tconst span = trace.getActiveSpan()?.spanContext();\n\n\tconst tags = [\n\t\t['operation', request?.operation],\n\t\t['request_id', request?.requestId],\n\t\t['traceparent', span && isSpanContextValid(span) ? traceparent(span) : ''],\n\t].filter((tag): tag is [string, string] => Boolean(tag[1]));\n\tif (tags.length === 0) return '';\n\n\tconst clean = (value: string) => value.replace(/[^\\w ./:{}@-]/g, '');\n\treturn ` /*${tags.map(([key, value]) => `${key}='${clean(value)}'`).join(',')}*/`;\n}\n\n/** A span as W3C trace context's `traceparent`, version 00. */\nfunction traceparent(span: {\n\ttraceId: string;\n\tspanId: string;\n\ttraceFlags: number;\n}): string {\n\tconst flags = (span.traceFlags & 0xff).toString(16).padStart(2, '0');\n\treturn `00-${span.traceId}-${span.spanId}-${flags}`;\n}\n\n/**\n * Append {@link queryTag} to everything `client` runs: a SQL string — what\n * Kysely sends — or a query object such as a cursor's.\n */\nfunction tagQueries(client: pg.PoolClient): void {\n\tconst query = client.query.bind(client) as (...args: unknown[]) => unknown;\n\tclient.query = ((first: unknown, ...rest: unknown[]) => {\n\t\tconst tag = queryTag();\n\t\tif (tag && typeof first === 'string') return query(first + tag, ...rest);\n\t\tif (\n\t\t\ttag &&\n\t\t\tfirst &&\n\t\t\ttypeof first === 'object' &&\n\t\t\ttypeof (first as { text?: unknown }).text === 'string'\n\t\t) {\n\t\t\tconst config = first as { text: string };\n\t\t\tconfig.text += tag;\n\t\t}\n\t\treturn query(first, ...rest);\n\t}) as typeof client.query;\n}\n\n/** What every span of one pool says about where it connects. */\nfunction connectionAttributes(url: URL): Attributes {\n\tconst name = decodeURIComponent(url.pathname.slice(1));\n\treturn {\n\t\t'db.system': 'postgresql',\n\t\t...(name && { 'db.name': name }),\n\t\t'server.address': url.hostname,\n\t\t'server.port': Number(url.port || 5432),\n\t};\n}\n\nconst TRACER = '@geekmidas/constructs';\n\n/** `select`, `insert`, … — the first keyword, or `with`'s main statement. */\nconst OPERATION = /^\\s*(?:\\/\\*.*?\\*\\/\\s*)?(\\w+)/s;\n/** The table a statement is about, when it names one where it usually does. */\nconst TABLE =\n\t/\\b(?:from|into|update|join)\\s+((?:\"[^\"]+\"|[\\w$]+)(?:\\.(?:\"[^\"]+\"|[\\w$]+))?)/i;\n\n/**\n * What a statement does and to which table, parsed cheaply from its first\n * characters: `select \"orders\"`, `insert \"public\".\"users\"`. A statement the\n * patterns cannot read leaves `table` unset.\n */\nexport function describeStatement(text: string): {\n\toperation?: string;\n\ttable?: string;\n} {\n\tconst head = text.length > 512 ? text.slice(0, 512) : text;\n\tconst operation = OPERATION.exec(head)?.[1]?.toLowerCase();\n\tconst table = TABLE.exec(head)?.[1]?.replace(/\"/g, '');\n\treturn {\n\t\t...(operation && { operation }),\n\t\t...(table && { table }),\n\t};\n}\n\n/**\n * A span around everything `client` runs — `<operation> <table>`, or\n * `db.query` when the statement does not say.\n *\n * The statement text goes on the span only for a parameterized query — values\n * passed separately, as Kysely always does — and truncated. Parameter values\n * never do. A bare string with no values could hold anything a caller\n * concatenated into it, so it gets no text at all.\n */\nfunction traceQueries(client: pg.PoolClient, connection: Attributes): void {\n\tconst query = client.query.bind(client) as (...args: unknown[]) => unknown;\n\tclient.query = ((first: unknown, ...rest: unknown[]) => {\n\t\tconst config =\n\t\t\tfirst && typeof first === 'object'\n\t\t\t\t? (first as { text?: unknown; values?: unknown })\n\t\t\t\t: undefined;\n\t\tconst text =\n\t\t\ttypeof first === 'string'\n\t\t\t\t? first\n\t\t\t\t: typeof config?.text === 'string'\n\t\t\t\t\t? config.text\n\t\t\t\t\t: undefined;\n\t\tconst values = typeof first === 'string' ? rest[0] : config?.values;\n\t\tconst { operation, table } = text ? describeStatement(text) : {};\n\n\t\tconst span = trace\n\t\t\t.getTracer(TRACER)\n\t\t\t.startSpan(operation && table ? `${operation} ${table}` : 'db.query', {\n\t\t\t\tkind: SpanKind.CLIENT,\n\t\t\t\tattributes: {\n\t\t\t\t\t...connection,\n\t\t\t\t\t...(operation && { 'db.operation': operation }),\n\t\t\t\t\t...(table && { 'db.sql.table': table }),\n\t\t\t\t\t...(text &&\n\t\t\t\t\t\tArray.isArray(values) && {\n\t\t\t\t\t\t\t'db.statement':\n\t\t\t\t\t\t\t\ttext.length > MAX_STATEMENT_LENGTH\n\t\t\t\t\t\t\t\t\t? text.slice(0, MAX_STATEMENT_LENGTH)\n\t\t\t\t\t\t\t\t\t: text,\n\t\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t});\n\t\tconst end = (error?: unknown) => {\n\t\t\tif (error) {\n\t\t\t\tif (error instanceof Error) span.recordException(error);\n\t\t\t\tspan.setStatus({ code: SpanStatusCode.ERROR });\n\t\t\t}\n\t\t\tspan.end();\n\t\t};\n\n\t\t// A callback, as `pg`'s own callback form takes it.\n\t\tconst last = rest[rest.length - 1];\n\t\tif (typeof last === 'function') {\n\t\t\tconst args = [...rest];\n\t\t\targs[args.length - 1] = (error: unknown, ...result: unknown[]) => {\n\t\t\t\tend(error);\n\t\t\t\treturn (last as (...a: unknown[]) => unknown)(error, ...result);\n\t\t\t};\n\t\t\treturn context.with(trace.setSpan(context.active(), span), () =>\n\t\t\t\tquery(first, ...args),\n\t\t\t);\n\t\t}\n\n\t\tlet result: unknown;\n\t\ttry {\n\t\t\tresult = context.with(trace.setSpan(context.active(), span), () =>\n\t\t\t\tquery(first, ...rest),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tend(error);\n\t\t\tthrow error;\n\t\t}\n\n\t\tif (result && typeof (result as Promise<unknown>).then === 'function') {\n\t\t\t(result as Promise<unknown>).then(\n\t\t\t\t() => end(),\n\t\t\t\t(error) => end(error),\n\t\t\t);\n\t\t} else if (\n\t\t\tresult &&\n\t\t\ttypeof (result as { once?: unknown }).once === 'function'\n\t\t) {\n\t\t\t// A submittable — a cursor or a stream — ends when it says so.\n\t\t\tconst emitter = result as {\n\t\t\t\tonce(event: string, fn: (e?: unknown) => void): void;\n\t\t\t};\n\t\t\temitter.once('end', () => end());\n\t\t\temitter.once('error', (error) => end(error));\n\t\t} else {\n\t\t\tend();\n\t\t}\n\t\treturn result;\n\t}) as typeof client.query;\n}\n","/**\n * `KyselyDatabase` — a declared Postgres database, typed by its schema.\n *\n * It declares a logical database, a schema, and the roles that reach it, and\n * hands back a Kysely client built from the one URL the adapter supplied. It\n * names no cloud: `--target=aws` fills that URL from RDS, local dev from the\n * Postgres container.\n *\n * Transactions and RLS context are the execution wrapper's job — it opens the\n * transaction and puts it in `ctx.db`. This construct does not resolve\n * connections per request.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\tDEFAULT_POSTGRES_VERSION,\n\ttype Declaration,\n\ttype PostgresVersion,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport { Kysely, type KyselyConfig, PostgresDialect } from 'kysely';\nimport { Cache } from '../cache';\nimport type { Construct } from '../construct-interface';\nimport { openPool } from './pool';\n\n/** The schema a database uses when it does not say otherwise. */\nconst DEFAULT_SCHEMA = 'app';\n\n/**\n * Everything Kysely takes, plus what this construct declares.\n *\n * `dialect` is omitted because the construct owns it — it is built from the one\n * URL the adapter supplied, which is the whole point of the construct. The rest\n * of `KyselyConfig` (`plugins`, `log`) is the app's business and passes\n * straight through, so anything Kysely adds later arrives without being\n * tracked here.\n */\ninterface KyselyDatabaseBaseOptions extends Omit<KyselyConfig, 'dialect'> {\n\t/**\n\t * The schema, pinned on both roles' `search_path`.\n\t *\n\t * Defaults to `app` — the role the schema plays, rather than a restatement\n\t * of the database's own name, which reads correctly beside `auth` and\n\t * `pgboss` and keeps the application off `public`.\n\t */\n\tschema?: string;\n\t/**\n\t * Provision the owner/runtime role split. Defaults to on.\n\t *\n\t * Off falls back to the cluster's master credential in both URLs, giving up\n\t * the DDL/DML split and putting credentials that can drop a table into the\n\t * function's environment. A deliberate downgrade, not a default.\n\t */\n\troles?: boolean;\n\t/**\n\t * Extensions to create in this database, as the cluster master, before the\n\t * first migration — for the ones the owner role a migration runs as may not\n\t * create (PostGIS is not a trusted extension). They are created in\n\t * `public`, which joins this database's roles' `search_path`, so their\n\t * types resolve unqualified.\n\t *\n\t * Only attempted: the image has to ship them.\n\t */\n\textensions?: readonly string[];\n\t/**\n\t * End each query run inside a request with a comment naming what ran it —\n\t * `/*operation='POST /orders',request_id='…'*\\/` — so `pg_stat_activity`\n\t * and the server's logs can tie a query to its endpoint — and, inside a\n\t * trace, with the query span's `traceparent='00-…'` (sqlcommenter), so\n\t * they can tie it to the trace too. Defaults to on.\n\t */\n\tqueryTags?: boolean;\n}\n\n/**\n * Which Postgres the database runs: a major on the stock image, or an image\n * the project names. One or the other, never both — an image's tag already\n * says its major, and a second statement of it is one that can disagree.\n */\nexport type PostgresRuntime =\n\t| {\n\t\t\t/**\n\t\t\t * The Postgres major version to provision, on the stock image.\n\t\t\t *\n\t\t\t * Declared here so one statement reaches every target. It was\n\t\t\t * previously set in two unrelated places — a container tag locally,\n\t\t\t * nothing at all on AWS (so Aurora chose) — which is how local came to\n\t\t\t * run 18 while deployed ran 17.7 with nothing recording the difference.\n\t\t\t *\n\t\t\t * Defaults to {@link DEFAULT_POSTGRES_VERSION}.\n\t\t\t */\n\t\t\tversion?: PostgresVersion;\n\t\t\timage?: never;\n\t  }\n\t| {\n\t\t\t/**\n\t\t\t * The container image to run, wherever a target runs one (local,\n\t\t\t * Dokploy), in place of `postgres:<version>`.\n\t\t\t *\n\t\t\t * Yours to choose and used as written: its tag is the major, and it\n\t\t\t * should ship every extension in `extensions`. AWS runs RDS, ignores\n\t\t\t * it, and provisions {@link DEFAULT_POSTGRES_VERSION}.\n\t\t\t *\n\t\t\t * ```ts\n\t\t\t * new KyselyDatabase<GeoDB>('Geo', {\n\t\t\t *   image: 'postgis/postgis:18-3.6-alpine',\n\t\t\t *   extensions: ['postgis'],\n\t\t\t * });\n\t\t\t * ```\n\t\t\t */\n\t\t\timage: string;\n\t\t\tversion?: never;\n\t  };\n\n/**\n * Everything Kysely takes, plus what this construct declares — including\n * which Postgres it runs, as a version or an image.\n */\nexport type KyselyDatabaseOptions = KyselyDatabaseBaseOptions & PostgresRuntime;\n\n/** What makes a construct derived rather than a database in its own right. */\ninterface DerivedFrom {\n\tkind: 'database-reader' | 'database-schema';\n\tof: string;\n\tschema?: string;\n}\n\n/**\n * @typeParam DB - the database's schema.\n * @typeParam TName - the canonical id. TypeScript has no partial\n * type-argument inference, so `new KyselyDatabase<OrdersDB>('orders')` leaves\n * this at its default and the service key widens to `string`. `db` still types\n * through `.database()`, which infers from the service.\n */\nexport class KyselyDatabase<DB = unknown, TName extends string = string>\n\timplements Construct<TName, Kysely<DB>>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, Kysely<DB>>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * build publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly config: { url: string; ownerUrl: string };\n\tprivate readonly schemaName: string;\n\tprivate readonly roles: boolean;\n\tprivate readonly runtime: { version: PostgresVersion } | { image: string };\n\tprivate readonly derivedFrom?: DerivedFrom;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: KyselyDatabaseOptions = {},\n\t\tderivedFrom?: DerivedFrom,\n\t) {\n\t\t// Canonicalises, so `orders` and `Orders` are one construct rather than\n\t\t// two that collide. Throws on anything that cannot become a valid id.\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.config = {\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\townerUrl: provideKey(canonical, 'ownerUrl'),\n\t\t};\n\t\tthis.schemaName = options.schema ?? DEFAULT_SCHEMA;\n\t\tthis.roles = options.roles ?? true;\n\t\tthis.runtime = options.image\n\t\t\t? { image: options.image }\n\t\t\t: { version: options.version ?? DEFAULT_POSTGRES_VERSION };\n\t\tthis.derivedFrom = derivedFrom;\n\n\t\t// A field, not a getter: service discovery caches by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\t// Forwards the whole options object — cherry-picking `envParser` strips\n\t\t\t// `context` and with it the request-scoped logger.\n\t\t\tregister: (registerOptions) => this.connect(registerOptions),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\tif (this.derivedFrom) {\n\t\t\tconst { kind, of, schema } = this.derivedFrom;\n\n\t\t\treturn [\n\t\t\t\tkind === 'database-schema'\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tkind,\n\t\t\t\t\t\t\tid: this.id,\n\t\t\t\t\t\t\tof,\n\t\t\t\t\t\t\tschema: schema ?? this.schemaName,\n\t\t\t\t\t\t\t// The runtime key alone — see the note below on the parent.\n\t\t\t\t\t\t\tprovides: [this.config.url],\n\t\t\t\t\t\t}\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tkind,\n\t\t\t\t\t\t\tid: this.id,\n\t\t\t\t\t\t\tof,\n\t\t\t\t\t\t\t// A reader has no owner URL of its own — nothing migrates\n\t\t\t\t\t\t\t// through a read-only endpoint — so this is the one key.\n\t\t\t\t\t\t\tprovides: [this.config.url],\n\t\t\t\t\t\t},\n\t\t\t];\n\t\t}\n\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'database',\n\t\t\t\tid: this.id,\n\t\t\t\tengine: 'postgres',\n\t\t\t\tschema: this.schemaName,\n\t\t\t\t// A version, or the image whose tag is one — never both.\n\t\t\t\t...this.runtime,\n\t\t\t\t...(this.options.extensions?.length\n\t\t\t\t\t? { extensions: [...new Set(this.options.extensions)] }\n\t\t\t\t\t: {}),\n\t\t\t\t// One key, the runtime role's. `config` also holds the owner key and\n\t\t\t\t// it is deliberately absent here: a key in `provides` is a key an\n\t\t\t\t// edge can name, and nothing should be able to depend on DDL rights.\n\t\t\t\tprovides: [this.config.url],\n\t\t\t\t...(this.roles ? {} : { roles: false }),\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * A read-only endpoint on this database.\n\t *\n\t * Read-only is enforced by the reader role's grants rather than by which\n\t * endpoint it resolves to, so falling back to the writer where no replica\n\t * exists is safe rather than a silently writable connection behind a name\n\t * that says reader. There is no `writer()`: the database *is* the writer, so\n\t * a replica can never be reached by accident.\n\t *\n\t * The return type is narrower than this class on purpose — see\n\t * {@link ReadOnlyDatabase}.\n\t */\n\treader(): ReadOnlyDatabase<DB, `${TName}Reader`> {\n\t\treturn new KyselyDatabase<DB, `${TName}Reader`>(\n\t\t\t`${this.id}Reader` as ConstructName<`${TName}Reader`>,\n\t\t\tthis.options,\n\t\t\t{ kind: 'database-reader', of: this.id },\n\t\t);\n\t}\n\n\t/**\n\t * A cache that lives in this database.\n\t *\n\t * The same strengthening `schema()` is over a second database: `new\n\t * Cache('Sessions')` says the app caches and leaves where to the deployment,\n\t * while this says it caches *here* — which is a fact about the application\n\t * and so belongs in its code.\n\t *\n\t * What it buys beyond being explicit: the table's schema and the role that\n\t * reaches it come from this database rather than from a second convention,\n\t * and the backend no longer has to guess which database \"the database\" meant\n\t * when an app declares two.\n\t *\n\t * A cache is not a `KyselyDatabase`, so this returns a `Cache` — the client\n\t * is a key/value store, not a query builder, and typing it as the parent\n\t * would be a convenience that lies.\n\t */\n\tcache<TCache extends string = `${TName}Cache`>(\n\t\tid: ConstructName<TCache> = `${this.id}Cache` as ConstructName<TCache>,\n\t\toptions: { table?: string } = {},\n\t): Cache<TCache> {\n\t\treturn new Cache<TCache>(id, {\n\t\t\tof: this.id,\n\t\t\t...(options.table ? { table: options.table } : {}),\n\t\t});\n\t}\n\n\t/**\n\t * A second schema in this database, with its own role(s) and its own URL —\n\t * so this database's role holds no grant on those tables at all.\n\t *\n\t * Typed separately because a tenant has its own tables: the point is that\n\t * `auth.selectFrom('sessions')` type-checks and\n\t * `orders.selectFrom('sessions')` does not.\n\t */\n\tschema<TenantDB, TTenant extends string>(\n\t\tid: ConstructName<TTenant>,\n\t\toptions: KyselyDatabaseOptions = {},\n\t): KyselyDatabase<TenantDB, TTenant> {\n\t\treturn new KyselyDatabase<TenantDB, TTenant>(id, options, {\n\t\t\tkind: 'database-schema',\n\t\t\tof: this.id,\n\t\t\tschema: options.schema ?? (id as string).toLowerCase(),\n\t\t});\n\t}\n\n\t/**\n\t * A connection as the *owner* role — the one that may create, alter and drop.\n\t *\n\t * A `Service` rather than part of the construct, and deliberately so: a\n\t * construct is what `.dependsOn()` accepts, and nothing should be able to\n\t * depend on this. A migrator asks for it by name; a handler cannot ask at\n\t * all, which is the security property the role split exists for.\n\t *\n\t * Falls back to the runtime URL where no owner URL was published — the\n\t * `roles: false` downgrade, where there is only one credential and it is the\n\t * cluster master's.\n\t */\n\tget owner(): Service<`${Uncapitalize<TName>}Owner`, Kysely<DB>> {\n\t\treturn {\n\t\t\tserviceName:\n\t\t\t\t`${serviceKey(this.id)}Owner` as `${Uncapitalize<TName>}Owner`,\n\t\t\tregister: (options) => this.connect(options, { owner: true }),\n\t\t};\n\t}\n\n\t/**\n\t * What this database's clients are built with besides a dialect — the\n\t * plugins and logging it was declared with.\n\t *\n\t * Public so that whatever opens a connection to it outside \\`connect()\\` —\n\t * a test's transaction — builds the same client. A test that dropped the\n\t * plugins would write \\`createdAt\\` where production writes \\`created_at\\`.\n\t */\n\tget clientConfig(): Omit<KyselyConfig, 'dialect'> {\n\t\t// Split what the manifest declared from what Kysely takes, so neither\n\t\t// leaks into the other: \\`schema\\`, \\`roles\\`, \\`version\\`, \\`image\\`\n\t\t// and \\`extensions\\` describe infrastructure and mean nothing to a\n\t\t// client.\n\t\tconst {\n\t\t\tschema: _schema,\n\t\t\troles: _roles,\n\t\t\tversion: _version,\n\t\t\timage: _image,\n\t\t\textensions: _extensions,\n\t\t\tqueryTags: _queryTags,\n\t\t\t...kysely\n\t\t} = this.options;\n\t\treturn kysely;\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<Kysely<DB>> {\n\t\tconst { url, ownerUrl } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\turl: get(this.config.url).string(),\n\t\t\t\townerUrl: get(this.config.ownerUrl).string().optional(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\treturn new Kysely<DB>({\n\t\t\t...this.clientConfig,\n\t\t\tdialect: new PostgresDialect({\n\t\t\t\tpool: openPool(as.owner ? (ownerUrl ?? url) : url, {\n\t\t\t\t\tqueryTags: this.options.queryTags,\n\t\t\t\t}),\n\t\t\t}),\n\t\t});\n\t}\n}\n\n/**\n * A database you may read through, and derive nothing from.\n *\n * A reader is terminal in the graph, and this is that fact in the type system.\n * `DERIVES_FROM` gives `cache` and `database-schema` no `database-reader`\n * parent, and there is no reader of a reader — so `orders.reader().cache(…)`\n * has always been illegal, but it type-checked and failed later at\n * `assertDerivations`. That is a long way round to learn that a read-only\n * endpoint cannot own a table something writes to.\n *\n * Omitting the three deriving methods rather than making them throw keeps the\n * failure where it costs least: the editor, on the line that wrote it.\n *\n * The result is deliberately not assignable back to `KyselyDatabase` — a\n * reader is not one, and anything that genuinely needs the writer should say\n * so.\n */\nexport type ReadOnlyDatabase<DB, TName extends string> = Omit<\n\tKyselyDatabase<DB, TName>,\n\t'reader' | 'cache' | 'schema'\n>;\nexport { closeDatabasePools } from './pool';\n"],"mappings":";;;;;;;;;;AAgDA,MAAM,uBAAO,IAAI,IAAa;AAC9BA,iBAAAA,iBAAiB,mBAAmB,CAAC;;;;;;;;;;;AAYrC,SAAgB,SACf,KACA,UAA+B,CAAC,GACtB;CACV,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,MAAM,aAAa,OAAO,aAAa,IAAI,aAAa;CACxD,OAAO,aAAa,OAAO,aAAa;CAExC,MAAM,OAAO,IAAI,GAAA,QAAG,KAAK;EACxB,kBAAkB,OAAO,SAAS;EAClC,GAAI,aAAa,EAAE,SAAS,kBAAkB,aAAa,IAAI,CAAC;EAChE,2BAA2B,gBAAgB;CAC5C,CAAC;CAED,KAAK,GAAG,UAAU,UAAU;EAC3B,MAAM,UAAA,GAASC,oBAAAA,sBAAAA,CAAsB,CAAC,EAAE;EACxC,IAAI,QAAQ,OAAO,KAAK,EAAE,KAAK,MAAM,GAAG,+BAA+B;OAClE,QAAQ,KAAK,kCAAkC,MAAM,OAAO;CAClE,CAAC;CACD,MAAM,SAAS,qBAAqB,MAAM;CAC1C,KAAK,GAAG,YAAY,WAAW;EAK9B,IAAI,QAAQ,cAAc,OAAO,WAAW,MAAM;EAClD,aAAa,QAAQ,MAAM;CAC5B,CAAC;CAED,KAAK,IAAI,IAAI;CACb,MAAM,MAAM,KAAK,IAAI,KAAK,IAAI;CAC9B,KAAK,OAAO,YAAY;EACvB,KAAK,OAAO,IAAI;EAChB,MAAM,IAAI;CACX;CAEA,OAAO;AACR;;;;;AAMA,eAAsB,qBAAoC;CACzD,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,SAAS,KAAK,IAAI,CAAC,CAAC;AACtD;;;;;;AAOA,SAAgB,gBACf,MAAyB,QAAQ,KACZ;CACrB,OACC,IAAI,4BACJ,IAAI,gBACJ,IAAI,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAChC,KAAA;AAEF;;;;;;;;;;AAWA,SAAgB,WAAmB;CAClC,MAAM,WAAA,GAAUA,oBAAAA,sBAAAA,CAAsB;CACtC,MAAM,OAAOC,mBAAAA,MAAM,cAAc,CAAC,EAAE,YAAY;CAEhD,MAAM,OAAO;EACZ,CAAC,aAAa,SAAS,SAAS;EAChC,CAAC,cAAc,SAAS,SAAS;EACjC,CAAC,eAAe,SAAA,GAAQC,mBAAAA,mBAAAA,CAAmB,IAAI,IAAI,YAAY,IAAI,IAAI,EAAE;CAC1E,CAAC,CAAC,QAAQ,QAAiC,QAAQ,IAAI,EAAE,CAAC;CAC1D,IAAI,KAAK,WAAW,GAAG,OAAO;CAE9B,MAAM,SAAS,UAAkB,MAAM,QAAQ,kBAAkB,EAAE;CACnE,OAAO,MAAM,KAAK,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;AAC/E;;AAGA,SAAS,YAAY,MAIV;CACV,MAAM,SAAS,KAAK,aAAa,IAAA,CAAM,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CACnE,OAAO,MAAM,KAAK,QAAQ,GAAG,KAAK,OAAO,GAAG;AAC7C;;;;;AAMA,SAAS,WAAW,QAA6B;CAChD,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;CACtC,OAAO,UAAU,OAAgB,GAAG,SAAoB;EACvD,MAAM,MAAM,SAAS;EACrB,IAAI,OAAO,OAAO,UAAU,UAAU,OAAO,MAAM,QAAQ,KAAK,GAAG,IAAI;EACvE,IACC,OACA,SACA,OAAO,UAAU,YACjB,OAAQ,MAA6B,SAAS,UAC7C;GACD,MAAM,SAAS;GACf,OAAO,QAAQ;EAChB;EACA,OAAO,MAAM,OAAO,GAAG,IAAI;CAC5B;AACD;;AAGA,SAAS,qBAAqB,KAAsB;CACnD,MAAM,OAAO,mBAAmB,IAAI,SAAS,MAAM,CAAC,CAAC;CACrD,OAAO;EACN,aAAa;EACb,GAAI,QAAQ,EAAE,WAAW,KAAK;EAC9B,kBAAkB,IAAI;EACtB,eAAe,OAAO,IAAI,QAAQ,IAAI;CACvC;AACD;AAEA,MAAM,SAAS;;AAGf,MAAM,YAAY;;AAElB,MAAM,QACL;;;;;;AAOD,SAAgB,kBAAkB,MAGhC;CACD,MAAM,OAAO,KAAK,SAAS,MAAM,KAAK,MAAM,GAAG,GAAG,IAAI;CACtD,MAAM,YAAY,UAAU,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY;CACzD,MAAM,QAAQ,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,MAAM,EAAE;CACrD,OAAO;EACN,GAAI,aAAa,EAAE,UAAU;EAC7B,GAAI,SAAS,EAAE,MAAM;CACtB;AACD;;;;;;;;;;AAWA,SAAS,aAAa,QAAuB,YAA8B;CAC1E,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;CACtC,OAAO,UAAU,OAAgB,GAAG,SAAoB;EACvD,MAAM,SACL,SAAS,OAAO,UAAU,WACtB,QACD,KAAA;EACJ,MAAM,OACL,OAAO,UAAU,WACd,QACA,OAAO,QAAQ,SAAS,WACvB,OAAO,OACP,KAAA;EACL,MAAM,SAAS,OAAO,UAAU,WAAW,KAAK,KAAK,QAAQ;EAC7D,MAAM,EAAE,WAAW,UAAU,OAAO,kBAAkB,IAAI,IAAI,CAAC;EAE/D,MAAM,OAAOD,mBAAAA,MACX,UAAU,MAAM,CAAC,CACjB,UAAU,aAAa,QAAQ,GAAG,UAAU,GAAG,UAAU,YAAY;GACrE,MAAME,mBAAAA,SAAS;GACf,YAAY;IACX,GAAG;IACH,GAAI,aAAa,EAAE,gBAAgB,UAAU;IAC7C,GAAI,SAAS,EAAE,gBAAgB,MAAM;IACrC,GAAI,QACH,MAAM,QAAQ,MAAM,KAAK,EACxB,gBACC,KAAK,SAAA,OACF,KAAK,MAAM,GAAA,IAAuB,IAClC,KACL;GACF;EACD,CAAC;EACF,MAAM,OAAO,UAAoB;GAChC,IAAI,OAAO;IACV,IAAI,iBAAiB,OAAO,KAAK,gBAAgB,KAAK;IACtD,KAAK,UAAU,EAAE,MAAMC,mBAAAA,eAAe,MAAM,CAAC;GAC9C;GACA,KAAK,IAAI;EACV;EAGA,MAAM,OAAO,KAAK,KAAK,SAAS;EAChC,IAAI,OAAO,SAAS,YAAY;GAC/B,MAAM,OAAO,CAAC,GAAG,IAAI;GACrB,KAAK,KAAK,SAAS,MAAM,OAAgB,GAAG,WAAsB;IACjE,IAAI,KAAK;IACT,OAAQ,KAAsC,OAAO,GAAG,MAAM;GAC/D;GACA,OAAOC,mBAAAA,QAAQ,KAAKJ,mBAAAA,MAAM,QAAQI,mBAAAA,QAAQ,OAAO,GAAG,IAAI,SACvD,MAAM,OAAO,GAAG,IAAI,CACrB;EACD;EAEA,IAAI;EACJ,IAAI;GACH,SAASA,mBAAAA,QAAQ,KAAKJ,mBAAAA,MAAM,QAAQI,mBAAAA,QAAQ,OAAO,GAAG,IAAI,SACzD,MAAM,OAAO,GAAG,IAAI,CACrB;EACD,SAAS,OAAO;GACf,IAAI,KAAK;GACT,MAAM;EACP;EAEA,IAAI,UAAU,OAAQ,OAA4B,SAAS,YAC1D,OAA6B,WACtB,IAAI,IACT,UAAU,IAAI,KAAK,CACrB;OACM,IACN,UACA,OAAQ,OAA8B,SAAS,YAC9C;GAED,MAAM,UAAU;GAGhB,QAAQ,KAAK,aAAa,IAAI,CAAC;GAC/B,QAAQ,KAAK,UAAU,UAAU,IAAI,KAAK,CAAC;EAC5C,OACC,IAAI;EAEL,OAAO;CACR;AACD;;;;;;;;;;;;;;;;ACzRA,MAAM,iBAAiB;;;;;;;;AA4GvB,IAAa,iBAAb,MAAa,eAEb;CAgBmB;CAflB;CACA;;;;;CAMA;CACA;CACA;CACA;CACA;CAEA,YACC,IACA,UAAkD,CAAC,GACnD,aACC;EAFgB,KAAA,UAAA;EAKjB,MAAM,aAAA,GAAYC,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,SAAS;GACb,MAAA,GAAKC,oBAAAA,WAAAA,CAAW,WAAW,KAAK;GAChC,WAAA,GAAUA,oBAAAA,WAAAA,CAAW,WAAW,UAAU;EAC3C;EACA,KAAK,aAAa,QAAQ,UAAU;EACpC,KAAK,QAAQ,QAAQ,SAAS;EAC9B,KAAK,UAAU,QAAQ,QACpB,EAAE,OAAO,QAAQ,MAAM,IACvB,EAAE,SAAS,QAAQ,WAAWC,oBAAAA,yBAAyB;EAC1D,KAAK,cAAc;EAGnB,KAAK,UAAU;GACd,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,SAAS;GAGjC,WAAW,oBAAoB,KAAK,QAAQ,eAAe;EAC5D;CACD;CAEA,UAAyB;EACxB,IAAI,KAAK,aAAa;GACrB,MAAM,EAAE,MAAM,IAAI,WAAW,KAAK;GAElC,OAAO,CACN,SAAS,oBACN;IACA;IACA,IAAI,KAAK;IACT;IACA,QAAQ,UAAU,KAAK;IAEvB,UAAU,CAAC,KAAK,OAAO,GAAG;GAC3B,IACC;IACA;IACA,IAAI,KAAK;IACT;IAGA,UAAU,CAAC,KAAK,OAAO,GAAG;GAC3B,CACH;EACD;EAEA,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,QAAQ;GACR,QAAQ,KAAK;GAEb,GAAG,KAAK;GACR,GAAI,KAAK,QAAQ,YAAY,SAC1B,EAAE,YAAY,CAAC,GAAG,IAAI,IAAI,KAAK,QAAQ,UAAU,CAAC,EAAE,IACpD,CAAC;GAIJ,UAAU,CAAC,KAAK,OAAO,GAAG;GAC1B,GAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,OAAO,MAAM;EACtC,CACD;CACD;;;;;;;;;;;;;CAcA,SAAiD;EAChD,OAAO,IAAI,eACV,GAAG,KAAK,GAAG,SACX,KAAK,SACL;GAAE,MAAM;GAAmB,IAAI,KAAK;EAAG,CACxC;CACD;;;;;;;;;;;;;;;;;;CAmBA,MACC,KAA4B,GAAG,KAAK,GAAG,QACvC,UAA8B,CAAC,GACf;EAChB,OAAO,IAAIC,cAAAA,MAAc,IAAI;GAC5B,IAAI,KAAK;GACT,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjD,CAAC;CACF;;;;;;;;;CAUA,OACC,IACA,UAAiC,CAAC,GACE;EACpC,OAAO,IAAI,eAAkC,IAAI,SAAS;GACzD,MAAM;GACN,IAAI,KAAK;GACT,QAAQ,QAAQ,UAAW,GAAc,YAAY;EACtD,CAAC;CACF;;;;;;;;;;;;;CAcA,IAAI,QAA4D;EAC/D,OAAO;GACN,aACC,IAAA,GAAGD,oBAAAA,WAAAA,CAAW,KAAK,EAAE,EAAE;GACxB,WAAW,YAAY,KAAK,QAAQ,SAAS,EAAE,OAAO,KAAK,CAAC;EAC7D;CACD;;;;;;;;;CAUA,IAAI,eAA8C;EAKjD,MAAM,EACL,QAAQ,SACR,OAAO,QACP,SAAS,UACT,OAAO,QACP,YAAY,aACZ,WAAW,YACX,GAAGE,aACA,KAAK;EACT,OAAOA;CACR;CAEA,MAAc,QACb,SACA,KAA0B,CAAC,GACL;EACtB,MAAM,EAAE,KAAK,aAAa,QAAQ,UAChC,QAAQ,SAAS;GACjB,KAAK,IAAI,KAAK,OAAO,GAAG,CAAC,CAAC,OAAO;GACjC,UAAU,IAAI,KAAK,OAAO,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS;EACvD,EAAE,CAAC,CACF,MAAM;EAER,OAAO,IAAIC,OAAAA,OAAW;GACrB,GAAG,KAAK;GACR,SAAS,IAAIC,OAAAA,gBAAgB,EAC5B,MAAM,SAAS,GAAG,QAAS,YAAY,MAAO,KAAK,EAClD,WAAW,KAAK,QAAQ,UACzB,CAAC,EACF,CAAC;EACF,CAAC;CACF;AACD"}

package/dist/{telemetry-C3L0iS28.d.cts → lambdaTelemetry-8vnmVZQ5.d.cts}

@@ -1,7 +1,5 @@
 import { Context } from "aws-lambda";
-
-//#region src/telemetry.d.ts
-
+//#region src/endpoints/lambdaTelemetry.d.ts
 /**
  * Context object returned by onRequestStart, passed to subsequent hooks
  */
@@ -89,7 +87,6 @@ interface Telemetry {
    */
   onRequestError(ctx: TelemetryContext, error: Error): void;
 }
-//# sourceMappingURL=telemetry.d.ts.map
 //#endregion
-export { Telemetry, TelemetryContext, TelemetryRequest, TelemetryResponse };
-//# sourceMappingURL=telemetry-C3L0iS28.d.cts.map
+export { TelemetryResponse as i, TelemetryContext as n, TelemetryRequest as r, Telemetry as t };
+//# sourceMappingURL=lambdaTelemetry-8vnmVZQ5.d.cts.map

package/dist/lambdaTelemetry-8vnmVZQ5.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lambdaTelemetry-8vnmVZQ5.d.cts","names":["LambdaContext"],"sources":["../src/endpoints/lambdaTelemetry.ts"],"mappings":";;;;;UAWiB;;;;GAIf;;;;;UAMe;;;;EAIhB;;;;EAKA,SAASA;;;;;UAMO;;;;EAIhB;;;;EAKA;;;;EAKA,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4BM;;;;;;;EAOhB,eAAe,SAAS,mBAAmB;;;;;;;EAQ3C,aAAa,KAAK,kBAAkB,UAAU;;;;;;;EAQ9C,eAAe,KAAK,kBAAkB,OAAO"}

package/dist/{telemetry-D7bVFLGi.d.mts → lambdaTelemetry-8vnmVZQ5.d.mts}

@@ -1,7 +1,5 @@
 import { Context } from "aws-lambda";
-
-//#region src/telemetry.d.ts
-
+//#region src/endpoints/lambdaTelemetry.d.ts
 /**
  * Context object returned by onRequestStart, passed to subsequent hooks
  */
@@ -89,7 +87,6 @@ interface Telemetry {
    */
   onRequestError(ctx: TelemetryContext, error: Error): void;
 }
-//# sourceMappingURL=telemetry.d.ts.map
 //#endregion
-export { Telemetry, TelemetryContext, TelemetryRequest, TelemetryResponse };
-//# sourceMappingURL=telemetry-D7bVFLGi.d.mts.map
+export { TelemetryResponse as i, TelemetryContext as n, TelemetryRequest as r, Telemetry as t };
+//# sourceMappingURL=lambdaTelemetry-8vnmVZQ5.d.mts.map

package/dist/lambdaTelemetry-8vnmVZQ5.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lambdaTelemetry-8vnmVZQ5.d.mts","names":["LambdaContext"],"sources":["../src/endpoints/lambdaTelemetry.ts"],"mappings":";;;;;UAWiB;;;;GAIf;;;;;UAMe;;;;EAIhB;;;;EAKA,SAASA;;;;;UAMO;;;;EAIhB;;;;EAKA;;;;EAKA,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4BM;;;;;;;EAOhB,eAAe,SAAS,mBAAmB;;;;;;;EAQ3C,aAAa,KAAK,kBAAkB,UAAU;;;;;;;EAQ9C,eAAe,KAAK,kBAAkB,OAAO"}

package/dist/mobile-app.cjs

@@ -0,0 +1,74 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_construct_interface = require("./construct-interface.cjs");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+//#region src/mobile-app.ts
+/**
+* `MobileApp` — an Expo app, declared like a site.
+*
+* Its edges are the point, as a site's are. One `.dependsOn([api, auth])` is
+* the fact behind everything a mobile app otherwise has written down by hand:
+*
+* - its `EXPO_PUBLIC_API_URL` and `EXPO_PUBLIC_AUTH_URL`, which locally are
+*   the servers' own ports — reachable once the app swaps `localhost` for the
+*   address Metro is served from, which is what makes a phone on the LAN work;
+* - with an `Email` among them, Mailpit's inbox on a local stage
+*   (`EXPO_PUBLIC_<ID>_INBOX_URL`), so a sign-in link can be opened from the
+*   app — unset deployed, where there is no inbox;
+* - its URL scheme (`shop`), the same on every stage;
+* - the scheme in the auth server's and the API's trusted origins — and, on a
+*   local stage, the `exp://` origins Expo Go sends from;
+* - Better Auth's Expo plugin on the auth server, and sign-in links an app asks
+*   for built on an address the phone can open.
+*
+* ```ts
+* export const app = new MobileApp('App', { path: 'apps/app' })
+*   .dependsOn([api, auth]);
+* ```
+*
+* Like a site it has no `.service`: it is built by its own toolchain, and
+* consumes addresses rather than connections. Nothing deploys it — EAS and the
+* stores do — so the targets derive *for* it and never run it.
+*/
+var MobileApp = class MobileApp {
+	config;
+	dependencies;
+	id;
+	/** The key its scheme arrives under — what its `app.config.ts` reads. */
+	keys;
+	constructor(id, config, dependencies = []) {
+		this.config = config;
+		this.dependencies = dependencies;
+		this.id = (0, _geekmidas_manifest.canonicalId)(id);
+		this.keys = { scheme: (0, _geekmidas_manifest.provideKey)(this.id, "scheme") };
+	}
+	/**
+	* What this app calls — the surfaces it is built with the URLs of, and the
+	* ones that come to trust its scheme.
+	*
+	* Immutable, like every other builder: it returns a new app rather than
+	* changing this one.
+	*/
+	dependsOn(constructs) {
+		return new MobileApp(this.id, this.config, [...this.dependencies, ...constructs.map(require_construct_interface.edgeTo)]);
+	}
+	declare() {
+		return [{
+			kind: "mobile-app",
+			id: this.id,
+			variant: this.config.variant ?? "expo",
+			app: {
+				path: this.config.path,
+				...this.config.port ? { port: this.config.port } : {},
+				...this.config.config ? { config: this.config.config } : {}
+			},
+			...this.config.scheme ? { scheme: this.config.scheme } : {},
+			...this.config.stages ? { stages: this.config.stages } : {},
+			dependencies: this.dependencies,
+			provides: [this.keys.scheme]
+		}];
+	}
+};
+//#endregion
+exports.MobileApp = MobileApp;
+
+//# sourceMappingURL=mobile-app.cjs.map

package/dist/mobile-app.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mobile-app.cjs","names":["canonicalId","provideKey","edgeTo"],"sources":["../src/mobile-app.ts"],"sourcesContent":["/**\n * `MobileApp` — an Expo app, declared like a site.\n *\n * Its edges are the point, as a site's are. One `.dependsOn([api, auth])` is\n * the fact behind everything a mobile app otherwise has written down by hand:\n *\n * - its `EXPO_PUBLIC_API_URL` and `EXPO_PUBLIC_AUTH_URL`, which locally are\n *   the servers' own ports — reachable once the app swaps `localhost` for the\n *   address Metro is served from, which is what makes a phone on the LAN work;\n * - with an `Email` among them, Mailpit's inbox on a local stage\n *   (`EXPO_PUBLIC_<ID>_INBOX_URL`), so a sign-in link can be opened from the\n *   app — unset deployed, where there is no inbox;\n * - its URL scheme (`shop`), the same on every stage;\n * - the scheme in the auth server's and the API's trusted origins — and, on a\n *   local stage, the `exp://` origins Expo Go sends from;\n * - Better Auth's Expo plugin on the auth server, and sign-in links an app asks\n *   for built on an address the phone can open.\n *\n * ```ts\n * export const app = new MobileApp('App', { path: 'apps/app' })\n *   .dependsOn([api, auth]);\n * ```\n *\n * Like a site it has no `.service`: it is built by its own toolchain, and\n * consumes addresses rather than connections. Nothing deploys it — EAS and the\n * stores do — so the targets derive *for* it and never run it.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\ttype Dependency,\n\ttype MobileAppDeclaration,\n\ttype MobileAppStage,\n\tprovideKey,\n} from '@geekmidas/manifest';\nimport { type Declarable, edgeTo } from './construct-interface';\n\nexport interface MobileAppConfig {\n\t/**\n\t * Where its source lives, relative to the workspace root — `'apps/app'`.\n\t * Required, the same field a site and a surface take.\n\t */\n\tpath: string;\n\t/**\n\t * The port Metro serves it on locally.\n\t *\n\t * Normally omitted: ports are assigned in a stable order, as a site's are,\n\t * and `gkm exec` hands it to Expo as `RCT_METRO_PORT`.\n\t */\n\tport?: number;\n\t/**\n\t * Modules to import when sniffing which env vars the app reads — its\n\t * values are inlined at build time, as a site's are.\n\t */\n\tconfig?: { client?: string; server?: string };\n\t/**\n\t * Which toolchain builds it — the same field a site names its framework\n\t * by. Expo is the one that ships, and the default.\n\t */\n\tvariant?: MobileAppDeclaration['variant'];\n\t/**\n\t * Its URL scheme.\n\t *\n\t * Normally omitted: it is the project's name — `shop` — on every stage.\n\t * Give one only when the app is known by another name.\n\t */\n\tscheme?: string;\n\t/**\n\t * How a deployed stage ships it, where that differs from the defaults: the\n\t * protected stage reads EAS's `production` environment and submits to\n\t * Play's `production` track, every other deployed stage `preview` and\n\t * `internal`, and every Android release is a `draft` until someone\n\t * releases it in Play Console.\n\t *\n\t * ```ts\n\t * stages: { beta: { environment: 'preview', android: { track: 'alpha' } } }\n\t * ```\n\t */\n\tstages?: Readonly<Record<string, MobileAppStage>>;\n}\n\nexport class MobileApp<TName extends string = string>\n\timplements Declarable<TName>\n{\n\treadonly id: TName;\n\t/** The key its scheme arrives under — what its `app.config.ts` reads. */\n\treadonly keys: { scheme: string };\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: MobileAppConfig,\n\t\t/** Internal: how `.dependsOn()` carries edges into the copy it returns. */\n\t\tprivate readonly dependencies: readonly Dependency[] = [],\n\t) {\n\t\tthis.id = canonicalId(id as string) as TName;\n\t\tthis.keys = { scheme: provideKey(this.id, 'scheme') };\n\t}\n\n\t/**\n\t * What this app calls — the surfaces it is built with the URLs of, and the\n\t * ones that come to trust its scheme.\n\t *\n\t * Immutable, like every other builder: it returns a new app rather than\n\t * changing this one.\n\t */\n\tdependsOn(constructs: readonly Declarable[]): MobileApp<TName> {\n\t\treturn new MobileApp<TName>(this.id as ConstructName<TName>, this.config, [\n\t\t\t...this.dependencies,\n\t\t\t...constructs.map(edgeTo),\n\t\t]);\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'mobile-app',\n\t\t\t\tid: this.id,\n\t\t\t\tvariant: this.config.variant ?? 'expo',\n\t\t\t\tapp: {\n\t\t\t\t\tpath: this.config.path,\n\t\t\t\t\t...(this.config.port ? { port: this.config.port } : {}),\n\t\t\t\t\t...(this.config.config ? { config: this.config.config } : {}),\n\t\t\t\t},\n\t\t\t\t...(this.config.scheme ? { scheme: this.config.scheme } : {}),\n\t\t\t\t...(this.config.stages ? { stages: this.config.stages } : {}),\n\t\t\t\tdependencies: this.dependencies,\n\t\t\t\tprovides: [this.keys.scheme],\n\t\t\t},\n\t\t];\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmFA,IAAa,YAAb,MAAa,UAEb;CAOmB;CAEA;CARlB;;CAEA;CAEA,YACC,IACA,QAEA,eAAuD,CAAC,GACvD;EAHgB,KAAA,SAAA;EAEA,KAAA,eAAA;EAEjB,KAAK,MAAA,GAAKA,oBAAAA,YAAAA,CAAY,EAAY;EAClC,KAAK,OAAO,EAAE,SAAA,GAAQC,oBAAAA,WAAAA,CAAW,KAAK,IAAI,QAAQ,EAAE;CACrD;;;;;;;;CASA,UAAU,YAAqD;EAC9D,OAAO,IAAI,UAAiB,KAAK,IAA4B,KAAK,QAAQ,CACzE,GAAG,KAAK,cACR,GAAG,WAAW,IAAIC,4BAAAA,MAAM,CACzB,CAAC;CACF;CAEA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,SAAS,KAAK,OAAO,WAAW;GAChC,KAAK;IACJ,MAAM,KAAK,OAAO;IAClB,GAAI,KAAK,OAAO,OAAO,EAAE,MAAM,KAAK,OAAO,KAAK,IAAI,CAAC;IACrD,GAAI,KAAK,OAAO,SAAS,EAAE,QAAQ,KAAK,OAAO,OAAO,IAAI,CAAC;GAC5D;GACA,GAAI,KAAK,OAAO,SAAS,EAAE,QAAQ,KAAK,OAAO,OAAO,IAAI,CAAC;GAC3D,GAAI,KAAK,OAAO,SAAS,EAAE,QAAQ,KAAK,OAAO,OAAO,IAAI,CAAC;GAC3D,cAAc,KAAK;GACnB,UAAU,CAAC,KAAK,KAAK,MAAM;EAC5B,CACD;CACD;AACD"}