@geekmidas/constructs 10.0.0-alpha.12 → 10.0.0-alpha.121

package/dist/queue/index.cjs

@@ -1,189 +1,6 @@
-const require_chunk = require('../chunk-DWy1uDak.cjs');
-const require_construct_interface = require('../construct-interface-BfjcOD_E.cjs');
-const require_Construct = require('../Construct-CyS3RpTL.cjs');
-const require_clone = require('../clone-Dy0cR2SZ.cjs');
-const __geekmidas_manifest = require_chunk.__toESM(require("@geekmidas/manifest"));
-const __geekmidas_logger_console = require_chunk.__toESM(require("@geekmidas/logger/console"));
-const __geekmidas_events = require_chunk.__toESM(require("@geekmidas/events"));
-
-//#region src/queue/Queue.ts
-/**
-* A queue worker — a point-to-point SQS-style queue and its single consumer.
-* Unlike a `Subscriber` (topic fan-out, filtered by `subscribedEvents`), a queue
-* drains every message of its one `message` type. Build one with `q` (see
-* `QueueBuilder`); `gkm build` discovers it into the manifest's `queues` field.
-*
-* The producer side is {@link Queue.publisher} — a ready-to-inject `Service`
-* that any endpoint/function drops into `.services([...])` to send messages.
-*/
-var Queue = class extends require_Construct.Construct {
-	__IS_QUEUE__ = true;
-	static isQueue(obj) {
-		return Boolean(obj && obj.__IS_QUEUE__ === true && obj.type === require_Construct.ConstructType.Queue);
-	}
-	/**
-	* The canonical id this queue is declared under.
-	*
-	* Derived from the name rather than given separately, so `emails` and
-	* `Emails` are one queue. The name stays what it was: it is the wire `type`
-	* a producer sends and the worker subscribes to, and changing that would
-	* silently orphan in-flight messages.
-	*/
-	id;
-	/**
-	* The producer's env key. Read by both {@link declare} and
-	* {@link publisher}, so what the target publishes and what the producer
-	* looks up cannot drift.
-	*/
-	connectionKey;
-	constructor(name, handler, messageSchema, timeout = 3e4, services = [], logger = __geekmidas_logger_console.DEFAULT_LOGGER, batchSize, fifo, constructs = []) {
-		super(require_Construct.ConstructType.Queue, logger, services, [], void 0, void 0, timeout, void 0, void 0, constructs);
-		this.name = name;
-		this.handler = handler;
-		this.messageSchema = messageSchema;
-		this.timeout = timeout;
-		this.services = services;
-		this.logger = logger;
-		this.batchSize = batchSize;
-		this.fifo = fifo;
-		this.id = (0, __geekmidas_manifest.canonicalId)(name);
-		this.connectionKey = (0, __geekmidas_manifest.provideKey)(this.id, "publisherConnectionString");
-	}
-	/**
-	* What this queue is in the manifest.
-	*
-	* A queue is a resource, not a handler: the worker is reached *through* it,
-	* so the declaration carries the producer's key and nothing about the code
-	* that drains it. The local target reads this to know which broker has to be
-	* running and what connection string to inject.
-	*/
-	declare() {
-		return [{
-			kind: "queue",
-			id: this.id,
-			provides: [this.connectionKey],
-			...this.fifo ? { fifo: true } : {},
-			worker: {
-				id: `${this.id}Worker`,
-				handler: `${this.id}.handler`,
-				dependencies: []
-			}
-		}];
-	}
-	/**
-	* The producer side — a `Service` exposing an `EventPublisher` typed to this
-	* queue's message. Inject it via `.services([queue.publisher])`; the handler
-	* then calls `services.<name>Publisher.publish([{ type, payload }])`.
-	*
-	* It reads `<NAME>_PUBLISHER_CONNECTION_STRING` and builds the transport from
-	* the URL protocol — `pgboss://` locally, `sqs://` deployed — so the same
-	* code publishes to Postgres in dev and SQS in prod. Because it's a `Service`,
-	* `Construct.getEnvironment()` sniffs it, so the env requirement flows into
-	* the manifest and infra links exactly this queue with least privilege.
-	*/
-	/**
-	* The queue as a dependency — what `.dependsOn([emailsQueue])` dissolves
-	* into, reachable as `services.emails`.
-	*
-	* It is the producer: a consumer is the worker written right here, so the
-	* only thing another construct can want from a queue is the ability to send
-	* to it. {@link publisher} is the same service under its older
-	* `<name>Publisher` key, kept for `.services([queue.publisher])`.
-	*/
-	get service() {
-		const { register } = this.publisher;
-		return {
-			serviceName: (0, __geekmidas_manifest.serviceKey)(this.id),
-			register
-		};
-	}
-	get publisher() {
-		const envVar = this.connectionKey;
-		return {
-			serviceName: `${this.name}Publisher`,
-			async register({ envParser }) {
-				const { connectionString } = envParser.create((get) => ({ connectionString: get(envVar).string() })).parse();
-				return __geekmidas_events.Publisher.fromConnectionString(connectionString);
-			}
-		};
-	}
-};
-
-//#endregion
-//#region src/queue/QueueBuilder.ts
-/**
-* Builds a {@link Queue} worker — `q.queue('orders').services([db]).message(schema).handle(fn)`.
-* Services are an array (sniffed for required env vars); `message` is the typed
-* job payload; `handle` is the single consumer. The queue name is captured as a
-* literal so `queue.publisher` is typed to `{ type: '<name>', payload }`.
-*/
-var QueueBuilder = class {
-	_name;
-	_messageSchema;
-	_timeout = 3e4;
-	_batchSize;
-	_fifo;
-	_services = [];
-	/** The construct ids `.dependsOn()` named — what the manifest records. */
-	_constructs = [];
-	_logger = __geekmidas_logger_console.DEFAULT_LOGGER;
-	/** The queue name — drives the infra queue and its `<NAME>_*` env vars. */
-	queue(name) {
-		return require_clone.cloneWith(this, { _name: name });
-	}
-	timeout(timeout) {
-		return require_clone.cloneWith(this, { _timeout: timeout });
-	}
-	/** SQS event-source batch size (deployed). */
-	batchSize(batchSize) {
-		return require_clone.cloneWith(this, { _batchSize: batchSize });
-	}
-	/** Mark the queue as FIFO (deployed). */
-	fifo(fifo = true) {
-		return require_clone.cloneWith(this, { _fifo: fifo });
-	}
-	/**
-	* Depend on constructs — a database, a bucket, a mail sender, a queue, a
-	* topic.
-	*
-	* It records the edge and dissolves each construct's client into the
-	* handler's service record under the construct's own id, so
-	* `.dependsOn([uploads])` is what makes `services.uploads` exist and type.
-	*
-	* Constructs only. A `Service` does not match the shape, which is what keeps
-	* env sniffing confined to `.services()` and the explicit lift.
-	*/
-	dependsOn(constructs) {
-		const services = require_construct_interface.servicesOf(constructs);
-		return require_clone.cloneWith(this, {
-			_services: [...this._services, ...services],
-			_constructs: require_construct_interface.idsOf(constructs, this._constructs)
-		});
-	}
-	services(services) {
-		return require_clone.cloneWith(this, { _services: [...this._services, ...services] });
-	}
-	logger(logger) {
-		return require_clone.cloneWith(this, { _logger: logger });
-	}
-	/** The typed message (job) payload the queue carries. */
-	message(schema) {
-		return require_clone.cloneWith(this, { _messageSchema: schema });
-	}
-	handle(fn) {
-		if (!this._name) throw new Error("Queue requires a name — call .queue(name) before .handle().");
-		if (!this._messageSchema) throw new Error("Queue requires a message schema — call .message(schema) before .handle().");
-		const queue = new Queue(this._name, fn, this._messageSchema, this._timeout, this._services, this._logger, this._batchSize, this._fifo, this._constructs);
-		return queue;
-	}
-};
-
-//#endregion
-//#region src/queue/index.ts
-const q = new QueueBuilder();
-
-//#endregion
-exports.Queue = Queue;
-exports.QueueBuilder = QueueBuilder;
-exports.q = q;
-//# sourceMappingURL=index.cjs.map
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_Queue = require("../Queue-BhuofM3k.cjs");
+const require_QueueBuilder = require("../QueueBuilder-DdU2klPu.cjs");
+exports.Queue = require_Queue.Queue;
+exports.QueueNeedsMessage = require_QueueBuilder.QueueNeedsMessage;
+exports.QueueNeedsName = require_QueueBuilder.QueueNeedsName;

package/dist/queue/index.d.cts

@@ -1,60 +1,3 @@
-import "../Construct-C0ijr2qp.cjs";
-import { Consumable, ServicesOf } from "../construct-interface-D9d4Gm4p.cjs";
-import { Queue, QueueContext, QueueHandler, QueueMessage } from "../Queue-D7ZuwBhy.cjs";
-import * as _geekmidas_logger0 from "@geekmidas/logger";
-import { Logger } from "@geekmidas/logger";
-import { Service } from "@geekmidas/services";
-import { StandardSchemaV1 } from "@standard-schema/spec";
-
-//#region src/queue/QueueBuilder.d.ts
-
-/**
- * Builds a {@link Queue} worker — `q.queue('orders').services([db]).message(schema).handle(fn)`.
- * Services are an array (sniffed for required env vars); `message` is the typed
- * job payload; `handle` is the single consumer. The queue name is captured as a
- * literal so `queue.publisher` is typed to `{ type: '<name>', payload }`.
- */
-declare class QueueBuilder<TName extends string = string, TMessage extends StandardSchemaV1 | undefined = undefined, TServices extends Service[] = [], TLogger extends Logger = Logger> {
-  private _name?;
-  private _messageSchema?;
-  private _timeout;
-  private _batchSize?;
-  private _fifo?;
-  private _services;
-  /** The construct ids `.dependsOn()` named — what the manifest records. */
-  _constructs: string[];
-  private _logger;
-  /** The queue name — drives the infra queue and its `<NAME>_*` env vars. */
-  queue<T extends string>(name: T): QueueBuilder<T, TMessage, TServices, TLogger>;
-  timeout(timeout: number): this;
-  /** SQS event-source batch size (deployed). */
-  batchSize(batchSize: number): this;
-  /** Mark the queue as FIFO (deployed). */
-  fifo(fifo?: boolean): this;
-  /**
-   * Depend on constructs — a database, a bucket, a mail sender, a queue, a
-   * topic.
-   *
-   * It records the edge and dissolves each construct's client into the
-   * handler's service record under the construct's own id, so
-   * `.dependsOn([uploads])` is what makes `services.uploads` exist and type.
-   *
-   * Constructs only. A `Service` does not match the shape, which is what keeps
-   * env sniffing confined to `.services()` and the explicit lift.
-   */
-  dependsOn<const T extends readonly Consumable[]>(constructs: T): QueueBuilder<TName, TMessage, [...TServices, ...ServicesOf<T>], TLogger>;
-  services<T extends Service[]>(services: T): QueueBuilder<TName, TMessage, [...TServices, ...T], TLogger>;
-  logger<T extends Logger>(logger: T): QueueBuilder<TName, TMessage, TServices, T>;
-  /** The typed message (job) payload the queue carries. */
-  message<T extends StandardSchemaV1>(schema: T): QueueBuilder<TName, T, TServices, TLogger>;
-  handle(fn: QueueHandler<NonNullable<TMessage>, TServices, TLogger>): Queue<TName, NonNullable<TMessage>, TServices, TLogger>;
-}
-//# sourceMappingURL=QueueBuilder.d.ts.map
-//#endregion
-//#region src/queue/index.d.ts
-declare const q: QueueBuilder<string, undefined, [], _geekmidas_logger0.Logger>;
-//# sourceMappingURL=index.d.ts.map
-
-//#endregion
-export { Queue, QueueBuilder, QueueContext, QueueHandler, QueueMessage, q };
-//# sourceMappingURL=index.d.cts.map
+import { i as QueueMessage, n as QueueContext, r as QueueHandler, t as Queue } from "../Queue-JbIjVtTf.cjs";
+import { n as QueueNeedsMessage, r as QueueNeedsName } from "../QueueBuilder-MfpkJ3R9.cjs";
+export { Queue, type QueueContext, type QueueHandler, type QueueMessage, QueueNeedsMessage, QueueNeedsName };

package/dist/queue/index.d.mts

@@ -1,60 +1,3 @@
-import "../Construct-Ct8nalEi.mjs";
-import { Consumable, ServicesOf } from "../construct-interface-g5GM5pwR.mjs";
-import { Queue, QueueContext, QueueHandler, QueueMessage } from "../Queue-gVGfi2Yk.mjs";
-import { Service } from "@geekmidas/services";
-import * as _geekmidas_logger16 from "@geekmidas/logger";
-import { Logger } from "@geekmidas/logger";
-import { StandardSchemaV1 } from "@standard-schema/spec";
-
-//#region src/queue/QueueBuilder.d.ts
-
-/**
- * Builds a {@link Queue} worker — `q.queue('orders').services([db]).message(schema).handle(fn)`.
- * Services are an array (sniffed for required env vars); `message` is the typed
- * job payload; `handle` is the single consumer. The queue name is captured as a
- * literal so `queue.publisher` is typed to `{ type: '<name>', payload }`.
- */
-declare class QueueBuilder<TName extends string = string, TMessage extends StandardSchemaV1 | undefined = undefined, TServices extends Service[] = [], TLogger extends Logger = Logger> {
-  private _name?;
-  private _messageSchema?;
-  private _timeout;
-  private _batchSize?;
-  private _fifo?;
-  private _services;
-  /** The construct ids `.dependsOn()` named — what the manifest records. */
-  _constructs: string[];
-  private _logger;
-  /** The queue name — drives the infra queue and its `<NAME>_*` env vars. */
-  queue<T extends string>(name: T): QueueBuilder<T, TMessage, TServices, TLogger>;
-  timeout(timeout: number): this;
-  /** SQS event-source batch size (deployed). */
-  batchSize(batchSize: number): this;
-  /** Mark the queue as FIFO (deployed). */
-  fifo(fifo?: boolean): this;
-  /**
-   * Depend on constructs — a database, a bucket, a mail sender, a queue, a
-   * topic.
-   *
-   * It records the edge and dissolves each construct's client into the
-   * handler's service record under the construct's own id, so
-   * `.dependsOn([uploads])` is what makes `services.uploads` exist and type.
-   *
-   * Constructs only. A `Service` does not match the shape, which is what keeps
-   * env sniffing confined to `.services()` and the explicit lift.
-   */
-  dependsOn<const T extends readonly Consumable[]>(constructs: T): QueueBuilder<TName, TMessage, [...TServices, ...ServicesOf<T>], TLogger>;
-  services<T extends Service[]>(services: T): QueueBuilder<TName, TMessage, [...TServices, ...T], TLogger>;
-  logger<T extends Logger>(logger: T): QueueBuilder<TName, TMessage, TServices, T>;
-  /** The typed message (job) payload the queue carries. */
-  message<T extends StandardSchemaV1>(schema: T): QueueBuilder<TName, T, TServices, TLogger>;
-  handle(fn: QueueHandler<NonNullable<TMessage>, TServices, TLogger>): Queue<TName, NonNullable<TMessage>, TServices, TLogger>;
-}
-//# sourceMappingURL=QueueBuilder.d.ts.map
-//#endregion
-//#region src/queue/index.d.ts
-declare const q: QueueBuilder<string, undefined, [], _geekmidas_logger16.Logger>;
-//# sourceMappingURL=index.d.ts.map
-
-//#endregion
-export { Queue, QueueBuilder, QueueContext, QueueHandler, QueueMessage, q };
-//# sourceMappingURL=index.d.mts.map
+import { i as QueueMessage, n as QueueContext, r as QueueHandler, t as Queue } from "../Queue-B-dDXyjF.mjs";
+import { n as QueueNeedsMessage, r as QueueNeedsName } from "../QueueBuilder-48W-q8In.mjs";
+export { Queue, type QueueContext, type QueueHandler, type QueueMessage, QueueNeedsMessage, QueueNeedsName };

package/dist/queue/index.mjs

@@ -1,186 +1,3 @@
-import { Construct, ConstructType } from "../Construct-BD5neF7w.mjs";
-import { idsOf, servicesOf } from "../construct-interface-Z4CpS8tK.mjs";
-import { cloneWith } from "../clone-DblgEZZa.mjs";
-import { canonicalId, provideKey, serviceKey } from "@geekmidas/manifest";
-import { DEFAULT_LOGGER } from "@geekmidas/logger/console";
-import { Publisher } from "@geekmidas/events";
-
-//#region src/queue/Queue.ts
-/**
-* A queue worker — a point-to-point SQS-style queue and its single consumer.
-* Unlike a `Subscriber` (topic fan-out, filtered by `subscribedEvents`), a queue
-* drains every message of its one `message` type. Build one with `q` (see
-* `QueueBuilder`); `gkm build` discovers it into the manifest's `queues` field.
-*
-* The producer side is {@link Queue.publisher} — a ready-to-inject `Service`
-* that any endpoint/function drops into `.services([...])` to send messages.
-*/
-var Queue = class extends Construct {
-	__IS_QUEUE__ = true;
-	static isQueue(obj) {
-		return Boolean(obj && obj.__IS_QUEUE__ === true && obj.type === ConstructType.Queue);
-	}
-	/**
-	* The canonical id this queue is declared under.
-	*
-	* Derived from the name rather than given separately, so `emails` and
-	* `Emails` are one queue. The name stays what it was: it is the wire `type`
-	* a producer sends and the worker subscribes to, and changing that would
-	* silently orphan in-flight messages.
-	*/
-	id;
-	/**
-	* The producer's env key. Read by both {@link declare} and
-	* {@link publisher}, so what the target publishes and what the producer
-	* looks up cannot drift.
-	*/
-	connectionKey;
-	constructor(name, handler, messageSchema, timeout = 3e4, services = [], logger = DEFAULT_LOGGER, batchSize, fifo, constructs = []) {
-		super(ConstructType.Queue, logger, services, [], void 0, void 0, timeout, void 0, void 0, constructs);
-		this.name = name;
-		this.handler = handler;
-		this.messageSchema = messageSchema;
-		this.timeout = timeout;
-		this.services = services;
-		this.logger = logger;
-		this.batchSize = batchSize;
-		this.fifo = fifo;
-		this.id = canonicalId(name);
-		this.connectionKey = provideKey(this.id, "publisherConnectionString");
-	}
-	/**
-	* What this queue is in the manifest.
-	*
-	* A queue is a resource, not a handler: the worker is reached *through* it,
-	* so the declaration carries the producer's key and nothing about the code
-	* that drains it. The local target reads this to know which broker has to be
-	* running and what connection string to inject.
-	*/
-	declare() {
-		return [{
-			kind: "queue",
-			id: this.id,
-			provides: [this.connectionKey],
-			...this.fifo ? { fifo: true } : {},
-			worker: {
-				id: `${this.id}Worker`,
-				handler: `${this.id}.handler`,
-				dependencies: []
-			}
-		}];
-	}
-	/**
-	* The producer side — a `Service` exposing an `EventPublisher` typed to this
-	* queue's message. Inject it via `.services([queue.publisher])`; the handler
-	* then calls `services.<name>Publisher.publish([{ type, payload }])`.
-	*
-	* It reads `<NAME>_PUBLISHER_CONNECTION_STRING` and builds the transport from
-	* the URL protocol — `pgboss://` locally, `sqs://` deployed — so the same
-	* code publishes to Postgres in dev and SQS in prod. Because it's a `Service`,
-	* `Construct.getEnvironment()` sniffs it, so the env requirement flows into
-	* the manifest and infra links exactly this queue with least privilege.
-	*/
-	/**
-	* The queue as a dependency — what `.dependsOn([emailsQueue])` dissolves
-	* into, reachable as `services.emails`.
-	*
-	* It is the producer: a consumer is the worker written right here, so the
-	* only thing another construct can want from a queue is the ability to send
-	* to it. {@link publisher} is the same service under its older
-	* `<name>Publisher` key, kept for `.services([queue.publisher])`.
-	*/
-	get service() {
-		const { register } = this.publisher;
-		return {
-			serviceName: serviceKey(this.id),
-			register
-		};
-	}
-	get publisher() {
-		const envVar = this.connectionKey;
-		return {
-			serviceName: `${this.name}Publisher`,
-			async register({ envParser }) {
-				const { connectionString } = envParser.create((get) => ({ connectionString: get(envVar).string() })).parse();
-				return Publisher.fromConnectionString(connectionString);
-			}
-		};
-	}
-};
-
-//#endregion
-//#region src/queue/QueueBuilder.ts
-/**
-* Builds a {@link Queue} worker — `q.queue('orders').services([db]).message(schema).handle(fn)`.
-* Services are an array (sniffed for required env vars); `message` is the typed
-* job payload; `handle` is the single consumer. The queue name is captured as a
-* literal so `queue.publisher` is typed to `{ type: '<name>', payload }`.
-*/
-var QueueBuilder = class {
-	_name;
-	_messageSchema;
-	_timeout = 3e4;
-	_batchSize;
-	_fifo;
-	_services = [];
-	/** The construct ids `.dependsOn()` named — what the manifest records. */
-	_constructs = [];
-	_logger = DEFAULT_LOGGER;
-	/** The queue name — drives the infra queue and its `<NAME>_*` env vars. */
-	queue(name) {
-		return cloneWith(this, { _name: name });
-	}
-	timeout(timeout) {
-		return cloneWith(this, { _timeout: timeout });
-	}
-	/** SQS event-source batch size (deployed). */
-	batchSize(batchSize) {
-		return cloneWith(this, { _batchSize: batchSize });
-	}
-	/** Mark the queue as FIFO (deployed). */
-	fifo(fifo = true) {
-		return cloneWith(this, { _fifo: fifo });
-	}
-	/**
-	* Depend on constructs — a database, a bucket, a mail sender, a queue, a
-	* topic.
-	*
-	* It records the edge and dissolves each construct's client into the
-	* handler's service record under the construct's own id, so
-	* `.dependsOn([uploads])` is what makes `services.uploads` exist and type.
-	*
-	* Constructs only. A `Service` does not match the shape, which is what keeps
-	* env sniffing confined to `.services()` and the explicit lift.
-	*/
-	dependsOn(constructs) {
-		const services = servicesOf(constructs);
-		return cloneWith(this, {
-			_services: [...this._services, ...services],
-			_constructs: idsOf(constructs, this._constructs)
-		});
-	}
-	services(services) {
-		return cloneWith(this, { _services: [...this._services, ...services] });
-	}
-	logger(logger) {
-		return cloneWith(this, { _logger: logger });
-	}
-	/** The typed message (job) payload the queue carries. */
-	message(schema) {
-		return cloneWith(this, { _messageSchema: schema });
-	}
-	handle(fn) {
-		if (!this._name) throw new Error("Queue requires a name — call .queue(name) before .handle().");
-		if (!this._messageSchema) throw new Error("Queue requires a message schema — call .message(schema) before .handle().");
-		const queue = new Queue(this._name, fn, this._messageSchema, this._timeout, this._services, this._logger, this._batchSize, this._fifo, this._constructs);
-		return queue;
-	}
-};
-
-//#endregion
-//#region src/queue/index.ts
-const q = new QueueBuilder();
-
-//#endregion
-export { Queue, QueueBuilder, q };
-//# sourceMappingURL=index.mjs.map
+import { t as Queue } from "../Queue-cmhqEBOB.mjs";
+import { n as QueueNeedsMessage, r as QueueNeedsName } from "../QueueBuilder-DXu1qxT1.mjs";
+export { Queue, QueueNeedsMessage, QueueNeedsName };

package/dist/random-password.cjs

@@ -0,0 +1,86 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _geekmidas_manifest = require("@geekmidas/manifest");
+//#region src/random-password.ts
+/**
+* `RandomPassword` — a password the platform generates, once per stage.
+*
+* ```ts
+* export const adminPassword = new RandomPassword('AdminPassword');
+*
+* // an endpoint that `.dependsOn([adminPassword])`
+* services.adminPassword // 'k3J…' — a string, no await
+* ```
+*
+* The app's own `secret`: the kind an auth server's signing key already is,
+* with nothing else attached. Nobody issues it and nobody sets it, which is
+* the line between it and a `Credential`:
+*
+* - **A deployed stage** generates it on the first deploy that needs it and
+*   keeps it — a server stage in its secrets store, an AWS stage in its
+*   state — so every later deploy reads the same value back. One set by hand
+*   (`gkm secrets:set`, `sst secret set`) is kept, never replaced.
+* - **`gkm dev` and `gkm test`** derive it from the project, the stage and the
+*   id, so nothing has to be set and it is the same on every run.
+*
+* Its key is its name, as a secret's is: `AdminPassword` is `ADMIN_PASSWORD`.
+*
+* 43 letters, digits, `-` and `_` unless told otherwise — for a system with
+* rules of its own:
+*
+* ```ts
+* new RandomPassword('RouterPassword', { length: 24, symbols: '!@#$%' });
+* ```
+*
+* The format is read when the password is generated, so changing it later
+* leaves a deployed stage's existing password as it is.
+*/
+var RandomPassword = class {
+	format;
+	id;
+	service;
+	/**
+	* Declared once and read by both `declare()` and `connect()`, so the key the
+	* target publishes and the key the client reads cannot drift.
+	*/
+	key;
+	constructor(id, format = {}) {
+		this.format = format;
+		const canonical = (0, _geekmidas_manifest.canonicalId)(id);
+		const { length } = format;
+		if (length !== void 0 && !(Number.isInteger(length) && length > 0)) throw new InvalidPasswordLength(canonical, length);
+		this.id = canonical;
+		this.key = (0, _geekmidas_manifest.environmentCase)(canonical);
+		this.service = {
+			serviceName: (0, _geekmidas_manifest.serviceKey)(canonical),
+			register: (options) => this.connect(options)
+		};
+	}
+	declare() {
+		return [{
+			kind: "secret",
+			id: this.id,
+			provides: [this.key],
+			...this.format.length !== void 0 ? { length: this.format.length } : {},
+			...this.format.symbols !== void 0 ? { symbols: this.format.symbols } : {}
+		}];
+	}
+	connect(options) {
+		return options.envParser.create((get) => ({ password: get(this.key).string() })).parse().password;
+	}
+};
+/** A `RandomPassword` given a length no password can have. */
+var InvalidPasswordLength = class extends Error {
+	id;
+	length;
+	constructor(id, length) {
+		super(`${id} asks for a password ${length} characters long. Give it a whole number of characters, at least 1 — or leave length out for 43.`);
+		this.id = id;
+		this.length = length;
+		this.name = "InvalidPasswordLength";
+	}
+};
+//#endregion
+exports.InvalidPasswordLength = InvalidPasswordLength;
+exports.RandomPassword = RandomPassword;
+
+//# sourceMappingURL=random-password.cjs.map

package/dist/random-password.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"random-password.cjs","names":["canonicalId","environmentCase","serviceKey"],"sources":["../src/random-password.ts"],"sourcesContent":["/**\n * `RandomPassword` — a password the platform generates, once per stage.\n *\n * ```ts\n * export const adminPassword = new RandomPassword('AdminPassword');\n *\n * // an endpoint that `.dependsOn([adminPassword])`\n * services.adminPassword // 'k3J…' — a string, no await\n * ```\n *\n * The app's own `secret`: the kind an auth server's signing key already is,\n * with nothing else attached. Nobody issues it and nobody sets it, which is\n * the line between it and a `Credential`:\n *\n * - **A deployed stage** generates it on the first deploy that needs it and\n *   keeps it — a server stage in its secrets store, an AWS stage in its\n *   state — so every later deploy reads the same value back. One set by hand\n *   (`gkm secrets:set`, `sst secret set`) is kept, never replaced.\n * - **`gkm dev` and `gkm test`** derive it from the project, the stage and the\n *   id, so nothing has to be set and it is the same on every run.\n *\n * Its key is its name, as a secret's is: `AdminPassword` is `ADMIN_PASSWORD`.\n *\n * 43 letters, digits, `-` and `_` unless told otherwise — for a system with\n * rules of its own:\n *\n * ```ts\n * new RandomPassword('RouterPassword', { length: 24, symbols: '!@#$%' });\n * ```\n *\n * The format is read when the password is generated, so changing it later\n * leaves a deployed stage's existing password as it is.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tenvironmentCase,\n\ttype SecretFormat,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport type { Construct } from './construct-interface';\n\nexport class RandomPassword<TName extends string = string>\n\timplements Construct<TName, string>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, string>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * target publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly key: string;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly format: RandomPasswordOptions = {},\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\t\tconst { length } = format;\n\n\t\tif (length !== undefined && !(Number.isInteger(length) && length > 0)) {\n\t\t\tthrow new InvalidPasswordLength(canonical, length);\n\t\t}\n\n\t\tthis.id = canonical as TName;\n\t\tthis.key = environmentCase(canonical);\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'secret',\n\t\t\t\tid: this.id,\n\t\t\t\tprovides: [this.key],\n\t\t\t\t...(this.format.length !== undefined\n\t\t\t\t\t? { length: this.format.length }\n\t\t\t\t\t: {}),\n\t\t\t\t...(this.format.symbols !== undefined\n\t\t\t\t\t? { symbols: this.format.symbols }\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t];\n\t}\n\n\tprivate connect(options: ServiceRegisterOptions): string {\n\t\treturn options.envParser\n\t\t\t.create((get) => ({ password: get(this.key).string() }))\n\t\t\t.parse().password;\n\t}\n}\n\n/**\n * What a password is drawn as. Letters and digits always; `symbols` beside\n * them, one of which is always present.\n */\nexport type RandomPasswordOptions = SecretFormat;\n\n/** A `RandomPassword` given a length no password can have. */\nexport class InvalidPasswordLength extends Error {\n\tconstructor(\n\t\treadonly id: string,\n\t\treadonly length: number,\n\t) {\n\t\tsuper(\n\t\t\t`${id} asks for a password ${length} characters long. ` +\n\t\t\t\t'Give it a whole number of characters, at least 1 — or leave length out for 43.',\n\t\t);\n\t\tthis.name = 'InvalidPasswordLength';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,IAAa,iBAAb,MAEA;CAYmB;CAXlB;CACA;;;;;CAMA;CAEA,YACC,IACA,SAAiD,CAAC,GACjD;EADgB,KAAA,SAAA;EAEjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAC1C,MAAM,EAAE,WAAW;EAEnB,IAAI,WAAW,KAAA,KAAa,EAAE,OAAO,UAAU,MAAM,KAAK,SAAS,IAClE,MAAM,IAAI,sBAAsB,WAAW,MAAM;EAGlD,KAAK,KAAK;EACV,KAAK,OAAA,GAAMC,oBAAAA,gBAAAA,CAAgB,SAAS;EAGpC,KAAK,UAAU;GACd,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,SAAS;GACjC,WAAW,YAAY,KAAK,QAAQ,OAAO;EAC5C;CACD;CAEA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,UAAU,CAAC,KAAK,GAAG;GACnB,GAAI,KAAK,OAAO,WAAW,KAAA,IACxB,EAAE,QAAQ,KAAK,OAAO,OAAO,IAC7B,CAAC;GACJ,GAAI,KAAK,OAAO,YAAY,KAAA,IACzB,EAAE,SAAS,KAAK,OAAO,QAAQ,IAC/B,CAAC;EACL,CACD;CACD;CAEA,QAAgB,SAAyC;EACxD,OAAO,QAAQ,UACb,QAAQ,SAAS,EAAE,UAAU,IAAI,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACvD,MAAM,CAAC,CAAC;CACX;AACD;;AASA,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,IACA,QACC;EACD,MACC,GAAG,GAAG,uBAAuB,OAAO,iGAErC;EANS,KAAA,KAAA;EACA,KAAA,SAAA;EAMT,KAAK,OAAO;CACb;AACD"}

package/dist/random-password.d.cts

@@ -0,0 +1,30 @@
+import { n as Construct } from "./construct-interface-B1AfqRl4.cjs";
+import { Service } from "@geekmidas/services";
+import { ConstructName, Declaration, SecretFormat } from "@geekmidas/manifest";
+//#region src/random-password.d.ts
+export declare class RandomPassword<TName extends string = string> implements Construct<TName, string> {
+  private readonly format;
+  readonly id: TName;
+  readonly service: Service<Uncapitalize<TName>, string>;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the key the
+   * target publishes and the key the client reads cannot drift.
+   */
+  private readonly key;
+  constructor(id: ConstructName<TName>, format?: RandomPasswordOptions);
+  declare(): Declaration[];
+  private connect;
+}
+/**
+ * What a password is drawn as. Letters and digits always; `symbols` beside
+ * them, one of which is always present.
+ */
+export type RandomPasswordOptions = SecretFormat;
+/** A `RandomPassword` given a length no password can have. */
+export declare class InvalidPasswordLength extends Error {
+  readonly id: string;
+  readonly length: number;
+  constructor(id: string, length: number);
+}
+//#endregion
+//# sourceMappingURL=random-password.d.cts.map

package/dist/random-password.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"random-password.d.cts","names":[],"sources":["../src/random-password.ts"],"mappings":";;;;qBA6Ca,eAAe,0CAChB,UAAU;mBAaH;WAXT,IAAI;WACJ,SAAS,QAAQ,aAAa;;;;;mBAMtB;EAEjB,YACC,IAAI,cAAc,QACD,SAAQ;EAmB1B,WAAW;UAgBH;;;;;;YAWG,wBAAwB;;qBAGvB,8BAA8B;WAEhC;WACA;EAFV,YACU,YACA"}