@geekmidas/constructs 10.0.0-alpha.12 → 10.0.0-alpha.13

package/dist/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.mjs","names":["id: ConstructName<TName>","config: BetterAuthConfig<TDatabase>","options: ServiceRegisterOptions","value: string","as: { owner?: boolean }","configured: BetterAuthOptions"],"sources":["../src/auth.ts"],"sourcesContent":["/**\n * `BetterAuth` — a declared auth server.\n *\n * It is three things at once, which is what makes it the construct that\n * exercises most of the model: a consumer of a database, a producer of an\n * authorizer, and a set of endpoints. This lands the first two.\n *\n * Its tables live in a schema tenant it is *given* — `orders.schema('AuthDb')`\n * — rather than one it invents. The tenant declares the schema and the role;\n * this declares the one thing left, the signing secret, and reads back the keys\n * it needs.\n *\n * :::caution\n * The isolation that arrangement is *for* — the application's own role holding\n * no grant on these tables, so a compromised handler cannot read sessions — does\n * **not hold yet**. No target creates the per-schema role: both connect as the\n * database owner, so today the tenant is a `search_path`, which is a namespace\n * and not a privilege boundary. See \"Roles are declared and never created\" in\n * `docs/design/constructs-outstanding.md`.\n * :::\n *\n * It declares its own surface, so where it answers, who may call it, and the\n * domain its cookies are scoped to all arrive as environment resolved by the\n * target — none of them guessed from a port, and none of them listed by hand in\n * application config.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tenvironmentCase,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport { betterAuth } from 'better-auth';\nimport type { Hono } from 'hono';\nimport type { Kysely } from 'kysely';\nimport { type Construct, type Consumable, edgeTo } from './construct-interface';\n\n/** The server better-auth hands back. */\nexport type AuthServer = ReturnType<typeof betterAuth>;\n\n/** Everything better-auth takes, minus what the construct owns. */\nexport type BetterAuthOptions = Omit<\n\tParameters<typeof betterAuth>[0],\n\t'database' | 'secret' | 'basePath' | 'baseURL'\n>;\n\nexport interface BetterAuthConfig<TDatabase extends Consumable> {\n\t/**\n\t * The schema tenant its tables live in.\n\t *\n\t * A construct rather than a URL: the tenant already declares its schema and\n\t * its role, and taking the declaration is what puts the edge in the graph\n\t * instead of a connection string in two places.\n\t */\n\tdatabase: TDatabase;\n\t/**\n\t * The app that serves this auth server, relative to the workspace root —\n\t * `'apps/auth'`.\n\t *\n\t * Required, for the reason `RestApi.path` is. Not to be confused with\n\t * `basePath`, which is where its routes are mounted in a URL.\n\t */\n\tpath: string;\n\t/**\n\t * Where the auth routes are mounted, e.g. `/api/auth`.\n\t *\n\t * Structural — it is part of the URL every client calls, so it cannot differ\n\t * between stages the way the host can.\n\t */\n\tbasePath?: string;\n\t/**\n\t * The rest of better-auth's options: providers, plugins, email settings.\n\t *\n\t * A function when they need another construct — a magic-link plugin has to\n\t * *send* the link, and the thing that sends mail is a construct whose client\n\t * has to be registered. It is handed the same `ServiceRegisterOptions` this\n\t * construct was, so the env parser flows through the graph rather than being\n\t * imported out of application config.\n\t */\n\toptions?:\n\t\t| BetterAuthOptions\n\t\t| ((\n\t\t\t\toptions: ServiceRegisterOptions,\n\t\t  ) => BetterAuthOptions | Promise<BetterAuthOptions>);\n}\n\nconst DEFAULT_BASE_PATH = '/api/auth';\n\nexport class BetterAuth<\n\tTName extends string = string,\n\tTDatabase extends Consumable = Consumable,\n> implements Construct<TName, AuthServer>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, AuthServer>;\n\treadonly basePath: string;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the keys the\n\t * target publishes and the keys the server reads cannot drift.\n\t */\n\tprivate readonly keys: {\n\t\tsecretId: string;\n\t\tsecret: string;\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: BetterAuthConfig<TDatabase>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.basePath = config.basePath ?? DEFAULT_BASE_PATH;\n\n\t\t// A secret's name is its key: `Auth` signs with `AUTH_SECRET`, which is\n\t\t// also what better-auth's own tooling looks for.\n\t\tconst secretId = `${canonical}Secret`;\n\t\tthis.keys = {\n\t\t\tsecretId,\n\t\t\tsecret: environmentCase(secretId),\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\t/**\n\t * A signing secret and a surface.\n\t *\n\t * The database is *not* declared here — the tenant that was passed in\n\t * declares it, and declaring it twice is the duplication the whole model\n\t * removes. What is declared is what this construct owns: the key it signs\n\t * with, and the routes it answers on.\n\t *\n\t * One endpoint, wildcarded. Better Auth routes internally and the set of\n\t * paths depends on which capabilities are enabled, so enumerating them here\n\t * would be a copy of its router that goes stale on its next release. The\n\t * surface's job is to send everything under `basePath` to one handler, which\n\t * is exactly what the declaration says.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'secret',\n\t\t\t\tid: this.keys.secretId,\n\t\t\t\tprovides: [this.keys.secret],\n\t\t\t},\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\tpath: this.config.path,\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t\tendpoints: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: `${this.id}Handler`,\n\t\t\t\t\t\thandler: `${this.id}.handler`,\n\t\t\t\t\t\tmethod: 'ANY',\n\t\t\t\t\t\tpath: `${this.basePath}/*`,\n\t\t\t\t\t\t// Read off the tenant rather than written down: this\n\t\t\t\t\t\t// construct takes whatever database it is given, and a\n\t\t\t\t\t\t// hardcoded kind is a second statement of a fact the\n\t\t\t\t\t\t// tenant already makes.\n\t\t\t\t\t\tdependencies: [edgeTo(this.config.database)],\n\t\t\t\t\t\trequires: [this.keys.secret],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Better Auth's own migrations, for the app's migrate step.\n\t *\n\t * It brings its own schema — users, sessions, accounts, verifications — so\n\t * the app never writes those tables and never gets to drift from them.\n\t */\n\tasync migrations(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<() => Promise<void>> {\n\t\t// As the owner, not the runtime role. Creating tables is DDL, and the\n\t\t// whole point of the split is that a handler's role cannot do it — so a\n\t\t// migrator that connected the way a handler does would fail on the first\n\t\t// `CREATE TABLE` rather than working by accident.\n\t\tconst auth = await this.connect(options, { owner: true });\n\t\t// better-auth 1.7 split the migration builder out of `better-auth/db`\n\t\t// into its own entry, so importing it no longer drags the whole db layer\n\t\t// in behind it.\n\t\tconst { getMigrations } = await import('better-auth/db/migration');\n\t\tconst { runMigrations } = await getMigrations(auth.options);\n\n\t\treturn runMigrations;\n\t}\n\n\t/**\n\t * The server this surface runs as, built from its own declaration.\n\t *\n\t * A surface is a deploy unit, so something has to serve it, and the thing\n\t * that knows how is the construct — not a generator writing a mount into\n\t * somebody else's entry point. That is how the auth server came to be\n\t * mounted by a hook in the application it was supposed to be separate from,\n\t * and then to be served by nothing at all when the hook was deleted.\n\t *\n\t * The routes come from {@link declare}: one wildcard under `basePath`, read\n\t * off the same declaration the manifest carries, so the surface the graph\n\t * describes and the surface that answers requests cannot disagree.\n\t *\n\t * ```ts\n\t * // .gkm/server/app.ts — the whole generated entry\n\t * import { auth } from '@acme/constructs/auth.js';\n\t * export const { app } = await auth.server({ envParser });\n\t * ```\n\t */\n\tasync server(options: ServiceRegisterOptions): Promise<{ app: Hono }> {\n\t\tconst { Hono } = await import('hono');\n\t\tconst { cors } = await import('hono/cors');\n\t\tconst app = new Hono();\n\t\tconst server = await this.connect(options);\n\n\t\t// Who may call this surface, read off the graph. The same list Better\n\t\t// Auth checks for CSRF — it arrives as `<ID>_TRUSTED_ORIGINS`, composed\n\t\t// by the target from whatever declared an edge to this construct, so a\n\t\t// site that depends on the auth server is allowed to reach it and\n\t\t// nothing else is. Nobody writes an origin down.\n\t\tconst { origins } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\torigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value: string) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\tapp.use('*', cors({ origin: origins, credentials: true, maxAge: 3600 }));\n\n\t\t// Read off the declaration rather than restated here. `ANY` is every\n\t\t// method Better Auth routes internally, which is the reason the\n\t\t// declaration wildcards rather than enumerating.\n\t\tconst [surface] = this.declare().filter(\n\t\t\t(d): d is Extract<Declaration, { kind: 'rest-api' }> =>\n\t\t\t\td.kind === 'rest-api',\n\t\t);\n\n\t\tfor (const endpoint of surface?.endpoints ?? []) {\n\t\t\tconst methods =\n\t\t\t\tendpoint.method === 'ANY'\n\t\t\t\t\t? (['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'] as const)\n\t\t\t\t\t: ([endpoint.method] as const);\n\n\t\t\tapp.on([...methods], endpoint.path, (c) => server.handler(c.req.raw));\n\t\t}\n\n\t\treturn { app };\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<AuthServer> {\n\t\tconst { secret, baseUrl, trustedOrigins, cookieDomain } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\tsecret: get(this.keys.secret).string(),\n\t\t\t\t// The surface's own URL, resolved by the target — not guessed from\n\t\t\t\t// a port, which was wrong the moment the server moved to 3001.\n\t\t\t\tbaseUrl: get(this.keys.url).string(),\n\t\t\t\t// Better Auth's CSRF check applies to every caller, not just\n\t\t\t\t// browsers, so an API calling the auth server is rejected unless\n\t\t\t\t// its origin is trusted. The list is derived from the graph and\n\t\t\t\t// arrives as one comma-separated value, for the same reason every\n\t\t\t\t// other derived value arrives as a string: it crosses a process\n\t\t\t\t// boundary as env.\n\t\t\t\ttrustedOrigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t\t// The domain a session cookie has to carry to be readable by a\n\t\t\t\t// frontend on a sibling host. Optional because there is often\n\t\t\t\t// nothing to widen to: locally everything shares `localhost`,\n\t\t\t\t// where cookies ignore the port and a `Domain` would only be a\n\t\t\t\t// value the browser refuses.\n\t\t\t\tcookieDomain: get(this.keys.cookieDomain).string().optional(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\t// The tenant's own client: one construct, one connection, so what auth\n\t\t// writes and what the browser inspects cannot be two different databases.\n\t\t// A migration asks the tenant for its owner connection, which the tenant\n\t\t// exposes as a `Service` and not as anything `.dependsOn()` would take.\n\t\tconst tenant = this.config.database as Consumable & {\n\t\t\towner?: Service<string, unknown>;\n\t\t};\n\t\tconst source = as.owner && tenant.owner ? tenant.owner : tenant.service;\n\n\t\tconst db = (await source.register(options)) as Kysely<\n\t\t\tRecord<string, never>\n\t\t>;\n\n\t\t// Hoisted: narrowing a property of `this` is not preserved across the\n\t\t// await, and the false branch is the plain-object form.\n\t\tconst configure = this.config.options;\n\t\tconst configured: BetterAuthOptions =\n\t\t\ttypeof configure === 'function'\n\t\t\t\t? await configure(options)\n\t\t\t\t: (configure ?? {});\n\n\t\t// `Auth<O>` is invariant in its options in better-auth 1.7, so the value\n\t\t// built from a concrete literal is not assignable to the `AuthServer`\n\t\t// alias, which names the constraint. The runtime object is the same one\n\t\t// either way; the assertion keeps the variance where it happens instead\n\t\t// of spreading a generic through the construct's public type.\n\t\treturn betterAuth({\n\t\t\t...configured,\n\t\t\tsecret,\n\t\t\tbaseURL: baseUrl,\n\t\t\tbasePath: this.basePath,\n\t\t\tdatabase: { db, type: 'postgres' },\n\t\t\t// Whatever the app added wins over the derived list rather than\n\t\t\t// replacing it: an origin nobody declared is still sometimes real.\n\t\t\ttrustedOrigins: [\n\t\t\t\t...trustedOrigins,\n\t\t\t\t...(configured.trustedOrigins &&\n\t\t\t\tArray.isArray(configured.trustedOrigins)\n\t\t\t\t\t? configured.trustedOrigins\n\t\t\t\t\t: []),\n\t\t\t],\n\t\t\tadvanced: {\n\t\t\t\t...configured.advanced,\n\t\t\t\t// Only when a domain was derived. Better Auth reads the presence\n\t\t\t\t// of this block as intent, so enabling it with no domain would\n\t\t\t\t// widen the cookie to whatever host happened to set it — and the\n\t\t\t\t// case with nothing to widen to is the common one, not an error.\n\t\t\t\t...(cookieDomain\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tcrossSubDomainCookies: {\n\t\t\t\t\t\t\t\tenabled: true,\n\t\t\t\t\t\t\t\tdomain: cookieDomain,\n\t\t\t\t\t\t\t\t...configured.advanced?.crossSubDomainCookies,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t}) as AuthServer;\n\t}\n}\n"],"mappings":";;;;;AA0FA,MAAM,oBAAoB;AAE1B,IAAa,aAAb,MAIA;CACC,AAAS;CACT,AAAS;CACT,AAAS;;;;;CAMT,AAAiB;CAQjB,YACCA,IACiBC,QAChB;EADgB;EAEjB,MAAM,YAAY,YAAY,GAAa;AAE3C,OAAK,KAAK;AACV,OAAK,WAAW,OAAO,YAAY;EAInC,MAAM,YAAY,EAAE,UAAU;AAC9B,OAAK,OAAO;GACX;GACA,QAAQ,gBAAgB,SAAS;GACjC,KAAK,WAAW,WAAW,MAAM;GACjC,gBAAgB,WAAW,WAAW,iBAAiB;GACvD,cAAc,WAAW,WAAW,eAAe;EACnD;AAGD,OAAK,UAAU;GACd,aAAa,WAAW,UAAU;GAClC,UAAU,CAAC,YAAY,KAAK,QAAQ,QAAQ;EAC5C;CACD;;;;;;;;;;;;;;;CAgBD,UAAyB;AACxB,SAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK,KAAK;GACd,UAAU,CAAC,KAAK,KAAK,MAAO;EAC5B,GACD;GACC,MAAM;GACN,IAAI,KAAK;GACT,MAAM,KAAK,OAAO;GAClB,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACV;GACD,WAAW,CACV;IACC,KAAK,EAAE,KAAK,GAAG;IACf,UAAU,EAAE,KAAK,GAAG;IACpB,QAAQ;IACR,OAAO,EAAE,KAAK,SAAS;IAKvB,cAAc,CAAC,OAAO,KAAK,OAAO,SAAS,AAAC;IAC5C,UAAU,CAAC,KAAK,KAAK,MAAO;GAC5B,CACD;EACD,CACD;CACD;;;;;;;CAQD,MAAM,WACLC,SAC+B;EAK/B,MAAM,OAAO,MAAM,KAAK,QAAQ,SAAS,EAAE,OAAO,KAAM,EAAC;EAIzD,MAAM,EAAE,eAAe,GAAG,MAAM,OAAO;EACvC,MAAM,EAAE,eAAe,GAAG,MAAM,cAAc,KAAK,QAAQ;AAE3D,SAAO;CACP;;;;;;;;;;;;;;;;;;;;CAqBD,MAAM,OAAOA,SAAyD;EACrE,MAAM,EAAE,MAAM,GAAG,MAAM,OAAO;EAC9B,MAAM,EAAE,MAAM,GAAG,MAAM,OAAO;EAC9B,MAAM,MAAM,IAAI;EAChB,MAAM,SAAS,MAAM,KAAK,QAAQ,QAAQ;EAO1C,MAAM,EAAE,SAAS,GAAG,QAAQ,UAC1B,OAAO,CAAC,SAAS,EACjB,SAAS,IAAI,KAAK,KAAK,eAAe,CACpC,QAAQ,CACR,QAAQ,GAAG,CACX,UAAU,CAACC,UACX,MACE,MAAM,IAAI,CACV,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAC9B,OAAO,QAAQ,CACjB,CACF,GAAE,CACF,OAAO;AAET,MAAI,IAAI,KAAK,KAAK;GAAE,QAAQ;GAAS,aAAa;GAAM,QAAQ;EAAM,EAAC,CAAC;EAKxE,MAAM,CAAC,QAAQ,GAAG,KAAK,SAAS,CAAC,OAChC,CAAC,MACA,EAAE,SAAS,WACZ;AAED,OAAK,MAAM,YAAY,SAAS,aAAa,CAAE,GAAE;GAChD,MAAM,UACL,SAAS,WAAW,QAChB;IAAC;IAAO;IAAQ;IAAO;IAAS;IAAU;GAAU,IACpD,CAAC,SAAS,MAAO;AAEtB,OAAI,GAAG,CAAC,GAAG,OAAQ,GAAE,SAAS,MAAM,CAAC,MAAM,OAAO,QAAQ,EAAE,IAAI,IAAI,CAAC;EACrE;AAED,SAAO,EAAE,IAAK;CACd;CAED,MAAc,QACbD,SACAE,KAA0B,CAAE,GACN;EACtB,MAAM,EAAE,QAAQ,SAAS,gBAAgB,cAAc,GAAG,QAAQ,UAChE,OAAO,CAAC,SAAS;GACjB,QAAQ,IAAI,KAAK,KAAK,OAAO,CAAC,QAAQ;GAGtC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ;GAOpC,gBAAgB,IAAI,KAAK,KAAK,eAAe,CAC3C,QAAQ,CACR,QAAQ,GAAG,CACX,UAAU,CAAC,UACX,MACE,MAAM,IAAI,CACV,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAC9B,OAAO,QAAQ,CACjB;GAMF,cAAc,IAAI,KAAK,KAAK,aAAa,CAAC,QAAQ,CAAC,UAAU;EAC7D,GAAE,CACF,OAAO;EAMT,MAAM,SAAS,KAAK,OAAO;EAG3B,MAAM,SAAS,GAAG,SAAS,OAAO,QAAQ,OAAO,QAAQ,OAAO;EAEhE,MAAM,KAAM,MAAM,OAAO,SAAS,QAAQ;EAM1C,MAAM,YAAY,KAAK,OAAO;EAC9B,MAAMC,oBACE,cAAc,aAClB,MAAM,UAAU,QAAQ,GACvB,aAAa,CAAE;AAOpB,SAAO,WAAW;GACjB,GAAG;GACH;GACA,SAAS;GACT,UAAU,KAAK;GACf,UAAU;IAAE;IAAI,MAAM;GAAY;GAGlC,gBAAgB,CACf,GAAG,gBACH,GAAI,WAAW,kBACf,MAAM,QAAQ,WAAW,eAAe,GACrC,WAAW,iBACX,CAAE,CACL;GACD,UAAU;IACT,GAAG,WAAW;IAKd,GAAI,eACD,EACA,uBAAuB;KACtB,SAAS;KACT,QAAQ;KACR,GAAG,WAAW,UAAU;IACxB,EACD,IACA,CAAE;GACL;EACD,EAAC;CACF;AACD"}
+{"version":3,"file":"auth.mjs","names":[],"sources":["../src/auth.ts"],"sourcesContent":["/**\n * `BetterAuth` — a declared auth server.\n *\n * It is three things at once, which is what makes it the construct that\n * exercises most of the model: a consumer of a database, a producer of an\n * authorizer, and a set of endpoints. This lands the first two.\n *\n * Its tables live in a schema tenant it is *given* — `orders.schema('AuthDb')`\n * — rather than one it invents. The tenant declares the schema and the role;\n * this declares the one thing left, the signing secret, and reads back the keys\n * it needs.\n *\n * :::caution\n * The isolation that arrangement is *for* — the application's own role holding\n * no grant on these tables, so a compromised handler cannot read sessions — does\n * **not hold yet**. No target creates the per-schema role: both connect as the\n * database owner, so today the tenant is a `search_path`, which is a namespace\n * and not a privilege boundary. See \"Roles are declared and never created\" in\n * `docs/design/constructs-outstanding.md`.\n * :::\n *\n * It declares its own surface, so where it answers, who may call it, and the\n * domain its cookies are scoped to all arrive as environment resolved by the\n * target — none of them guessed from a port, and none of them listed by hand in\n * application config.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tenvironmentCase,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport { betterAuth } from 'better-auth';\nimport type { Hono } from 'hono';\nimport type { Kysely } from 'kysely';\nimport { type Construct, type Consumable, edgeTo } from './construct-interface';\n\n/** The server better-auth hands back. */\nexport type AuthServer = ReturnType<typeof betterAuth>;\n\n/** Everything better-auth takes, minus what the construct owns. */\nexport type BetterAuthOptions = Omit<\n\tParameters<typeof betterAuth>[0],\n\t'database' | 'secret' | 'basePath' | 'baseURL'\n>;\n\nexport interface BetterAuthConfig<TDatabase extends Consumable> {\n\t/**\n\t * The schema tenant its tables live in.\n\t *\n\t * A construct rather than a URL: the tenant already declares its schema and\n\t * its role, and taking the declaration is what puts the edge in the graph\n\t * instead of a connection string in two places.\n\t */\n\tdatabase: TDatabase;\n\t/**\n\t * The app that serves this auth server, relative to the workspace root —\n\t * `'apps/auth'`.\n\t *\n\t * Required, for the reason `RestApi.path` is. Not to be confused with\n\t * `basePath`, which is where its routes are mounted in a URL.\n\t */\n\tpath: string;\n\t/**\n\t * Where the auth routes are mounted, e.g. `/api/auth`.\n\t *\n\t * Structural — it is part of the URL every client calls, so it cannot differ\n\t * between stages the way the host can.\n\t */\n\tbasePath?: string;\n\t/**\n\t * The rest of better-auth's options: providers, plugins, email settings.\n\t *\n\t * A function when they need another construct — a magic-link plugin has to\n\t * *send* the link, and the thing that sends mail is a construct whose client\n\t * has to be registered. It is handed the same `ServiceRegisterOptions` this\n\t * construct was, so the env parser flows through the graph rather than being\n\t * imported out of application config.\n\t */\n\toptions?:\n\t\t| BetterAuthOptions\n\t\t| ((\n\t\t\t\toptions: ServiceRegisterOptions,\n\t\t  ) => BetterAuthOptions | Promise<BetterAuthOptions>);\n}\n\nconst DEFAULT_BASE_PATH = '/api/auth';\n\nexport class BetterAuth<\n\tTName extends string = string,\n\tTDatabase extends Consumable = Consumable,\n> implements Construct<TName, AuthServer>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, AuthServer>;\n\treadonly basePath: string;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the keys the\n\t * target publishes and the keys the server reads cannot drift.\n\t */\n\tprivate readonly keys: {\n\t\tsecretId: string;\n\t\tsecret: string;\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: BetterAuthConfig<TDatabase>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.basePath = config.basePath ?? DEFAULT_BASE_PATH;\n\n\t\t// A secret's name is its key: `Auth` signs with `AUTH_SECRET`, which is\n\t\t// also what better-auth's own tooling looks for.\n\t\tconst secretId = `${canonical}Secret`;\n\t\tthis.keys = {\n\t\t\tsecretId,\n\t\t\tsecret: environmentCase(secretId),\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\t/**\n\t * A signing secret and a surface.\n\t *\n\t * The database is *not* declared here — the tenant that was passed in\n\t * declares it, and declaring it twice is the duplication the whole model\n\t * removes. What is declared is what this construct owns: the key it signs\n\t * with, and the routes it answers on.\n\t *\n\t * One endpoint, wildcarded. Better Auth routes internally and the set of\n\t * paths depends on which capabilities are enabled, so enumerating them here\n\t * would be a copy of its router that goes stale on its next release. The\n\t * surface's job is to send everything under `basePath` to one handler, which\n\t * is exactly what the declaration says.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'secret',\n\t\t\t\tid: this.keys.secretId,\n\t\t\t\tprovides: [this.keys.secret],\n\t\t\t},\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\tpath: this.config.path,\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t\tendpoints: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: `${this.id}Handler`,\n\t\t\t\t\t\thandler: `${this.id}.handler`,\n\t\t\t\t\t\tmethod: 'ANY',\n\t\t\t\t\t\tpath: `${this.basePath}/*`,\n\t\t\t\t\t\t// Read off the tenant rather than written down: this\n\t\t\t\t\t\t// construct takes whatever database it is given, and a\n\t\t\t\t\t\t// hardcoded kind is a second statement of a fact the\n\t\t\t\t\t\t// tenant already makes.\n\t\t\t\t\t\tdependencies: [edgeTo(this.config.database)],\n\t\t\t\t\t\trequires: [this.keys.secret],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Better Auth's own migrations, for the app's migrate step.\n\t *\n\t * It brings its own schema — users, sessions, accounts, verifications — so\n\t * the app never writes those tables and never gets to drift from them.\n\t */\n\tasync migrations(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<() => Promise<void>> {\n\t\t// As the owner, not the runtime role. Creating tables is DDL, and the\n\t\t// whole point of the split is that a handler's role cannot do it — so a\n\t\t// migrator that connected the way a handler does would fail on the first\n\t\t// `CREATE TABLE` rather than working by accident.\n\t\tconst auth = await this.connect(options, { owner: true });\n\t\t// better-auth 1.7 split the migration builder out of `better-auth/db`\n\t\t// into its own entry, so importing it no longer drags the whole db layer\n\t\t// in behind it.\n\t\tconst { getMigrations } = await import('better-auth/db/migration');\n\t\tconst { runMigrations } = await getMigrations(auth.options);\n\n\t\treturn runMigrations;\n\t}\n\n\t/**\n\t * The server this surface runs as, built from its own declaration.\n\t *\n\t * A surface is a deploy unit, so something has to serve it, and the thing\n\t * that knows how is the construct — not a generator writing a mount into\n\t * somebody else's entry point. That is how the auth server came to be\n\t * mounted by a hook in the application it was supposed to be separate from,\n\t * and then to be served by nothing at all when the hook was deleted.\n\t *\n\t * The routes come from {@link declare}: one wildcard under `basePath`, read\n\t * off the same declaration the manifest carries, so the surface the graph\n\t * describes and the surface that answers requests cannot disagree.\n\t *\n\t * ```ts\n\t * // .gkm/server/app.ts — the whole generated entry\n\t * import { auth } from '@acme/constructs/auth.js';\n\t * export const { app } = await auth.server({ envParser });\n\t * ```\n\t */\n\tasync server(options: ServiceRegisterOptions): Promise<{ app: Hono }> {\n\t\tconst { Hono } = await import('hono');\n\t\tconst { cors } = await import('hono/cors');\n\t\tconst app = new Hono();\n\t\tconst server = await this.connect(options);\n\n\t\t// Who may call this surface, read off the graph. The same list Better\n\t\t// Auth checks for CSRF — it arrives as `<ID>_TRUSTED_ORIGINS`, composed\n\t\t// by the target from whatever declared an edge to this construct, so a\n\t\t// site that depends on the auth server is allowed to reach it and\n\t\t// nothing else is. Nobody writes an origin down.\n\t\tconst { origins } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\torigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value: string) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\tapp.use('*', cors({ origin: origins, credentials: true, maxAge: 3600 }));\n\n\t\t// Read off the declaration rather than restated here. `ANY` is every\n\t\t// method Better Auth routes internally, which is the reason the\n\t\t// declaration wildcards rather than enumerating.\n\t\tconst [surface] = this.declare().filter(\n\t\t\t(d): d is Extract<Declaration, { kind: 'rest-api' }> =>\n\t\t\t\td.kind === 'rest-api',\n\t\t);\n\n\t\tfor (const endpoint of surface?.endpoints ?? []) {\n\t\t\tconst methods =\n\t\t\t\tendpoint.method === 'ANY'\n\t\t\t\t\t? (['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'] as const)\n\t\t\t\t\t: ([endpoint.method] as const);\n\n\t\t\tapp.on([...methods], endpoint.path, (c) => server.handler(c.req.raw));\n\t\t}\n\n\t\treturn { app };\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<AuthServer> {\n\t\tconst { secret, baseUrl, trustedOrigins, cookieDomain } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\tsecret: get(this.keys.secret).string(),\n\t\t\t\t// The surface's own URL, resolved by the target — not guessed from\n\t\t\t\t// a port, which was wrong the moment the server moved to 3001.\n\t\t\t\tbaseUrl: get(this.keys.url).string(),\n\t\t\t\t// Better Auth's CSRF check applies to every caller, not just\n\t\t\t\t// browsers, so an API calling the auth server is rejected unless\n\t\t\t\t// its origin is trusted. The list is derived from the graph and\n\t\t\t\t// arrives as one comma-separated value, for the same reason every\n\t\t\t\t// other derived value arrives as a string: it crosses a process\n\t\t\t\t// boundary as env.\n\t\t\t\ttrustedOrigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t\t// The domain a session cookie has to carry to be readable by a\n\t\t\t\t// frontend on a sibling host. Optional because there is often\n\t\t\t\t// nothing to widen to: locally everything shares `localhost`,\n\t\t\t\t// where cookies ignore the port and a `Domain` would only be a\n\t\t\t\t// value the browser refuses.\n\t\t\t\tcookieDomain: get(this.keys.cookieDomain).string().optional(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\t// The tenant's own client: one construct, one connection, so what auth\n\t\t// writes and what the browser inspects cannot be two different databases.\n\t\t// A migration asks the tenant for its owner connection, which the tenant\n\t\t// exposes as a `Service` and not as anything `.dependsOn()` would take.\n\t\tconst tenant = this.config.database as Consumable & {\n\t\t\towner?: Service<string, unknown>;\n\t\t};\n\t\tconst source = as.owner && tenant.owner ? tenant.owner : tenant.service;\n\n\t\tconst db = (await source.register(options)) as Kysely<\n\t\t\tRecord<string, never>\n\t\t>;\n\n\t\t// Hoisted: narrowing a property of `this` is not preserved across the\n\t\t// await, and the false branch is the plain-object form.\n\t\tconst configure = this.config.options;\n\t\tconst configured: BetterAuthOptions =\n\t\t\ttypeof configure === 'function'\n\t\t\t\t? await configure(options)\n\t\t\t\t: (configure ?? {});\n\n\t\t// `Auth<O>` is invariant in its options in better-auth 1.7, so the value\n\t\t// built from a concrete literal is not assignable to the `AuthServer`\n\t\t// alias, which names the constraint. The runtime object is the same one\n\t\t// either way; the assertion keeps the variance where it happens instead\n\t\t// of spreading a generic through the construct's public type.\n\t\treturn betterAuth({\n\t\t\t...configured,\n\t\t\tsecret,\n\t\t\tbaseURL: baseUrl,\n\t\t\tbasePath: this.basePath,\n\t\t\tdatabase: { db, type: 'postgres' },\n\t\t\t// Whatever the app added wins over the derived list rather than\n\t\t\t// replacing it: an origin nobody declared is still sometimes real.\n\t\t\ttrustedOrigins: [\n\t\t\t\t...trustedOrigins,\n\t\t\t\t...(configured.trustedOrigins &&\n\t\t\t\tArray.isArray(configured.trustedOrigins)\n\t\t\t\t\t? configured.trustedOrigins\n\t\t\t\t\t: []),\n\t\t\t],\n\t\t\tadvanced: {\n\t\t\t\t...configured.advanced,\n\t\t\t\t// Only when a domain was derived. Better Auth reads the presence\n\t\t\t\t// of this block as intent, so enabling it with no domain would\n\t\t\t\t// widen the cookie to whatever host happened to set it — and the\n\t\t\t\t// case with nothing to widen to is the common one, not an error.\n\t\t\t\t...(cookieDomain\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tcrossSubDomainCookies: {\n\t\t\t\t\t\t\t\tenabled: true,\n\t\t\t\t\t\t\t\tdomain: cookieDomain,\n\t\t\t\t\t\t\t\t...configured.advanced?.crossSubDomainCookies,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t}) as AuthServer;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0FA,MAAM,oBAAoB;AAE1B,IAAa,aAAb,MAIA;CAmBmB;CAlBlB;CACA;CACA;;;;;CAMA;CAQA,YACC,IACA,QACC;EADgB,KAAA,SAAA;EAEjB,MAAM,YAAY,YAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,WAAW,OAAO,YAAY;EAInC,MAAM,WAAW,GAAG,UAAU;EAC9B,KAAK,OAAO;GACX;GACA,QAAQ,gBAAgB,QAAQ;GAChC,KAAK,WAAW,WAAW,KAAK;GAChC,gBAAgB,WAAW,WAAW,gBAAgB;GACtD,cAAc,WAAW,WAAW,cAAc;EACnD;EAGA,KAAK,UAAU;GACd,aAAa,WAAW,SAAS;GACjC,WAAW,YAAY,KAAK,QAAQ,OAAO;EAC5C;CACD;;;;;;;;;;;;;;;CAgBA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK,KAAK;GACd,UAAU,CAAC,KAAK,KAAK,MAAM;EAC5B,GACA;GACC,MAAM;GACN,IAAI,KAAK;GACT,MAAM,KAAK,OAAO;GAClB,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACX;GACA,WAAW,CACV;IACC,IAAI,GAAG,KAAK,GAAG;IACf,SAAS,GAAG,KAAK,GAAG;IACpB,QAAQ;IACR,MAAM,GAAG,KAAK,SAAS;IAKvB,cAAc,CAAC,OAAO,KAAK,OAAO,QAAQ,CAAC;IAC3C,UAAU,CAAC,KAAK,KAAK,MAAM;GAC5B,CACD;EACD,CACD;CACD;;;;;;;CAQA,MAAM,WACL,SAC+B;EAK/B,MAAM,OAAO,MAAM,KAAK,QAAQ,SAAS,EAAE,OAAO,KAAK,CAAC;EAIxD,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,MAAM,EAAE,kBAAkB,MAAM,cAAc,KAAK,OAAO;EAE1D,OAAO;CACR;;;;;;;;;;;;;;;;;;;;CAqBA,MAAM,OAAO,SAAyD;EACrE,MAAM,EAAE,SAAS,MAAM,OAAO;EAC9B,MAAM,EAAE,SAAS,MAAM,OAAO;EAC9B,MAAM,MAAM,IAAI,KAAK;EACrB,MAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;EAOzC,MAAM,EAAE,YAAY,QAAQ,UAC1B,QAAQ,SAAS,EACjB,SAAS,IAAI,KAAK,KAAK,cAAc,CAAC,CACpC,OAAO,CAAC,CACR,QAAQ,EAAE,CAAC,CACX,WAAW,UACX,MACE,MAAM,GAAG,CAAC,CACV,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,CAC9B,OAAO,OAAO,CACjB,EACF,EAAE,CAAC,CACF,MAAM;EAER,IAAI,IAAI,KAAK,KAAK;GAAE,QAAQ;GAAS,aAAa;GAAM,QAAQ;EAAK,CAAC,CAAC;EAKvE,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,QAC/B,MACA,EAAE,SAAS,UACb;EAEA,KAAK,MAAM,YAAY,SAAS,aAAa,CAAC,GAAG;GAChD,MAAM,UACL,SAAS,WAAW,QAChB;IAAC;IAAO;IAAQ;IAAO;IAAS;IAAU;GAAS,IACnD,CAAC,SAAS,MAAM;GAErB,IAAI,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS,OAAO,MAAM,OAAO,QAAQ,EAAE,IAAI,GAAG,CAAC;EACrE;EAEA,OAAO,EAAE,IAAI;CACd;CAEA,MAAc,QACb,SACA,KAA0B,CAAC,GACL;EACtB,MAAM,EAAE,QAAQ,SAAS,gBAAgB,iBAAiB,QAAQ,UAChE,QAAQ,SAAS;GACjB,QAAQ,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,OAAO;GAGrC,SAAS,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,OAAO;GAOnC,gBAAgB,IAAI,KAAK,KAAK,cAAc,CAAC,CAC3C,OAAO,CAAC,CACR,QAAQ,EAAE,CAAC,CACX,WAAW,UACX,MACE,MAAM,GAAG,CAAC,CACV,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,CAC9B,OAAO,OAAO,CACjB;GAMD,cAAc,IAAI,KAAK,KAAK,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS;EAC7D,EAAE,CAAC,CACF,MAAM;EAMR,MAAM,SAAS,KAAK,OAAO;EAK3B,MAAM,KAAM,OAFG,GAAG,SAAS,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAA,CAEvC,SAAS,OAAO;EAMzC,MAAM,YAAY,KAAK,OAAO;EAC9B,MAAM,aACL,OAAO,cAAc,aAClB,MAAM,UAAU,OAAO,IACtB,aAAa,CAAC;EAOnB,OAAO,WAAW;GACjB,GAAG;GACH;GACA,SAAS;GACT,UAAU,KAAK;GACf,UAAU;IAAE;IAAI,MAAM;GAAW;GAGjC,gBAAgB,CACf,GAAG,gBACH,GAAI,WAAW,kBACf,MAAM,QAAQ,WAAW,cAAc,IACpC,WAAW,iBACX,CAAC,CACL;GACA,UAAU;IACT,GAAG,WAAW;IAKd,GAAI,eACD,EACA,uBAAuB;KACtB,SAAS;KACT,QAAQ;KACR,GAAG,WAAW,UAAU;IACzB,EACD,IACC,CAAC;GACL;EACD,CAAC;CACF;AACD"}

package/dist/cache.cjs

@@ -1,3 +1,69 @@
-const require_cache = require('./cache-3WSvAulx.cjs');
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let _geekmidas_cache = require("@geekmidas/cache");
+//#region src/cache.ts
+/**
+* `Cache` — a declared key/value cache.
+*
+* The same three-package meeting point as `ObjectStorage` and `Email`: it
+* implements the construct contract, derives its env key through
+* `@geekmidas/manifest`, and hands back a `@geekmidas/cache` client.
+*
+* It names no provider — and unlike `Email`, it cannot name one protocol
+* either. Every mail backend speaks SMTP, so an `smtp://` URL is true of all of
+* them; cache backends genuinely differ, because Upstash speaks HTTP, a Redis
+* speaks its wire protocol, and a table in Postgres speaks SQL. So the scheme in
+* the URL picks the driver, exactly as it does for object storage, and which
+* drivers exist is the generated entry point's decision.
+*
+* The backend is chosen at deploy, not here. An app caching in Postgres and an
+* app caching in Upstash are the same application code.
+*/
+var Cache = class {
+	options;
+	id;
+	service;
+	/**
+	* Declared once and read by both `declare()` and `connect()`, so the key the
+	* target publishes and the key the client reads cannot drift.
+	*/
+	key;
+	constructor(id, options = {}) {
+		this.options = options;
+		const canonical = (0, _geekmidas_manifest.canonicalId)(id);
+		this.id = canonical;
+		this.key = (0, _geekmidas_manifest.provideKey)(canonical, "url");
+		this.service = {
+			serviceName: (0, _geekmidas_manifest.serviceKey)(canonical),
+			register: (options) => this.connect(options)
+		};
+	}
+	declare() {
+		return [{
+			kind: "cache",
+			id: this.id,
+			...this.options.of ? { of: this.options.of } : {},
+			...this.options.table ? { table: this.options.table } : {},
+			provides: [this.key]
+		}];
+	}
+	/**
+	* Builds the client from the single URL the target supplied.
+	*
+	* Any credential travels in that URL's userinfo rather than in a second key,
+	* for the same reason a Postgres password does: an address and the thing that
+	* opens it are one fact, and splitting them is one more thing to keep in step.
+	*
+	* The scheme selects the driver, so this construct imports no provider and
+	* an app that caches in Postgres never resolves a Redis client. Whoever
+	* assembles the application registers the drivers its target needs.
+	*/
+	async connect({ envParser }) {
+		const { url } = envParser.create((get) => ({ url: get(this.key).string() })).parse();
+		return (0, _geekmidas_cache.createCacheClient)(url);
+	}
+};
+//#endregion
+exports.Cache = Cache;
 
-exports.Cache = require_cache.Cache;
+//# sourceMappingURL=cache.cjs.map

package/dist/cache.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.cjs","names":["canonicalId","provideKey","serviceKey","createCacheClient"],"sources":["../src/cache.ts"],"sourcesContent":["/**\n * `Cache` — a declared key/value cache.\n *\n * The same three-package meeting point as `ObjectStorage` and `Email`: it\n * implements the construct contract, derives its env key through\n * `@geekmidas/manifest`, and hands back a `@geekmidas/cache` client.\n *\n * It names no provider — and unlike `Email`, it cannot name one protocol\n * either. Every mail backend speaks SMTP, so an `smtp://` URL is true of all of\n * them; cache backends genuinely differ, because Upstash speaks HTTP, a Redis\n * speaks its wire protocol, and a table in Postgres speaks SQL. So the scheme in\n * the URL picks the driver, exactly as it does for object storage, and which\n * drivers exist is the generated entry point's decision.\n *\n * The backend is chosen at deploy, not here. An app caching in Postgres and an\n * app caching in Upstash are the same application code.\n */\n\nimport { type Cache as CacheClient, createCacheClient } from '@geekmidas/cache';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport type { Construct } from './construct-interface';\n\nexport interface CacheOptions {\n\t/**\n\t * The database this cache lives in.\n\t *\n\t * Set by `database.cache()` rather than written by hand — the point of the\n\t * method is that the parent's id comes from the parent rather than from a\n\t * string somebody has to keep in step.\n\t */\n\tof?: string;\n\t/** The table entries are kept in. Defaults to `cache`. */\n\ttable?: string;\n}\n\nexport class Cache<TName extends string = string>\n\timplements Construct<TName, CacheClient>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, CacheClient>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * target publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly key: string;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: CacheOptions = {},\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.key = provideKey(canonical, 'url');\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'cache',\n\t\t\t\tid: this.id,\n\t\t\t\t...(this.options.of ? { of: this.options.of } : {}),\n\t\t\t\t...(this.options.table ? { table: this.options.table } : {}),\n\t\t\t\tprovides: [this.key],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Builds the client from the single URL the target supplied.\n\t *\n\t * Any credential travels in that URL's userinfo rather than in a second key,\n\t * for the same reason a Postgres password does: an address and the thing that\n\t * opens it are one fact, and splitting them is one more thing to keep in step.\n\t *\n\t * The scheme selects the driver, so this construct imports no provider and\n\t * an app that caches in Postgres never resolves a Redis client. Whoever\n\t * assembles the application registers the drivers its target needs.\n\t */\n\tprivate async connect({\n\t\tenvParser,\n\t}: ServiceRegisterOptions): Promise<CacheClient> {\n\t\tconst { url } = envParser\n\t\t\t.create((get) => ({ url: get(this.key).string() }))\n\t\t\t.parse();\n\n\t\treturn createCacheClient(url);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0CA,IAAa,QAAb,MAEA;CAYmB;CAXlB;CACA;;;;;CAMA;CAEA,YACC,IACA,UAAyC,CAAC,GACzC;EADgB,KAAA,UAAA;EAEjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,OAAA,GAAMC,oBAAAA,WAAAA,CAAW,WAAW,KAAK;EAGtC,KAAK,UAAU;GACd,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,SAAS;GACjC,WAAW,YAAY,KAAK,QAAQ,OAAO;EAC5C;CACD;CAEA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,GAAI,KAAK,QAAQ,KAAK,EAAE,IAAI,KAAK,QAAQ,GAAG,IAAI,CAAC;GACjD,GAAI,KAAK,QAAQ,QAAQ,EAAE,OAAO,KAAK,QAAQ,MAAM,IAAI,CAAC;GAC1D,UAAU,CAAC,KAAK,GAAG;EACpB,CACD;CACD;;;;;;;;;;;;CAaA,MAAc,QAAQ,EACrB,aACgD;EAChD,MAAM,EAAE,QAAQ,UACd,QAAQ,SAAS,EAAE,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAClD,MAAM;EAER,QAAA,GAAOC,iBAAAA,kBAAAA,CAAkB,GAAG;CAC7B;AACD"}

package/dist/cache.d.cts

@@ -1,3 +1,43 @@
-import "./construct-interface-D9d4Gm4p.cjs";
-import { Cache, CacheOptions } from "./cache-BtZY_tHe.cjs";
-export { Cache, CacheOptions };
+import { t as Construct } from "./construct-interface-DgXTJcOD.cjs";
+import { Service } from "@geekmidas/services";
+import { ConstructName, Declaration } from "@geekmidas/manifest";
+import { Cache as Cache$1 } from "@geekmidas/cache";
+//#region src/cache.d.ts
+export interface CacheOptions {
+  /**
+   * The database this cache lives in.
+   *
+   * Set by `database.cache()` rather than written by hand — the point of the
+   * method is that the parent's id comes from the parent rather than from a
+   * string somebody has to keep in step.
+   */
+  of?: string;
+  /** The table entries are kept in. Defaults to `cache`. */
+  table?: string;
+}
+export declare class Cache<TName extends string = string> implements Construct<TName, Cache$1> {
+  private readonly options;
+  readonly id: TName;
+  readonly service: Service<Uncapitalize<TName>, Cache$1>;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the key the
+   * target publishes and the key the client reads cannot drift.
+   */
+  private readonly key;
+  constructor(id: ConstructName<TName>, options?: CacheOptions);
+  declare(): Declaration[];
+  /**
+   * Builds the client from the single URL the target supplied.
+   *
+   * Any credential travels in that URL's userinfo rather than in a second key,
+   * for the same reason a Postgres password does: an address and the thing that
+   * opens it are one fact, and splitting them is one more thing to keep in step.
+   *
+   * The scheme selects the driver, so this construct imports no provider and
+   * an app that caches in Postgres never resolves a Redis client. Whoever
+   * assembles the application registers the drivers its target needs.
+   */
+  private connect;
+}
+//#endregion
+//# sourceMappingURL=cache.d.cts.map

package/dist/cache.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.cts","names":["CacheClient"],"sources":["../src/cache.ts"],"mappings":";;;;;iBA6BiB;;;;;;;;EAQhB;;EAEA;;qBAGY,MAAM,0CACP,UAAU,OAAOA;mBAaV;WAXT,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQA;;;;;mBAM9B;EAGhB,YAAA,IAAI,cAAc,QACD,UAAS;EAc3B,WAAW;;;;;;;;;;;;UAuBG"}

package/dist/cache.d.mts

@@ -1,3 +1,43 @@
-import "./construct-interface-g5GM5pwR.mjs";
-import { Cache, CacheOptions } from "./cache-BrRz3fEB.mjs";
-export { Cache, CacheOptions };
+import { t as Construct } from "./construct-interface-DPlxfpoS.mjs";
+import { ConstructName, Declaration } from "@geekmidas/manifest";
+import { Cache as Cache$1 } from "@geekmidas/cache";
+import { Service } from "@geekmidas/services";
+//#region src/cache.d.ts
+export interface CacheOptions {
+  /**
+   * The database this cache lives in.
+   *
+   * Set by `database.cache()` rather than written by hand — the point of the
+   * method is that the parent's id comes from the parent rather than from a
+   * string somebody has to keep in step.
+   */
+  of?: string;
+  /** The table entries are kept in. Defaults to `cache`. */
+  table?: string;
+}
+export declare class Cache<TName extends string = string> implements Construct<TName, Cache$1> {
+  private readonly options;
+  readonly id: TName;
+  readonly service: Service<Uncapitalize<TName>, Cache$1>;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the key the
+   * target publishes and the key the client reads cannot drift.
+   */
+  private readonly key;
+  constructor(id: ConstructName<TName>, options?: CacheOptions);
+  declare(): Declaration[];
+  /**
+   * Builds the client from the single URL the target supplied.
+   *
+   * Any credential travels in that URL's userinfo rather than in a second key,
+   * for the same reason a Postgres password does: an address and the thing that
+   * opens it are one fact, and splitting them is one more thing to keep in step.
+   *
+   * The scheme selects the driver, so this construct imports no provider and
+   * an app that caches in Postgres never resolves a Redis client. Whoever
+   * assembles the application registers the drivers its target needs.
+   */
+  private connect;
+}
+//#endregion
+//# sourceMappingURL=cache.d.mts.map

package/dist/cache.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.mts","names":["CacheClient"],"sources":["../src/cache.ts"],"mappings":";;;;;iBA6BiB;;;;;;;;EAQhB;;EAEA;;qBAGY,MAAM,0CACP,UAAU,OAAOA;mBAaV;WAXT,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQA;;;;;mBAM9B;EAGhB,YAAA,IAAI,cAAc,QACD,UAAS;EAc3B,WAAW;;;;;;;;;;;;UAuBG"}

package/dist/cache.mjs

@@ -1,3 +1,68 @@
-import { Cache } from "./cache-0ANvRQnD.mjs";
+import { canonicalId, provideKey, serviceKey } from "@geekmidas/manifest";
+import { createCacheClient } from "@geekmidas/cache";
+//#region src/cache.ts
+/**
+* `Cache` — a declared key/value cache.
+*
+* The same three-package meeting point as `ObjectStorage` and `Email`: it
+* implements the construct contract, derives its env key through
+* `@geekmidas/manifest`, and hands back a `@geekmidas/cache` client.
+*
+* It names no provider — and unlike `Email`, it cannot name one protocol
+* either. Every mail backend speaks SMTP, so an `smtp://` URL is true of all of
+* them; cache backends genuinely differ, because Upstash speaks HTTP, a Redis
+* speaks its wire protocol, and a table in Postgres speaks SQL. So the scheme in
+* the URL picks the driver, exactly as it does for object storage, and which
+* drivers exist is the generated entry point's decision.
+*
+* The backend is chosen at deploy, not here. An app caching in Postgres and an
+* app caching in Upstash are the same application code.
+*/
+var Cache = class {
+	options;
+	id;
+	service;
+	/**
+	* Declared once and read by both `declare()` and `connect()`, so the key the
+	* target publishes and the key the client reads cannot drift.
+	*/
+	key;
+	constructor(id, options = {}) {
+		this.options = options;
+		const canonical = canonicalId(id);
+		this.id = canonical;
+		this.key = provideKey(canonical, "url");
+		this.service = {
+			serviceName: serviceKey(canonical),
+			register: (options) => this.connect(options)
+		};
+	}
+	declare() {
+		return [{
+			kind: "cache",
+			id: this.id,
+			...this.options.of ? { of: this.options.of } : {},
+			...this.options.table ? { table: this.options.table } : {},
+			provides: [this.key]
+		}];
+	}
+	/**
+	* Builds the client from the single URL the target supplied.
+	*
+	* Any credential travels in that URL's userinfo rather than in a second key,
+	* for the same reason a Postgres password does: an address and the thing that
+	* opens it are one fact, and splitting them is one more thing to keep in step.
+	*
+	* The scheme selects the driver, so this construct imports no provider and
+	* an app that caches in Postgres never resolves a Redis client. Whoever
+	* assembles the application registers the drivers its target needs.
+	*/
+	async connect({ envParser }) {
+		const { url } = envParser.create((get) => ({ url: get(this.key).string() })).parse();
+		return createCacheClient(url);
+	}
+};
+//#endregion
+export { Cache };
 
-export { Cache };
+//# sourceMappingURL=cache.mjs.map

package/dist/cache.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.mjs","names":[],"sources":["../src/cache.ts"],"sourcesContent":["/**\n * `Cache` — a declared key/value cache.\n *\n * The same three-package meeting point as `ObjectStorage` and `Email`: it\n * implements the construct contract, derives its env key through\n * `@geekmidas/manifest`, and hands back a `@geekmidas/cache` client.\n *\n * It names no provider — and unlike `Email`, it cannot name one protocol\n * either. Every mail backend speaks SMTP, so an `smtp://` URL is true of all of\n * them; cache backends genuinely differ, because Upstash speaks HTTP, a Redis\n * speaks its wire protocol, and a table in Postgres speaks SQL. So the scheme in\n * the URL picks the driver, exactly as it does for object storage, and which\n * drivers exist is the generated entry point's decision.\n *\n * The backend is chosen at deploy, not here. An app caching in Postgres and an\n * app caching in Upstash are the same application code.\n */\n\nimport { type Cache as CacheClient, createCacheClient } from '@geekmidas/cache';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport type { Construct } from './construct-interface';\n\nexport interface CacheOptions {\n\t/**\n\t * The database this cache lives in.\n\t *\n\t * Set by `database.cache()` rather than written by hand — the point of the\n\t * method is that the parent's id comes from the parent rather than from a\n\t * string somebody has to keep in step.\n\t */\n\tof?: string;\n\t/** The table entries are kept in. Defaults to `cache`. */\n\ttable?: string;\n}\n\nexport class Cache<TName extends string = string>\n\timplements Construct<TName, CacheClient>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, CacheClient>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * target publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly key: string;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: CacheOptions = {},\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.key = provideKey(canonical, 'url');\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'cache',\n\t\t\t\tid: this.id,\n\t\t\t\t...(this.options.of ? { of: this.options.of } : {}),\n\t\t\t\t...(this.options.table ? { table: this.options.table } : {}),\n\t\t\t\tprovides: [this.key],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Builds the client from the single URL the target supplied.\n\t *\n\t * Any credential travels in that URL's userinfo rather than in a second key,\n\t * for the same reason a Postgres password does: an address and the thing that\n\t * opens it are one fact, and splitting them is one more thing to keep in step.\n\t *\n\t * The scheme selects the driver, so this construct imports no provider and\n\t * an app that caches in Postgres never resolves a Redis client. Whoever\n\t * assembles the application registers the drivers its target needs.\n\t */\n\tprivate async connect({\n\t\tenvParser,\n\t}: ServiceRegisterOptions): Promise<CacheClient> {\n\t\tconst { url } = envParser\n\t\t\t.create((get) => ({ url: get(this.key).string() }))\n\t\t\t.parse();\n\n\t\treturn createCacheClient(url);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA0CA,IAAa,QAAb,MAEA;CAYmB;CAXlB;CACA;;;;;CAMA;CAEA,YACC,IACA,UAAyC,CAAC,GACzC;EADgB,KAAA,UAAA;EAEjB,MAAM,YAAY,YAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,MAAM,WAAW,WAAW,KAAK;EAGtC,KAAK,UAAU;GACd,aAAa,WAAW,SAAS;GACjC,WAAW,YAAY,KAAK,QAAQ,OAAO;EAC5C;CACD;CAEA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,GAAI,KAAK,QAAQ,KAAK,EAAE,IAAI,KAAK,QAAQ,GAAG,IAAI,CAAC;GACjD,GAAI,KAAK,QAAQ,QAAQ,EAAE,OAAO,KAAK,QAAQ,MAAM,IAAI,CAAC;GAC1D,UAAU,CAAC,KAAK,GAAG;EACpB,CACD;CACD;;;;;;;;;;;;CAaA,MAAc,QAAQ,EACrB,aACgD;EAChD,MAAM,EAAE,QAAQ,UACd,QAAQ,SAAS,EAAE,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAClD,MAAM;EAER,OAAO,kBAAkB,GAAG;CAC7B;AACD"}

package/dist/{clone-DblgEZZa.mjs → clone-EKNovYHu.mjs}

@@ -33,7 +33,7 @@ function cloneWith(instance, delta) {
 	const next = Object.create(Object.getPrototypeOf(instance));
 	return Object.assign(next, instance, delta);
 }
-
 //#endregion
-export { cloneWith };
-//# sourceMappingURL=clone-DblgEZZa.mjs.map
+export { cloneWith as t };
+
+//# sourceMappingURL=clone-EKNovYHu.mjs.map

package/dist/clone-EKNovYHu.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"clone-EKNovYHu.mjs","names":[],"sources":["../src/clone.ts"],"sourcesContent":["/**\n * Cloning a builder, without enumerating its fields.\n *\n * The builders were mutable singletons that reset themselves by listing every\n * field at the end of `.handle()`. Two things followed from that, and both were\n * real:\n *\n * A configured base could not be reused. `const fn = f.logger(log)` handed back\n * `f` itself, and the first `.handle()` reset `_logger` to the default — so the\n * second handler built from that base silently logged somewhere else. Every\n * field in the reset block behaved the same way, which made\n * `f.logger(l).timeout(60_000)` a base that worked exactly once.\n *\n * And a field left out of the reset list leaked into the next handler instead.\n * `_constructs` was left out, so a function was granted a bucket a *previous*\n * function had declared — an over-grant in the field a deploy reads to size an\n * IAM policy.\n *\n * Both are the same defect: a hand-maintained list of fields that has to be\n * edited every time a field is added, and is silent when it isn't. So this\n * copies whatever the instance actually has, and the list stops existing. The\n * prototype is carried over, so `instanceof` and every method still resolve,\n * and the constructor is deliberately not re-run — this copies state rather\n * than initialising it.\n *\n * Fields must be replaced rather than mutated in place: a clone and its parent\n * share whatever array a field points at, so `_events.push(…)` would be seen by\n * both. Every builder assigns a fresh array instead, which is what makes\n * sharing the reference safe.\n */\nexport function cloneWith<T extends object>(\n\tinstance: T,\n\tdelta: Record<string, unknown>,\n): T {\n\tconst next = Object.create(Object.getPrototypeOf(instance)) as T;\n\n\treturn Object.assign(next, instance, delta);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,UACf,UACA,OACI;CACJ,MAAM,OAAO,OAAO,OAAO,OAAO,eAAe,QAAQ,CAAC;CAE1D,OAAO,OAAO,OAAO,MAAM,UAAU,KAAK;AAC3C"}

package/dist/{clone-Dy0cR2SZ.cjs → clone-UGJpvQnL.cjs}

@@ -1,4 +1,3 @@
-
 //#region src/clone.ts
 /**
 * Cloning a builder, without enumerating its fields.
@@ -34,12 +33,12 @@ function cloneWith(instance, delta) {
 	const next = Object.create(Object.getPrototypeOf(instance));
 	return Object.assign(next, instance, delta);
 }
-
 //#endregion
-Object.defineProperty(exports, 'cloneWith', {
-  enumerable: true,
-  get: function () {
-    return cloneWith;
-  }
+Object.defineProperty(exports, "cloneWith", {
+	enumerable: true,
+	get: function() {
+		return cloneWith;
+	}
 });
-//# sourceMappingURL=clone-Dy0cR2SZ.cjs.map
+
+//# sourceMappingURL=clone-UGJpvQnL.cjs.map

package/dist/clone-UGJpvQnL.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"clone-UGJpvQnL.cjs","names":[],"sources":["../src/clone.ts"],"sourcesContent":["/**\n * Cloning a builder, without enumerating its fields.\n *\n * The builders were mutable singletons that reset themselves by listing every\n * field at the end of `.handle()`. Two things followed from that, and both were\n * real:\n *\n * A configured base could not be reused. `const fn = f.logger(log)` handed back\n * `f` itself, and the first `.handle()` reset `_logger` to the default — so the\n * second handler built from that base silently logged somewhere else. Every\n * field in the reset block behaved the same way, which made\n * `f.logger(l).timeout(60_000)` a base that worked exactly once.\n *\n * And a field left out of the reset list leaked into the next handler instead.\n * `_constructs` was left out, so a function was granted a bucket a *previous*\n * function had declared — an over-grant in the field a deploy reads to size an\n * IAM policy.\n *\n * Both are the same defect: a hand-maintained list of fields that has to be\n * edited every time a field is added, and is silent when it isn't. So this\n * copies whatever the instance actually has, and the list stops existing. The\n * prototype is carried over, so `instanceof` and every method still resolve,\n * and the constructor is deliberately not re-run — this copies state rather\n * than initialising it.\n *\n * Fields must be replaced rather than mutated in place: a clone and its parent\n * share whatever array a field points at, so `_events.push(…)` would be seen by\n * both. Every builder assigns a fresh array instead, which is what makes\n * sharing the reference safe.\n */\nexport function cloneWith<T extends object>(\n\tinstance: T,\n\tdelta: Record<string, unknown>,\n): T {\n\tconst next = Object.create(Object.getPrototypeOf(instance)) as T;\n\n\treturn Object.assign(next, instance, delta);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,UACf,UACA,OACI;CACJ,MAAM,OAAO,OAAO,OAAO,OAAO,eAAe,QAAQ,CAAC;CAE1D,OAAO,OAAO,OAAO,MAAM,UAAU,KAAK;AAC3C"}

package/dist/{construct-interface-g5GM5pwR.d.mts → construct-interface-DPlxfpoS.d.mts}

@@ -1,8 +1,6 @@
 import { Declaration, Dependency } from "@geekmidas/manifest";
 import { Service } from "@geekmidas/services";
-
 //#region src/construct-interface.d.ts
-
 /**
  * @typeParam TName - the construct's canonical id, PascalCase. Keeping it a
  * literal is what lets the service key be `Uncapitalize<TName>` — a TypeScript
@@ -85,7 +83,7 @@ interface Consumable<TName extends string = string, TClient = unknown> {
  * both keys — the same machinery `.services()` already uses, which is why
  * `dependsOn` needs no type plumbing of its own.
  */
-type ServicesOf<T extends readonly Consumable[]> = { [K in keyof T]: T[K]['service'] };
+type ServicesOf<T extends readonly Consumable[]> = { [K in keyof T]: T[K]['service']; };
 /**
  * The services of a list of constructs, at runtime.
  *
@@ -125,7 +123,6 @@ declare function isConsumable(value: unknown): value is Consumable;
  * `Construct.fromService` exists to lift and not everything has been lifted.
  */
 declare function serviceOf<TName extends string, TClient>(source: Consumable<TName, TClient> | Service<TName, TClient>): Service<TName, TClient>;
-//# sourceMappingURL=construct-interface.d.ts.map
 //#endregion
-export { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };
-//# sourceMappingURL=construct-interface-g5GM5pwR.d.mts.map
+export { NameOf as a, edgeTo as c, serviceOf as d, servicesOf as f, Infer as i, idsOf as l, Consumable as n, NotAConstruct as o, Declarable as r, ServicesOf as s, Construct as t, isConsumable as u };
+//# sourceMappingURL=construct-interface-DPlxfpoS.d.mts.map

package/dist/construct-interface-DPlxfpoS.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"construct-interface-DPlxfpoS.d.mts","names":[],"sources":["../src/construct-interface.ts"],"mappings":";;;;;;;;;;;;UA6BiB,UAAU,+BAA+B;;WAEhD,IAAI;;;;;;;;EASb,WAAW;;;;;;;;WASF,UAAU,mCAEhB,QAAQ,aAAa,QAAQ;;;;;;;;;;;UAYhB,WAAW;WAClB,IAAI;EACb,WAAW;;;;;;;;;;;;;;iBAeI,OAAO,WAAW,aAAa;;KAWnC,MAAM,KACjB,UAAU,wBAAwB,WAAW;;KAGlC,OAAO,KAClB,UAAU,gBAAgB,kBAAkB;;;;;;;;;;;UAY5B,WAAW,+BAA+B;WACjD,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQ;EAC/C,WAAW;;;;;;;;;;KAWA,WAAW,mBAAmB,mBACxC,WAAW,IAAI,EAAE;;;;;;;;iBAUH,iBAAiB,mBAAmB,cACnD,YAAY,IACV,WAAW;;;;;;;;;;iBAiBE,MACf,qBAAqB,cACrB;;cAMY,sBAAsB;WACb;EAAA,YAAA;;;;;;;;;iBAsBN,aAAa,iBAAiB,SAAS;;;;;;;;iBAmBvC,UAAU,sBAAsB,SAC/C,QAAQ,WAAW,OAAO,WAAW,QAAQ,OAAO,WAClD,QAAQ,OAAO"}

package/dist/{construct-interface-D9d4Gm4p.d.cts → construct-interface-DgXTJcOD.d.cts}

@@ -1,8 +1,6 @@
 import { Service } from "@geekmidas/services";
 import { Declaration, Dependency } from "@geekmidas/manifest";
-
 //#region src/construct-interface.d.ts
-
 /**
  * @typeParam TName - the construct's canonical id, PascalCase. Keeping it a
  * literal is what lets the service key be `Uncapitalize<TName>` — a TypeScript
@@ -85,7 +83,7 @@ interface Consumable<TName extends string = string, TClient = unknown> {
  * both keys — the same machinery `.services()` already uses, which is why
  * `dependsOn` needs no type plumbing of its own.
  */
-type ServicesOf<T extends readonly Consumable[]> = { [K in keyof T]: T[K]['service'] };
+type ServicesOf<T extends readonly Consumable[]> = { [K in keyof T]: T[K]['service']; };
 /**
  * The services of a list of constructs, at runtime.
  *
@@ -125,7 +123,6 @@ declare function isConsumable(value: unknown): value is Consumable;
  * `Construct.fromService` exists to lift and not everything has been lifted.
  */
 declare function serviceOf<TName extends string, TClient>(source: Consumable<TName, TClient> | Service<TName, TClient>): Service<TName, TClient>;
-//# sourceMappingURL=construct-interface.d.ts.map
 //#endregion
-export { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };
-//# sourceMappingURL=construct-interface-D9d4Gm4p.d.cts.map
+export { NameOf as a, edgeTo as c, serviceOf as d, servicesOf as f, Infer as i, idsOf as l, Consumable as n, NotAConstruct as o, Declarable as r, ServicesOf as s, Construct as t, isConsumable as u };
+//# sourceMappingURL=construct-interface-DgXTJcOD.d.cts.map

package/dist/construct-interface-DgXTJcOD.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"construct-interface-DgXTJcOD.d.cts","names":[],"sources":["../src/construct-interface.ts"],"mappings":";;;;;;;;;;;;UA6BiB,UAAU,+BAA+B;;WAEhD,IAAI;;;;;;;;EASb,WAAW;;;;;;;;WASF,UAAU,mCAEhB,QAAQ,aAAa,QAAQ;;;;;;;;;;;UAYhB,WAAW;WAClB,IAAI;EACb,WAAW;;;;;;;;;;;;;;iBAeI,OAAO,WAAW,aAAa;;KAWnC,MAAM,KACjB,UAAU,wBAAwB,WAAW;;KAGlC,OAAO,KAClB,UAAU,gBAAgB,kBAAkB;;;;;;;;;;;UAY5B,WAAW,+BAA+B;WACjD,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQ;EAC/C,WAAW;;;;;;;;;;KAWA,WAAW,mBAAmB,mBACxC,WAAW,IAAI,EAAE;;;;;;;;iBAUH,iBAAiB,mBAAmB,cACnD,YAAY,IACV,WAAW;;;;;;;;;;iBAiBE,MACf,qBAAqB,cACrB;;cAMY,sBAAsB;WACb;EAAA,YAAA;;;;;;;;;iBAsBN,aAAa,iBAAiB,SAAS;;;;;;;;iBAmBvC,UAAU,sBAAsB,SAC/C,QAAQ,WAAW,OAAO,WAAW,QAAQ,OAAO,WAClD,QAAQ,OAAO"}

package/dist/construct-interface.cjs

@@ -1,8 +1,88 @@
-const require_construct_interface = require('./construct-interface-BfjcOD_E.cjs');
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/construct-interface.ts
+/**
+* The edge that points at a construct.
+*
+* A construct's *canonical* node is the one carrying its own id — the others are
+* things it owns rather than things it is, like the signing secret beside an
+* auth server — so the kind an edge records is read off that node instead of
+* being written down beside it. Hand-written kinds are the same fact stated
+* twice, and the copy is what goes stale when a construct changes what it
+* declares.
+*
+* @throws {NotAConstruct} when the value declares nothing under its own id.
+*/
+function edgeTo(construct) {
+	const canonical = construct.declare().find((declaration) => declaration.id === construct.id);
+	if (!canonical) throw new NotAConstruct(construct);
+	return {
+		target: construct.id,
+		kind: canonical.kind
+	};
+}
+/**
+* The services of a list of constructs, at runtime.
+*
+* @throws {NotAConstruct} when handed something else. The type already refuses
+* it, but a JavaScript caller gets no such warning, and a `Service` slipping
+* through would fail later as an undefined key in the handler.
+*/
+function servicesOf(constructs) {
+	return constructs.map((construct) => {
+		if (!isConsumable(construct)) throw new NotAConstruct(construct);
+		return construct.service;
+	});
+}
+/**
+* The other half of `servicesOf`: the same edge, as the manifest records it.
+*
+* `.dependsOn()` used to keep only the services, which is what a handler runs
+* with — and an id cannot be recovered from a service name reliably, so the
+* edges were gone by the time the build could read them. Both halves are taken
+* from one call now, and `existing` is folded in so repeated `.dependsOn()`
+* calls accumulate the way `.services()` already does.
+*/
+function idsOf(constructs, existing = []) {
+	return [.../* @__PURE__ */ new Set([...existing, ...constructs.map(({ id }) => id)])];
+}
+/** Something that is not a construct was passed to `.dependsOn()`. */
+var NotAConstruct = class extends Error {
+	value;
+	constructor(value) {
+		const name = typeof value === "object" && value !== null && "serviceName" in value ? `the service '${String(value.serviceName)}'` : `a ${typeof value}`;
+		super(`.dependsOn() takes constructs, and was given ${name}. Pass it to .services([…]) instead, or lift it with Construct.fromService().`);
+		this.value = value;
+		this.name = "NotAConstruct";
+	}
+};
+/**
+* Whether a value is a construct rather than a bare `Service`.
+*
+* Structural rather than `instanceof`: a construct from a second copy of
+* `@geekmidas/constructs` — a linked workspace, two versions in a lockfile — is
+* still a construct, and `instanceof` is exactly the check that says otherwise.
+*/
+function isConsumable(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.id === "string" && typeof candidate.declare === "function" && typeof candidate.service?.serviceName === "string";
+}
+/**
+* The service behind either face.
+*
+* `.database()` and the publisher slots take a construct now; they took a
+* `Service` before and still do, because a hand-written one is exactly what
+* `Construct.fromService` exists to lift and not everything has been lifted.
+*/
+function serviceOf(source) {
+	return isConsumable(source) ? source.service : source;
+}
+//#endregion
+exports.NotAConstruct = NotAConstruct;
+exports.edgeTo = edgeTo;
+exports.idsOf = idsOf;
+exports.isConsumable = isConsumable;
+exports.serviceOf = serviceOf;
+exports.servicesOf = servicesOf;
 
-exports.NotAConstruct = require_construct_interface.NotAConstruct;
-exports.edgeTo = require_construct_interface.edgeTo;
-exports.idsOf = require_construct_interface.idsOf;
-exports.isConsumable = require_construct_interface.isConsumable;
-exports.serviceOf = require_construct_interface.serviceOf;
-exports.servicesOf = require_construct_interface.servicesOf;
+//# sourceMappingURL=construct-interface.cjs.map

package/dist/construct-interface.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"construct-interface.cjs","names":[],"sources":["../src/construct-interface.ts"],"sourcesContent":["/**\n * The construct contract.\n *\n * A construct is three things at once — an infrastructure requirement at build\n * time, a runtime capability, and something other code can consume — which is\n * what forces exactly these three members.\n *\n * An **interface**, not a base class: `Endpoint`, `Cron`, `Queue`, and `Topic`\n * can satisfy it without inheritance surgery, a lifted `Service` can satisfy it\n * as a plain object, and `.dependsOn()` gets its enforcement structurally — a\n * `Service` (`{ serviceName, register }`) simply does not match\n * `{ id, declare, service }`, with no `instanceof` anywhere.\n *\n * Lives in its own module while the existing abstract `Construct` class is\n * still in use; it takes that name once the class is gone.\n */\n\nimport type { Declaration, Dependency } from '@geekmidas/manifest';\nimport type { Service } from '@geekmidas/services';\n\n/**\n * @typeParam TName - the construct's canonical id, PascalCase. Keeping it a\n * literal is what lets the service key be `Uncapitalize<TName>` — a TypeScript\n * intrinsic, so no custom transform needs a runtime twin.\n * @typeParam TClient - what consuming this construct hands you. `never` means it\n * owns no address and cannot be consumed: a `Cron` is fired by a schedule and a\n * `Subscriber` is reached through its topic, so `.dependsOn()` on either is a\n * compile error rather than a stub that throws.\n */\nexport interface Construct<TName extends string = string, TClient = never> {\n\t/** Canonical, PascalCase, unique within the manifest. */\n\treadonly id: TName;\n\n\t/**\n\t * The build-time face: what this construct contributes to the manifest.\n\t *\n\t * Returns an array because some constructs contribute more than one node — a\n\t * queue declares the queue and its worker, a database declares its migrator\n\t * and seeder. Most return one.\n\t */\n\tdeclare(): Declaration[];\n\n\t/**\n\t * The consumable face — the address this construct owns, as a client.\n\t *\n\t * A field assigned once rather than a getter. `Construct.getEnvironment`\n\t * caches by service *object*, and `Topic.publisher` returns a fresh literal\n\t * on every access, so that cache never hits for topics or queues today.\n\t */\n\treadonly service: [TClient] extends [never]\n\t\t? never\n\t\t: Service<Uncapitalize<TName>, TClient>;\n}\n\n/**\n * The build-time face alone — an id and what it contributes to the manifest.\n *\n * Weaker than {@link Consumable} on purpose. An edge is not always an\n * injection: a site depending on an API needs that API's *address at build\n * time* and has no service record to put a client into, so requiring one would\n * make the weakest kind of edge impossible to express with the strongest\n * interface. Discovery asks this same question and nothing more.\n */\nexport interface Declarable<TName extends string = string> {\n\treadonly id: TName;\n\tdeclare(): Declaration[];\n}\n\n/**\n * The edge that points at a construct.\n *\n * A construct's *canonical* node is the one carrying its own id — the others are\n * things it owns rather than things it is, like the signing secret beside an\n * auth server — so the kind an edge records is read off that node instead of\n * being written down beside it. Hand-written kinds are the same fact stated\n * twice, and the copy is what goes stale when a construct changes what it\n * declares.\n *\n * @throws {NotAConstruct} when the value declares nothing under its own id.\n */\nexport function edgeTo(construct: Declarable): Dependency {\n\tconst canonical = construct\n\t\t.declare()\n\t\t.find((declaration) => declaration.id === construct.id);\n\n\tif (!canonical) throw new NotAConstruct(construct);\n\n\treturn { target: construct.id, kind: canonical.kind };\n}\n\n/** What consuming a construct hands you. */\nexport type Infer<C> =\n\tC extends Construct<string, infer TClient> ? TClient : never;\n\n/** A construct's canonical id. */\nexport type NameOf<C> =\n\tC extends Construct<infer TName, unknown> ? TName : never;\n\n/**\n * What `.dependsOn([…])` accepts: a construct that owns a client.\n *\n * Structural, and deliberately narrower than {@link Construct} — it is the\n * face a *consumer* needs, so the builders can accept a database, a bucket, a\n * mail sender, a queue, or a topic without importing any of them. A plain\n * `Service` is not one of these, which is the point: constructs-only confines\n * env sniffing to `.services()` and the explicit lift, so retiring that method\n * retires implicit inference with it.\n */\nexport interface Consumable<TName extends string = string, TClient = unknown> {\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, TClient>;\n\tdeclare(): Declaration[];\n}\n\n/**\n * The services a list of constructs dissolves into.\n *\n * A mapped tuple, so `[db, uploads]` types as `[Service<'orders', Kysely<DB>>,\n * Service<'uploads', StorageClient>]` and the handler's service record gains\n * both keys — the same machinery `.services()` already uses, which is why\n * `dependsOn` needs no type plumbing of its own.\n */\nexport type ServicesOf<T extends readonly Consumable[]> = {\n\t[K in keyof T]: T[K]['service'];\n};\n\n/**\n * The services of a list of constructs, at runtime.\n *\n * @throws {NotAConstruct} when handed something else. The type already refuses\n * it, but a JavaScript caller gets no such warning, and a `Service` slipping\n * through would fail later as an undefined key in the handler.\n */\nexport function servicesOf<const T extends readonly Consumable[]>(\n\tconstructs: T,\n): ServicesOf<T> {\n\treturn constructs.map((construct) => {\n\t\tif (!isConsumable(construct)) throw new NotAConstruct(construct);\n\n\t\treturn construct.service;\n\t}) as ServicesOf<T>;\n}\n\n/**\n * The other half of `servicesOf`: the same edge, as the manifest records it.\n *\n * `.dependsOn()` used to keep only the services, which is what a handler runs\n * with — and an id cannot be recovered from a service name reliably, so the\n * edges were gone by the time the build could read them. Both halves are taken\n * from one call now, and `existing` is folded in so repeated `.dependsOn()`\n * calls accumulate the way `.services()` already does.\n */\nexport function idsOf(\n\tconstructs: readonly Consumable[],\n\texisting: readonly string[] = [],\n): string[] {\n\treturn [...new Set([...existing, ...constructs.map(({ id }) => id)])];\n}\n\n/** Something that is not a construct was passed to `.dependsOn()`. */\nexport class NotAConstruct extends Error {\n\tconstructor(readonly value: unknown) {\n\t\tconst name =\n\t\t\ttypeof value === 'object' && value !== null && 'serviceName' in value\n\t\t\t\t? `the service '${String((value as { serviceName: unknown }).serviceName)}'`\n\t\t\t\t: `a ${typeof value}`;\n\n\t\tsuper(\n\t\t\t`.dependsOn() takes constructs, and was given ${name}. ` +\n\t\t\t\t`Pass it to .services([…]) instead, or lift it with ` +\n\t\t\t\t`Construct.fromService().`,\n\t\t);\n\t\tthis.name = 'NotAConstruct';\n\t}\n}\n\n/**\n * Whether a value is a construct rather than a bare `Service`.\n *\n * Structural rather than `instanceof`: a construct from a second copy of\n * `@geekmidas/constructs` — a linked workspace, two versions in a lockfile — is\n * still a construct, and `instanceof` is exactly the check that says otherwise.\n */\nexport function isConsumable(value: unknown): value is Consumable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Consumable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\ttypeof candidate.declare === 'function' &&\n\t\ttypeof (candidate.service as Service | undefined)?.serviceName === 'string'\n\t);\n}\n\n/**\n * The service behind either face.\n *\n * `.database()` and the publisher slots take a construct now; they took a\n * `Service` before and still do, because a hand-written one is exactly what\n * `Construct.fromService` exists to lift and not everything has been lifted.\n */\nexport function serviceOf<TName extends string, TClient>(\n\tsource: Consumable<TName, TClient> | Service<TName, TClient>,\n): Service<TName, TClient> {\n\t// A construct's service key is `Uncapitalize<TName>` and the slot is typed\n\t// by `TName`; the two describe the same key, and only the cast says so.\n\treturn isConsumable(source)\n\t\t? (source.service as unknown as Service<TName, TClient>)\n\t\t: (source as Service<TName, TClient>);\n}\n"],"mappings":";;;;;;;;;;;;;;AAgFA,SAAgB,OAAO,WAAmC;CACzD,MAAM,YAAY,UAChB,QAAQ,CAAC,CACT,MAAM,gBAAgB,YAAY,OAAO,UAAU,EAAE;CAEvD,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,SAAS;CAEjD,OAAO;EAAE,QAAQ,UAAU;EAAI,MAAM,UAAU;CAAK;AACrD;;;;;;;;AA6CA,SAAgB,WACf,YACgB;CAChB,OAAO,WAAW,KAAK,cAAc;EACpC,IAAI,CAAC,aAAa,SAAS,GAAG,MAAM,IAAI,cAAc,SAAS;EAE/D,OAAO,UAAU;CAClB,CAAC;AACF;;;;;;;;;;AAWA,SAAgB,MACf,YACA,WAA8B,CAAC,GACpB;CACX,OAAO,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,WAAW,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACrE;;AAGA,IAAa,gBAAb,cAAmC,MAAM;CACnB;CAArB,YAAY,OAAyB;EACpC,MAAM,OACL,OAAO,UAAU,YAAY,UAAU,QAAQ,iBAAiB,QAC7D,gBAAgB,OAAQ,MAAmC,WAAW,EAAE,KACxE,KAAK,OAAO;EAEhB,MACC,gDAAgD,KAAK,8EAGtD;EAVoB,KAAA,QAAA;EAWpB,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,SAAgB,aAAa,OAAqC;CACjE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,YAAY;CAElB,OACC,OAAO,UAAU,OAAO,YACxB,OAAO,UAAU,YAAY,cAC7B,OAAQ,UAAU,SAAiC,gBAAgB;AAErE;;;;;;;;AASA,SAAgB,UACf,QAC0B;CAG1B,OAAO,aAAa,MAAM,IACtB,OAAO,UACP;AACL"}

package/dist/construct-interface.d.cts

@@ -1,2 +1,2 @@
-import { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf } from "./construct-interface-D9d4Gm4p.cjs";
+import { a as NameOf, c as edgeTo, d as serviceOf, f as servicesOf, i as Infer, l as idsOf, n as Consumable, o as NotAConstruct, r as Declarable, s as ServicesOf, t as Construct, u as isConsumable } from "./construct-interface-DgXTJcOD.cjs";
 export { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };

package/dist/construct-interface.d.mts

@@ -1,2 +1,2 @@
-import { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf } from "./construct-interface-g5GM5pwR.mjs";
+import { a as NameOf, c as edgeTo, d as serviceOf, f as servicesOf, i as Infer, l as idsOf, n as Consumable, o as NotAConstruct, r as Declarable, s as ServicesOf, t as Construct, u as isConsumable } from "./construct-interface-DPlxfpoS.mjs";
 export { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };