@geekmidas/constructs 10.0.0-alpha.38 → 10.0.0-alpha.39

package/dist/rest-api.mjs

@@ -1,5 +1,5 @@
 import { edgeTo } from "./construct-interface.mjs";
-import { o as getSecurityScheme, t as EndpointFactory } from "./EndpointFactory-B9HAjDAP.mjs";
+import { o as getSecurityScheme, t as EndpointFactory } from "./EndpointFactory-BBdNeaGJ.mjs";
 import { n as envParserFor } from "./surfaceEnv-wMT5QzgZ.mjs";
 import { canonicalId, provideKey } from "@geekmidas/manifest";
 import { DEFAULT_LOGGER } from "@geekmidas/logger/console";
@@ -7,7 +7,7 @@ import { DEFAULT_LOGGER } from "@geekmidas/logger/console";
 /**
 * What is *not* here, and why.
 *
-* `dependsOn`, `database`, `auditor` and `publisher` all inject a capability
+* `dependsOn`, `database`, `auditor` and `.event(topic, …)` all inject a capability
 * into a handler. Putting one on the surface hands it to every route the
 * surface serves — a health check gets the database because a report needed it
 * — which is the thing least privilege forbids and the reason `.calls()` is not
@@ -94,7 +94,6 @@ var RestApi = class RestApi {
 		this.session = endpoints.session.bind(endpoints);
 		this.auditor = endpoints.auditor.bind(endpoints);
 		this.actor = endpoints.actor.bind(endpoints);
-		this.publisher = endpoints.publisher.bind(endpoints);
 		this.authorizer = endpoints.authorizer.bind(endpoints);
 		this.authorize = endpoints.authorize.bind(endpoints);
 		this.rls = endpoints.rls.bind(endpoints);
@@ -137,7 +136,6 @@ var RestApi = class RestApi {
 	session;
 	auditor;
 	actor;
-	publisher;
 	authorizer;
 	authorize;
 	rls;

package/dist/rest-api.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api.mjs","names":[],"sources":["../src/rest-api.ts"],"sourcesContent":["/**\n * `RestApi` — the application's own HTTP surface, declared.\n *\n * Everything an app serves already existed; what did not exist was a *node* for\n * it. Without one, three things that are properties of the graph had to be\n * written down somewhere else: which origins the API accepts, which origins the\n * auth server trusts, and which URL a frontend is built against. All three were\n * being derived by walking the workspace config for ports — a second mechanism,\n * running beside the graph and answering the same question worse, since it can\n * only ever describe what this repo happens to run.\n *\n * With the surface declared, all three become one edge read backwards: a\n * consumer depends on the API, and *that* is the CORS entry, the trusted origin,\n * and the build-time URL. Nothing enumerates its own callers.\n *\n * ```ts\n * export const api = new RestApi('Api', {\n *   authorizers: ['session'],\n *   defaultAuthorizer: 'session',\n * });\n * ```\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Logger } from '@geekmidas/logger';\nimport { DEFAULT_LOGGER } from '@geekmidas/logger/console';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\ttype Dependency,\n\tprovideKey,\n} from '@geekmidas/manifest';\nimport type { Telescope } from '@geekmidas/telescope';\nimport {\n\ttype Authenticator,\n\ttype Declarable,\n\tedgeTo,\n} from './construct-interface';\n\nexport type { Authenticator } from './construct-interface';\n\nimport {\n\ttype BuiltInSecuritySchemeId,\n\tgetSecurityScheme,\n} from './endpoints/Authorizer';\nimport { EndpointFactory } from './endpoints/EndpointFactory';\nimport { envParserFor } from './endpoints/surfaceEnv';\n\n/** The factory a surface builds its endpoints from. */\ntype Endpoints = EndpointFactory<[], '', Logger>;\n\nexport interface RestApiConfig<\n\t// `readonly []` rather than `readonly string[]`: a surface that declares no\n\t// authorizers of its own should narrow `defaultAuthorizer` to the built-ins\n\t// and `'none'`, not widen it back to any string.\n\tTAuthorizers extends readonly string[] = readonly [],\n> {\n\t/**\n\t * The app that serves this surface, relative to the workspace root —\n\t * `'apps/api'`, or `'.'` in a single-app project.\n\t *\n\t * Required. It was inferred from the id (`apps/<kebab-id>`, or the root\n\t * when no such directory existed), which meant a surface's home was\n\t * whatever happened to be on disk. It is where the app's `package.json`\n\t * and base `tsconfig.json` are, and which build serves this surface. It\n\t * does not change discovery: constructs still load from the workspace's\n\t * `constructs` glob.\n\t */\n\tpath: string;\n\t/**\n\t * CORS tunables. The *origins* are never here — they are read off the\n\t * constructs that declared an edge to this surface, which is the whole point\n\t * of declaring one. These are the parts a graph cannot answer.\n\t */\n\tcors?: {\n\t\tmaxAge?: number;\n\t\tcredentials?: boolean;\n\t\tallowHeaders?: readonly string[];\n\t\texposeHeaders?: readonly string[];\n\t};\n\t/**\n\t * The authorizer names this surface exposes. Names only — what verifies a\n\t * request legitimately differs between local and deployed, so the mechanism\n\t * belongs to the target and never to portable code.\n\t */\n\tauthorizers?: TAuthorizers;\n\t/**\n\t * The authorizer applied to an endpoint that names none.\n\t *\n\t * Required, and `'none'` is a valid answer that has to be typed out. The\n\t * alternative is an API that ships open because a field was left off, which\n\t * is the one default worth refusing to have.\n\t *\n\t * It was called `default`, which said what it was to the type and nothing\n\t * to the reader: next to `authorizers: ['iam']`, a bare `default: 'none'`\n\t * could be defaulting the runtime or the target. The manifest has always\n\t * called it `defaultAuthorizer` and the factory `defaultAuthorizerName`;\n\t * this is the same fact under the same name.\n\t *\n\t * Typed from `authorizers`, so it can only name one this surface exposes —\n\t * plus a built-in scheme, and `'none'`. It was a bare `string`, which let\n\t * `defaultAuthorizer: 'jwtt'` compile and every endpoint on the surface\n\t * default to an authorizer that does not exist.\n\t */\n\tdefaultAuthorizer: TAuthorizers[number] | BuiltInSecuritySchemeId | 'none';\n\t/**\n\t * The logger every endpoint on this surface runs with.\n\t *\n\t * The actual logger, not a path to one. It used to be named in config as\n\t * `logger: './config/logger'`, because the build wrote an import into each\n\t * generated handler and a generator can print a specifier but not an object.\n\t * Endpoints built from the surface carry it, so there is nothing to print\n\t * and nothing to keep in step with a moved file.\n\t */\n\tlogger?: Logger;\n\t/**\n\t * The environment parser every endpoint on this surface runs with.\n\t *\n\t * Same reason as `logger`, and the same field it replaces —\n\t * `envParser: './config/env#envParser'`, a module path with an export name\n\t * appended, parsed by us, checked by nothing.\n\t */\n\tenvParser?: EnvironmentParser<{}>;\n\t/**\n\t * The Telescope instance this surface's entry mounts.\n\t *\n\t * The actual instance, for the reason `logger` is: it used to be named as\n\t * `telescope: './config/telescope#telescope'`, a module path the build\n\t * printed an import for. The entry already imports the surface.\n\t */\n\ttelescope?: Telescope;\n}\n\n/**\n * What is *not* here, and why.\n *\n * `dependsOn`, `database`, `auditor` and `publisher` all inject a capability\n * into a handler. Putting one on the surface hands it to every route the\n * surface serves — a health check gets the database because a report needed it\n * — which is the thing least privilege forbids and the reason `.calls()` is not\n * spelled `dependsOn`. They belong to the endpoint, or to a branch —\n * `api.database(db)` — for a group of endpoints that genuinely share them. A\n * branch is a new factory; the surface config stays free of grants.\n *\n * `auth` is not here either: `.auth(construct)` already declares it, and a\n * second way to say the same thing is the duplication this whole model removes.\n *\n * What is left is what the *process* is rather than what a route may reach.\n */\n\nexport class RestApi<\n\tTName extends string = string,\n\tconst TAuthorizers extends readonly string[] = readonly [],\n> implements Declarable<TName>\n{\n\treadonly id: TName;\n\n\t/**\n\t * Declared once and read by both `declare()` and anything that consumes this\n\t * surface, so what the target publishes and what a consumer reads cannot\n\t * drift.\n\t */\n\treadonly keys: {\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\t/**\n\t * The logger every endpoint on this surface runs with.\n\t *\n\t * Always defined — the surface's own if it was given one, the console\n\t * logger otherwise — so nothing downstream has to decide what to do about a\n\t * missing one. The generated entry reads it from here.\n\t */\n\treadonly logger: Logger;\n\n\t/**\n\t * The environment parser every endpoint on this surface runs with.\n\t *\n\t * Always defined, and normally the default: `process.env` merged with the\n\t * credentials `gkm dev`/`gkm exec` injected. That is what every\n\t * application's own `config/env.ts` was — boilerplate identical in every\n\t * project, and mandatory, which is a poor combination.\n\t */\n\treadonly envParser: EnvironmentParser<{}>;\n\n\t/** The Telescope instance, when this surface was given one. */\n\treadonly telescope?: Telescope;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: RestApiConfig<TAuthorizers>,\n\t\t/** Internal: how `.calls()` carries edges into the copy it returns. */\n\t\tprivate readonly dependencies: readonly Dependency[] = [],\n\t\t/** Internal: how `.auth()` carries the authenticator into its copy. */\n\t\tprivate readonly authenticator?: Authenticator,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\n\t\tthis.keys = {\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\tthis.logger = config.logger ?? DEFAULT_LOGGER;\n\t\tthis.telescope = config.telescope;\n\t\tthis.envParser = envParserFor(\n\t\t\tconfig.envParser\n\t\t\t\t? { id: canonical, envParser: config.envParser }\n\t\t\t\t: undefined,\n\t\t);\n\n\t\tthis.#endpoints = new EndpointFactory({\n\t\t\tdefaultLogger: this.logger,\n\t\t\t...(config.authorizers\n\t\t\t\t? {\n\t\t\t\t\t\t// With the scheme a built-in name stands for, as the factory's own\n\t\t\t\t\t\t// `.authorizers()` resolves it. Bare names reached the OpenAPI\n\t\t\t\t\t\t// document with no scheme, so a guarded endpoint read as public.\n\t\t\t\t\t\tavailableAuthorizers: config.authorizers.map((name) => {\n\t\t\t\t\t\t\tconst securityScheme = getSecurityScheme(name);\n\t\t\t\t\t\t\treturn securityScheme ? { name, securityScheme } : { name };\n\t\t\t\t\t\t}),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t// `'none'` reaches the factory as no default at all, which is what\n\t\t\t// public means to an endpoint that names no authorizer.\n\t\t\t...(config.defaultAuthorizer && config.defaultAuthorizer !== 'none'\n\t\t\t\t? { defaultAuthorizerName: config.defaultAuthorizer }\n\t\t\t\t: {}),\n\t\t\tsurface: {\n\t\t\t\tid: this.id,\n\t\t\t\tenvParser: this.envParser,\n\t\t\t\t...(authenticator ? { auth: authenticator } : {}),\n\t\t\t},\n\t\t});\n\n\t\tconst endpoints = this.#endpoints;\n\t\tthis.get = endpoints.get.bind(endpoints);\n\t\tthis.post = endpoints.post.bind(endpoints);\n\t\tthis.put = endpoints.put.bind(endpoints);\n\t\tthis.patch = endpoints.patch.bind(endpoints);\n\t\tthis.delete = endpoints.delete.bind(endpoints);\n\t\tthis.options = endpoints.options.bind(endpoints);\n\t\tthis.database = endpoints.database.bind(endpoints);\n\t\tthis.session = endpoints.session.bind(endpoints);\n\t\tthis.auditor = endpoints.auditor.bind(endpoints);\n\t\tthis.actor = endpoints.actor.bind(endpoints);\n\t\tthis.publisher = endpoints.publisher.bind(endpoints);\n\t\tthis.authorizer = endpoints.authorizer.bind(endpoints);\n\t\tthis.authorize = endpoints.authorize.bind(endpoints);\n\t\tthis.rls = endpoints.rls.bind(endpoints);\n\t\tthis.route = endpoints.route.bind(endpoints);\n\t}\n\n\t/**\n\t * This surface's endpoint factory, which every method below starts from.\n\t *\n\t * Private: a surface *is* where endpoints are built, so there is no second\n\t * object to reach through first. `api.database(db)` said the same\n\t * thing as `api.database(db)` with one more word to learn.\n\t */\n\treadonly #endpoints: Endpoints;\n\n\t/** `api.get('/users')` — one route on this surface. */\n\treadonly get: Endpoints['get'];\n\treadonly post: Endpoints['post'];\n\treadonly put: Endpoints['put'];\n\treadonly patch: Endpoints['patch'];\n\treadonly delete: Endpoints['delete'];\n\treadonly options: Endpoints['options'];\n\n\t/**\n\t * A branch for a *group* of endpoints that shares what a single route would\n\t * otherwise repeat — a database, an auditor, a publisher, a session:\n\t *\n\t * ```ts\n\t * export const router = api.database(database);\n\t * export const createUser = router.post('/users').handle(({ db }) => …);\n\t * ```\n\t *\n\t * Each returns a new factory and leaves the surface as it was. That is the\n\t * whole difference from putting the same thing in the surface's config: a\n\t * group opts in, where the surface would grant it to every route it serves —\n\t * a health check handed the database because a profile endpoint needed it.\n\t *\n\t * `dependsOn` is deliberately not here. It is per endpoint, and on the\n\t * surface it would read as the API depending on something, which is what\n\t * `.calls()` and `.auth()` say instead.\n\t */\n\treadonly database: Endpoints['database'];\n\treadonly session: Endpoints['session'];\n\treadonly auditor: Endpoints['auditor'];\n\treadonly actor: Endpoints['actor'];\n\treadonly publisher: Endpoints['publisher'];\n\treadonly authorizer: Endpoints['authorizer'];\n\treadonly authorize: Endpoints['authorize'];\n\treadonly rls: Endpoints['rls'];\n\treadonly route: Endpoints['route'];\n\n\t/**\n\t * What authenticates this surface.\n\t *\n\t * An edge like `.calls()` — the auth server learns this origin, and the two\n\t * share a cookie domain — but a named one, because *who authenticates me* is\n\t * a different fact from *who I happen to call*, and only one of them decides\n\t * what a request is allowed to be. A surface with two of the first is a\n\t * mistake; two of the second is Tuesday.\n\t *\n\t * It declares the id, and keeps the construct: a session callback reads from\n\t * it as `auth` — `session(async ({ auth }) => auth.getSession())` — which\n\t * calls the construct's `verify(headers)`. That is the one thing every\n\t * provider shares, whether the server is mounted in this process, deployed\n\t * beside it, or an OIDC issuer somebody else runs.\n\t */\n\tauth(construct: Authenticator): RestApi<TName, TAuthorizers> {\n\t\treturn new RestApi<TName, TAuthorizers>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, edgeTo(construct)],\n\t\t\tconstruct,\n\t\t);\n\t}\n\n\t/**\n\t * Other surfaces this one calls.\n\t *\n\t * **Not `.dependsOn()`, and the difference matters.** An endpoint's\n\t * `.dependsOn()` injects a client into that handler and grants it exactly\n\t * what it named. This grants nothing and injects nothing: it records that\n\t * this API calls another surface, which is what puts this API's origin on\n\t * that surface's trusted-origin list.\n\t *\n\t * Spelling it `dependsOn` would invite the thing least privilege forbids —\n\t * every route on the surface receiving whatever the surface named.\n\t *\n\t * Immutable, like every other builder here.\n\t */\n\tcalls(constructs: readonly Declarable[]): RestApi<TName, TAuthorizers> {\n\t\treturn new RestApi<TName, TAuthorizers>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, ...constructs.map(edgeTo)],\n\t\t\tthis.authenticator,\n\t\t);\n\t}\n\n\t/**\n\t * One surface node, with its endpoints left to the build.\n\t *\n\t * The three provided keys are one fact about this surface and two about its\n\t * callers. Declaring the caller-derived pair here rather than having the\n\t * target invent them is what makes the contract checkable: a target that\n\t * resolves no origins is caught against this list instead of being noticed\n\t * when a browser is refused in production.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\tpath: this.config.path,\n\t\t\t\t...(this.config.telescope ? { telescope: true } : {}),\n\t\t\t\t...(this.config.cors ? { cors: this.config.cors } : {}),\n\t\t\t\t...(this.authenticator ? { auth: this.authenticator.id } : {}),\n\t\t\t\t// Filled by the build, which already generates one handler per\n\t\t\t\t// endpoint and knows the path it wrote it to. A surface that\n\t\t\t\t// enumerates its own routes statically — an auth server's single\n\t\t\t\t// wildcard — puts them here instead.\n\t\t\t\tendpoints: [],\n\t\t\t\t...(this.dependencies.length ? { calls: this.dependencies } : {}),\n\t\t\t\t...(this.config.authorizers?.length\n\t\t\t\t\t? { authorizers: this.config.authorizers }\n\t\t\t\t\t: {}),\n\t\t\t\tdefaultAuthorizer: this.config.defaultAuthorizer,\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuJA,IAAa,UAAb,MAAa,QAIb;CAsCmB;CAEA;CAEA;CAzClB;;;;;;CAOA;;;;;;;;CAaA;;;;;;;;;CAUA;;CAGA;CAEA,YACC,IACA,QAEA,eAAuD,CAAC,GAExD,eACC;EALgB,KAAA,SAAA;EAEA,KAAA,eAAA;EAEA,KAAA,gBAAA;EAEjB,MAAM,YAAY,YAAY,EAAY;EAE1C,KAAK,KAAK;EAEV,KAAK,OAAO;GACX,KAAK,WAAW,WAAW,KAAK;GAChC,gBAAgB,WAAW,WAAW,gBAAgB;GACtD,cAAc,WAAW,WAAW,cAAc;EACnD;EAEA,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,YAAY,OAAO;EACxB,KAAK,YAAY,aAChB,OAAO,YACJ;GAAE,IAAI;GAAW,WAAW,OAAO;EAAU,IAC7C,KAAA,CACJ;EAEA,KAAK,aAAa,IAAI,gBAAgB;GACrC,eAAe,KAAK;GACpB,GAAI,OAAO,cACR,EAIA,sBAAsB,OAAO,YAAY,KAAK,SAAS;IACtD,MAAM,iBAAiB,kBAAkB,IAAI;IAC7C,OAAO,iBAAiB;KAAE;KAAM;IAAe,IAAI,EAAE,KAAK;GAC3D,CAAC,EACF,IACC,CAAC;GAGJ,GAAI,OAAO,qBAAqB,OAAO,sBAAsB,SAC1D,EAAE,uBAAuB,OAAO,kBAAkB,IAClD,CAAC;GACJ,SAAS;IACR,IAAI,KAAK;IACT,WAAW,KAAK;IAChB,GAAI,gBAAgB,EAAE,MAAM,cAAc,IAAI,CAAC;GAChD;EACD,CAAC;EAED,MAAM,YAAY,KAAK;EACvB,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,OAAO,UAAU,KAAK,KAAK,SAAS;EACzC,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;EAC3C,KAAK,SAAS,UAAU,OAAO,KAAK,SAAS;EAC7C,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,WAAW,UAAU,SAAS,KAAK,SAAS;EACjD,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;EAC3C,KAAK,YAAY,UAAU,UAAU,KAAK,SAAS;EACnD,KAAK,aAAa,UAAU,WAAW,KAAK,SAAS;EACrD,KAAK,YAAY,UAAU,UAAU,KAAK,SAAS;EACnD,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;CAC5C;;;;;;;;CASA;;CAGA;CACA;CACA;CACA;CACA;CACA;;;;;;;;;;;;;;;;;;;CAoBA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;;;;;;;;;;CAiBA,KAAK,WAAwD;EAC5D,OAAO,IAAI,QACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAc,OAAO,SAAS,CAAC,GACxC,SACD;CACD;;;;;;;;;;;;;;;CAgBA,MAAM,YAAiE;EACtE,OAAO,IAAI,QACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAc,GAAG,WAAW,IAAI,MAAM,CAAC,GAChD,KAAK,aACN;CACD;;;;;;;;;;CAWA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,MAAM,KAAK,OAAO;GAClB,GAAI,KAAK,OAAO,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;GACnD,GAAI,KAAK,OAAO,OAAO,EAAE,MAAM,KAAK,OAAO,KAAK,IAAI,CAAC;GACrD,GAAI,KAAK,gBAAgB,EAAE,MAAM,KAAK,cAAc,GAAG,IAAI,CAAC;GAK5D,WAAW,CAAC;GACZ,GAAI,KAAK,aAAa,SAAS,EAAE,OAAO,KAAK,aAAa,IAAI,CAAC;GAC/D,GAAI,KAAK,OAAO,aAAa,SAC1B,EAAE,aAAa,KAAK,OAAO,YAAY,IACvC,CAAC;GACJ,mBAAmB,KAAK,OAAO;GAC/B,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACX;EACD,CACD;CACD;AACD"}
+{"version":3,"file":"rest-api.mjs","names":[],"sources":["../src/rest-api.ts"],"sourcesContent":["/**\n * `RestApi` — the application's own HTTP surface, declared.\n *\n * Everything an app serves already existed; what did not exist was a *node* for\n * it. Without one, three things that are properties of the graph had to be\n * written down somewhere else: which origins the API accepts, which origins the\n * auth server trusts, and which URL a frontend is built against. All three were\n * being derived by walking the workspace config for ports — a second mechanism,\n * running beside the graph and answering the same question worse, since it can\n * only ever describe what this repo happens to run.\n *\n * With the surface declared, all three become one edge read backwards: a\n * consumer depends on the API, and *that* is the CORS entry, the trusted origin,\n * and the build-time URL. Nothing enumerates its own callers.\n *\n * ```ts\n * export const api = new RestApi('Api', {\n *   authorizers: ['session'],\n *   defaultAuthorizer: 'session',\n * });\n * ```\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Logger } from '@geekmidas/logger';\nimport { DEFAULT_LOGGER } from '@geekmidas/logger/console';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\ttype Dependency,\n\tprovideKey,\n} from '@geekmidas/manifest';\nimport type { Telescope } from '@geekmidas/telescope';\nimport {\n\ttype Authenticator,\n\ttype Declarable,\n\tedgeTo,\n} from './construct-interface';\n\nexport type { Authenticator } from './construct-interface';\n\nimport {\n\ttype BuiltInSecuritySchemeId,\n\tgetSecurityScheme,\n} from './endpoints/Authorizer';\nimport { EndpointFactory } from './endpoints/EndpointFactory';\nimport { envParserFor } from './endpoints/surfaceEnv';\n\n/** The factory a surface builds its endpoints from. */\ntype Endpoints = EndpointFactory<[], '', Logger>;\n\nexport interface RestApiConfig<\n\t// `readonly []` rather than `readonly string[]`: a surface that declares no\n\t// authorizers of its own should narrow `defaultAuthorizer` to the built-ins\n\t// and `'none'`, not widen it back to any string.\n\tTAuthorizers extends readonly string[] = readonly [],\n> {\n\t/**\n\t * The app that serves this surface, relative to the workspace root —\n\t * `'apps/api'`, or `'.'` in a single-app project.\n\t *\n\t * Required. It was inferred from the id (`apps/<kebab-id>`, or the root\n\t * when no such directory existed), which meant a surface's home was\n\t * whatever happened to be on disk. It is where the app's `package.json`\n\t * and base `tsconfig.json` are, and which build serves this surface. It\n\t * does not change discovery: constructs still load from the workspace's\n\t * `constructs` glob.\n\t */\n\tpath: string;\n\t/**\n\t * CORS tunables. The *origins* are never here — they are read off the\n\t * constructs that declared an edge to this surface, which is the whole point\n\t * of declaring one. These are the parts a graph cannot answer.\n\t */\n\tcors?: {\n\t\tmaxAge?: number;\n\t\tcredentials?: boolean;\n\t\tallowHeaders?: readonly string[];\n\t\texposeHeaders?: readonly string[];\n\t};\n\t/**\n\t * The authorizer names this surface exposes. Names only — what verifies a\n\t * request legitimately differs between local and deployed, so the mechanism\n\t * belongs to the target and never to portable code.\n\t */\n\tauthorizers?: TAuthorizers;\n\t/**\n\t * The authorizer applied to an endpoint that names none.\n\t *\n\t * Required, and `'none'` is a valid answer that has to be typed out. The\n\t * alternative is an API that ships open because a field was left off, which\n\t * is the one default worth refusing to have.\n\t *\n\t * It was called `default`, which said what it was to the type and nothing\n\t * to the reader: next to `authorizers: ['iam']`, a bare `default: 'none'`\n\t * could be defaulting the runtime or the target. The manifest has always\n\t * called it `defaultAuthorizer` and the factory `defaultAuthorizerName`;\n\t * this is the same fact under the same name.\n\t *\n\t * Typed from `authorizers`, so it can only name one this surface exposes —\n\t * plus a built-in scheme, and `'none'`. It was a bare `string`, which let\n\t * `defaultAuthorizer: 'jwtt'` compile and every endpoint on the surface\n\t * default to an authorizer that does not exist.\n\t */\n\tdefaultAuthorizer: TAuthorizers[number] | BuiltInSecuritySchemeId | 'none';\n\t/**\n\t * The logger every endpoint on this surface runs with.\n\t *\n\t * The actual logger, not a path to one. It used to be named in config as\n\t * `logger: './config/logger'`, because the build wrote an import into each\n\t * generated handler and a generator can print a specifier but not an object.\n\t * Endpoints built from the surface carry it, so there is nothing to print\n\t * and nothing to keep in step with a moved file.\n\t */\n\tlogger?: Logger;\n\t/**\n\t * The environment parser every endpoint on this surface runs with.\n\t *\n\t * Same reason as `logger`, and the same field it replaces —\n\t * `envParser: './config/env#envParser'`, a module path with an export name\n\t * appended, parsed by us, checked by nothing.\n\t */\n\tenvParser?: EnvironmentParser<{}>;\n\t/**\n\t * The Telescope instance this surface's entry mounts.\n\t *\n\t * The actual instance, for the reason `logger` is: it used to be named as\n\t * `telescope: './config/telescope#telescope'`, a module path the build\n\t * printed an import for. The entry already imports the surface.\n\t */\n\ttelescope?: Telescope;\n}\n\n/**\n * What is *not* here, and why.\n *\n * `dependsOn`, `database`, `auditor` and `.event(topic, …)` all inject a capability\n * into a handler. Putting one on the surface hands it to every route the\n * surface serves — a health check gets the database because a report needed it\n * — which is the thing least privilege forbids and the reason `.calls()` is not\n * spelled `dependsOn`. They belong to the endpoint, or to a branch —\n * `api.database(db)` — for a group of endpoints that genuinely share them. A\n * branch is a new factory; the surface config stays free of grants.\n *\n * `auth` is not here either: `.auth(construct)` already declares it, and a\n * second way to say the same thing is the duplication this whole model removes.\n *\n * What is left is what the *process* is rather than what a route may reach.\n */\n\nexport class RestApi<\n\tTName extends string = string,\n\tconst TAuthorizers extends readonly string[] = readonly [],\n> implements Declarable<TName>\n{\n\treadonly id: TName;\n\n\t/**\n\t * Declared once and read by both `declare()` and anything that consumes this\n\t * surface, so what the target publishes and what a consumer reads cannot\n\t * drift.\n\t */\n\treadonly keys: {\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\t/**\n\t * The logger every endpoint on this surface runs with.\n\t *\n\t * Always defined — the surface's own if it was given one, the console\n\t * logger otherwise — so nothing downstream has to decide what to do about a\n\t * missing one. The generated entry reads it from here.\n\t */\n\treadonly logger: Logger;\n\n\t/**\n\t * The environment parser every endpoint on this surface runs with.\n\t *\n\t * Always defined, and normally the default: `process.env` merged with the\n\t * credentials `gkm dev`/`gkm exec` injected. That is what every\n\t * application's own `config/env.ts` was — boilerplate identical in every\n\t * project, and mandatory, which is a poor combination.\n\t */\n\treadonly envParser: EnvironmentParser<{}>;\n\n\t/** The Telescope instance, when this surface was given one. */\n\treadonly telescope?: Telescope;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: RestApiConfig<TAuthorizers>,\n\t\t/** Internal: how `.calls()` carries edges into the copy it returns. */\n\t\tprivate readonly dependencies: readonly Dependency[] = [],\n\t\t/** Internal: how `.auth()` carries the authenticator into its copy. */\n\t\tprivate readonly authenticator?: Authenticator,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\n\t\tthis.keys = {\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\tthis.logger = config.logger ?? DEFAULT_LOGGER;\n\t\tthis.telescope = config.telescope;\n\t\tthis.envParser = envParserFor(\n\t\t\tconfig.envParser\n\t\t\t\t? { id: canonical, envParser: config.envParser }\n\t\t\t\t: undefined,\n\t\t);\n\n\t\tthis.#endpoints = new EndpointFactory({\n\t\t\tdefaultLogger: this.logger,\n\t\t\t...(config.authorizers\n\t\t\t\t? {\n\t\t\t\t\t\t// With the scheme a built-in name stands for, as the factory's own\n\t\t\t\t\t\t// `.authorizers()` resolves it. Bare names reached the OpenAPI\n\t\t\t\t\t\t// document with no scheme, so a guarded endpoint read as public.\n\t\t\t\t\t\tavailableAuthorizers: config.authorizers.map((name) => {\n\t\t\t\t\t\t\tconst securityScheme = getSecurityScheme(name);\n\t\t\t\t\t\t\treturn securityScheme ? { name, securityScheme } : { name };\n\t\t\t\t\t\t}),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t// `'none'` reaches the factory as no default at all, which is what\n\t\t\t// public means to an endpoint that names no authorizer.\n\t\t\t...(config.defaultAuthorizer && config.defaultAuthorizer !== 'none'\n\t\t\t\t? { defaultAuthorizerName: config.defaultAuthorizer }\n\t\t\t\t: {}),\n\t\t\tsurface: {\n\t\t\t\tid: this.id,\n\t\t\t\tenvParser: this.envParser,\n\t\t\t\t...(authenticator ? { auth: authenticator } : {}),\n\t\t\t},\n\t\t});\n\n\t\tconst endpoints = this.#endpoints;\n\t\tthis.get = endpoints.get.bind(endpoints);\n\t\tthis.post = endpoints.post.bind(endpoints);\n\t\tthis.put = endpoints.put.bind(endpoints);\n\t\tthis.patch = endpoints.patch.bind(endpoints);\n\t\tthis.delete = endpoints.delete.bind(endpoints);\n\t\tthis.options = endpoints.options.bind(endpoints);\n\t\tthis.database = endpoints.database.bind(endpoints);\n\t\tthis.session = endpoints.session.bind(endpoints);\n\t\tthis.auditor = endpoints.auditor.bind(endpoints);\n\t\tthis.actor = endpoints.actor.bind(endpoints);\n\t\tthis.authorizer = endpoints.authorizer.bind(endpoints);\n\t\tthis.authorize = endpoints.authorize.bind(endpoints);\n\t\tthis.rls = endpoints.rls.bind(endpoints);\n\t\tthis.route = endpoints.route.bind(endpoints);\n\t}\n\n\t/**\n\t * This surface's endpoint factory, which every method below starts from.\n\t *\n\t * Private: a surface *is* where endpoints are built, so there is no second\n\t * object to reach through first. `api.database(db)` said the same\n\t * thing as `api.database(db)` with one more word to learn.\n\t */\n\treadonly #endpoints: Endpoints;\n\n\t/** `api.get('/users')` — one route on this surface. */\n\treadonly get: Endpoints['get'];\n\treadonly post: Endpoints['post'];\n\treadonly put: Endpoints['put'];\n\treadonly patch: Endpoints['patch'];\n\treadonly delete: Endpoints['delete'];\n\treadonly options: Endpoints['options'];\n\n\t/**\n\t * A branch for a *group* of endpoints that shares what a single route would\n\t * otherwise repeat — a database, an auditor, a publisher, a session:\n\t *\n\t * ```ts\n\t * export const router = api.database(database);\n\t * export const createUser = router.post('/users').handle(({ db }) => …);\n\t * ```\n\t *\n\t * Each returns a new factory and leaves the surface as it was. That is the\n\t * whole difference from putting the same thing in the surface's config: a\n\t * group opts in, where the surface would grant it to every route it serves —\n\t * a health check handed the database because a profile endpoint needed it.\n\t *\n\t * `dependsOn` is deliberately not here. It is per endpoint, and on the\n\t * surface it would read as the API depending on something, which is what\n\t * `.calls()` and `.auth()` say instead.\n\t */\n\treadonly database: Endpoints['database'];\n\treadonly session: Endpoints['session'];\n\treadonly auditor: Endpoints['auditor'];\n\treadonly actor: Endpoints['actor'];\n\treadonly authorizer: Endpoints['authorizer'];\n\treadonly authorize: Endpoints['authorize'];\n\treadonly rls: Endpoints['rls'];\n\treadonly route: Endpoints['route'];\n\n\t/**\n\t * What authenticates this surface.\n\t *\n\t * An edge like `.calls()` — the auth server learns this origin, and the two\n\t * share a cookie domain — but a named one, because *who authenticates me* is\n\t * a different fact from *who I happen to call*, and only one of them decides\n\t * what a request is allowed to be. A surface with two of the first is a\n\t * mistake; two of the second is Tuesday.\n\t *\n\t * It declares the id, and keeps the construct: a session callback reads from\n\t * it as `auth` — `session(async ({ auth }) => auth.getSession())` — which\n\t * calls the construct's `verify(headers)`. That is the one thing every\n\t * provider shares, whether the server is mounted in this process, deployed\n\t * beside it, or an OIDC issuer somebody else runs.\n\t */\n\tauth(construct: Authenticator): RestApi<TName, TAuthorizers> {\n\t\treturn new RestApi<TName, TAuthorizers>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, edgeTo(construct)],\n\t\t\tconstruct,\n\t\t);\n\t}\n\n\t/**\n\t * Other surfaces this one calls.\n\t *\n\t * **Not `.dependsOn()`, and the difference matters.** An endpoint's\n\t * `.dependsOn()` injects a client into that handler and grants it exactly\n\t * what it named. This grants nothing and injects nothing: it records that\n\t * this API calls another surface, which is what puts this API's origin on\n\t * that surface's trusted-origin list.\n\t *\n\t * Spelling it `dependsOn` would invite the thing least privilege forbids —\n\t * every route on the surface receiving whatever the surface named.\n\t *\n\t * Immutable, like every other builder here.\n\t */\n\tcalls(constructs: readonly Declarable[]): RestApi<TName, TAuthorizers> {\n\t\treturn new RestApi<TName, TAuthorizers>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, ...constructs.map(edgeTo)],\n\t\t\tthis.authenticator,\n\t\t);\n\t}\n\n\t/**\n\t * One surface node, with its endpoints left to the build.\n\t *\n\t * The three provided keys are one fact about this surface and two about its\n\t * callers. Declaring the caller-derived pair here rather than having the\n\t * target invent them is what makes the contract checkable: a target that\n\t * resolves no origins is caught against this list instead of being noticed\n\t * when a browser is refused in production.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\tpath: this.config.path,\n\t\t\t\t...(this.config.telescope ? { telescope: true } : {}),\n\t\t\t\t...(this.config.cors ? { cors: this.config.cors } : {}),\n\t\t\t\t...(this.authenticator ? { auth: this.authenticator.id } : {}),\n\t\t\t\t// Filled by the build, which already generates one handler per\n\t\t\t\t// endpoint and knows the path it wrote it to. A surface that\n\t\t\t\t// enumerates its own routes statically — an auth server's single\n\t\t\t\t// wildcard — puts them here instead.\n\t\t\t\tendpoints: [],\n\t\t\t\t...(this.dependencies.length ? { calls: this.dependencies } : {}),\n\t\t\t\t...(this.config.authorizers?.length\n\t\t\t\t\t? { authorizers: this.config.authorizers }\n\t\t\t\t\t: {}),\n\t\t\t\tdefaultAuthorizer: this.config.defaultAuthorizer,\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuJA,IAAa,UAAb,MAAa,QAIb;CAsCmB;CAEA;CAEA;CAzClB;;;;;;CAOA;;;;;;;;CAaA;;;;;;;;;CAUA;;CAGA;CAEA,YACC,IACA,QAEA,eAAuD,CAAC,GAExD,eACC;EALgB,KAAA,SAAA;EAEA,KAAA,eAAA;EAEA,KAAA,gBAAA;EAEjB,MAAM,YAAY,YAAY,EAAY;EAE1C,KAAK,KAAK;EAEV,KAAK,OAAO;GACX,KAAK,WAAW,WAAW,KAAK;GAChC,gBAAgB,WAAW,WAAW,gBAAgB;GACtD,cAAc,WAAW,WAAW,cAAc;EACnD;EAEA,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,YAAY,OAAO;EACxB,KAAK,YAAY,aAChB,OAAO,YACJ;GAAE,IAAI;GAAW,WAAW,OAAO;EAAU,IAC7C,KAAA,CACJ;EAEA,KAAK,aAAa,IAAI,gBAAgB;GACrC,eAAe,KAAK;GACpB,GAAI,OAAO,cACR,EAIA,sBAAsB,OAAO,YAAY,KAAK,SAAS;IACtD,MAAM,iBAAiB,kBAAkB,IAAI;IAC7C,OAAO,iBAAiB;KAAE;KAAM;IAAe,IAAI,EAAE,KAAK;GAC3D,CAAC,EACF,IACC,CAAC;GAGJ,GAAI,OAAO,qBAAqB,OAAO,sBAAsB,SAC1D,EAAE,uBAAuB,OAAO,kBAAkB,IAClD,CAAC;GACJ,SAAS;IACR,IAAI,KAAK;IACT,WAAW,KAAK;IAChB,GAAI,gBAAgB,EAAE,MAAM,cAAc,IAAI,CAAC;GAChD;EACD,CAAC;EAED,MAAM,YAAY,KAAK;EACvB,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,OAAO,UAAU,KAAK,KAAK,SAAS;EACzC,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;EAC3C,KAAK,SAAS,UAAU,OAAO,KAAK,SAAS;EAC7C,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,WAAW,UAAU,SAAS,KAAK,SAAS;EACjD,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;EAC3C,KAAK,aAAa,UAAU,WAAW,KAAK,SAAS;EACrD,KAAK,YAAY,UAAU,UAAU,KAAK,SAAS;EACnD,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;CAC5C;;;;;;;;CASA;;CAGA;CACA;CACA;CACA;CACA;CACA;;;;;;;;;;;;;;;;;;;CAoBA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;;;;;;;;;;CAiBA,KAAK,WAAwD;EAC5D,OAAO,IAAI,QACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAc,OAAO,SAAS,CAAC,GACxC,SACD;CACD;;;;;;;;;;;;;;;CAgBA,MAAM,YAAiE;EACtE,OAAO,IAAI,QACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAc,GAAG,WAAW,IAAI,MAAM,CAAC,GAChD,KAAK,aACN;CACD;;;;;;;;;;CAWA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,MAAM,KAAK,OAAO;GAClB,GAAI,KAAK,OAAO,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;GACnD,GAAI,KAAK,OAAO,OAAO,EAAE,MAAM,KAAK,OAAO,KAAK,IAAI,CAAC;GACrD,GAAI,KAAK,gBAAgB,EAAE,MAAM,KAAK,cAAc,GAAG,IAAI,CAAC;GAK5D,WAAW,CAAC;GACZ,GAAI,KAAK,aAAa,SAAS,EAAE,OAAO,KAAK,aAAa,IAAI,CAAC;GAC/D,GAAI,KAAK,OAAO,aAAa,SAC1B,EAAE,aAAa,KAAK,OAAO,YAAY,IACvC,CAAC;GACJ,mBAAmB,KAAK,OAAO;GAC/B,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACX;EACD,CACD;CACD;AACD"}

package/dist/site.d.cts

@@ -1,4 +1,4 @@
-import { i as Declarable } from "./construct-interface-DcNaRKoC.cjs";
+import { i as Declarable } from "./construct-interface-_xi4BPN8.cjs";
 import { ConstructName, Declaration, Dependency, SiteDeclaration } from "@geekmidas/manifest";
 //#region src/site.d.ts
 /**

package/dist/site.d.mts

@@ -1,4 +1,4 @@
-import { i as Declarable } from "./construct-interface-BLG_BEH5.mjs";
+import { i as Declarable } from "./construct-interface-_3zgxzXl.mjs";
 import { ConstructName, Declaration, Dependency, SiteDeclaration } from "@geekmidas/manifest";
 //#region src/site.d.ts
 /**

package/dist/subscribers/index.cjs

@@ -1,4 +1,4 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_SubscriberBuilder = require("../SubscriberBuilder-C2bCOuPT.cjs");
+const require_SubscriberBuilder = require("../SubscriberBuilder-Duk028pD.cjs");
 exports.Subscriber = require_SubscriberBuilder.Subscriber;
 exports.SubscriberBuilder = require_SubscriberBuilder.SubscriberBuilder;

package/dist/subscribers/index.d.cts

@@ -1,3 +1,3 @@
-import { t as Subscriber } from "../Subscriber-DQCaiOXF.cjs";
-import { t as SubscriberBuilder } from "../SubscriberBuilder-CIXTozBi.cjs";
+import { t as Subscriber } from "../Subscriber-B91YSkZt.cjs";
+import { t as SubscriberBuilder } from "../SubscriberBuilder-BSpQX1JT.cjs";
 export { Subscriber, SubscriberBuilder };

package/dist/subscribers/index.d.mts

@@ -1,3 +1,3 @@
-import { t as Subscriber } from "../Subscriber-CIO3pwji.mjs";
-import { t as SubscriberBuilder } from "../SubscriberBuilder-CMBzPdRX.mjs";
+import { t as Subscriber } from "../Subscriber-BjHYe5hK.mjs";
+import { t as SubscriberBuilder } from "../SubscriberBuilder-BhMphk4z.mjs";
 export { Subscriber, SubscriberBuilder };

package/dist/subscribers/index.mjs

@@ -1,2 +1,2 @@
-import { n as Subscriber, t as SubscriberBuilder } from "../SubscriberBuilder-B4YRTBng.mjs";
+import { n as Subscriber, t as SubscriberBuilder } from "../SubscriberBuilder-DzQUWE08.mjs";
 export { Subscriber, SubscriberBuilder };

package/dist/topic/index.cjs

@@ -1,38 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_clone = require("../clone-UGJpvQnL.cjs");
-const require_Topic = require("../Topic-D5rlM9wS.cjs");
-let _geekmidas_logger_console = require("@geekmidas/logger/console");
-//#region src/topic/TopicBuilder.ts
-/**
-* Builds a {@link Topic} — `t.topic('users').events({ 'user.created': schema, … })`.
-* The event map is the topic's contract: it types the derived `topic.publisher`
-* and the subscribers that bind via `s.topic(topic)`.
-*/
-var TopicBuilder = class {
-	_name;
-	_logger = _geekmidas_logger_console.DEFAULT_LOGGER;
-	/** The topic name — drives the infra topic and its `<NAME>_*` env vars. */
-	topic(name) {
-		return require_clone.cloneWith(this, { _name: name });
-	}
-	logger(logger) {
-		return require_clone.cloneWith(this, { _logger: logger });
-	}
-	/**
-	* The event contract — a map of event type → payload schema. Building the
-	* topic requires this; it's what types the publisher and subscribers.
-	*/
-	events(events) {
-		if (!this._name) throw new Error("Topic requires a name — call .topic(name) before .events().");
-		return new require_Topic.Topic(this._name, events, this._logger);
-	}
-};
-//#endregion
-//#region src/topic/index.ts
-const t = new TopicBuilder();
-//#endregion
+const require_Topic = require("../Topic-BBVXC3H4.cjs");
 exports.Topic = require_Topic.Topic;
-exports.TopicBuilder = TopicBuilder;
-exports.t = t;
-
-//# sourceMappingURL=index.cjs.map

package/dist/topic/index.d.cts

@@ -1,3 +1,2 @@
-import { n as TopicEvents, r as TopicMessage, t as Topic } from "../Topic-D6blllEn.cjs";
-import { n as TopicBuilder, t } from "../index-tE_119SX.cjs";
-export { Topic, TopicBuilder, type TopicEvents, type TopicMessage, t };
+import { c as Topic, d as TopicOptions, l as TopicEvents, u as TopicMessage } from "../Construct-BQALFCh2.cjs";
+export { Topic, type TopicEvents, type TopicMessage, type TopicOptions };

package/dist/topic/index.d.mts

@@ -1,3 +1,2 @@
-import { n as TopicEvents, r as TopicMessage, t as Topic } from "../Topic-DVvheJ_-.mjs";
-import { n as TopicBuilder, t } from "../index-fnpjXiA-.mjs";
-export { Topic, TopicBuilder, type TopicEvents, type TopicMessage, t };
+import { c as Topic, d as TopicOptions, l as TopicEvents, u as TopicMessage } from "../Construct-QXnl3VqT.mjs";
+export { Topic, type TopicEvents, type TopicMessage, type TopicOptions };

package/dist/topic/index.mjs

@@ -1,35 +1,2 @@
-import { t as cloneWith } from "../clone-EKNovYHu.mjs";
-import { t as Topic } from "../Topic-Ct3Le8Wt.mjs";
-import { DEFAULT_LOGGER } from "@geekmidas/logger/console";
-//#region src/topic/TopicBuilder.ts
-/**
-* Builds a {@link Topic} — `t.topic('users').events({ 'user.created': schema, … })`.
-* The event map is the topic's contract: it types the derived `topic.publisher`
-* and the subscribers that bind via `s.topic(topic)`.
-*/
-var TopicBuilder = class {
-	_name;
-	_logger = DEFAULT_LOGGER;
-	/** The topic name — drives the infra topic and its `<NAME>_*` env vars. */
-	topic(name) {
-		return cloneWith(this, { _name: name });
-	}
-	logger(logger) {
-		return cloneWith(this, { _logger: logger });
-	}
-	/**
-	* The event contract — a map of event type → payload schema. Building the
-	* topic requires this; it's what types the publisher and subscribers.
-	*/
-	events(events) {
-		if (!this._name) throw new Error("Topic requires a name — call .topic(name) before .events().");
-		return new Topic(this._name, events, this._logger);
-	}
-};
-//#endregion
-//#region src/topic/index.ts
-const t = new TopicBuilder();
-//#endregion
-export { Topic, TopicBuilder, t };
-
-//# sourceMappingURL=index.mjs.map
+import { t as Topic } from "../Topic-DOw051ch.mjs";
+export { Topic };

package/dist/worker.cjs

@@ -1,9 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_construct_interface = require("./construct-interface.cjs");
-const require_functions = require("./functions-DKN6aQWJ.cjs");
+const require_functions = require("./functions-ZH60FE7H.cjs");
 const require_surfaceEnv = require("./surfaceEnv-CNimK76p.cjs");
-const require_CronBuilder = require("./CronBuilder-BbnT7tqo.cjs");
-const require_SubscriberBuilder = require("./SubscriberBuilder-C2bCOuPT.cjs");
+const require_CronBuilder = require("./CronBuilder-DB35T5dL.cjs");
+const require_QueueBuilder = require("./QueueBuilder-CJNcv4dy.cjs");
+const require_SubscriberBuilder = require("./SubscriberBuilder-Duk028pD.cjs");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let _geekmidas_logger_console = require("@geekmidas/logger/console");
 //#region src/worker.ts
@@ -64,12 +65,31 @@ var Worker = class Worker {
 		return this.own(new require_CronBuilder.CronBuilder().logger(this.logger)).schedule(schedule);
 	}
 	/**
+	* A queue and its one consumer, run by this worker.
+	*
+	* One construct, because a queue has exactly one consumer: nothing else can
+	* attach a second, or forget to attach the first. Producers send to it by
+	* depending on it — `.dependsOn([emails])` makes `services.emails` the
+	* publisher.
+	*
+	* @example
+	* ```ts
+	* export const emails = worker
+	*   .queue('Emails')
+	*   .message(z.object({ userId: z.uuid(), template: z.string() }))
+	*   .handle(async ({ messages, services }) => { … });
+	* ```
+	*/
+	queue(name) {
+		return this.own(new require_QueueBuilder.QueueBuilder().logger(this.logger)).queue(name);
+	}
+	/**
 	* A runnable that consumes a topic.
 	*
 	* Binding is not publishing: a consumer is handed the topic's event types
-	* and no connection string it could publish with. Chain `.publishes(…)` when
-	* the handler emits follow-up events, which is the only reason it would need
-	* one.
+	* and no connection string it could publish with. A handler that emits
+	* follow-up events depends on the topic it emits to —
+	* `.dependsOn([orders])` — which is the only reason it would need one.
 	*
 	* @example `worker.topic(users).subscribe(['user.created']).handle(…)`
 	*/
@@ -77,17 +97,6 @@ var Worker = class Worker {
 		return this.own(new require_SubscriberBuilder.SubscriberBuilder().logger(this.logger)).topic(topic);
 	}
 	/**
-	* A runnable that consumes events typed from a publisher service.
-	*
-	* The older of the two ways to bind a subscriber, kept for a project whose
-	* events come from a hand-written publisher rather than a `Topic`
-	* construct. `topic()` is the one to reach for: it types the events the same
-	* way and hands the consumer no connection string it could publish with.
-	*/
-	publisher(service) {
-		return this.own(new require_SubscriberBuilder.SubscriberBuilder().logger(this.logger)).publisher(service);
-	}
-	/**
 	* Everything below builds a function — the runnable with no schedule and no
 	* topic, invoked by something else.
 	*

package/dist/worker.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"worker.cjs","names":["canonicalId","DEFAULT_LOGGER","envParserFor","edgeTo","CronBuilder","SubscriberBuilder","FunctionBuilder"],"sources":["../src/worker.ts"],"sourcesContent":["/**\n * A process with no port.\n *\n * `RestApi` is the process that answers HTTP. This is the one that does not —\n * the thing that runs a schedule, drains a queue, consumes a topic. Until it\n * existed, those had nowhere to say they belonged: a cron declared a schedule\n * and nothing else, and which container ran it was decided by the directory the\n * file sat in. A glob owned it.\n *\n * The cost of that shows up in the scaffolds. `gkm init --template worker` —\n * a project that is background jobs and nothing else — declared\n * `new RestApi('Api', { defaultAuthorizer: 'none', logger })`: an HTTP surface\n * with no HTTP on it, written because it was the only construct that made an\n * app exist and the only way to get a logger into the generated runtime.\n *\n * It takes no authorizer, and that is the tell that these are two constructs\n * rather than one with a flag: a `RestApi` needs one because an HTTP surface\n * can ship open by omission, and nothing reaches a worker from outside.\n *\n * ## Crons on a server target need a database\n *\n * A cron becomes an EventBridge rule on AWS and nothing here is consulted. A\n * server has nothing firing its crons but itself, and a process that schedules\n * in memory fires every job once per replica while reporting success — so the\n * schedule is kept in Postgres, and the worker says which one with\n * `.database(db)`.\n *\n * A worker with crons and no `.database(…)` schedules nothing on a server\n * target and says so at startup. That is a limitation of workers today rather\n * than a design: the store could be a cache, or something the target\n * provisions, and Postgres is what exists.\n *\n * It is not an app. A worker names the process that runs its crons and\n * subscribers, and that process is the app's server — the same one the\n * endpoints run in, minus the HTTP surface. Giving a worker a container of its\n * own made a second thing to build, deploy and keep alive for work that was\n * always going to run somewhere already. Declare as many as the shape of the\n * work wants: they are groupings, not deployments.\n *\n * @example\n * ```ts\n * // constructs/worker.ts\n * import { Worker } from '@geekmidas/constructs/worker';\n * import { logger } from './logger.js';\n *\n * export const worker = new Worker('Worker', { logger }).calls([database]);\n *\n * // crons/cleanup.ts\n * import { worker } from '@acme/constructs/worker.js';\n *\n * export const cleanup = worker\n *   .cron('rate(1 day)')\n *   .handle(async ({ logger }) => { … });\n * ```\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { EventPublisher } from '@geekmidas/events';\nimport type { Logger } from '@geekmidas/logger';\nimport { DEFAULT_LOGGER } from '@geekmidas/logger/console';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\ttype Dependency,\n} from '@geekmidas/manifest';\nimport type { ComposableStandardSchema } from '@geekmidas/schema';\nimport type { Service } from '@geekmidas/services';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport {\n\ttype Consumable,\n\ttype Declarable,\n\tedgeTo,\n} from './construct-interface';\nimport type { ScheduleExpression } from './crons/Cron';\nimport { CronBuilder } from './crons/CronBuilder';\nimport { envParserFor } from './endpoints/surfaceEnv';\nimport { FunctionBuilder } from './functions/FunctionBuilder';\nimport { SubscriberBuilder } from './subscribers/SubscriberBuilder';\nimport type { Topic, TopicEvents } from './topic/Topic';\n\nexport interface WorkerConfig {\n\t/**\n\t * The logger everything built from this worker runs with.\n\t *\n\t * The actual logger, not a path to one — the same reason `RestApi` takes\n\t * one. Every cron and subscriber in a scaffolded project used to open with\n\t * `import { logger } from '…/constructs/logger.js'`, which is the line this\n\t * removes.\n\t */\n\tlogger?: Logger;\n\t/**\n\t * The environment parser everything built from this worker runs with.\n\t *\n\t * Defaults to `process.env` merged with the credentials `gkm dev` injected,\n\t * which is what an application's own `config/env.ts` always was.\n\t */\n\tenvParser?: EnvironmentParser<{}>;\n}\n\nexport class Worker<TName extends string = string>\n\timplements Declarable<TName>\n{\n\treadonly id: TName;\n\n\t/** Always defined — the worker's own, or the console logger. */\n\treadonly logger: Logger;\n\n\t/** Always defined, and normally the default. */\n\treadonly envParser: EnvironmentParser<{}>;\n\n\t/**\n\t * Where this worker's schedules live, when it has crons and a server runs\n\t * them. `undefined` until `.database(…)` says.\n\t */\n\treadonly scheduleStore?: Consumable<string, unknown>;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: WorkerConfig = {},\n\t\t/** Internal: how `.calls()` carries edges into the copy it returns. */\n\t\tprivate readonly dependencies: readonly Dependency[] = [],\n\t\tscheduleStore?: Consumable<string, unknown>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.logger = config.logger ?? DEFAULT_LOGGER;\n\t\tthis.envParser = envParserFor(\n\t\t\tconfig.envParser\n\t\t\t\t? { id: canonical, envParser: config.envParser }\n\t\t\t\t: undefined,\n\t\t);\n\t\tthis.scheduleStore = scheduleStore;\n\t}\n\n\t/**\n\t * The database this worker keeps its schedules in.\n\t *\n\t * Only a server target uses it. On AWS a cron is an EventBridge rule\n\t * invoking a Lambda and nothing here is consulted — but a server has nothing\n\t * firing its crons except itself, and a process that schedules in memory\n\t * fires every job once per replica while reporting that all is well.\n\t *\n\t * So the store is declared rather than discovered. It could have been\n\t * inferred — from a database the app happens to declare, or from the events\n\t * backend when that backend is pg-boss — and both would work until an app\n\t * had two databases, or moved its events to SNS, at which point the\n\t * schedules would quietly move or stop. Naming it is one line and cannot\n\t * drift.\n\t *\n\t * @example\n\t * ```ts\n\t * export const jobs = new Worker('Jobs', { logger }).database(database);\n\t * ```\n\t */\n\tdatabase<T, TDbName extends string>(\n\t\tsource: Consumable<TDbName, T>,\n\t): Worker<TName> {\n\t\treturn new Worker<TName>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, edgeTo(source)],\n\t\t\tsource as unknown as Consumable<string, unknown>,\n\t\t);\n\t}\n\n\t/**\n\t * A scheduled runnable.\n\t *\n\t * @example `worker.cron('rate(1 day)').handle(async ({ logger }) => { … })`\n\t */\n\tcron(schedule: ScheduleExpression) {\n\t\treturn this.own(new CronBuilder().logger(this.logger)).schedule(schedule);\n\t}\n\n\t/**\n\t * A runnable that consumes a topic.\n\t *\n\t * Binding is not publishing: a consumer is handed the topic's event types\n\t * and no connection string it could publish with. Chain `.publishes(…)` when\n\t * the handler emits follow-up events, which is the only reason it would need\n\t * one.\n\t *\n\t * @example `worker.topic(users).subscribe(['user.created']).handle(…)`\n\t */\n\ttopic<TTopicName extends string, TEvents extends TopicEvents>(\n\t\ttopic: Topic<TTopicName, TEvents>,\n\t) {\n\t\treturn this.own(new SubscriberBuilder().logger(this.logger)).topic(topic);\n\t}\n\n\t/**\n\t * A runnable that consumes events typed from a publisher service.\n\t *\n\t * The older of the two ways to bind a subscriber, kept for a project whose\n\t * events come from a hand-written publisher rather than a `Topic`\n\t * construct. `topic()` is the one to reach for: it types the events the same\n\t * way and hands the consumer no connection string it could publish with.\n\t */\n\tpublisher<T extends EventPublisher<any>, TPubName extends string>(\n\t\tservice: Service<TPubName, T> | Consumable<TPubName, T>,\n\t) {\n\t\treturn this.own(new SubscriberBuilder().logger(this.logger)).publisher(\n\t\t\tservice as never,\n\t\t);\n\t}\n\n\t/**\n\t * Everything below builds a function — the runnable with no schedule and no\n\t * topic, invoked by something else.\n\t *\n\t * These sit on the worker rather than behind a `functions` namespace because\n\t * the namespace was a hop that said nothing: `worker.functions.input(…)`\n\t * names a collection to reach one member of it. What kind of runnable is\n\t * being built is decided by which of these is called first — a schedule\n\t * makes a cron, a topic makes a subscriber, and anything else makes a\n\t * function.\n\t */\n\tinput<T extends ComposableStandardSchema>(schema: T) {\n\t\treturn this.functions.input(schema);\n\t}\n\n\toutput<T extends StandardSchemaV1>(schema: T) {\n\t\treturn this.functions.output(schema);\n\t}\n\n\ttimeout(ms: number) {\n\t\treturn this.functions.timeout(ms);\n\t}\n\n\tmemorySize(mb: number) {\n\t\treturn this.functions.memorySize(mb);\n\t}\n\n\tdependsOn<const T extends readonly Consumable[]>(constructs: T) {\n\t\treturn this.functions.dependsOn(constructs);\n\t}\n\n\tservices<T extends Service[]>(services: T) {\n\t\treturn this.functions.services(services);\n\t}\n\n\t/**\n\t * A function with no input schema — the shortest runnable there is.\n\t *\n\t * @example `worker.handle(async ({ logger }) => { … })`\n\t */\n\thandle(\n\t\t...args: Parameters<\n\t\t\tReturnType<Worker<TName>['schemalessFunction']>['handle']\n\t\t>\n\t) {\n\t\treturn this.schemalessFunction().handle(...args);\n\t}\n\n\t/** The builder `handle` delegates to, named so its type can be referred to. */\n\tprivate schemalessFunction() {\n\t\treturn this.functions;\n\t}\n\n\t/** The function builder the delegating methods above are built on. */\n\tprivate get functions() {\n\t\treturn this.own(new FunctionBuilder().logger(this.logger));\n\t}\n\n\t/**\n\t * Resources and surfaces this worker calls.\n\t *\n\t * Not `.dependsOn()`: this records the edge that derives the worker's\n\t * environment and its access, the same distinction `RestApi.calls()` draws.\n\t */\n\tcalls(constructs: readonly Declarable[]): Worker<TName> {\n\t\treturn new Worker<TName>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, ...constructs.map(edgeTo)],\n\t\t\tthis.scheduleStore,\n\t\t);\n\t}\n\n\t/**\n\t * Stamps this worker's id onto a builder, so everything built from it says\n\t * which process runs it.\n\t */\n\tprivate own<T extends { _owner?: string; _scheduleStore?: unknown }>(\n\t\tbuilder: T,\n\t): T {\n\t\tbuilder._owner = this.id;\n\t\tbuilder._scheduleStore = this.scheduleStore;\n\n\t\treturn builder;\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'worker',\n\t\t\t\tid: this.id,\n\t\t\t\t...(this.dependencies.length\n\t\t\t\t\t? { dependencies: this.dependencies }\n\t\t\t\t\t: {}),\n\t\t\t\t// Nothing calls a worker, so it publishes no address.\n\t\t\t\tprovides: [],\n\t\t\t},\n\t\t];\n\t}\n}\n"],"mappings":";;;;;;;;;AAoGA,IAAa,SAAb,MAAa,OAEb;CAiBmB;CAEA;CAlBlB;;CAGA;;CAGA;;;;;CAMA;CAEA,YACC,IACA,SAAwC,CAAC,GAEzC,eAAuD,CAAC,GACxD,eACC;EAJgB,KAAA,SAAA;EAEA,KAAA,eAAA;EAGjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,SAAS,OAAO,UAAUC,0BAAAA;EAC/B,KAAK,YAAYC,mBAAAA,aAChB,OAAO,YACJ;GAAE,IAAI;GAAW,WAAW,OAAO;EAAU,IAC7C,KAAA,CACJ;EACA,KAAK,gBAAgB;CACtB;;;;;;;;;;;;;;;;;;;;;CAsBA,SACC,QACgB;EAChB,OAAO,IAAI,OACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAcC,4BAAAA,OAAO,MAAM,CAAC,GACrC,MACD;CACD;;;;;;CAOA,KAAK,UAA8B;EAClC,OAAO,KAAK,IAAI,IAAIC,oBAAAA,YAAY,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,QAAQ;CACzE;;;;;;;;;;;CAYA,MACC,OACC;EACD,OAAO,KAAK,IAAI,IAAIC,0BAAAA,kBAAkB,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK;CACzE;;;;;;;;;CAUA,UACC,SACC;EACD,OAAO,KAAK,IAAI,IAAIA,0BAAAA,kBAAkB,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,UAC5D,OACD;CACD;;;;;;;;;;;;CAaA,MAA0C,QAAW;EACpD,OAAO,KAAK,UAAU,MAAM,MAAM;CACnC;CAEA,OAAmC,QAAW;EAC7C,OAAO,KAAK,UAAU,OAAO,MAAM;CACpC;CAEA,QAAQ,IAAY;EACnB,OAAO,KAAK,UAAU,QAAQ,EAAE;CACjC;CAEA,WAAW,IAAY;EACtB,OAAO,KAAK,UAAU,WAAW,EAAE;CACpC;CAEA,UAAiD,YAAe;EAC/D,OAAO,KAAK,UAAU,UAAU,UAAU;CAC3C;CAEA,SAA8B,UAAa;EAC1C,OAAO,KAAK,UAAU,SAAS,QAAQ;CACxC;;;;;;CAOA,OACC,GAAG,MAGF;EACD,OAAO,KAAK,mBAAmB,CAAC,CAAC,OAAO,GAAG,IAAI;CAChD;;CAGA,qBAA6B;EAC5B,OAAO,KAAK;CACb;;CAGA,IAAY,YAAY;EACvB,OAAO,KAAK,IAAI,IAAIC,kBAAAA,gBAAgB,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;CAC1D;;;;;;;CAQA,MAAM,YAAkD;EACvD,OAAO,IAAI,OACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAc,GAAG,WAAW,IAAIH,4BAAAA,MAAM,CAAC,GAChD,KAAK,aACN;CACD;;;;;CAMA,IACC,SACI;EACJ,QAAQ,SAAS,KAAK;EACtB,QAAQ,iBAAiB,KAAK;EAE9B,OAAO;CACR;CAEA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,GAAI,KAAK,aAAa,SACnB,EAAE,cAAc,KAAK,aAAa,IAClC,CAAC;GAEJ,UAAU,CAAC;EACZ,CACD;CACD;AACD"}
+{"version":3,"file":"worker.cjs","names":["canonicalId","DEFAULT_LOGGER","envParserFor","edgeTo","CronBuilder","QueueBuilder","SubscriberBuilder","FunctionBuilder"],"sources":["../src/worker.ts"],"sourcesContent":["/**\n * A process with no port.\n *\n * `RestApi` is the process that answers HTTP. This is the one that does not —\n * the thing that runs a schedule, drains a queue, consumes a topic. Until it\n * existed, those had nowhere to say they belonged: a cron declared a schedule\n * and nothing else, and which container ran it was decided by the directory the\n * file sat in. A glob owned it.\n *\n * The cost of that shows up in the scaffolds. `gkm init --template worker` —\n * a project that is background jobs and nothing else — declared\n * `new RestApi('Api', { defaultAuthorizer: 'none', logger })`: an HTTP surface\n * with no HTTP on it, written because it was the only construct that made an\n * app exist and the only way to get a logger into the generated runtime.\n *\n * It takes no authorizer, and that is the tell that these are two constructs\n * rather than one with a flag: a `RestApi` needs one because an HTTP surface\n * can ship open by omission, and nothing reaches a worker from outside.\n *\n * ## Crons on a server target need a database\n *\n * A cron becomes an EventBridge rule on AWS and nothing here is consulted. A\n * server has nothing firing its crons but itself, and a process that schedules\n * in memory fires every job once per replica while reporting success — so the\n * schedule is kept in Postgres, and the worker says which one with\n * `.database(db)`.\n *\n * A worker with crons and no `.database(…)` schedules nothing on a server\n * target and says so at startup. That is a limitation of workers today rather\n * than a design: the store could be a cache, or something the target\n * provisions, and Postgres is what exists.\n *\n * It is not an app. A worker names the process that runs its crons and\n * subscribers, and that process is the app's server — the same one the\n * endpoints run in, minus the HTTP surface. Giving a worker a container of its\n * own made a second thing to build, deploy and keep alive for work that was\n * always going to run somewhere already. Declare as many as the shape of the\n * work wants: they are groupings, not deployments.\n *\n * @example\n * ```ts\n * // constructs/worker.ts\n * import { Worker } from '@geekmidas/constructs/worker';\n * import { logger } from './logger.js';\n *\n * export const worker = new Worker('Worker', { logger }).calls([database]);\n *\n * // crons/cleanup.ts\n * import { worker } from '@acme/constructs/worker.js';\n *\n * export const cleanup = worker\n *   .cron('rate(1 day)')\n *   .handle(async ({ logger }) => { … });\n * ```\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { EventPublisher } from '@geekmidas/events';\nimport type { Logger } from '@geekmidas/logger';\nimport { DEFAULT_LOGGER } from '@geekmidas/logger/console';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\ttype Dependency,\n} from '@geekmidas/manifest';\nimport type { ComposableStandardSchema } from '@geekmidas/schema';\nimport type { Service } from '@geekmidas/services';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport {\n\ttype Consumable,\n\ttype Declarable,\n\tedgeTo,\n} from './construct-interface';\nimport type { ScheduleExpression } from './crons/Cron';\nimport { CronBuilder } from './crons/CronBuilder';\nimport { envParserFor } from './endpoints/surfaceEnv';\nimport { FunctionBuilder } from './functions/FunctionBuilder';\nimport { QueueBuilder } from './queue/QueueBuilder';\nimport { SubscriberBuilder } from './subscribers/SubscriberBuilder';\nimport type { Topic, TopicEvents } from './topic/Topic';\n\nexport interface WorkerConfig {\n\t/**\n\t * The logger everything built from this worker runs with.\n\t *\n\t * The actual logger, not a path to one — the same reason `RestApi` takes\n\t * one. Every cron and subscriber in a scaffolded project used to open with\n\t * `import { logger } from '…/constructs/logger.js'`, which is the line this\n\t * removes.\n\t */\n\tlogger?: Logger;\n\t/**\n\t * The environment parser everything built from this worker runs with.\n\t *\n\t * Defaults to `process.env` merged with the credentials `gkm dev` injected,\n\t * which is what an application's own `config/env.ts` always was.\n\t */\n\tenvParser?: EnvironmentParser<{}>;\n}\n\nexport class Worker<TName extends string = string>\n\timplements Declarable<TName>\n{\n\treadonly id: TName;\n\n\t/** Always defined — the worker's own, or the console logger. */\n\treadonly logger: Logger;\n\n\t/** Always defined, and normally the default. */\n\treadonly envParser: EnvironmentParser<{}>;\n\n\t/**\n\t * Where this worker's schedules live, when it has crons and a server runs\n\t * them. `undefined` until `.database(…)` says.\n\t */\n\treadonly scheduleStore?: Consumable<string, unknown>;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: WorkerConfig = {},\n\t\t/** Internal: how `.calls()` carries edges into the copy it returns. */\n\t\tprivate readonly dependencies: readonly Dependency[] = [],\n\t\tscheduleStore?: Consumable<string, unknown>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.logger = config.logger ?? DEFAULT_LOGGER;\n\t\tthis.envParser = envParserFor(\n\t\t\tconfig.envParser\n\t\t\t\t? { id: canonical, envParser: config.envParser }\n\t\t\t\t: undefined,\n\t\t);\n\t\tthis.scheduleStore = scheduleStore;\n\t}\n\n\t/**\n\t * The database this worker keeps its schedules in.\n\t *\n\t * Only a server target uses it. On AWS a cron is an EventBridge rule\n\t * invoking a Lambda and nothing here is consulted — but a server has nothing\n\t * firing its crons except itself, and a process that schedules in memory\n\t * fires every job once per replica while reporting that all is well.\n\t *\n\t * So the store is declared rather than discovered. It could have been\n\t * inferred — from a database the app happens to declare, or from the events\n\t * backend when that backend is pg-boss — and both would work until an app\n\t * had two databases, or moved its events to SNS, at which point the\n\t * schedules would quietly move or stop. Naming it is one line and cannot\n\t * drift.\n\t *\n\t * @example\n\t * ```ts\n\t * export const jobs = new Worker('Jobs', { logger }).database(database);\n\t * ```\n\t */\n\tdatabase<T, TDbName extends string>(\n\t\tsource: Consumable<TDbName, T>,\n\t): Worker<TName> {\n\t\treturn new Worker<TName>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, edgeTo(source)],\n\t\t\tsource as unknown as Consumable<string, unknown>,\n\t\t);\n\t}\n\n\t/**\n\t * A scheduled runnable.\n\t *\n\t * @example `worker.cron('rate(1 day)').handle(async ({ logger }) => { … })`\n\t */\n\tcron(schedule: ScheduleExpression) {\n\t\treturn this.own(new CronBuilder().logger(this.logger)).schedule(schedule);\n\t}\n\n\t/**\n\t * A queue and its one consumer, run by this worker.\n\t *\n\t * One construct, because a queue has exactly one consumer: nothing else can\n\t * attach a second, or forget to attach the first. Producers send to it by\n\t * depending on it — `.dependsOn([emails])` makes `services.emails` the\n\t * publisher.\n\t *\n\t * @example\n\t * ```ts\n\t * export const emails = worker\n\t *   .queue('Emails')\n\t *   .message(z.object({ userId: z.uuid(), template: z.string() }))\n\t *   .handle(async ({ messages, services }) => { … });\n\t * ```\n\t */\n\tqueue<TQueueName extends string>(name: TQueueName) {\n\t\treturn this.own(new QueueBuilder().logger(this.logger)).queue(name);\n\t}\n\n\t/**\n\t * A runnable that consumes a topic.\n\t *\n\t * Binding is not publishing: a consumer is handed the topic's event types\n\t * and no connection string it could publish with. A handler that emits\n\t * follow-up events depends on the topic it emits to —\n\t * `.dependsOn([orders])` — which is the only reason it would need one.\n\t *\n\t * @example `worker.topic(users).subscribe(['user.created']).handle(…)`\n\t */\n\ttopic<TTopicName extends string, TEvents extends TopicEvents>(\n\t\ttopic: Topic<TTopicName, TEvents>,\n\t) {\n\t\treturn this.own(new SubscriberBuilder().logger(this.logger)).topic(topic);\n\t}\n\n\t/**\n\t * Everything below builds a function — the runnable with no schedule and no\n\t * topic, invoked by something else.\n\t *\n\t * These sit on the worker rather than behind a `functions` namespace because\n\t * the namespace was a hop that said nothing: `worker.functions.input(…)`\n\t * names a collection to reach one member of it. What kind of runnable is\n\t * being built is decided by which of these is called first — a schedule\n\t * makes a cron, a topic makes a subscriber, and anything else makes a\n\t * function.\n\t */\n\tinput<T extends ComposableStandardSchema>(schema: T) {\n\t\treturn this.functions.input(schema);\n\t}\n\n\toutput<T extends StandardSchemaV1>(schema: T) {\n\t\treturn this.functions.output(schema);\n\t}\n\n\ttimeout(ms: number) {\n\t\treturn this.functions.timeout(ms);\n\t}\n\n\tmemorySize(mb: number) {\n\t\treturn this.functions.memorySize(mb);\n\t}\n\n\tdependsOn<const T extends readonly Consumable[]>(constructs: T) {\n\t\treturn this.functions.dependsOn(constructs);\n\t}\n\n\tservices<T extends Service[]>(services: T) {\n\t\treturn this.functions.services(services);\n\t}\n\n\t/**\n\t * A function with no input schema — the shortest runnable there is.\n\t *\n\t * @example `worker.handle(async ({ logger }) => { … })`\n\t */\n\thandle(\n\t\t...args: Parameters<\n\t\t\tReturnType<Worker<TName>['schemalessFunction']>['handle']\n\t\t>\n\t) {\n\t\treturn this.schemalessFunction().handle(...args);\n\t}\n\n\t/** The builder `handle` delegates to, named so its type can be referred to. */\n\tprivate schemalessFunction() {\n\t\treturn this.functions;\n\t}\n\n\t/** The function builder the delegating methods above are built on. */\n\tprivate get functions() {\n\t\treturn this.own(new FunctionBuilder().logger(this.logger));\n\t}\n\n\t/**\n\t * Resources and surfaces this worker calls.\n\t *\n\t * Not `.dependsOn()`: this records the edge that derives the worker's\n\t * environment and its access, the same distinction `RestApi.calls()` draws.\n\t */\n\tcalls(constructs: readonly Declarable[]): Worker<TName> {\n\t\treturn new Worker<TName>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, ...constructs.map(edgeTo)],\n\t\t\tthis.scheduleStore,\n\t\t);\n\t}\n\n\t/**\n\t * Stamps this worker's id onto a builder, so everything built from it says\n\t * which process runs it.\n\t */\n\tprivate own<T extends { _owner?: string; _scheduleStore?: unknown }>(\n\t\tbuilder: T,\n\t): T {\n\t\tbuilder._owner = this.id;\n\t\tbuilder._scheduleStore = this.scheduleStore;\n\n\t\treturn builder;\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'worker',\n\t\t\t\tid: this.id,\n\t\t\t\t...(this.dependencies.length\n\t\t\t\t\t? { dependencies: this.dependencies }\n\t\t\t\t\t: {}),\n\t\t\t\t// Nothing calls a worker, so it publishes no address.\n\t\t\t\tprovides: [],\n\t\t\t},\n\t\t];\n\t}\n}\n"],"mappings":";;;;;;;;;;AAqGA,IAAa,SAAb,MAAa,OAEb;CAiBmB;CAEA;CAlBlB;;CAGA;;CAGA;;;;;CAMA;CAEA,YACC,IACA,SAAwC,CAAC,GAEzC,eAAuD,CAAC,GACxD,eACC;EAJgB,KAAA,SAAA;EAEA,KAAA,eAAA;EAGjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,SAAS,OAAO,UAAUC,0BAAAA;EAC/B,KAAK,YAAYC,mBAAAA,aAChB,OAAO,YACJ;GAAE,IAAI;GAAW,WAAW,OAAO;EAAU,IAC7C,KAAA,CACJ;EACA,KAAK,gBAAgB;CACtB;;;;;;;;;;;;;;;;;;;;;CAsBA,SACC,QACgB;EAChB,OAAO,IAAI,OACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAcC,4BAAAA,OAAO,MAAM,CAAC,GACrC,MACD;CACD;;;;;;CAOA,KAAK,UAA8B;EAClC,OAAO,KAAK,IAAI,IAAIC,oBAAAA,YAAY,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,QAAQ;CACzE;;;;;;;;;;;;;;;;;CAkBA,MAAiC,MAAkB;EAClD,OAAO,KAAK,IAAI,IAAIC,qBAAAA,aAAa,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI;CACnE;;;;;;;;;;;CAYA,MACC,OACC;EACD,OAAO,KAAK,IAAI,IAAIC,0BAAAA,kBAAkB,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK;CACzE;;;;;;;;;;;;CAaA,MAA0C,QAAW;EACpD,OAAO,KAAK,UAAU,MAAM,MAAM;CACnC;CAEA,OAAmC,QAAW;EAC7C,OAAO,KAAK,UAAU,OAAO,MAAM;CACpC;CAEA,QAAQ,IAAY;EACnB,OAAO,KAAK,UAAU,QAAQ,EAAE;CACjC;CAEA,WAAW,IAAY;EACtB,OAAO,KAAK,UAAU,WAAW,EAAE;CACpC;CAEA,UAAiD,YAAe;EAC/D,OAAO,KAAK,UAAU,UAAU,UAAU;CAC3C;CAEA,SAA8B,UAAa;EAC1C,OAAO,KAAK,UAAU,SAAS,QAAQ;CACxC;;;;;;CAOA,OACC,GAAG,MAGF;EACD,OAAO,KAAK,mBAAmB,CAAC,CAAC,OAAO,GAAG,IAAI;CAChD;;CAGA,qBAA6B;EAC5B,OAAO,KAAK;CACb;;CAGA,IAAY,YAAY;EACvB,OAAO,KAAK,IAAI,IAAIC,kBAAAA,gBAAgB,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;CAC1D;;;;;;;CAQA,MAAM,YAAkD;EACvD,OAAO,IAAI,OACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAc,GAAG,WAAW,IAAIJ,4BAAAA,MAAM,CAAC,GAChD,KAAK,aACN;CACD;;;;;CAMA,IACC,SACI;EACJ,QAAQ,SAAS,KAAK;EACtB,QAAQ,iBAAiB,KAAK;EAE9B,OAAO;CACR;CAEA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,GAAI,KAAK,aAAa,SACnB,EAAE,cAAc,KAAK,aAAa,IAClC,CAAC;GAEJ,UAAU,CAAC;EACZ,CACD;CACD;AACD"}

package/dist/worker.d.cts

@@ -1,13 +1,13 @@
 import { t as StandardSchemaV1 } from "./index-CeEtxDmK.cjs";
-import { a as FunctionHandler, r as Function, t as FunctionBuilder } from "./index-Dzkdm-IE.cjs";
-import { c as ServicesOf, i as Declarable, r as Consumable } from "./construct-interface-DcNaRKoC.cjs";
-import { i as ScheduleExpression } from "./Cron-Brs_n_vQ.cjs";
-import { t as CronBuilder } from "./CronBuilder-4WnWKR40.cjs";
-import { n as TopicEvents, r as TopicMessage, t as Topic } from "./Topic-D6blllEn.cjs";
-import { t as SubscriberBuilder } from "./SubscriberBuilder-CIXTozBi.cjs";
-import "./index-tE_119SX.cjs";
+import { c as Topic, l as TopicEvents, u as TopicMessage } from "./Construct-BQALFCh2.cjs";
+import { a as FunctionHandler, r as Function, t as FunctionBuilder } from "./index-B0kxstwf.cjs";
+import { c as ServicesOf, i as Declarable, r as Consumable } from "./construct-interface-_xi4BPN8.cjs";
+import { i as ScheduleExpression } from "./Cron-CMEGfRs8.cjs";
+import { t as CronBuilder } from "./CronBuilder-CEK7aOqD.cjs";
+import { t as QueueBuilder } from "./QueueBuilder-XEnnOWGe.cjs";
+import { t as SubscriberBuilder } from "./SubscriberBuilder-BSpQX1JT.cjs";
+import "./topic/index.cjs";
 import { EnvironmentParser } from "@geekmidas/envkit";
-import { EventPublisher } from "@geekmidas/events";
 import { Logger } from "@geekmidas/logger";
 import { ComposableStandardSchema } from "@geekmidas/schema";
 import { Service } from "@geekmidas/services";
@@ -74,27 +74,35 @@ export declare class Worker<TName extends string = string> implements Declarable
    *
    * @example `worker.cron('rate(1 day)').handle(async ({ logger }) => { … })`
    */
-  cron(schedule: ScheduleExpression): CronBuilder<ComposableStandardSchema, Service[], Logger, undefined, undefined, string, undefined, string>;
+  cron(schedule: ScheduleExpression): CronBuilder<ComposableStandardSchema, Service[], Logger, undefined, undefined, string>;
   /**
-   * A runnable that consumes a topic.
+   * A queue and its one consumer, run by this worker.
    *
-   * Binding is not publishing: a consumer is handed the topic's event types
-   * and no connection string it could publish with. Chain `.publishes(…)` when
-   * the handler emits follow-up events, which is the only reason it would need
-   * one.
+   * One construct, because a queue has exactly one consumer: nothing else can
+   * attach a second, or forget to attach the first. Producers send to it by
+   * depending on it — `.dependsOn([emails])` makes `services.emails` the
+   * publisher.
    *
-   * @example `worker.topic(users).subscribe(['user.created']).handle(…)`
+   * @example
+   * ```ts
+   * export const emails = worker
+   *   .queue('Emails')
+   *   .message(z.object({ userId: z.uuid(), template: z.string() }))
+   *   .handle(async ({ messages, services }) => { … });
+   * ```
    */
-  topic<TTopicName extends string, TEvents extends TopicEvents>(topic: Topic<TTopicName, TEvents>): SubscriberBuilder<[], Logger, undefined, EventPublisher<TopicMessage<TEvents_1>>, string, []>;
+  queue<TQueueName extends string>(name: TQueueName): QueueBuilder<TQueueName, undefined, [], Logger>;
   /**
-   * A runnable that consumes events typed from a publisher service.
+   * A runnable that consumes a topic.
    *
-   * The older of the two ways to bind a subscriber, kept for a project whose
-   * events come from a hand-written publisher rather than a `Topic`
-   * construct. `topic()` is the one to reach for: it types the events the same
-   * way and hands the consumer no connection string it could publish with.
+   * Binding is not publishing: a consumer is handed the topic's event types
+   * and no connection string it could publish with. A handler that emits
+   * follow-up events depends on the topic it emits to —
+   * `.dependsOn([orders])` — which is the only reason it would need one.
+   *
+   * @example `worker.topic(users).subscribe(['user.created']).handle(…)`
    */
-  publisher<T extends EventPublisher<any>, TPubName extends string>(service: Service<TPubName, T> | Consumable<TPubName, T>): SubscriberBuilder<[], Logger, undefined, EventPublisher<any>, string, []>;
+  topic<TTopicName extends string, TEvents extends TopicEvents>(topic: Topic<TTopicName, TEvents>): SubscriberBuilder<[], Logger, undefined, EventPublisher<TopicMessage<TEvents_1>>, []>;
   /**
    * Everything below builds a function — the runnable with no schedule and no
    * topic, invoked by something else.
@@ -106,18 +114,18 @@ export declare class Worker<TName extends string = string> implements Declarable
    * makes a cron, a topic makes a subscriber, and anything else makes a
    * function.
    */
-  input<T extends ComposableStandardSchema>(schema: T): FunctionBuilder<T, undefined, [], Logger, undefined, string, undefined, string, undefined, string, AuditableAction<string, unknown>>;
-  output<T extends StandardSchemaV1>(schema: T): FunctionBuilder<ComposableStandardSchema, T, [], Logger, undefined, string, undefined, string, undefined, string, AuditableAction<string, unknown>>;
-  timeout(ms: number): FunctionBuilder<ComposableStandardSchema, undefined, [], Logger, undefined, string, undefined, string, undefined, string, AuditableAction<string, unknown>>;
-  memorySize(mb: number): FunctionBuilder<ComposableStandardSchema, undefined, [], Logger, undefined, string, undefined, string, undefined, string, AuditableAction<string, unknown>>;
-  dependsOn<const T extends readonly Consumable[]>(constructs: T): FunctionBuilder<ComposableStandardSchema, undefined, [...ServicesOf<T>], Logger, undefined, string, undefined, string, undefined, string, AuditableAction<string, unknown>>;
-  services<T extends Service[]>(services: T): FunctionBuilder<ComposableStandardSchema, undefined, [...T], Logger, undefined, string, undefined, string, undefined, string, AuditableAction<string, unknown>>;
+  input<T extends ComposableStandardSchema>(schema: T): FunctionBuilder<T, undefined, [], Logger, undefined, string, undefined, string, AuditableAction<string, unknown>>;
+  output<T extends StandardSchemaV1>(schema: T): FunctionBuilder<ComposableStandardSchema, T, [], Logger, undefined, string, undefined, string, AuditableAction<string, unknown>>;
+  timeout(ms: number): FunctionBuilder<ComposableStandardSchema, undefined, [], Logger, undefined, string, undefined, string, AuditableAction<string, unknown>>;
+  memorySize(mb: number): FunctionBuilder<ComposableStandardSchema, undefined, [], Logger, undefined, string, undefined, string, AuditableAction<string, unknown>>;
+  dependsOn<const T extends readonly Consumable[]>(constructs: T): FunctionBuilder<ComposableStandardSchema, undefined, [...ServicesOf<T>], Logger, undefined, string, undefined, string, AuditableAction<string, unknown>>;
+  services<T extends Service[]>(services: T): FunctionBuilder<ComposableStandardSchema, undefined, [...T], Logger, undefined, string, undefined, string, AuditableAction<string, unknown>>;
   /**
    * A function with no input schema — the shortest runnable there is.
    *
    * @example `worker.handle(async ({ logger }) => { … })`
    */
-  handle(...args: Parameters<ReturnType<Worker<TName>['schemalessFunction']>['handle']>): Function<ComposableStandardSchema, [], Logger, undefined, undefined, string, undefined, string, undefined, string, AuditableAction<string, unknown>, FunctionHandler<ComposableStandardSchema, [], Logger, undefined, undefined, undefined, AuditableAction<string, unknown>>>;
+  handle(...args: Parameters<ReturnType<Worker<TName>['schemalessFunction']>['handle']>): Function<ComposableStandardSchema, [], Logger, undefined, undefined, string, undefined, string, AuditableAction<string, unknown>, FunctionHandler<ComposableStandardSchema, [], Logger, undefined, undefined, undefined, AuditableAction<string, unknown>>>;
   /** The builder `handle` delegates to, named so its type can be referred to. */
   private schemalessFunction;
   /** The function builder the delegating methods above are built on. */

package/dist/worker.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"worker.d.cts","names":["_$__topic0.TopicMessage","_$__construct_interface0.ServicesOf","_$__functions0.FunctionHandler","_$__functions0.Function"],"sources":["../src/worker.ts"],"mappings":";;;;;;;;;;;;;;;iBAiFiB;;;;;;;;;EAShB,SAAS;;;;;;;EAOT,YAAY;;qBAGA,OAAO,0CACR,WAAW;mBAkBJ;;mBAEA;WAlBT,IAAI;;WAGJ,QAAQ;;WAGR,WAAW;;;;;WAMX,gBAAgB;EAEzB,YACC,IAAI,cAAc,QACD,SAAQ,cAER;;EAAA,wBAAuB,cACxC,gBAAgB;;;;;;;;;;;;;;;;;;;;;EAkCjB,SAAS,GAAG,wBACX,QAAQ,WAAW,SAAS,KAC1B,OAAO;;;;;;EAcV,KAAK,UAAU,qBAAkB,YAAA,0BAAA,WAAA;;;;;;;;;;;EAcjC,MAAM,2BAA2B,gBAAgB,aAChD,OAAO,MAAM,YAAY,WAAQ,sBAAA,mBAAA,eAAAA,aAAA;;;;;;;;;EAalC,UAAU,UAAU,qBAAqB,yBACxC,SAAS,QAAQ,UAAU,KAAK,WAAW,UAAU,KAAE,sBAAA,mBAAA;;;;;;;;;;;;EAkBxD,MAAM,UAAU,0BAA0B,QAAQ,IAAC,gBAAA,kBAAA,iEAAA;EAInD,OAAO,UAAU,kBAAkB,QAAQ,IAAC,gBAAA,0BAAA,OAAA,iEAAA;EAI5C,QAAQ,aAAU,gBAAA,yCAAA,iEAAA;EAIlB,WAAW,aAAU,gBAAA,yCAAA,iEAAA;EAIrB,gBAAgB,mBAAmB,cAAc,YAAY,IAAC,gBAAA,yCAAAC,WAAA,KAAA,iEAAA;EAI9D,SAAS,UAAU,WAAW,UAAU,IAAC,gBAAA,yCAAA,IAAA,iEAAA;;;;;;EASzC,UACI,MAAM,WACR,WAAW,OAAO,2CAClBE,SAAA,8BAAA,4EAAA,kCAAAD,gBAAA,8BAAA,yCAAA;;UAMM;;cAKI;;;;;;;EAUZ,MAAM,qBAAqB,eAAe,OAAO;;;;;UAazC;EASR,WAAW"}
+{"version":3,"file":"worker.d.cts","names":["_$__topic0.TopicMessage","_$__construct_interface0.ServicesOf","_$__functions0.FunctionHandler","_$__functions0.Function"],"sources":["../src/worker.ts"],"mappings":";;;;;;;;;;;;;;;iBAkFiB;;;;;;;;;EAShB,SAAS;;;;;;;EAOT,YAAY;;qBAGA,OAAO,0CACR,WAAW;mBAkBJ;;mBAEA;WAlBT,IAAI;;WAGJ,QAAQ;;WAGR,WAAW;;;;;WAMX,gBAAgB;EAEzB,YACC,IAAI,cAAc,QACD,SAAQ,cAER;;EAAA,wBAAuB,cACxC,gBAAgB;;;;;;;;;;;;;;;;;;;;;EAkCjB,SAAS,GAAG,wBACX,QAAQ,WAAW,SAAS,KAC1B,OAAO;;;;;;EAcV,KAAK,UAAU,qBAAkB,YAAA,0BAAA,WAAA;;;;;;;;;;;;;;;;;EAoBjC,MAAM,2BAA2B,MAAM,aAAU,aAAA,2BAAA;;;;;;;;;;;EAcjD,MAAM,2BAA2B,gBAAgB,aAChD,OAAO,MAAM,YAAY,WAAQ,sBAAA,mBAAA,eAAAA,aAAA;;;;;;;;;;;;EAgBlC,MAAM,UAAU,0BAA0B,QAAQ,IAAC,gBAAA,kBAAA,8CAAA;EAInD,OAAO,UAAU,kBAAkB,QAAQ,IAAC,gBAAA,0BAAA,OAAA,8CAAA;EAI5C,QAAQ,aAAU,gBAAA,yCAAA,8CAAA;EAIlB,WAAW,aAAU,gBAAA,yCAAA,8CAAA;EAIrB,gBAAgB,mBAAmB,cAAc,YAAY,IAAC,gBAAA,yCAAAC,WAAA,KAAA,8CAAA;EAI9D,SAAS,UAAU,WAAW,UAAU,IAAC,gBAAA,yCAAA,IAAA,8CAAA;;;;;;EASzC,UACI,MAAM,WACR,WAAW,OAAO,2CAClBE,SAAA,8BAAA,yDAAA,kCAAAD,gBAAA,8BAAA,yCAAA;;UAMM;;cAKI;;;;;;;EAUZ,MAAM,qBAAqB,eAAe,OAAO;;;;;UAazC;EASR,WAAW"}