@geekmidas/constructs 10.0.0-alpha.4 → 10.0.0-alpha.41

package/dist/crons/index.d.mts

@@ -1,16 +1,34 @@
-import "../Construct-Ct8nalEi.mjs";
-import "../index-CubPzHd9.mjs";
-import "../construct-interface-g5GM5pwR.mjs";
-import { Cron, CronExpression, RateExpression, ScheduleExpression } from "../Cron-ByxdOfpE.mjs";
-import { CronBuilder } from "../CronBuilder-BL0AP6fs.mjs";
-import * as _geekmidas_services1 from "@geekmidas/services";
-import * as _geekmidas_logger2 from "@geekmidas/logger";
-import * as _geekmidas_schema0 from "@geekmidas/schema";
-
-//#region src/crons/index.d.ts
-declare const c: CronBuilder<_geekmidas_schema0.ComposableStandardSchema, _geekmidas_services1.Service<string, unknown>[], _geekmidas_logger2.Logger, undefined, undefined, string, undefined, string>;
-//# sourceMappingURL=index.d.ts.map
-
+import { i as ScheduleExpression, n as CronExpression, r as RateExpression, t as Cron } from "../Cron-D6X4-xjB.mjs";
+import { t as CronBuilder } from "../CronBuilder-O_gvButp.mjs";
+//#region src/crons/schedule.d.ts
+/**
+ * A schedule a cron runner can take, as standard five-field cron.
+ *
+ * `ScheduleExpression` has two spellings. `cron(m h dom mon dow)` is already
+ * five-field cron and unwraps; `rate(n unit)` is an interval, and an interval
+ * is not a schedule — it says how often, where cron says when.
+ *
+ * Most intervals still have an exact cron equivalent, because they divide their
+ * unit evenly: `rate(5 minutes)` is every fifth minute of every hour, and that
+ * is `*​/5 * * * *` precisely. `rate(7 hours)` has none. There is no cron field
+ * that means "every seven hours" — `*​/7` in the hour field fires at 0, 7, 14
+ * and 21 and then starts over at midnight, so the gap between the last firing
+ * of one day and the first of the next is three hours rather than seven.
+ *
+ * Those are refused rather than rounded. A job that runs at the wrong hour is
+ * far harder to notice than one that refused to build, and a schedule quietly
+ * adjusted by the framework is a bug nobody goes looking for.
+ */
+export declare class UnrepresentableSchedule extends Error {
+  readonly schedule: string;
+  constructor(schedule: string, reason: string);
+}
+/**
+ * Standard five-field cron for a schedule expression.
+ *
+ * @throws {UnrepresentableSchedule} when a `rate(…)` has no exact equivalent.
+ */
+export declare function toCronExpression(schedule: ScheduleExpression): string;
 //#endregion
-export { Cron, CronBuilder, CronExpression, RateExpression, ScheduleExpression, c };
+export { Cron, CronBuilder, type CronExpression, type RateExpression, type ScheduleExpression };
 //# sourceMappingURL=index.d.mts.map

package/dist/crons/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/crons/index.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;cAUa,GAAC,YAAoB,kBAAA,CAApB,wBAAA,EAAA,oBAAA,CAAA,4BAAA,kBAAA,CAAA,MAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/crons/schedule.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;qBAoBa,gCAAgC;WAElC;EADV,YACU,kBACT;;;;;;;wBAuBc,iBAAiB,UAAU"}

package/dist/crons/index.mjs

@@ -1,12 +1,68 @@
-import "../Construct-BD5neF7w.mjs";
-import "../construct-interface-Z4CpS8tK.mjs";
-import "../functions-Ck21Uyq0.mjs";
-import "../clone-DblgEZZa.mjs";
-import { Cron, CronBuilder } from "../CronBuilder-CdibiHNB.mjs";
-
-//#region src/crons/index.ts
-const c = new CronBuilder();
-
+import { n as Cron, t as CronBuilder } from "../CronBuilder-Dv0IlZs0.mjs";
+//#region src/crons/schedule.ts
+/**
+* A schedule a cron runner can take, as standard five-field cron.
+*
+* `ScheduleExpression` has two spellings. `cron(m h dom mon dow)` is already
+* five-field cron and unwraps; `rate(n unit)` is an interval, and an interval
+* is not a schedule — it says how often, where cron says when.
+*
+* Most intervals still have an exact cron equivalent, because they divide their
+* unit evenly: `rate(5 minutes)` is every fifth minute of every hour, and that
+* is `*​/5 * * * *` precisely. `rate(7 hours)` has none. There is no cron field
+* that means "every seven hours" — `*​/7` in the hour field fires at 0, 7, 14
+* and 21 and then starts over at midnight, so the gap between the last firing
+* of one day and the first of the next is three hours rather than seven.
+*
+* Those are refused rather than rounded. A job that runs at the wrong hour is
+* far harder to notice than one that refused to build, and a schedule quietly
+* adjusted by the framework is a bug nobody goes looking for.
+*/
+var UnrepresentableSchedule = class extends Error {
+	schedule;
+	constructor(schedule, reason) {
+		super(`\`${schedule}\` has no exact cron equivalent: ${reason}.\n\nCron says *when*, not *how often*, so an interval is only exact when it divides its unit evenly.
+Write the schedule you mean instead — \`cron(0 */6 * * *)\` for every sixth hour, say — or pick an interval that divides: minutes into 60, hours into 24.`);
+		this.schedule = schedule;
+		this.name = "UnrepresentableSchedule";
+	}
+};
+/** Units `rate(…)` accepts, singular or plural. */
+const UNITS = [
+	"minute",
+	"hour",
+	"day"
+];
+/**
+* Standard five-field cron for a schedule expression.
+*
+* @throws {UnrepresentableSchedule} when a `rate(…)` has no exact equivalent.
+*/
+function toCronExpression(schedule) {
+	const cron = /^cron\((.+)\)$/.exec(schedule);
+	if (cron?.[1]) return cron[1].trim();
+	const rate = /^rate\(\s*(\d+)\s+(\w+?)s?\s*\)$/.exec(schedule);
+	if (!rate) throw new UnrepresentableSchedule(schedule, "it is neither `cron(…)` nor `rate(n unit)`");
+	const every = Number(rate[1]);
+	const unit = rate[2];
+	/* c8 ignore next */ if (!unit) throw new UnrepresentableSchedule(schedule, "no unit");
+	if (!UNITS.includes(unit)) throw new UnrepresentableSchedule(schedule, `\`${unit}\` is not one of ${UNITS.join(", ")}`);
+	if (every < 1) throw new UnrepresentableSchedule(schedule, "an interval must be at least 1");
+	switch (unit) {
+		case "minute":
+			if (every === 1) return "* * * * *";
+			if (60 % every !== 0) throw new UnrepresentableSchedule(schedule, `${every} does not divide 60, so the interval would reset at the top of each hour`);
+			return `*/${every} * * * *`;
+		case "hour":
+			if (every === 1) return "0 * * * *";
+			if (24 % every !== 0) throw new UnrepresentableSchedule(schedule, `${every} does not divide 24, so the interval would reset at midnight`);
+			return `0 */${every} * * *`;
+		case "day":
+			if (every === 1) return "0 0 * * *";
+			throw new UnrepresentableSchedule(schedule, "day-of-month restarts every month, so no multi-day interval is even");
+	}
+}
 //#endregion
-export { Cron, CronBuilder, c };
+export { Cron, CronBuilder, UnrepresentableSchedule, toCronExpression };
+
 //# sourceMappingURL=index.mjs.map

package/dist/crons/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/crons/index.ts"],"sourcesContent":["export {\n\tCron,\n\ttype CronExpression,\n\ttype RateExpression,\n\ttype ScheduleExpression,\n} from './Cron';\nexport { CronBuilder } from './CronBuilder';\n\nimport { CronBuilder } from './CronBuilder';\n\nexport const c = new CronBuilder();\n"],"mappings":";;;;;;;AAUA,MAAa,IAAI,IAAI"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/crons/schedule.ts"],"sourcesContent":["import type { ScheduleExpression } from './Cron';\n\n/**\n * A schedule a cron runner can take, as standard five-field cron.\n *\n * `ScheduleExpression` has two spellings. `cron(m h dom mon dow)` is already\n * five-field cron and unwraps; `rate(n unit)` is an interval, and an interval\n * is not a schedule — it says how often, where cron says when.\n *\n * Most intervals still have an exact cron equivalent, because they divide their\n * unit evenly: `rate(5 minutes)` is every fifth minute of every hour, and that\n * is `*​/5 * * * *` precisely. `rate(7 hours)` has none. There is no cron field\n * that means \"every seven hours\" — `*​/7` in the hour field fires at 0, 7, 14\n * and 21 and then starts over at midnight, so the gap between the last firing\n * of one day and the first of the next is three hours rather than seven.\n *\n * Those are refused rather than rounded. A job that runs at the wrong hour is\n * far harder to notice than one that refused to build, and a schedule quietly\n * adjusted by the framework is a bug nobody goes looking for.\n */\nexport class UnrepresentableSchedule extends Error {\n\tconstructor(\n\t\treadonly schedule: string,\n\t\treason: string,\n\t) {\n\t\tsuper(\n\t\t\t`\\`${schedule}\\` has no exact cron equivalent: ${reason}.\\n\\n` +\n\t\t\t\t'Cron says *when*, not *how often*, so an interval is only exact when ' +\n\t\t\t\t'it divides its unit evenly.\\n' +\n\t\t\t\t'Write the schedule you mean instead — `cron(0 */6 * * *)` for every ' +\n\t\t\t\t'sixth hour, say — or pick an interval that divides: minutes into 60, ' +\n\t\t\t\t'hours into 24.',\n\t\t);\n\t\tthis.name = 'UnrepresentableSchedule';\n\t}\n}\n\n/** Units `rate(…)` accepts, singular or plural. */\nconst UNITS = ['minute', 'hour', 'day'] as const;\ntype Unit = (typeof UNITS)[number];\n\n/**\n * Standard five-field cron for a schedule expression.\n *\n * @throws {UnrepresentableSchedule} when a `rate(…)` has no exact equivalent.\n */\nexport function toCronExpression(schedule: ScheduleExpression): string {\n\tconst cron = /^cron\\((.+)\\)$/.exec(schedule);\n\tif (cron?.[1]) return cron[1].trim();\n\n\tconst rate = /^rate\\(\\s*(\\d+)\\s+(\\w+?)s?\\s*\\)$/.exec(schedule);\n\tif (!rate) {\n\t\tthrow new UnrepresentableSchedule(\n\t\t\tschedule,\n\t\t\t'it is neither `cron(…)` nor `rate(n unit)`',\n\t\t);\n\t}\n\n\tconst every = Number(rate[1]);\n\tconst unit = rate[2] as Unit;\n\t/* c8 ignore next */ if (!unit)\n\t\tthrow new UnrepresentableSchedule(schedule, 'no unit');\n\n\tif (!UNITS.includes(unit)) {\n\t\tthrow new UnrepresentableSchedule(\n\t\t\tschedule,\n\t\t\t`\\`${unit}\\` is not one of ${UNITS.join(', ')}`,\n\t\t);\n\t}\n\n\tif (every < 1) {\n\t\tthrow new UnrepresentableSchedule(\n\t\t\tschedule,\n\t\t\t'an interval must be at least 1',\n\t\t);\n\t}\n\n\tswitch (unit) {\n\t\tcase 'minute':\n\t\t\tif (every === 1) return '* * * * *';\n\t\t\tif (60 % every !== 0) {\n\t\t\t\tthrow new UnrepresentableSchedule(\n\t\t\t\t\tschedule,\n\t\t\t\t\t`${every} does not divide 60, so the interval would reset at the top of each hour`,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn `*/${every} * * * *`;\n\n\t\tcase 'hour':\n\t\t\tif (every === 1) return '0 * * * *';\n\t\t\tif (24 % every !== 0) {\n\t\t\t\tthrow new UnrepresentableSchedule(\n\t\t\t\t\tschedule,\n\t\t\t\t\t`${every} does not divide 24, so the interval would reset at midnight`,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn `0 */${every} * * *`;\n\n\t\tcase 'day':\n\t\t\tif (every === 1) return '0 0 * * *';\n\t\t\t// `*/n` in day-of-month restarts on the 1st, so a 2-day interval fires\n\t\t\t// on the 1st and 3rd of a 31-day month and then again on the 1st — one\n\t\t\t// day later, not two. No month length makes that come out even.\n\t\t\tthrow new UnrepresentableSchedule(\n\t\t\t\tschedule,\n\t\t\t\t'day-of-month restarts every month, so no multi-day interval is even',\n\t\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBA,IAAa,0BAAb,cAA6C,MAAM;CAExC;CADV,YACC,UACA,QACC;EACD,MACC,KAAK,SAAS,mCAAmC,OAAO;0JAMzD;EAVS,KAAA,WAAA;EAWT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,QAAQ;CAAC;CAAU;CAAQ;AAAK;;;;;;AAQtC,SAAgB,iBAAiB,UAAsC;CACtE,MAAM,OAAO,iBAAiB,KAAK,QAAQ;CAC3C,IAAI,OAAO,IAAI,OAAO,KAAK,EAAE,CAAC,KAAK;CAEnC,MAAM,OAAO,mCAAmC,KAAK,QAAQ;CAC7D,IAAI,CAAC,MACJ,MAAM,IAAI,wBACT,UACA,4CACD;CAGD,MAAM,QAAQ,OAAO,KAAK,EAAE;CAC5B,MAAM,OAAO,KAAK;sBACG,IAAI,CAAC,MACzB,MAAM,IAAI,wBAAwB,UAAU,SAAS;CAEtD,IAAI,CAAC,MAAM,SAAS,IAAI,GACvB,MAAM,IAAI,wBACT,UACA,KAAK,KAAK,mBAAmB,MAAM,KAAK,IAAI,GAC7C;CAGD,IAAI,QAAQ,GACX,MAAM,IAAI,wBACT,UACA,gCACD;CAGD,QAAQ,MAAR;EACC,KAAK;GACJ,IAAI,UAAU,GAAG,OAAO;GACxB,IAAI,KAAK,UAAU,GAClB,MAAM,IAAI,wBACT,UACA,GAAG,MAAM,yEACV;GAED,OAAO,KAAK,MAAM;EAEnB,KAAK;GACJ,IAAI,UAAU,GAAG,OAAO;GACxB,IAAI,KAAK,UAAU,GAClB,MAAM,IAAI,wBACT,UACA,GAAG,MAAM,6DACV;GAED,OAAO,OAAO,MAAM;EAErB,KAAK;GACJ,IAAI,UAAU,GAAG,OAAO;GAIxB,MAAM,IAAI,wBACT,UACA,qEACD;CACF;AACD"}

package/dist/database/kysely.cjs

@@ -1,10 +1,23 @@
-const require_chunk = require('../chunk-DWy1uDak.cjs');
-const require_cache = require('../cache-3WSvAulx.cjs');
-const __geekmidas_manifest = require_chunk.__toESM(require("@geekmidas/manifest"));
-const kysely = require_chunk.__toESM(require("kysely"));
-const pg = require_chunk.__toESM(require("pg"));
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../rolldown-runtime-y5ARvAq5.cjs");
+const require_cache = require("../cache.cjs");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let kysely = require("kysely");
+let pg = require("pg");
+pg = require_rolldown_runtime.__toESM(pg, 1);
 //#region src/database/kysely.ts
+/**
+* `KyselyDatabase` — a declared Postgres database, typed by its schema.
+*
+* It declares a logical database, a schema, and the roles that reach it, and
+* hands back a Kysely client built from the one URL the adapter supplied. It
+* names no cloud: `--target=aws` fills that URL from RDS, local dev from the
+* Postgres container.
+*
+* Transactions and RLS context are the execution wrapper's job — it opens the
+* transaction and puts it in `ctx.db`. This construct does not resolve
+* connections per request.
+*/
 /** The schema a database uses when it does not say otherwise. */
 const DEFAULT_SCHEMA = "app";
 /**
@@ -15,6 +28,7 @@ const DEFAULT_SCHEMA = "app";
 * through `.database()`, which infers from the service.
 */
 var KyselyDatabase = class KyselyDatabase {
+	options;
 	id;
 	service;
 	/**
@@ -28,18 +42,18 @@ var KyselyDatabase = class KyselyDatabase {
 	derivedFrom;
 	constructor(id, options = {}, derivedFrom) {
 		this.options = options;
-		const canonical = (0, __geekmidas_manifest.canonicalId)(id);
+		const canonical = (0, _geekmidas_manifest.canonicalId)(id);
 		this.id = canonical;
 		this.config = {
-			url: (0, __geekmidas_manifest.provideKey)(canonical, "url"),
-			ownerUrl: (0, __geekmidas_manifest.provideKey)(canonical, "ownerUrl")
+			url: (0, _geekmidas_manifest.provideKey)(canonical, "url"),
+			ownerUrl: (0, _geekmidas_manifest.provideKey)(canonical, "ownerUrl")
 		};
 		this.schemaName = options.schema ?? DEFAULT_SCHEMA;
 		this.roles = options.roles ?? true;
-		this.version = options.version ?? __geekmidas_manifest.DEFAULT_POSTGRES_VERSION;
+		this.version = options.version ?? _geekmidas_manifest.DEFAULT_POSTGRES_VERSION;
 		this.derivedFrom = derivedFrom;
 		this.service = {
-			serviceName: (0, __geekmidas_manifest.serviceKey)(canonical),
+			serviceName: (0, _geekmidas_manifest.serviceKey)(canonical),
 			register: (registerOptions) => this.connect(registerOptions)
 		};
 	}
@@ -139,18 +153,29 @@ var KyselyDatabase = class KyselyDatabase {
 	*/
 	get owner() {
 		return {
-			serviceName: `${(0, __geekmidas_manifest.serviceKey)(this.id)}Owner`,
+			serviceName: `${(0, _geekmidas_manifest.serviceKey)(this.id)}Owner`,
 			register: (options) => this.connect(options, { owner: true })
 		};
 	}
+	/**
+	* What this database's clients are built with besides a dialect — the
+	* plugins and logging it was declared with.
+	*
+	* Public so that whatever opens a connection to it outside \`connect()\` —
+	* a test's transaction — builds the same client. A test that dropped the
+	* plugins would write \`createdAt\` where production writes \`created_at\`.
+	*/
+	get clientConfig() {
+		const { schema: _schema, roles: _roles, version: _version, ...kysely$1 } = this.options;
+		return kysely$1;
+	}
 	async connect(options, as = {}) {
 		const { url, ownerUrl } = options.envParser.create((get) => ({
 			url: get(this.config.url).string(),
 			ownerUrl: get(this.config.ownerUrl).string().optional()
 		})).parse();
-		const { schema: _schema, roles: _roles,...kysely$1 } = this.options;
 		return new kysely.Kysely({
-			...kysely$1,
+			...this.clientConfig,
 			dialect: new kysely.PostgresDialect({ pool: pool(as.owner ? ownerUrl ?? url : url) })
 		});
 	}
@@ -175,7 +200,7 @@ function pool(url) {
 		options: `-c search_path=${searchPath}`
 	});
 }
-
 //#endregion
 exports.KyselyDatabase = KyselyDatabase;
+
 //# sourceMappingURL=kysely.cjs.map

package/dist/database/kysely.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"kysely.cjs","names":["id: ConstructName<TName>","options: KyselyDatabaseOptions","derivedFrom?: DerivedFrom","DEFAULT_POSTGRES_VERSION","id: ConstructName<TCache>","options: { table?: string }","Cache","id: ConstructName<TTenant>","options: ServiceRegisterOptions","as: { owner?: boolean }","kysely","Kysely","PostgresDialect","url: string"],"sources":["../../src/database/kysely.ts"],"sourcesContent":["/**\n * `KyselyDatabase` — a declared Postgres database, typed by its schema.\n *\n * It declares a logical database, a schema, and the roles that reach it, and\n * hands back a Kysely client built from the one URL the adapter supplied. It\n * names no cloud: `--target=aws` fills that URL from RDS, local dev from the\n * Postgres container.\n *\n * Transactions and RLS context are the execution wrapper's job — it opens the\n * transaction and puts it in `ctx.db`. This construct does not resolve\n * connections per request.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\tDEFAULT_POSTGRES_VERSION,\n\ttype Declaration,\n\ttype PostgresVersion,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport { Kysely, type KyselyConfig, PostgresDialect } from 'kysely';\nimport pg from 'pg';\nimport { Cache } from '../cache';\nimport type { Construct } from '../construct-interface';\n\n/** The schema a database uses when it does not say otherwise. */\nconst DEFAULT_SCHEMA = 'app';\n\n/**\n * Everything Kysely takes, plus what this construct declares.\n *\n * `dialect` is omitted because the construct owns it — it is built from the one\n * URL the adapter supplied, which is the whole point of the construct. The rest\n * of `KyselyConfig` (`plugins`, `log`) is the app's business and passes\n * straight through, so anything Kysely adds later arrives without being\n * tracked here.\n */\nexport interface KyselyDatabaseOptions extends Omit<KyselyConfig, 'dialect'> {\n\t/**\n\t * The schema, pinned on both roles' `search_path`.\n\t *\n\t * Defaults to `app` — the role the schema plays, rather than a restatement\n\t * of the database's own name, which reads correctly beside `auth` and\n\t * `pgboss` and keeps the application off `public`.\n\t */\n\tschema?: string;\n\t/**\n\t * Provision the owner/runtime role split. Defaults to on.\n\t *\n\t * Off falls back to the cluster's master credential in both URLs, giving up\n\t * the DDL/DML split and putting credentials that can drop a table into the\n\t * function's environment. A deliberate downgrade, not a default.\n\t */\n\troles?: boolean;\n\t/**\n\t * The Postgres major version to provision.\n\t *\n\t * Declared here so one statement reaches both targets. It was previously\n\t * set in two unrelated places — a container tag locally, nothing at all on\n\t * AWS (so Aurora chose) — which is how local came to run 18 while deployed\n\t * ran 17.7 with nothing recording the difference.\n\t *\n\t * Defaults to {@link DEFAULT_POSTGRES_VERSION}.\n\t */\n\tversion?: PostgresVersion;\n}\n\n/** What makes a construct derived rather than a database in its own right. */\ninterface DerivedFrom {\n\tkind: 'database-reader' | 'database-schema';\n\tof: string;\n\tschema?: string;\n}\n\n/**\n * @typeParam DB - the database's schema.\n * @typeParam TName - the canonical id. TypeScript has no partial\n * type-argument inference, so `new KyselyDatabase<OrdersDB>('orders')` leaves\n * this at its default and the service key widens to `string`. `db` still types\n * through `.database()`, which infers from the service.\n */\nexport class KyselyDatabase<DB = unknown, TName extends string = string>\n\timplements Construct<TName, Kysely<DB>>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, Kysely<DB>>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * build publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly config: { url: string; ownerUrl: string };\n\tprivate readonly schemaName: string;\n\tprivate readonly roles: boolean;\n\tprivate readonly version: PostgresVersion;\n\tprivate readonly derivedFrom?: DerivedFrom;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: KyselyDatabaseOptions = {},\n\t\tderivedFrom?: DerivedFrom,\n\t) {\n\t\t// Canonicalises, so `orders` and `Orders` are one construct rather than\n\t\t// two that collide. Throws on anything that cannot become a valid id.\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.config = {\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\townerUrl: provideKey(canonical, 'ownerUrl'),\n\t\t};\n\t\tthis.schemaName = options.schema ?? DEFAULT_SCHEMA;\n\t\tthis.roles = options.roles ?? true;\n\t\tthis.version = options.version ?? DEFAULT_POSTGRES_VERSION;\n\t\tthis.derivedFrom = derivedFrom;\n\n\t\t// A field, not a getter: service discovery caches by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\t// Forwards the whole options object — cherry-picking `envParser` strips\n\t\t\t// `context` and with it the request-scoped logger.\n\t\t\tregister: (registerOptions) => this.connect(registerOptions),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\tif (this.derivedFrom) {\n\t\t\tconst { kind, of, schema } = this.derivedFrom;\n\n\t\t\treturn [\n\t\t\t\tkind === 'database-schema'\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tkind,\n\t\t\t\t\t\t\tid: this.id,\n\t\t\t\t\t\t\tof,\n\t\t\t\t\t\t\tschema: schema ?? this.schemaName,\n\t\t\t\t\t\t\t// The runtime key alone — see the note below on the parent.\n\t\t\t\t\t\t\tprovides: [this.config.url],\n\t\t\t\t\t\t}\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tkind,\n\t\t\t\t\t\t\tid: this.id,\n\t\t\t\t\t\t\tof,\n\t\t\t\t\t\t\t// A reader has no owner URL of its own — nothing migrates\n\t\t\t\t\t\t\t// through a read-only endpoint — so this is the one key.\n\t\t\t\t\t\t\tprovides: [this.config.url],\n\t\t\t\t\t\t},\n\t\t\t];\n\t\t}\n\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'database',\n\t\t\t\tid: this.id,\n\t\t\t\tengine: 'postgres',\n\t\t\t\tschema: this.schemaName,\n\t\t\t\tversion: this.version,\n\t\t\t\t// One key, the runtime role's. `config` also holds the owner key and\n\t\t\t\t// it is deliberately absent here: a key in `provides` is a key an\n\t\t\t\t// edge can name, and nothing should be able to depend on DDL rights.\n\t\t\t\tprovides: [this.config.url],\n\t\t\t\t...(this.roles ? {} : { roles: false }),\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * A read-only endpoint on this database.\n\t *\n\t * Read-only is enforced by the reader role's grants rather than by which\n\t * endpoint it resolves to, so falling back to the writer where no replica\n\t * exists is safe rather than a silently writable connection behind a name\n\t * that says reader. There is no `writer()`: the database *is* the writer, so\n\t * a replica can never be reached by accident.\n\t *\n\t * The return type is narrower than this class on purpose — see\n\t * {@link ReadOnlyDatabase}.\n\t */\n\treader(): ReadOnlyDatabase<DB, `${TName}Reader`> {\n\t\treturn new KyselyDatabase<DB, `${TName}Reader`>(\n\t\t\t`${this.id}Reader` as ConstructName<`${TName}Reader`>,\n\t\t\tthis.options,\n\t\t\t{ kind: 'database-reader', of: this.id },\n\t\t);\n\t}\n\n\t/**\n\t * A cache that lives in this database.\n\t *\n\t * The same strengthening `schema()` is over a second database: `new\n\t * Cache('Sessions')` says the app caches and leaves where to the deployment,\n\t * while this says it caches *here* — which is a fact about the application\n\t * and so belongs in its code.\n\t *\n\t * What it buys beyond being explicit: the table's schema and the role that\n\t * reaches it come from this database rather than from a second convention,\n\t * and the backend no longer has to guess which database \"the database\" meant\n\t * when an app declares two.\n\t *\n\t * A cache is not a `KyselyDatabase`, so this returns a `Cache` — the client\n\t * is a key/value store, not a query builder, and typing it as the parent\n\t * would be a convenience that lies.\n\t */\n\tcache<TCache extends string = `${TName}Cache`>(\n\t\tid: ConstructName<TCache> = `${this.id}Cache` as ConstructName<TCache>,\n\t\toptions: { table?: string } = {},\n\t): Cache<TCache> {\n\t\treturn new Cache<TCache>(id, {\n\t\t\tof: this.id,\n\t\t\t...(options.table ? { table: options.table } : {}),\n\t\t});\n\t}\n\n\t/**\n\t * A second schema in this database, with its own role(s) and its own URL —\n\t * so this database's role holds no grant on those tables at all.\n\t *\n\t * Typed separately because a tenant has its own tables: the point is that\n\t * `auth.selectFrom('sessions')` type-checks and\n\t * `orders.selectFrom('sessions')` does not.\n\t */\n\tschema<TenantDB, TTenant extends string>(\n\t\tid: ConstructName<TTenant>,\n\t\toptions: KyselyDatabaseOptions = {},\n\t): KyselyDatabase<TenantDB, TTenant> {\n\t\treturn new KyselyDatabase<TenantDB, TTenant>(id, options, {\n\t\t\tkind: 'database-schema',\n\t\t\tof: this.id,\n\t\t\tschema: options.schema ?? (id as string).toLowerCase(),\n\t\t});\n\t}\n\n\t/**\n\t * A connection as the *owner* role — the one that may create, alter and drop.\n\t *\n\t * A `Service` rather than part of the construct, and deliberately so: a\n\t * construct is what `.dependsOn()` accepts, and nothing should be able to\n\t * depend on this. A migrator asks for it by name; a handler cannot ask at\n\t * all, which is the security property the role split exists for.\n\t *\n\t * Falls back to the runtime URL where no owner URL was published — the\n\t * `roles: false` downgrade, where there is only one credential and it is the\n\t * cluster master's.\n\t */\n\tget owner(): Service<`${Uncapitalize<TName>}Owner`, Kysely<DB>> {\n\t\treturn {\n\t\t\tserviceName:\n\t\t\t\t`${serviceKey(this.id)}Owner` as `${Uncapitalize<TName>}Owner`,\n\t\t\tregister: (options) => this.connect(options, { owner: true }),\n\t\t};\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<Kysely<DB>> {\n\t\tconst { url, ownerUrl } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\turl: get(this.config.url).string(),\n\t\t\t\townerUrl: get(this.config.ownerUrl).string().optional(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\t// Split what the manifest declared from what Kysely takes, so neither\n\t\t// leaks into the other: `schema` and `roles` describe infrastructure and\n\t\t// mean nothing to a client.\n\t\tconst { schema: _schema, roles: _roles, ...kysely } = this.options;\n\n\t\treturn new Kysely<DB>({\n\t\t\t...kysely,\n\t\t\tdialect: new PostgresDialect({\n\t\t\t\tpool: pool(as.owner ? (ownerUrl ?? url) : url),\n\t\t\t}),\n\t\t});\n\t}\n}\n\n/**\n * A pool for one URL, with its schema actually on the search path.\n *\n * `?search_path=` is not a libpq parameter — a URL carrying it connects\n * happily and then resolves every unqualified name against `public`, which is\n * how a schema tenant silently writes its tables into the database it was\n * separated from. Postgres takes it as a startup option instead, so the URL\n * keeps the readable form the target derives and this turns it into the thing\n * the server understands.\n */\nfunction pool(url: string): pg.Pool {\n\tconst parsed = new URL(url);\n\tconst searchPath = parsed.searchParams.get('search_path');\n\n\tif (!searchPath) return new pg.Pool({ connectionString: url });\n\n\tparsed.searchParams.delete('search_path');\n\n\treturn new pg.Pool({\n\t\tconnectionString: parsed.toString(),\n\t\toptions: `-c search_path=${searchPath}`,\n\t});\n}\n\n/**\n * A database you may read through, and derive nothing from.\n *\n * A reader is terminal in the graph, and this is that fact in the type system.\n * `DERIVES_FROM` gives `cache` and `database-schema` no `database-reader`\n * parent, and there is no reader of a reader — so `orders.reader().cache(…)`\n * has always been illegal, but it type-checked and failed later at\n * `assertDerivations`. That is a long way round to learn that a read-only\n * endpoint cannot own a table something writes to.\n *\n * Omitting the three deriving methods rather than making them throw keeps the\n * failure where it costs least: the editor, on the line that wrote it.\n *\n * The result is deliberately not assignable back to `KyselyDatabase` — a\n * reader is not one, and anything that genuinely needs the writer should say\n * so.\n */\nexport type ReadOnlyDatabase<DB, TName extends string> = Omit<\n\tKyselyDatabase<DB, TName>,\n\t'reader' | 'cache' | 'schema'\n>;\n"],"mappings":";;;;;;;;AA6BA,MAAM,iBAAiB;;;;;;;;AAuDvB,IAAa,iBAAb,MAAa,eAEb;CACC,AAAS;CACT,AAAS;;;;;CAMT,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YACCA,IACiBC,UAAiC,CAAE,GACpDC,aACC;EAFgB;EAKjB,MAAM,YAAY,sCAAY,GAAa;AAE3C,OAAK,KAAK;AACV,OAAK,SAAS;GACb,KAAK,qCAAW,WAAW,MAAM;GACjC,UAAU,qCAAW,WAAW,WAAW;EAC3C;AACD,OAAK,aAAa,QAAQ,UAAU;AACpC,OAAK,QAAQ,QAAQ,SAAS;AAC9B,OAAK,UAAU,QAAQ,WAAWC;AAClC,OAAK,cAAc;AAGnB,OAAK,UAAU;GACd,aAAa,qCAAW,UAAU;GAGlC,UAAU,CAAC,oBAAoB,KAAK,QAAQ,gBAAgB;EAC5D;CACD;CAED,UAAyB;AACxB,MAAI,KAAK,aAAa;GACrB,MAAM,EAAE,MAAM,IAAI,QAAQ,GAAG,KAAK;AAElC,UAAO,CACN,SAAS,oBACN;IACA;IACA,IAAI,KAAK;IACT;IACA,QAAQ,UAAU,KAAK;IAEvB,UAAU,CAAC,KAAK,OAAO,GAAI;GAC3B,IACA;IACA;IACA,IAAI,KAAK;IACT;IAGA,UAAU,CAAC,KAAK,OAAO,GAAI;GAC3B,CACH;EACD;AAED,SAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,QAAQ;GACR,QAAQ,KAAK;GACb,SAAS,KAAK;GAId,UAAU,CAAC,KAAK,OAAO,GAAI;GAC3B,GAAI,KAAK,QAAQ,CAAE,IAAG,EAAE,OAAO,MAAO;EACtC,CACD;CACD;;;;;;;;;;;;;CAcD,SAAiD;AAChD,SAAO,IAAI,gBACT,EAAE,KAAK,GAAG,SACX,KAAK,SACL;GAAE,MAAM;GAAmB,IAAI,KAAK;EAAI;CAEzC;;;;;;;;;;;;;;;;;;CAmBD,MACCC,MAA6B,EAAE,KAAK,GAAG,QACvCC,UAA8B,CAAE,GAChB;AAChB,SAAO,IAAIC,oBAAc,IAAI;GAC5B,IAAI,KAAK;GACT,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAO,IAAG,CAAE;EACjD;CACD;;;;;;;;;CAUD,OACCC,IACAN,UAAiC,CAAE,GACC;AACpC,SAAO,IAAI,eAAkC,IAAI,SAAS;GACzD,MAAM;GACN,IAAI,KAAK;GACT,QAAQ,QAAQ,UAAU,AAAC,GAAc,aAAa;EACtD;CACD;;;;;;;;;;;;;CAcD,IAAI,QAA4D;AAC/D,SAAO;GACN,cACE,EAAE,qCAAW,KAAK,GAAG,CAAC;GACxB,UAAU,CAAC,YAAY,KAAK,QAAQ,SAAS,EAAE,OAAO,KAAM,EAAC;EAC7D;CACD;CAED,MAAc,QACbO,SACAC,KAA0B,CAAE,GACN;EACtB,MAAM,EAAE,KAAK,UAAU,GAAG,QAAQ,UAChC,OAAO,CAAC,SAAS;GACjB,KAAK,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ;GAClC,UAAU,IAAI,KAAK,OAAO,SAAS,CAAC,QAAQ,CAAC,UAAU;EACvD,GAAE,CACF,OAAO;EAKT,MAAM,EAAE,QAAQ,SAAS,OAAO,OAAQ,GAAGC,UAAQ,GAAG,KAAK;AAE3D,SAAO,IAAIC,cAAW;GACrB,GAAGD;GACH,SAAS,IAAIE,uBAAgB,EAC5B,MAAM,KAAK,GAAG,QAAS,YAAY,MAAO,IAAI,CAC9C;EACD;CACD;AACD;;;;;;;;;;;AAYD,SAAS,KAAKC,KAAsB;CACnC,MAAM,SAAS,IAAI,IAAI;CACvB,MAAM,aAAa,OAAO,aAAa,IAAI,cAAc;AAEzD,MAAK,WAAY,QAAO,IAAI,WAAG,KAAK,EAAE,kBAAkB,IAAK;AAE7D,QAAO,aAAa,OAAO,cAAc;AAEzC,QAAO,IAAI,WAAG,KAAK;EAClB,kBAAkB,OAAO,UAAU;EACnC,UAAU,iBAAiB,WAAW;CACtC;AACD"}
+{"version":3,"file":"kysely.cjs","names":["canonicalId","provideKey","DEFAULT_POSTGRES_VERSION","serviceKey","Cache","kysely","Kysely","PostgresDialect"],"sources":["../../src/database/kysely.ts"],"sourcesContent":["/**\n * `KyselyDatabase` — a declared Postgres database, typed by its schema.\n *\n * It declares a logical database, a schema, and the roles that reach it, and\n * hands back a Kysely client built from the one URL the adapter supplied. It\n * names no cloud: `--target=aws` fills that URL from RDS, local dev from the\n * Postgres container.\n *\n * Transactions and RLS context are the execution wrapper's job — it opens the\n * transaction and puts it in `ctx.db`. This construct does not resolve\n * connections per request.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\tDEFAULT_POSTGRES_VERSION,\n\ttype Declaration,\n\ttype PostgresVersion,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport { Kysely, type KyselyConfig, PostgresDialect } from 'kysely';\nimport pg from 'pg';\nimport { Cache } from '../cache';\nimport type { Construct } from '../construct-interface';\n\n/** The schema a database uses when it does not say otherwise. */\nconst DEFAULT_SCHEMA = 'app';\n\n/**\n * Everything Kysely takes, plus what this construct declares.\n *\n * `dialect` is omitted because the construct owns it — it is built from the one\n * URL the adapter supplied, which is the whole point of the construct. The rest\n * of `KyselyConfig` (`plugins`, `log`) is the app's business and passes\n * straight through, so anything Kysely adds later arrives without being\n * tracked here.\n */\nexport interface KyselyDatabaseOptions extends Omit<KyselyConfig, 'dialect'> {\n\t/**\n\t * The schema, pinned on both roles' `search_path`.\n\t *\n\t * Defaults to `app` — the role the schema plays, rather than a restatement\n\t * of the database's own name, which reads correctly beside `auth` and\n\t * `pgboss` and keeps the application off `public`.\n\t */\n\tschema?: string;\n\t/**\n\t * Provision the owner/runtime role split. Defaults to on.\n\t *\n\t * Off falls back to the cluster's master credential in both URLs, giving up\n\t * the DDL/DML split and putting credentials that can drop a table into the\n\t * function's environment. A deliberate downgrade, not a default.\n\t */\n\troles?: boolean;\n\t/**\n\t * The Postgres major version to provision.\n\t *\n\t * Declared here so one statement reaches both targets. It was previously\n\t * set in two unrelated places — a container tag locally, nothing at all on\n\t * AWS (so Aurora chose) — which is how local came to run 18 while deployed\n\t * ran 17.7 with nothing recording the difference.\n\t *\n\t * Defaults to {@link DEFAULT_POSTGRES_VERSION}.\n\t */\n\tversion?: PostgresVersion;\n}\n\n/** What makes a construct derived rather than a database in its own right. */\ninterface DerivedFrom {\n\tkind: 'database-reader' | 'database-schema';\n\tof: string;\n\tschema?: string;\n}\n\n/**\n * @typeParam DB - the database's schema.\n * @typeParam TName - the canonical id. TypeScript has no partial\n * type-argument inference, so `new KyselyDatabase<OrdersDB>('orders')` leaves\n * this at its default and the service key widens to `string`. `db` still types\n * through `.database()`, which infers from the service.\n */\nexport class KyselyDatabase<DB = unknown, TName extends string = string>\n\timplements Construct<TName, Kysely<DB>>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, Kysely<DB>>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * build publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly config: { url: string; ownerUrl: string };\n\tprivate readonly schemaName: string;\n\tprivate readonly roles: boolean;\n\tprivate readonly version: PostgresVersion;\n\tprivate readonly derivedFrom?: DerivedFrom;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: KyselyDatabaseOptions = {},\n\t\tderivedFrom?: DerivedFrom,\n\t) {\n\t\t// Canonicalises, so `orders` and `Orders` are one construct rather than\n\t\t// two that collide. Throws on anything that cannot become a valid id.\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.config = {\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\townerUrl: provideKey(canonical, 'ownerUrl'),\n\t\t};\n\t\tthis.schemaName = options.schema ?? DEFAULT_SCHEMA;\n\t\tthis.roles = options.roles ?? true;\n\t\tthis.version = options.version ?? DEFAULT_POSTGRES_VERSION;\n\t\tthis.derivedFrom = derivedFrom;\n\n\t\t// A field, not a getter: service discovery caches by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\t// Forwards the whole options object — cherry-picking `envParser` strips\n\t\t\t// `context` and with it the request-scoped logger.\n\t\t\tregister: (registerOptions) => this.connect(registerOptions),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\tif (this.derivedFrom) {\n\t\t\tconst { kind, of, schema } = this.derivedFrom;\n\n\t\t\treturn [\n\t\t\t\tkind === 'database-schema'\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tkind,\n\t\t\t\t\t\t\tid: this.id,\n\t\t\t\t\t\t\tof,\n\t\t\t\t\t\t\tschema: schema ?? this.schemaName,\n\t\t\t\t\t\t\t// The runtime key alone — see the note below on the parent.\n\t\t\t\t\t\t\tprovides: [this.config.url],\n\t\t\t\t\t\t}\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tkind,\n\t\t\t\t\t\t\tid: this.id,\n\t\t\t\t\t\t\tof,\n\t\t\t\t\t\t\t// A reader has no owner URL of its own — nothing migrates\n\t\t\t\t\t\t\t// through a read-only endpoint — so this is the one key.\n\t\t\t\t\t\t\tprovides: [this.config.url],\n\t\t\t\t\t\t},\n\t\t\t];\n\t\t}\n\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'database',\n\t\t\t\tid: this.id,\n\t\t\t\tengine: 'postgres',\n\t\t\t\tschema: this.schemaName,\n\t\t\t\tversion: this.version,\n\t\t\t\t// One key, the runtime role's. `config` also holds the owner key and\n\t\t\t\t// it is deliberately absent here: a key in `provides` is a key an\n\t\t\t\t// edge can name, and nothing should be able to depend on DDL rights.\n\t\t\t\tprovides: [this.config.url],\n\t\t\t\t...(this.roles ? {} : { roles: false }),\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * A read-only endpoint on this database.\n\t *\n\t * Read-only is enforced by the reader role's grants rather than by which\n\t * endpoint it resolves to, so falling back to the writer where no replica\n\t * exists is safe rather than a silently writable connection behind a name\n\t * that says reader. There is no `writer()`: the database *is* the writer, so\n\t * a replica can never be reached by accident.\n\t *\n\t * The return type is narrower than this class on purpose — see\n\t * {@link ReadOnlyDatabase}.\n\t */\n\treader(): ReadOnlyDatabase<DB, `${TName}Reader`> {\n\t\treturn new KyselyDatabase<DB, `${TName}Reader`>(\n\t\t\t`${this.id}Reader` as ConstructName<`${TName}Reader`>,\n\t\t\tthis.options,\n\t\t\t{ kind: 'database-reader', of: this.id },\n\t\t);\n\t}\n\n\t/**\n\t * A cache that lives in this database.\n\t *\n\t * The same strengthening `schema()` is over a second database: `new\n\t * Cache('Sessions')` says the app caches and leaves where to the deployment,\n\t * while this says it caches *here* — which is a fact about the application\n\t * and so belongs in its code.\n\t *\n\t * What it buys beyond being explicit: the table's schema and the role that\n\t * reaches it come from this database rather than from a second convention,\n\t * and the backend no longer has to guess which database \"the database\" meant\n\t * when an app declares two.\n\t *\n\t * A cache is not a `KyselyDatabase`, so this returns a `Cache` — the client\n\t * is a key/value store, not a query builder, and typing it as the parent\n\t * would be a convenience that lies.\n\t */\n\tcache<TCache extends string = `${TName}Cache`>(\n\t\tid: ConstructName<TCache> = `${this.id}Cache` as ConstructName<TCache>,\n\t\toptions: { table?: string } = {},\n\t): Cache<TCache> {\n\t\treturn new Cache<TCache>(id, {\n\t\t\tof: this.id,\n\t\t\t...(options.table ? { table: options.table } : {}),\n\t\t});\n\t}\n\n\t/**\n\t * A second schema in this database, with its own role(s) and its own URL —\n\t * so this database's role holds no grant on those tables at all.\n\t *\n\t * Typed separately because a tenant has its own tables: the point is that\n\t * `auth.selectFrom('sessions')` type-checks and\n\t * `orders.selectFrom('sessions')` does not.\n\t */\n\tschema<TenantDB, TTenant extends string>(\n\t\tid: ConstructName<TTenant>,\n\t\toptions: KyselyDatabaseOptions = {},\n\t): KyselyDatabase<TenantDB, TTenant> {\n\t\treturn new KyselyDatabase<TenantDB, TTenant>(id, options, {\n\t\t\tkind: 'database-schema',\n\t\t\tof: this.id,\n\t\t\tschema: options.schema ?? (id as string).toLowerCase(),\n\t\t});\n\t}\n\n\t/**\n\t * A connection as the *owner* role — the one that may create, alter and drop.\n\t *\n\t * A `Service` rather than part of the construct, and deliberately so: a\n\t * construct is what `.dependsOn()` accepts, and nothing should be able to\n\t * depend on this. A migrator asks for it by name; a handler cannot ask at\n\t * all, which is the security property the role split exists for.\n\t *\n\t * Falls back to the runtime URL where no owner URL was published — the\n\t * `roles: false` downgrade, where there is only one credential and it is the\n\t * cluster master's.\n\t */\n\tget owner(): Service<`${Uncapitalize<TName>}Owner`, Kysely<DB>> {\n\t\treturn {\n\t\t\tserviceName:\n\t\t\t\t`${serviceKey(this.id)}Owner` as `${Uncapitalize<TName>}Owner`,\n\t\t\tregister: (options) => this.connect(options, { owner: true }),\n\t\t};\n\t}\n\n\t/**\n\t * What this database's clients are built with besides a dialect — the\n\t * plugins and logging it was declared with.\n\t *\n\t * Public so that whatever opens a connection to it outside \\`connect()\\` —\n\t * a test's transaction — builds the same client. A test that dropped the\n\t * plugins would write \\`createdAt\\` where production writes \\`created_at\\`.\n\t */\n\tget clientConfig(): Omit<KyselyConfig, 'dialect'> {\n\t\t// Split what the manifest declared from what Kysely takes, so neither\n\t\t// leaks into the other: \\`schema\\`, \\`roles\\` and \\`version\\` describe\n\t\t// infrastructure and mean nothing to a client.\n\t\tconst {\n\t\t\tschema: _schema,\n\t\t\troles: _roles,\n\t\t\tversion: _version,\n\t\t\t...kysely\n\t\t} = this.options;\n\t\treturn kysely;\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<Kysely<DB>> {\n\t\tconst { url, ownerUrl } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\turl: get(this.config.url).string(),\n\t\t\t\townerUrl: get(this.config.ownerUrl).string().optional(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\treturn new Kysely<DB>({\n\t\t\t...this.clientConfig,\n\t\t\tdialect: new PostgresDialect({\n\t\t\t\tpool: pool(as.owner ? (ownerUrl ?? url) : url),\n\t\t\t}),\n\t\t});\n\t}\n}\n\n/**\n * A pool for one URL, with its schema actually on the search path.\n *\n * `?search_path=` is not a libpq parameter — a URL carrying it connects\n * happily and then resolves every unqualified name against `public`, which is\n * how a schema tenant silently writes its tables into the database it was\n * separated from. Postgres takes it as a startup option instead, so the URL\n * keeps the readable form the target derives and this turns it into the thing\n * the server understands.\n */\nfunction pool(url: string): pg.Pool {\n\tconst parsed = new URL(url);\n\tconst searchPath = parsed.searchParams.get('search_path');\n\n\tif (!searchPath) return new pg.Pool({ connectionString: url });\n\n\tparsed.searchParams.delete('search_path');\n\n\treturn new pg.Pool({\n\t\tconnectionString: parsed.toString(),\n\t\toptions: `-c search_path=${searchPath}`,\n\t});\n}\n\n/**\n * A database you may read through, and derive nothing from.\n *\n * A reader is terminal in the graph, and this is that fact in the type system.\n * `DERIVES_FROM` gives `cache` and `database-schema` no `database-reader`\n * parent, and there is no reader of a reader — so `orders.reader().cache(…)`\n * has always been illegal, but it type-checked and failed later at\n * `assertDerivations`. That is a long way round to learn that a read-only\n * endpoint cannot own a table something writes to.\n *\n * Omitting the three deriving methods rather than making them throw keeps the\n * failure where it costs least: the editor, on the line that wrote it.\n *\n * The result is deliberately not assignable back to `KyselyDatabase` — a\n * reader is not one, and anything that genuinely needs the writer should say\n * so.\n */\nexport type ReadOnlyDatabase<DB, TName extends string> = Omit<\n\tKyselyDatabase<DB, TName>,\n\t'reader' | 'cache' | 'schema'\n>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA6BA,MAAM,iBAAiB;;;;;;;;AAuDvB,IAAa,iBAAb,MAAa,eAEb;CAgBmB;CAflB;CACA;;;;;CAMA;CACA;CACA;CACA;CACA;CAEA,YACC,IACA,UAAkD,CAAC,GACnD,aACC;EAFgB,KAAA,UAAA;EAKjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,SAAS;GACb,MAAA,GAAKC,oBAAAA,WAAAA,CAAW,WAAW,KAAK;GAChC,WAAA,GAAUA,oBAAAA,WAAAA,CAAW,WAAW,UAAU;EAC3C;EACA,KAAK,aAAa,QAAQ,UAAU;EACpC,KAAK,QAAQ,QAAQ,SAAS;EAC9B,KAAK,UAAU,QAAQ,WAAWC,oBAAAA;EAClC,KAAK,cAAc;EAGnB,KAAK,UAAU;GACd,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,SAAS;GAGjC,WAAW,oBAAoB,KAAK,QAAQ,eAAe;EAC5D;CACD;CAEA,UAAyB;EACxB,IAAI,KAAK,aAAa;GACrB,MAAM,EAAE,MAAM,IAAI,WAAW,KAAK;GAElC,OAAO,CACN,SAAS,oBACN;IACA;IACA,IAAI,KAAK;IACT;IACA,QAAQ,UAAU,KAAK;IAEvB,UAAU,CAAC,KAAK,OAAO,GAAG;GAC3B,IACC;IACA;IACA,IAAI,KAAK;IACT;IAGA,UAAU,CAAC,KAAK,OAAO,GAAG;GAC3B,CACH;EACD;EAEA,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,QAAQ;GACR,QAAQ,KAAK;GACb,SAAS,KAAK;GAId,UAAU,CAAC,KAAK,OAAO,GAAG;GAC1B,GAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,OAAO,MAAM;EACtC,CACD;CACD;;;;;;;;;;;;;CAcA,SAAiD;EAChD,OAAO,IAAI,eACV,GAAG,KAAK,GAAG,SACX,KAAK,SACL;GAAE,MAAM;GAAmB,IAAI,KAAK;EAAG,CACxC;CACD;;;;;;;;;;;;;;;;;;CAmBA,MACC,KAA4B,GAAG,KAAK,GAAG,QACvC,UAA8B,CAAC,GACf;EAChB,OAAO,IAAIC,cAAAA,MAAc,IAAI;GAC5B,IAAI,KAAK;GACT,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjD,CAAC;CACF;;;;;;;;;CAUA,OACC,IACA,UAAiC,CAAC,GACE;EACpC,OAAO,IAAI,eAAkC,IAAI,SAAS;GACzD,MAAM;GACN,IAAI,KAAK;GACT,QAAQ,QAAQ,UAAW,GAAc,YAAY;EACtD,CAAC;CACF;;;;;;;;;;;;;CAcA,IAAI,QAA4D;EAC/D,OAAO;GACN,aACC,IAAA,GAAGD,oBAAAA,WAAAA,CAAW,KAAK,EAAE,EAAE;GACxB,WAAW,YAAY,KAAK,QAAQ,SAAS,EAAE,OAAO,KAAK,CAAC;EAC7D;CACD;;;;;;;;;CAUA,IAAI,eAA8C;EAIjD,MAAM,EACL,QAAQ,SACR,OAAO,QACP,SAAS,UACT,GAAGE,aACA,KAAK;EACT,OAAOA;CACR;CAEA,MAAc,QACb,SACA,KAA0B,CAAC,GACL;EACtB,MAAM,EAAE,KAAK,aAAa,QAAQ,UAChC,QAAQ,SAAS;GACjB,KAAK,IAAI,KAAK,OAAO,GAAG,CAAC,CAAC,OAAO;GACjC,UAAU,IAAI,KAAK,OAAO,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS;EACvD,EAAE,CAAC,CACF,MAAM;EAER,OAAO,IAAIC,OAAAA,OAAW;GACrB,GAAG,KAAK;GACR,SAAS,IAAIC,OAAAA,gBAAgB,EAC5B,MAAM,KAAK,GAAG,QAAS,YAAY,MAAO,GAAG,EAC9C,CAAC;EACF,CAAC;CACF;AACD;;;;;;;;;;;AAYA,SAAS,KAAK,KAAsB;CACnC,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,MAAM,aAAa,OAAO,aAAa,IAAI,aAAa;CAExD,IAAI,CAAC,YAAY,OAAO,IAAI,GAAA,QAAG,KAAK,EAAE,kBAAkB,IAAI,CAAC;CAE7D,OAAO,aAAa,OAAO,aAAa;CAExC,OAAO,IAAI,GAAA,QAAG,KAAK;EAClB,kBAAkB,OAAO,SAAS;EAClC,SAAS,kBAAkB;CAC5B,CAAC;AACF"}

package/dist/database/kysely.d.cts

@@ -1,152 +1,2 @@
-import { Construct } from "../construct-interface-D9d4Gm4p.cjs";
-import { Cache } from "../cache-BtZY_tHe.cjs";
-import { Service } from "@geekmidas/services";
-import { ConstructName, Declaration, PostgresVersion } from "@geekmidas/manifest";
-import { Kysely, KyselyConfig } from "kysely";
-
-//#region src/database/kysely.d.ts
-
-/**
- * Everything Kysely takes, plus what this construct declares.
- *
- * `dialect` is omitted because the construct owns it — it is built from the one
- * URL the adapter supplied, which is the whole point of the construct. The rest
- * of `KyselyConfig` (`plugins`, `log`) is the app's business and passes
- * straight through, so anything Kysely adds later arrives without being
- * tracked here.
- */
-interface KyselyDatabaseOptions extends Omit<KyselyConfig, 'dialect'> {
-  /**
-   * The schema, pinned on both roles' `search_path`.
-   *
-   * Defaults to `app` — the role the schema plays, rather than a restatement
-   * of the database's own name, which reads correctly beside `auth` and
-   * `pgboss` and keeps the application off `public`.
-   */
-  schema?: string;
-  /**
-   * Provision the owner/runtime role split. Defaults to on.
-   *
-   * Off falls back to the cluster's master credential in both URLs, giving up
-   * the DDL/DML split and putting credentials that can drop a table into the
-   * function's environment. A deliberate downgrade, not a default.
-   */
-  roles?: boolean;
-  /**
-   * The Postgres major version to provision.
-   *
-   * Declared here so one statement reaches both targets. It was previously
-   * set in two unrelated places — a container tag locally, nothing at all on
-   * AWS (so Aurora chose) — which is how local came to run 18 while deployed
-   * ran 17.7 with nothing recording the difference.
-   *
-   * Defaults to {@link DEFAULT_POSTGRES_VERSION}.
-   */
-  version?: PostgresVersion;
-}
-/** What makes a construct derived rather than a database in its own right. */
-interface DerivedFrom {
-  kind: 'database-reader' | 'database-schema';
-  of: string;
-  schema?: string;
-}
-/**
- * @typeParam DB - the database's schema.
- * @typeParam TName - the canonical id. TypeScript has no partial
- * type-argument inference, so `new KyselyDatabase<OrdersDB>('orders')` leaves
- * this at its default and the service key widens to `string`. `db` still types
- * through `.database()`, which infers from the service.
- */
-declare class KyselyDatabase<DB = unknown, TName extends string = string> implements Construct<TName, Kysely<DB>> {
-  private readonly options;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, Kysely<DB>>;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the key the
-   * build publishes and the key the client reads cannot drift.
-   */
-  private readonly config;
-  private readonly schemaName;
-  private readonly roles;
-  private readonly version;
-  private readonly derivedFrom?;
-  constructor(id: ConstructName<TName>, options?: KyselyDatabaseOptions, derivedFrom?: DerivedFrom);
-  declare(): Declaration[];
-  /**
-   * A read-only endpoint on this database.
-   *
-   * Read-only is enforced by the reader role's grants rather than by which
-   * endpoint it resolves to, so falling back to the writer where no replica
-   * exists is safe rather than a silently writable connection behind a name
-   * that says reader. There is no `writer()`: the database *is* the writer, so
-   * a replica can never be reached by accident.
-   *
-   * The return type is narrower than this class on purpose — see
-   * {@link ReadOnlyDatabase}.
-   */
-  reader(): ReadOnlyDatabase<DB, `${TName}Reader`>;
-  /**
-   * A cache that lives in this database.
-   *
-   * The same strengthening `schema()` is over a second database: `new
-   * Cache('Sessions')` says the app caches and leaves where to the deployment,
-   * while this says it caches *here* — which is a fact about the application
-   * and so belongs in its code.
-   *
-   * What it buys beyond being explicit: the table's schema and the role that
-   * reaches it come from this database rather than from a second convention,
-   * and the backend no longer has to guess which database "the database" meant
-   * when an app declares two.
-   *
-   * A cache is not a `KyselyDatabase`, so this returns a `Cache` — the client
-   * is a key/value store, not a query builder, and typing it as the parent
-   * would be a convenience that lies.
-   */
-  cache<TCache extends string = `${TName}Cache`>(id?: ConstructName<TCache>, options?: {
-    table?: string;
-  }): Cache<TCache>;
-  /**
-   * A second schema in this database, with its own role(s) and its own URL —
-   * so this database's role holds no grant on those tables at all.
-   *
-   * Typed separately because a tenant has its own tables: the point is that
-   * `auth.selectFrom('sessions')` type-checks and
-   * `orders.selectFrom('sessions')` does not.
-   */
-  schema<TenantDB, TTenant extends string>(id: ConstructName<TTenant>, options?: KyselyDatabaseOptions): KyselyDatabase<TenantDB, TTenant>;
-  /**
-   * A connection as the *owner* role — the one that may create, alter and drop.
-   *
-   * A `Service` rather than part of the construct, and deliberately so: a
-   * construct is what `.dependsOn()` accepts, and nothing should be able to
-   * depend on this. A migrator asks for it by name; a handler cannot ask at
-   * all, which is the security property the role split exists for.
-   *
-   * Falls back to the runtime URL where no owner URL was published — the
-   * `roles: false` downgrade, where there is only one credential and it is the
-   * cluster master's.
-   */
-  get owner(): Service<`${Uncapitalize<TName>}Owner`, Kysely<DB>>;
-  private connect;
-}
-/**
- * A database you may read through, and derive nothing from.
- *
- * A reader is terminal in the graph, and this is that fact in the type system.
- * `DERIVES_FROM` gives `cache` and `database-schema` no `database-reader`
- * parent, and there is no reader of a reader — so `orders.reader().cache(…)`
- * has always been illegal, but it type-checked and failed later at
- * `assertDerivations`. That is a long way round to learn that a read-only
- * endpoint cannot own a table something writes to.
- *
- * Omitting the three deriving methods rather than making them throw keeps the
- * failure where it costs least: the editor, on the line that wrote it.
- *
- * The result is deliberately not assignable back to `KyselyDatabase` — a
- * reader is not one, and anything that genuinely needs the writer should say
- * so.
- */
-type ReadOnlyDatabase<DB, TName extends string> = Omit<KyselyDatabase<DB, TName>, 'reader' | 'cache' | 'schema'>;
-//#endregion
-export { KyselyDatabase, KyselyDatabaseOptions, ReadOnlyDatabase };
-//# sourceMappingURL=kysely.d.cts.map
+import { n as KyselyDatabaseOptions, r as ReadOnlyDatabase, t as KyselyDatabase } from "../kysely-DVF8wOT4.cjs";
+export { KyselyDatabase, KyselyDatabaseOptions, ReadOnlyDatabase };

package/dist/database/kysely.d.mts

@@ -1,152 +1,2 @@
-import { Construct } from "../construct-interface-g5GM5pwR.mjs";
-import { Cache } from "../cache-BrRz3fEB.mjs";
-import { ConstructName, Declaration, PostgresVersion } from "@geekmidas/manifest";
-import { Service } from "@geekmidas/services";
-import { Kysely, KyselyConfig } from "kysely";
-
-//#region src/database/kysely.d.ts
-
-/**
- * Everything Kysely takes, plus what this construct declares.
- *
- * `dialect` is omitted because the construct owns it — it is built from the one
- * URL the adapter supplied, which is the whole point of the construct. The rest
- * of `KyselyConfig` (`plugins`, `log`) is the app's business and passes
- * straight through, so anything Kysely adds later arrives without being
- * tracked here.
- */
-interface KyselyDatabaseOptions extends Omit<KyselyConfig, 'dialect'> {
-  /**
-   * The schema, pinned on both roles' `search_path`.
-   *
-   * Defaults to `app` — the role the schema plays, rather than a restatement
-   * of the database's own name, which reads correctly beside `auth` and
-   * `pgboss` and keeps the application off `public`.
-   */
-  schema?: string;
-  /**
-   * Provision the owner/runtime role split. Defaults to on.
-   *
-   * Off falls back to the cluster's master credential in both URLs, giving up
-   * the DDL/DML split and putting credentials that can drop a table into the
-   * function's environment. A deliberate downgrade, not a default.
-   */
-  roles?: boolean;
-  /**
-   * The Postgres major version to provision.
-   *
-   * Declared here so one statement reaches both targets. It was previously
-   * set in two unrelated places — a container tag locally, nothing at all on
-   * AWS (so Aurora chose) — which is how local came to run 18 while deployed
-   * ran 17.7 with nothing recording the difference.
-   *
-   * Defaults to {@link DEFAULT_POSTGRES_VERSION}.
-   */
-  version?: PostgresVersion;
-}
-/** What makes a construct derived rather than a database in its own right. */
-interface DerivedFrom {
-  kind: 'database-reader' | 'database-schema';
-  of: string;
-  schema?: string;
-}
-/**
- * @typeParam DB - the database's schema.
- * @typeParam TName - the canonical id. TypeScript has no partial
- * type-argument inference, so `new KyselyDatabase<OrdersDB>('orders')` leaves
- * this at its default and the service key widens to `string`. `db` still types
- * through `.database()`, which infers from the service.
- */
-declare class KyselyDatabase<DB = unknown, TName extends string = string> implements Construct<TName, Kysely<DB>> {
-  private readonly options;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, Kysely<DB>>;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the key the
-   * build publishes and the key the client reads cannot drift.
-   */
-  private readonly config;
-  private readonly schemaName;
-  private readonly roles;
-  private readonly version;
-  private readonly derivedFrom?;
-  constructor(id: ConstructName<TName>, options?: KyselyDatabaseOptions, derivedFrom?: DerivedFrom);
-  declare(): Declaration[];
-  /**
-   * A read-only endpoint on this database.
-   *
-   * Read-only is enforced by the reader role's grants rather than by which
-   * endpoint it resolves to, so falling back to the writer where no replica
-   * exists is safe rather than a silently writable connection behind a name
-   * that says reader. There is no `writer()`: the database *is* the writer, so
-   * a replica can never be reached by accident.
-   *
-   * The return type is narrower than this class on purpose — see
-   * {@link ReadOnlyDatabase}.
-   */
-  reader(): ReadOnlyDatabase<DB, `${TName}Reader`>;
-  /**
-   * A cache that lives in this database.
-   *
-   * The same strengthening `schema()` is over a second database: `new
-   * Cache('Sessions')` says the app caches and leaves where to the deployment,
-   * while this says it caches *here* — which is a fact about the application
-   * and so belongs in its code.
-   *
-   * What it buys beyond being explicit: the table's schema and the role that
-   * reaches it come from this database rather than from a second convention,
-   * and the backend no longer has to guess which database "the database" meant
-   * when an app declares two.
-   *
-   * A cache is not a `KyselyDatabase`, so this returns a `Cache` — the client
-   * is a key/value store, not a query builder, and typing it as the parent
-   * would be a convenience that lies.
-   */
-  cache<TCache extends string = `${TName}Cache`>(id?: ConstructName<TCache>, options?: {
-    table?: string;
-  }): Cache<TCache>;
-  /**
-   * A second schema in this database, with its own role(s) and its own URL —
-   * so this database's role holds no grant on those tables at all.
-   *
-   * Typed separately because a tenant has its own tables: the point is that
-   * `auth.selectFrom('sessions')` type-checks and
-   * `orders.selectFrom('sessions')` does not.
-   */
-  schema<TenantDB, TTenant extends string>(id: ConstructName<TTenant>, options?: KyselyDatabaseOptions): KyselyDatabase<TenantDB, TTenant>;
-  /**
-   * A connection as the *owner* role — the one that may create, alter and drop.
-   *
-   * A `Service` rather than part of the construct, and deliberately so: a
-   * construct is what `.dependsOn()` accepts, and nothing should be able to
-   * depend on this. A migrator asks for it by name; a handler cannot ask at
-   * all, which is the security property the role split exists for.
-   *
-   * Falls back to the runtime URL where no owner URL was published — the
-   * `roles: false` downgrade, where there is only one credential and it is the
-   * cluster master's.
-   */
-  get owner(): Service<`${Uncapitalize<TName>}Owner`, Kysely<DB>>;
-  private connect;
-}
-/**
- * A database you may read through, and derive nothing from.
- *
- * A reader is terminal in the graph, and this is that fact in the type system.
- * `DERIVES_FROM` gives `cache` and `database-schema` no `database-reader`
- * parent, and there is no reader of a reader — so `orders.reader().cache(…)`
- * has always been illegal, but it type-checked and failed later at
- * `assertDerivations`. That is a long way round to learn that a read-only
- * endpoint cannot own a table something writes to.
- *
- * Omitting the three deriving methods rather than making them throw keeps the
- * failure where it costs least: the editor, on the line that wrote it.
- *
- * The result is deliberately not assignable back to `KyselyDatabase` — a
- * reader is not one, and anything that genuinely needs the writer should say
- * so.
- */
-type ReadOnlyDatabase<DB, TName extends string> = Omit<KyselyDatabase<DB, TName>, 'reader' | 'cache' | 'schema'>;
-//#endregion
-export { KyselyDatabase, KyselyDatabaseOptions, ReadOnlyDatabase };
-//# sourceMappingURL=kysely.d.mts.map
+import { n as KyselyDatabaseOptions, r as ReadOnlyDatabase, t as KyselyDatabase } from "../kysely-BJ8IQ_1P.mjs";
+export { KyselyDatabase, KyselyDatabaseOptions, ReadOnlyDatabase };