@geekmidas/constructs 10.0.0-alpha.78 → 10.0.0-alpha.80

package/dist/kysely-H7L1YDgE.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"kysely-H7L1YDgE.cjs","names":["onShutdown","currentRequestContext","trace","SpanKind","SpanStatusCode","context","canonicalId","provideKey","DEFAULT_POSTGRES_VERSION","serviceKey","Cache","kysely","Kysely","PostgresDialect"],"sources":["../src/database/pool.ts","../src/database/kysely.ts"],"sourcesContent":["/**\n * The `pg` pools a database construct opens, and what every one of them gets:\n *\n * - **A name.** `application_name` is what `pg_stat_activity` shows beside a\n *   connection. Without one, a database at `max_connections` cannot say who\n *   holds them. It is a *fallback*, so `PGAPPNAME` or `?application_name=` in\n *   the URL still win.\n * - **Tagged queries.** Inside a request, each query ends in a comment naming\n *   what ran it — `/*operation='POST /orders',request_id='…'*\\/` — in the\n *   sqlcommenter form. It shows in `pg_stat_activity.query`, in the server's\n *   slow-query and `auto_explain` logs, and costs no round trip;\n *   `pg_stat_statements` ignores comments, so its grouping is unchanged.\n * - **A listener for idle-client errors.** When the server ends an idle\n *   connection (`idle_session_timeout`, a failover, an admin), the pool emits\n *   `'error'`. With no listener that is an uncaught exception that kills the\n *   process — for a client the pool has already discarded.\n * - **A span per query.** Through the global OpenTelemetry tracer, so a no-op\n *   without a provider. `pg` is bundled into a production entry, where no\n *   instrumentation can hook its module load — so the client is wrapped here,\n *   as the tags are. See {@link traceQueries}.\n * - **A way to close.** {@link closeDatabasePools} ends every pool opened, so a\n *   server shutting down releases its connections instead of holding them\n *   until the process dies.\n */\n\nimport { currentRequestContext } from '@geekmidas/services';\nimport {\n\ttype Attributes,\n\tcontext,\n\tSpanKind,\n\tSpanStatusCode,\n\ttrace,\n} from '@opentelemetry/api';\nimport pg from 'pg';\nimport { onShutdown } from '../shutdown';\n\nexport interface DatabasePoolOptions {\n\t/** Tag queries run inside a request with what ran them. Default true. */\n\tqueryTags?: boolean;\n}\n\n/** The longest statement text a query span carries. */\nexport const MAX_STATEMENT_LENGTH = 2048;\n\n/** Every pool opened and not yet closed, so a shutdown can end them all. */\nconst open = new Set<pg.Pool>();\nonShutdown(() => closeDatabasePools());\n\n/**\n * A pool for one URL, with its schema actually on the search path.\n *\n * `?search_path=` is not a libpq parameter — a URL carrying it connects\n * happily and then resolves every unqualified name against `public`, which is\n * how a schema tenant silently writes its tables into the database it was\n * separated from. Postgres takes it as a startup option instead, so the URL\n * keeps the readable form the target derives and this turns it into the thing\n * the server understands.\n */\nexport function openPool(\n\turl: string,\n\toptions: DatabasePoolOptions = {},\n): pg.Pool {\n\tconst parsed = new URL(url);\n\tconst searchPath = parsed.searchParams.get('search_path');\n\tparsed.searchParams.delete('search_path');\n\n\tconst pool = new pg.Pool({\n\t\tconnectionString: parsed.toString(),\n\t\t...(searchPath ? { options: `-c search_path=${searchPath}` } : {}),\n\t\tfallback_application_name: applicationName(),\n\t});\n\n\tpool.on('error', (error) => {\n\t\tconst logger = currentRequestContext()?.logger;\n\t\tif (logger) logger.warn({ err: error }, 'Idle database connection lost');\n\t\telse console.warn('Idle database connection lost:', error.message);\n\t});\n\tconst target = connectionAttributes(parsed);\n\tpool.on('connect', (client) => {\n\t\t// Tags first, so the span wraps them and records the statement as the\n\t\t// application wrote it rather than with the comment on the end.\n\t\tif (options.queryTags !== false) tagQueries(client);\n\t\ttraceQueries(client, target);\n\t});\n\n\topen.add(pool);\n\tconst end = pool.end.bind(pool);\n\tpool.end = (async () => {\n\t\topen.delete(pool);\n\t\tawait end();\n\t}) as typeof pool.end;\n\n\treturn pool;\n}\n\n/**\n * End every pool opened, waiting for checked-out connections to come back.\n * For a server's shutdown, after it has stopped taking requests.\n */\nexport async function closeDatabasePools(): Promise<void> {\n\tawait Promise.all([...open].map((pool) => pool.end()));\n}\n\n/**\n * Who this process is, as Postgres will show it: the Lambda function, else the\n * app — `GKM_APP_NAME` where an entry sets it, `gkm dev`'s app tag otherwise.\n * Postgres keeps 63 bytes of it.\n */\nexport function applicationName(\n\tenv: NodeJS.ProcessEnv = process.env,\n): string | undefined {\n\treturn (\n\t\tenv.AWS_LAMBDA_FUNCTION_NAME ||\n\t\tenv.GKM_APP_NAME ||\n\t\tenv.GKM_DEV_APP?.split('#').pop() ||\n\t\tundefined\n\t);\n}\n\n/**\n * The comment that says what ran a query, or '' outside a request.\n *\n * Values keep only characters that cannot end a comment or a quoted value —\n * `*` and `'` among those dropped — so a route cannot inject SQL through it.\n */\nexport function queryTag(): string {\n\tconst request = currentRequestContext();\n\tif (!request) return '';\n\n\tconst tags = [\n\t\t['operation', request.operation],\n\t\t['request_id', request.requestId],\n\t].filter((tag): tag is [string, string] => Boolean(tag[1]));\n\tif (tags.length === 0) return '';\n\n\tconst clean = (value: string) => value.replace(/[^\\w ./:{}@-]/g, '');\n\treturn ` /*${tags.map(([key, value]) => `${key}='${clean(value)}'`).join(',')}*/`;\n}\n\n/**\n * Append {@link queryTag} to everything `client` runs: a SQL string — what\n * Kysely sends — or a query object such as a cursor's.\n */\nfunction tagQueries(client: pg.PoolClient): void {\n\tconst query = client.query.bind(client) as (...args: unknown[]) => unknown;\n\tclient.query = ((first: unknown, ...rest: unknown[]) => {\n\t\tconst tag = queryTag();\n\t\tif (tag && typeof first === 'string') return query(first + tag, ...rest);\n\t\tif (\n\t\t\ttag &&\n\t\t\tfirst &&\n\t\t\ttypeof first === 'object' &&\n\t\t\ttypeof (first as { text?: unknown }).text === 'string'\n\t\t) {\n\t\t\tconst config = first as { text: string };\n\t\t\tconfig.text += tag;\n\t\t}\n\t\treturn query(first, ...rest);\n\t}) as typeof client.query;\n}\n\n/** What every span of one pool says about where it connects. */\nfunction connectionAttributes(url: URL): Attributes {\n\tconst name = decodeURIComponent(url.pathname.slice(1));\n\treturn {\n\t\t'db.system': 'postgresql',\n\t\t...(name && { 'db.name': name }),\n\t\t'server.address': url.hostname,\n\t\t'server.port': Number(url.port || 5432),\n\t};\n}\n\nconst TRACER = '@geekmidas/constructs';\n\n/** `select`, `insert`, … — the first keyword, or `with`'s main statement. */\nconst OPERATION = /^\\s*(?:\\/\\*.*?\\*\\/\\s*)?(\\w+)/s;\n/** The table a statement is about, when it names one where it usually does. */\nconst TABLE =\n\t/\\b(?:from|into|update|join)\\s+((?:\"[^\"]+\"|[\\w$]+)(?:\\.(?:\"[^\"]+\"|[\\w$]+))?)/i;\n\n/**\n * What a statement does and to which table, parsed cheaply from its first\n * characters: `select \"orders\"`, `insert \"public\".\"users\"`. A statement the\n * patterns cannot read leaves `table` unset.\n */\nexport function describeStatement(text: string): {\n\toperation?: string;\n\ttable?: string;\n} {\n\tconst head = text.length > 512 ? text.slice(0, 512) : text;\n\tconst operation = OPERATION.exec(head)?.[1]?.toLowerCase();\n\tconst table = TABLE.exec(head)?.[1]?.replace(/\"/g, '');\n\treturn {\n\t\t...(operation && { operation }),\n\t\t...(table && { table }),\n\t};\n}\n\n/**\n * A span around everything `client` runs — `<operation> <table>`, or\n * `db.query` when the statement does not say.\n *\n * The statement text goes on the span only for a parameterized query — values\n * passed separately, as Kysely always does — and truncated. Parameter values\n * never do. A bare string with no values could hold anything a caller\n * concatenated into it, so it gets no text at all.\n */\nfunction traceQueries(client: pg.PoolClient, connection: Attributes): void {\n\tconst query = client.query.bind(client) as (...args: unknown[]) => unknown;\n\tclient.query = ((first: unknown, ...rest: unknown[]) => {\n\t\tconst config =\n\t\t\tfirst && typeof first === 'object'\n\t\t\t\t? (first as { text?: unknown; values?: unknown })\n\t\t\t\t: undefined;\n\t\tconst text =\n\t\t\ttypeof first === 'string'\n\t\t\t\t? first\n\t\t\t\t: typeof config?.text === 'string'\n\t\t\t\t\t? config.text\n\t\t\t\t\t: undefined;\n\t\tconst values = typeof first === 'string' ? rest[0] : config?.values;\n\t\tconst { operation, table } = text ? describeStatement(text) : {};\n\n\t\tconst span = trace\n\t\t\t.getTracer(TRACER)\n\t\t\t.startSpan(operation && table ? `${operation} ${table}` : 'db.query', {\n\t\t\t\tkind: SpanKind.CLIENT,\n\t\t\t\tattributes: {\n\t\t\t\t\t...connection,\n\t\t\t\t\t...(operation && { 'db.operation': operation }),\n\t\t\t\t\t...(table && { 'db.sql.table': table }),\n\t\t\t\t\t...(text &&\n\t\t\t\t\t\tArray.isArray(values) && {\n\t\t\t\t\t\t\t'db.statement':\n\t\t\t\t\t\t\t\ttext.length > MAX_STATEMENT_LENGTH\n\t\t\t\t\t\t\t\t\t? text.slice(0, MAX_STATEMENT_LENGTH)\n\t\t\t\t\t\t\t\t\t: text,\n\t\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t});\n\t\tconst end = (error?: unknown) => {\n\t\t\tif (error) {\n\t\t\t\tif (error instanceof Error) span.recordException(error);\n\t\t\t\tspan.setStatus({ code: SpanStatusCode.ERROR });\n\t\t\t}\n\t\t\tspan.end();\n\t\t};\n\n\t\t// A callback, as `pg`'s own callback form takes it.\n\t\tconst last = rest[rest.length - 1];\n\t\tif (typeof last === 'function') {\n\t\t\tconst args = [...rest];\n\t\t\targs[args.length - 1] = (error: unknown, ...result: unknown[]) => {\n\t\t\t\tend(error);\n\t\t\t\treturn (last as (...a: unknown[]) => unknown)(error, ...result);\n\t\t\t};\n\t\t\treturn context.with(trace.setSpan(context.active(), span), () =>\n\t\t\t\tquery(first, ...args),\n\t\t\t);\n\t\t}\n\n\t\tlet result: unknown;\n\t\ttry {\n\t\t\tresult = context.with(trace.setSpan(context.active(), span), () =>\n\t\t\t\tquery(first, ...rest),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tend(error);\n\t\t\tthrow error;\n\t\t}\n\n\t\tif (result && typeof (result as Promise<unknown>).then === 'function') {\n\t\t\t(result as Promise<unknown>).then(\n\t\t\t\t() => end(),\n\t\t\t\t(error) => end(error),\n\t\t\t);\n\t\t} else if (\n\t\t\tresult &&\n\t\t\ttypeof (result as { once?: unknown }).once === 'function'\n\t\t) {\n\t\t\t// A submittable — a cursor or a stream — ends when it says so.\n\t\t\tconst emitter = result as {\n\t\t\t\tonce(event: string, fn: (e?: unknown) => void): void;\n\t\t\t};\n\t\t\temitter.once('end', () => end());\n\t\t\temitter.once('error', (error) => end(error));\n\t\t} else {\n\t\t\tend();\n\t\t}\n\t\treturn result;\n\t}) as typeof client.query;\n}\n","/**\n * `KyselyDatabase` — a declared Postgres database, typed by its schema.\n *\n * It declares a logical database, a schema, and the roles that reach it, and\n * hands back a Kysely client built from the one URL the adapter supplied. It\n * names no cloud: `--target=aws` fills that URL from RDS, local dev from the\n * Postgres container.\n *\n * Transactions and RLS context are the execution wrapper's job — it opens the\n * transaction and puts it in `ctx.db`. This construct does not resolve\n * connections per request.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\tDEFAULT_POSTGRES_VERSION,\n\ttype Declaration,\n\ttype PostgresVersion,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport { Kysely, type KyselyConfig, PostgresDialect } from 'kysely';\nimport { Cache } from '../cache';\nimport type { Construct } from '../construct-interface';\nimport { openPool } from './pool';\n\n/** The schema a database uses when it does not say otherwise. */\nconst DEFAULT_SCHEMA = 'app';\n\n/**\n * Everything Kysely takes, plus what this construct declares.\n *\n * `dialect` is omitted because the construct owns it — it is built from the one\n * URL the adapter supplied, which is the whole point of the construct. The rest\n * of `KyselyConfig` (`plugins`, `log`) is the app's business and passes\n * straight through, so anything Kysely adds later arrives without being\n * tracked here.\n */\nexport interface KyselyDatabaseOptions extends Omit<KyselyConfig, 'dialect'> {\n\t/**\n\t * The schema, pinned on both roles' `search_path`.\n\t *\n\t * Defaults to `app` — the role the schema plays, rather than a restatement\n\t * of the database's own name, which reads correctly beside `auth` and\n\t * `pgboss` and keeps the application off `public`.\n\t */\n\tschema?: string;\n\t/**\n\t * Provision the owner/runtime role split. Defaults to on.\n\t *\n\t * Off falls back to the cluster's master credential in both URLs, giving up\n\t * the DDL/DML split and putting credentials that can drop a table into the\n\t * function's environment. A deliberate downgrade, not a default.\n\t */\n\troles?: boolean;\n\t/**\n\t * The Postgres major version to provision.\n\t *\n\t * Declared here so one statement reaches both targets. It was previously\n\t * set in two unrelated places — a container tag locally, nothing at all on\n\t * AWS (so Aurora chose) — which is how local came to run 18 while deployed\n\t * ran 17.7 with nothing recording the difference.\n\t *\n\t * Defaults to {@link DEFAULT_POSTGRES_VERSION}.\n\t */\n\tversion?: PostgresVersion;\n\t/**\n\t * End each query run inside a request with a comment naming what ran it —\n\t * `/*operation='POST /orders',request_id='…'*\\/` — so `pg_stat_activity`\n\t * and the server's logs can tie a query to its endpoint. Defaults to on.\n\t */\n\tqueryTags?: boolean;\n}\n\n/** What makes a construct derived rather than a database in its own right. */\ninterface DerivedFrom {\n\tkind: 'database-reader' | 'database-schema';\n\tof: string;\n\tschema?: string;\n}\n\n/**\n * @typeParam DB - the database's schema.\n * @typeParam TName - the canonical id. TypeScript has no partial\n * type-argument inference, so `new KyselyDatabase<OrdersDB>('orders')` leaves\n * this at its default and the service key widens to `string`. `db` still types\n * through `.database()`, which infers from the service.\n */\nexport class KyselyDatabase<DB = unknown, TName extends string = string>\n\timplements Construct<TName, Kysely<DB>>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, Kysely<DB>>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * build publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly config: { url: string; ownerUrl: string };\n\tprivate readonly schemaName: string;\n\tprivate readonly roles: boolean;\n\tprivate readonly version: PostgresVersion;\n\tprivate readonly derivedFrom?: DerivedFrom;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: KyselyDatabaseOptions = {},\n\t\tderivedFrom?: DerivedFrom,\n\t) {\n\t\t// Canonicalises, so `orders` and `Orders` are one construct rather than\n\t\t// two that collide. Throws on anything that cannot become a valid id.\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.config = {\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\townerUrl: provideKey(canonical, 'ownerUrl'),\n\t\t};\n\t\tthis.schemaName = options.schema ?? DEFAULT_SCHEMA;\n\t\tthis.roles = options.roles ?? true;\n\t\tthis.version = options.version ?? DEFAULT_POSTGRES_VERSION;\n\t\tthis.derivedFrom = derivedFrom;\n\n\t\t// A field, not a getter: service discovery caches by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\t// Forwards the whole options object — cherry-picking `envParser` strips\n\t\t\t// `context` and with it the request-scoped logger.\n\t\t\tregister: (registerOptions) => this.connect(registerOptions),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\tif (this.derivedFrom) {\n\t\t\tconst { kind, of, schema } = this.derivedFrom;\n\n\t\t\treturn [\n\t\t\t\tkind === 'database-schema'\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tkind,\n\t\t\t\t\t\t\tid: this.id,\n\t\t\t\t\t\t\tof,\n\t\t\t\t\t\t\tschema: schema ?? this.schemaName,\n\t\t\t\t\t\t\t// The runtime key alone — see the note below on the parent.\n\t\t\t\t\t\t\tprovides: [this.config.url],\n\t\t\t\t\t\t}\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tkind,\n\t\t\t\t\t\t\tid: this.id,\n\t\t\t\t\t\t\tof,\n\t\t\t\t\t\t\t// A reader has no owner URL of its own — nothing migrates\n\t\t\t\t\t\t\t// through a read-only endpoint — so this is the one key.\n\t\t\t\t\t\t\tprovides: [this.config.url],\n\t\t\t\t\t\t},\n\t\t\t];\n\t\t}\n\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'database',\n\t\t\t\tid: this.id,\n\t\t\t\tengine: 'postgres',\n\t\t\t\tschema: this.schemaName,\n\t\t\t\tversion: this.version,\n\t\t\t\t// One key, the runtime role's. `config` also holds the owner key and\n\t\t\t\t// it is deliberately absent here: a key in `provides` is a key an\n\t\t\t\t// edge can name, and nothing should be able to depend on DDL rights.\n\t\t\t\tprovides: [this.config.url],\n\t\t\t\t...(this.roles ? {} : { roles: false }),\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * A read-only endpoint on this database.\n\t *\n\t * Read-only is enforced by the reader role's grants rather than by which\n\t * endpoint it resolves to, so falling back to the writer where no replica\n\t * exists is safe rather than a silently writable connection behind a name\n\t * that says reader. There is no `writer()`: the database *is* the writer, so\n\t * a replica can never be reached by accident.\n\t *\n\t * The return type is narrower than this class on purpose — see\n\t * {@link ReadOnlyDatabase}.\n\t */\n\treader(): ReadOnlyDatabase<DB, `${TName}Reader`> {\n\t\treturn new KyselyDatabase<DB, `${TName}Reader`>(\n\t\t\t`${this.id}Reader` as ConstructName<`${TName}Reader`>,\n\t\t\tthis.options,\n\t\t\t{ kind: 'database-reader', of: this.id },\n\t\t);\n\t}\n\n\t/**\n\t * A cache that lives in this database.\n\t *\n\t * The same strengthening `schema()` is over a second database: `new\n\t * Cache('Sessions')` says the app caches and leaves where to the deployment,\n\t * while this says it caches *here* — which is a fact about the application\n\t * and so belongs in its code.\n\t *\n\t * What it buys beyond being explicit: the table's schema and the role that\n\t * reaches it come from this database rather than from a second convention,\n\t * and the backend no longer has to guess which database \"the database\" meant\n\t * when an app declares two.\n\t *\n\t * A cache is not a `KyselyDatabase`, so this returns a `Cache` — the client\n\t * is a key/value store, not a query builder, and typing it as the parent\n\t * would be a convenience that lies.\n\t */\n\tcache<TCache extends string = `${TName}Cache`>(\n\t\tid: ConstructName<TCache> = `${this.id}Cache` as ConstructName<TCache>,\n\t\toptions: { table?: string } = {},\n\t): Cache<TCache> {\n\t\treturn new Cache<TCache>(id, {\n\t\t\tof: this.id,\n\t\t\t...(options.table ? { table: options.table } : {}),\n\t\t});\n\t}\n\n\t/**\n\t * A second schema in this database, with its own role(s) and its own URL —\n\t * so this database's role holds no grant on those tables at all.\n\t *\n\t * Typed separately because a tenant has its own tables: the point is that\n\t * `auth.selectFrom('sessions')` type-checks and\n\t * `orders.selectFrom('sessions')` does not.\n\t */\n\tschema<TenantDB, TTenant extends string>(\n\t\tid: ConstructName<TTenant>,\n\t\toptions: KyselyDatabaseOptions = {},\n\t): KyselyDatabase<TenantDB, TTenant> {\n\t\treturn new KyselyDatabase<TenantDB, TTenant>(id, options, {\n\t\t\tkind: 'database-schema',\n\t\t\tof: this.id,\n\t\t\tschema: options.schema ?? (id as string).toLowerCase(),\n\t\t});\n\t}\n\n\t/**\n\t * A connection as the *owner* role — the one that may create, alter and drop.\n\t *\n\t * A `Service` rather than part of the construct, and deliberately so: a\n\t * construct is what `.dependsOn()` accepts, and nothing should be able to\n\t * depend on this. A migrator asks for it by name; a handler cannot ask at\n\t * all, which is the security property the role split exists for.\n\t *\n\t * Falls back to the runtime URL where no owner URL was published — the\n\t * `roles: false` downgrade, where there is only one credential and it is the\n\t * cluster master's.\n\t */\n\tget owner(): Service<`${Uncapitalize<TName>}Owner`, Kysely<DB>> {\n\t\treturn {\n\t\t\tserviceName:\n\t\t\t\t`${serviceKey(this.id)}Owner` as `${Uncapitalize<TName>}Owner`,\n\t\t\tregister: (options) => this.connect(options, { owner: true }),\n\t\t};\n\t}\n\n\t/**\n\t * What this database's clients are built with besides a dialect — the\n\t * plugins and logging it was declared with.\n\t *\n\t * Public so that whatever opens a connection to it outside \\`connect()\\` —\n\t * a test's transaction — builds the same client. A test that dropped the\n\t * plugins would write \\`createdAt\\` where production writes \\`created_at\\`.\n\t */\n\tget clientConfig(): Omit<KyselyConfig, 'dialect'> {\n\t\t// Split what the manifest declared from what Kysely takes, so neither\n\t\t// leaks into the other: \\`schema\\`, \\`roles\\` and \\`version\\` describe\n\t\t// infrastructure and mean nothing to a client.\n\t\tconst {\n\t\t\tschema: _schema,\n\t\t\troles: _roles,\n\t\t\tversion: _version,\n\t\t\tqueryTags: _queryTags,\n\t\t\t...kysely\n\t\t} = this.options;\n\t\treturn kysely;\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<Kysely<DB>> {\n\t\tconst { url, ownerUrl } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\turl: get(this.config.url).string(),\n\t\t\t\townerUrl: get(this.config.ownerUrl).string().optional(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\treturn new Kysely<DB>({\n\t\t\t...this.clientConfig,\n\t\t\tdialect: new PostgresDialect({\n\t\t\t\tpool: openPool(as.owner ? (ownerUrl ?? url) : url, {\n\t\t\t\t\tqueryTags: this.options.queryTags,\n\t\t\t\t}),\n\t\t\t}),\n\t\t});\n\t}\n}\n\n/**\n * A database you may read through, and derive nothing from.\n *\n * A reader is terminal in the graph, and this is that fact in the type system.\n * `DERIVES_FROM` gives `cache` and `database-schema` no `database-reader`\n * parent, and there is no reader of a reader — so `orders.reader().cache(…)`\n * has always been illegal, but it type-checked and failed later at\n * `assertDerivations`. That is a long way round to learn that a read-only\n * endpoint cannot own a table something writes to.\n *\n * Omitting the three deriving methods rather than making them throw keeps the\n * failure where it costs least: the editor, on the line that wrote it.\n *\n * The result is deliberately not assignable back to `KyselyDatabase` — a\n * reader is not one, and anything that genuinely needs the writer should say\n * so.\n */\nexport type ReadOnlyDatabase<DB, TName extends string> = Omit<\n\tKyselyDatabase<DB, TName>,\n\t'reader' | 'cache' | 'schema'\n>;\nexport { closeDatabasePools } from './pool';\n"],"mappings":";;;;;;;;;;AA6CA,MAAM,uBAAO,IAAI,IAAa;AAC9BA,iBAAAA,iBAAiB,mBAAmB,CAAC;;;;;;;;;;;AAYrC,SAAgB,SACf,KACA,UAA+B,CAAC,GACtB;CACV,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,MAAM,aAAa,OAAO,aAAa,IAAI,aAAa;CACxD,OAAO,aAAa,OAAO,aAAa;CAExC,MAAM,OAAO,IAAI,GAAA,QAAG,KAAK;EACxB,kBAAkB,OAAO,SAAS;EAClC,GAAI,aAAa,EAAE,SAAS,kBAAkB,aAAa,IAAI,CAAC;EAChE,2BAA2B,gBAAgB;CAC5C,CAAC;CAED,KAAK,GAAG,UAAU,UAAU;EAC3B,MAAM,UAAA,GAASC,oBAAAA,sBAAAA,CAAsB,CAAC,EAAE;EACxC,IAAI,QAAQ,OAAO,KAAK,EAAE,KAAK,MAAM,GAAG,+BAA+B;OAClE,QAAQ,KAAK,kCAAkC,MAAM,OAAO;CAClE,CAAC;CACD,MAAM,SAAS,qBAAqB,MAAM;CAC1C,KAAK,GAAG,YAAY,WAAW;EAG9B,IAAI,QAAQ,cAAc,OAAO,WAAW,MAAM;EAClD,aAAa,QAAQ,MAAM;CAC5B,CAAC;CAED,KAAK,IAAI,IAAI;CACb,MAAM,MAAM,KAAK,IAAI,KAAK,IAAI;CAC9B,KAAK,OAAO,YAAY;EACvB,KAAK,OAAO,IAAI;EAChB,MAAM,IAAI;CACX;CAEA,OAAO;AACR;;;;;AAMA,eAAsB,qBAAoC;CACzD,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,SAAS,KAAK,IAAI,CAAC,CAAC;AACtD;;;;;;AAOA,SAAgB,gBACf,MAAyB,QAAQ,KACZ;CACrB,OACC,IAAI,4BACJ,IAAI,gBACJ,IAAI,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAChC,KAAA;AAEF;;;;;;;AAQA,SAAgB,WAAmB;CAClC,MAAM,WAAA,GAAUA,oBAAAA,sBAAAA,CAAsB;CACtC,IAAI,CAAC,SAAS,OAAO;CAErB,MAAM,OAAO,CACZ,CAAC,aAAa,QAAQ,SAAS,GAC/B,CAAC,cAAc,QAAQ,SAAS,CACjC,CAAC,CAAC,QAAQ,QAAiC,QAAQ,IAAI,EAAE,CAAC;CAC1D,IAAI,KAAK,WAAW,GAAG,OAAO;CAE9B,MAAM,SAAS,UAAkB,MAAM,QAAQ,kBAAkB,EAAE;CACnE,OAAO,MAAM,KAAK,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;AAC/E;;;;;AAMA,SAAS,WAAW,QAA6B;CAChD,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;CACtC,OAAO,UAAU,OAAgB,GAAG,SAAoB;EACvD,MAAM,MAAM,SAAS;EACrB,IAAI,OAAO,OAAO,UAAU,UAAU,OAAO,MAAM,QAAQ,KAAK,GAAG,IAAI;EACvE,IACC,OACA,SACA,OAAO,UAAU,YACjB,OAAQ,MAA6B,SAAS,UAC7C;GACD,MAAM,SAAS;GACf,OAAO,QAAQ;EAChB;EACA,OAAO,MAAM,OAAO,GAAG,IAAI;CAC5B;AACD;;AAGA,SAAS,qBAAqB,KAAsB;CACnD,MAAM,OAAO,mBAAmB,IAAI,SAAS,MAAM,CAAC,CAAC;CACrD,OAAO;EACN,aAAa;EACb,GAAI,QAAQ,EAAE,WAAW,KAAK;EAC9B,kBAAkB,IAAI;EACtB,eAAe,OAAO,IAAI,QAAQ,IAAI;CACvC;AACD;AAEA,MAAM,SAAS;;AAGf,MAAM,YAAY;;AAElB,MAAM,QACL;;;;;;AAOD,SAAgB,kBAAkB,MAGhC;CACD,MAAM,OAAO,KAAK,SAAS,MAAM,KAAK,MAAM,GAAG,GAAG,IAAI;CACtD,MAAM,YAAY,UAAU,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY;CACzD,MAAM,QAAQ,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,MAAM,EAAE;CACrD,OAAO;EACN,GAAI,aAAa,EAAE,UAAU;EAC7B,GAAI,SAAS,EAAE,MAAM;CACtB;AACD;;;;;;;;;;AAWA,SAAS,aAAa,QAAuB,YAA8B;CAC1E,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;CACtC,OAAO,UAAU,OAAgB,GAAG,SAAoB;EACvD,MAAM,SACL,SAAS,OAAO,UAAU,WACtB,QACD,KAAA;EACJ,MAAM,OACL,OAAO,UAAU,WACd,QACA,OAAO,QAAQ,SAAS,WACvB,OAAO,OACP,KAAA;EACL,MAAM,SAAS,OAAO,UAAU,WAAW,KAAK,KAAK,QAAQ;EAC7D,MAAM,EAAE,WAAW,UAAU,OAAO,kBAAkB,IAAI,IAAI,CAAC;EAE/D,MAAM,OAAOC,mBAAAA,MACX,UAAU,MAAM,CAAC,CACjB,UAAU,aAAa,QAAQ,GAAG,UAAU,GAAG,UAAU,YAAY;GACrE,MAAMC,mBAAAA,SAAS;GACf,YAAY;IACX,GAAG;IACH,GAAI,aAAa,EAAE,gBAAgB,UAAU;IAC7C,GAAI,SAAS,EAAE,gBAAgB,MAAM;IACrC,GAAI,QACH,MAAM,QAAQ,MAAM,KAAK,EACxB,gBACC,KAAK,SAAA,OACF,KAAK,MAAM,GAAA,IAAuB,IAClC,KACL;GACF;EACD,CAAC;EACF,MAAM,OAAO,UAAoB;GAChC,IAAI,OAAO;IACV,IAAI,iBAAiB,OAAO,KAAK,gBAAgB,KAAK;IACtD,KAAK,UAAU,EAAE,MAAMC,mBAAAA,eAAe,MAAM,CAAC;GAC9C;GACA,KAAK,IAAI;EACV;EAGA,MAAM,OAAO,KAAK,KAAK,SAAS;EAChC,IAAI,OAAO,SAAS,YAAY;GAC/B,MAAM,OAAO,CAAC,GAAG,IAAI;GACrB,KAAK,KAAK,SAAS,MAAM,OAAgB,GAAG,WAAsB;IACjE,IAAI,KAAK;IACT,OAAQ,KAAsC,OAAO,GAAG,MAAM;GAC/D;GACA,OAAOC,mBAAAA,QAAQ,KAAKH,mBAAAA,MAAM,QAAQG,mBAAAA,QAAQ,OAAO,GAAG,IAAI,SACvD,MAAM,OAAO,GAAG,IAAI,CACrB;EACD;EAEA,IAAI;EACJ,IAAI;GACH,SAASA,mBAAAA,QAAQ,KAAKH,mBAAAA,MAAM,QAAQG,mBAAAA,QAAQ,OAAO,GAAG,IAAI,SACzD,MAAM,OAAO,GAAG,IAAI,CACrB;EACD,SAAS,OAAO;GACf,IAAI,KAAK;GACT,MAAM;EACP;EAEA,IAAI,UAAU,OAAQ,OAA4B,SAAS,YAC1D,OAA6B,WACtB,IAAI,IACT,UAAU,IAAI,KAAK,CACrB;OACM,IACN,UACA,OAAQ,OAA8B,SAAS,YAC9C;GAED,MAAM,UAAU;GAGhB,QAAQ,KAAK,aAAa,IAAI,CAAC;GAC/B,QAAQ,KAAK,UAAU,UAAU,IAAI,KAAK,CAAC;EAC5C,OACC,IAAI;EAEL,OAAO;CACR;AACD;;;;;;;;;;;;;;;;ACtQA,MAAM,iBAAiB;;;;;;;;AA6DvB,IAAa,iBAAb,MAAa,eAEb;CAgBmB;CAflB;CACA;;;;;CAMA;CACA;CACA;CACA;CACA;CAEA,YACC,IACA,UAAkD,CAAC,GACnD,aACC;EAFgB,KAAA,UAAA;EAKjB,MAAM,aAAA,GAAYC,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,SAAS;GACb,MAAA,GAAKC,oBAAAA,WAAAA,CAAW,WAAW,KAAK;GAChC,WAAA,GAAUA,oBAAAA,WAAAA,CAAW,WAAW,UAAU;EAC3C;EACA,KAAK,aAAa,QAAQ,UAAU;EACpC,KAAK,QAAQ,QAAQ,SAAS;EAC9B,KAAK,UAAU,QAAQ,WAAWC,oBAAAA;EAClC,KAAK,cAAc;EAGnB,KAAK,UAAU;GACd,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,SAAS;GAGjC,WAAW,oBAAoB,KAAK,QAAQ,eAAe;EAC5D;CACD;CAEA,UAAyB;EACxB,IAAI,KAAK,aAAa;GACrB,MAAM,EAAE,MAAM,IAAI,WAAW,KAAK;GAElC,OAAO,CACN,SAAS,oBACN;IACA;IACA,IAAI,KAAK;IACT;IACA,QAAQ,UAAU,KAAK;IAEvB,UAAU,CAAC,KAAK,OAAO,GAAG;GAC3B,IACC;IACA;IACA,IAAI,KAAK;IACT;IAGA,UAAU,CAAC,KAAK,OAAO,GAAG;GAC3B,CACH;EACD;EAEA,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,QAAQ;GACR,QAAQ,KAAK;GACb,SAAS,KAAK;GAId,UAAU,CAAC,KAAK,OAAO,GAAG;GAC1B,GAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,OAAO,MAAM;EACtC,CACD;CACD;;;;;;;;;;;;;CAcA,SAAiD;EAChD,OAAO,IAAI,eACV,GAAG,KAAK,GAAG,SACX,KAAK,SACL;GAAE,MAAM;GAAmB,IAAI,KAAK;EAAG,CACxC;CACD;;;;;;;;;;;;;;;;;;CAmBA,MACC,KAA4B,GAAG,KAAK,GAAG,QACvC,UAA8B,CAAC,GACf;EAChB,OAAO,IAAIC,cAAAA,MAAc,IAAI;GAC5B,IAAI,KAAK;GACT,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjD,CAAC;CACF;;;;;;;;;CAUA,OACC,IACA,UAAiC,CAAC,GACE;EACpC,OAAO,IAAI,eAAkC,IAAI,SAAS;GACzD,MAAM;GACN,IAAI,KAAK;GACT,QAAQ,QAAQ,UAAW,GAAc,YAAY;EACtD,CAAC;CACF;;;;;;;;;;;;;CAcA,IAAI,QAA4D;EAC/D,OAAO;GACN,aACC,IAAA,GAAGD,oBAAAA,WAAAA,CAAW,KAAK,EAAE,EAAE;GACxB,WAAW,YAAY,KAAK,QAAQ,SAAS,EAAE,OAAO,KAAK,CAAC;EAC7D;CACD;;;;;;;;;CAUA,IAAI,eAA8C;EAIjD,MAAM,EACL,QAAQ,SACR,OAAO,QACP,SAAS,UACT,WAAW,YACX,GAAGE,aACA,KAAK;EACT,OAAOA;CACR;CAEA,MAAc,QACb,SACA,KAA0B,CAAC,GACL;EACtB,MAAM,EAAE,KAAK,aAAa,QAAQ,UAChC,QAAQ,SAAS;GACjB,KAAK,IAAI,KAAK,OAAO,GAAG,CAAC,CAAC,OAAO;GACjC,UAAU,IAAI,KAAK,OAAO,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS;EACvD,EAAE,CAAC,CACF,MAAM;EAER,OAAO,IAAIC,OAAAA,OAAW;GACrB,GAAG,KAAK;GACR,SAAS,IAAIC,OAAAA,gBAAgB,EAC5B,MAAM,SAAS,GAAG,QAAS,YAAY,MAAO,KAAK,EAClD,WAAW,KAAK,QAAQ,UACzB,CAAC,EACF,CAAC;EACF,CAAC;CACF;AACD"}

package/dist/queue/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_Queue = require("../Queue-umpX3683.cjs");
-const require_QueueBuilder = require("../QueueBuilder-B9ClmXjX.cjs");
+const require_Queue = require("../Queue-A3wfD0it.cjs");
+const require_QueueBuilder = require("../QueueBuilder-BjuF0UBl.cjs");
 exports.Queue = require_Queue.Queue;
 exports.QueueNeedsMessage = require_QueueBuilder.QueueNeedsMessage;
 exports.QueueNeedsName = require_QueueBuilder.QueueNeedsName;

package/dist/queue/index.mjs

@@ -1,3 +1,3 @@
-import { t as Queue } from "../Queue-CLRT_j5a.mjs";
-import { n as QueueNeedsMessage, r as QueueNeedsName } from "../QueueBuilder-B0mCqq74.mjs";
+import { t as Queue } from "../Queue-D6USGS4q.mjs";
+import { n as QueueNeedsMessage, r as QueueNeedsName } from "../QueueBuilder-Cue73M4t.mjs";
 export { Queue, QueueNeedsMessage, QueueNeedsName };

package/dist/subscribers/index.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_SubscriberBuilder = require("../SubscriberBuilder-D_owVoHo.cjs");
 const require_runSubscriber = require("../runSubscriber-D8nLXIv1.cjs");
+let _geekmidas_events = require("@geekmidas/events");
 let _geekmidas_errors = require("@geekmidas/errors");
 let _geekmidas_services = require("@geekmidas/services");
 let _geekmidas_events_sns = require("@geekmidas/events/sns");
@@ -70,21 +71,27 @@ var SnsPushSubscriberAdaptor = class {
 			requestId,
 			startTime: Date.now(),
 			operation: `subscriber ${this.subscriber.topicName ?? "sns"}`
-		}, async () => {
-			try {
-				const { services, db } = await require_runSubscriber.subscriberContext(this.subscriber, this.envParser);
-				const events = require_runSubscriber.subscribedEvents(this.subscriber, (0, _geekmidas_events_sns.toSnsEvent)(message), logger);
-				await require_runSubscriber.runSubscriber(this.subscriber, {
-					events,
-					services,
-					logger,
-					db
-				});
-			} catch (error) {
-				logger.error(error, "Error processing subscriber");
-				throw (0, _geekmidas_errors.wrapError)(error);
-			}
-		});
+		}, () => (0, _geekmidas_events.consumeTraced)({
+			system: "aws_sns",
+			destination: this.subscriber.topicName ?? message.TopicArn.split(":").pop() ?? message.TopicArn,
+			type: message.MessageAttributes?.type?.Value,
+			messageId: message.MessageId
+		}, (0, _geekmidas_events.carrierFromAttributes)(message.MessageAttributes), () => this.run(message, logger)));
+	}
+	async run(message, logger) {
+		try {
+			const { services, db } = await require_runSubscriber.subscriberContext(this.subscriber, this.envParser);
+			const events = require_runSubscriber.subscribedEvents(this.subscriber, (0, _geekmidas_events_sns.toSnsEvent)(message), logger);
+			await require_runSubscriber.runSubscriber(this.subscriber, {
+				events,
+				services,
+				logger,
+				db
+			});
+		} catch (error) {
+			logger.error(error, "Error processing subscriber");
+			throw (0, _geekmidas_errors.wrapError)(error);
+		}
 	}
 };
 /** `url`, sent to `endpoint`'s origin instead of its own. */

package/dist/subscribers/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["verifySnsMessage","confirmSnsSubscription","runWithRequestContext","subscriberContext","subscribedEvents","toSnsEvent","runSubscriber","wrapError"],"sources":["../../src/subscribers/SnsPushSubscriberAdaptor.ts"],"sourcesContent":["import type { EnvironmentParser } from '@geekmidas/envkit';\nimport { wrapError } from '@geekmidas/errors';\nimport {\n\tconfirmSnsSubscription,\n\ttype SnsHttpMessage,\n\ttoSnsEvent,\n\tverifySnsMessage,\n} from '@geekmidas/events/sns';\nimport { runWithRequestContext } from '@geekmidas/services';\nimport {\n\trunSubscriber,\n\tsubscribedEvents,\n\tsubscriberContext,\n} from './runSubscriber';\nimport type { Subscriber } from './Subscriber';\n\nexport interface SnsPushOptions {\n\t/** The topic this subscriber is subscribed to. Anything else is refused. */\n\ttopicArn: string;\n\t/**\n\t * Verify each message's signature. Off only against an emulator, which\n\t * signs nothing — decided by the connection string's endpoint, never by\n\t * anything the request says about itself.\n\t */\n\tverify: boolean;\n\t/**\n\t * The emulator's address, as this server was configured with it. An\n\t * emulator names itself in `SubscribeURL` by the port it listens on inside\n\t * its container, which is not the port published to the host — so against\n\t * one, the confirmation is sent here instead. From configuration, never\n\t * from the request.\n\t */\n\temulatorEndpoint?: string;\n}\n\n/** What to answer SNS with. A non-2xx tells SNS to retry. */\nexport interface SnsPushResponse {\n\tstatus: 200 | 400 | 403 | 500;\n\tbody: { status: string; error?: string };\n}\n\n/**\n * A topic subscriber run by SNS pushing to an HTTP endpoint, rather than by a\n * poller.\n *\n * The notification is read as the Lambda event SNS would have invoked a\n * function with, and run through the same parsing, services and handler as the\n * Lambda adaptor — without its middy wrapper, which is Lambda's alone: a\n * server serving this route has no reason to install `@middy/core`.\n */\nexport class SnsPushSubscriberAdaptor {\n\tconstructor(\n\t\tprivate readonly envParser: EnvironmentParser<{}>,\n\t\treadonly subscriber: Subscriber<any, any, any, any, any, any, any>,\n\t\tprivate readonly options: SnsPushOptions,\n\t) {}\n\n\tasync handle(body: unknown): Promise<SnsPushResponse> {\n\t\tconst message = body as SnsHttpMessage;\n\t\tif (typeof message?.Type !== 'string' || !message.TopicArn) {\n\t\t\treturn refuse(400, 'not an SNS message');\n\t\t}\n\t\t// Checked before the signature: a genuine message for another topic is\n\t\t// still not this subscriber's to confirm or to handle.\n\t\tif (message.TopicArn !== this.options.topicArn) {\n\t\t\treturn refuse(403, `not subscribed to ${message.TopicArn}`);\n\t\t}\n\n\t\tif (this.options.verify) {\n\t\t\ttry {\n\t\t\t\tawait verifySnsMessage(message);\n\t\t\t} catch (error) {\n\t\t\t\tthis.subscriber.logger.warn(\n\t\t\t\t\t{ err: error, topicArn: message.TopicArn },\n\t\t\t\t\t'Refused an SNS message that did not verify',\n\t\t\t\t);\n\t\t\t\treturn refuse(403, (error as Error).name);\n\t\t\t}\n\t\t}\n\n\t\tswitch (message.Type) {\n\t\t\tcase 'SubscriptionConfirmation':\n\t\t\t\tawait confirmSnsSubscription(\n\t\t\t\t\tthis.options.emulatorEndpoint && message.SubscribeURL\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t...message,\n\t\t\t\t\t\t\t\tSubscribeURL: throughEndpoint(\n\t\t\t\t\t\t\t\t\tmessage.SubscribeURL,\n\t\t\t\t\t\t\t\t\tthis.options.emulatorEndpoint,\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: message,\n\t\t\t\t);\n\t\t\t\tthis.subscriber.logger.info(\n\t\t\t\t\t{ topicArn: message.TopicArn },\n\t\t\t\t\t'Confirmed SNS subscription',\n\t\t\t\t);\n\t\t\t\treturn { status: 200, body: { status: 'confirmed' } };\n\t\t\tcase 'Notification':\n\t\t\t\ttry {\n\t\t\t\t\tawait this.notify(message);\n\t\t\t\t\treturn { status: 200, body: { status: 'ok' } };\n\t\t\t\t} catch (error) {\n\t\t\t\t\t// Already logged. A 500 makes SNS retry, which is the point of\n\t\t\t\t\t// answering at all.\n\t\t\t\t\treturn refuse(500, (error as Error).name);\n\t\t\t\t}\n\t\t\tdefault:\n\t\t\t\treturn { status: 200, body: { status: 'ignored' } };\n\t\t}\n\t}\n\n\tprivate async notify(message: SnsHttpMessage): Promise<void> {\n\t\tconst requestId = message.MessageId;\n\t\tconst logger = this.subscriber.logger.child({ requestId });\n\n\t\tawait runWithRequestContext(\n\t\t\t{\n\t\t\t\tlogger,\n\t\t\t\trequestId,\n\t\t\t\tstartTime: Date.now(),\n\t\t\t\toperation: `subscriber ${this.subscriber.topicName ?? 'sns'}`,\n\t\t\t},\n\t\t\tasync () => {\n\t\t\t\ttry {\n\t\t\t\t\tconst { services, db } = await subscriberContext(\n\t\t\t\t\t\tthis.subscriber,\n\t\t\t\t\t\tthis.envParser,\n\t\t\t\t\t);\n\t\t\t\t\tconst events = subscribedEvents(\n\t\t\t\t\t\tthis.subscriber,\n\t\t\t\t\t\ttoSnsEvent(message),\n\t\t\t\t\t\tlogger,\n\t\t\t\t\t);\n\t\t\t\t\tawait runSubscriber(this.subscriber, {\n\t\t\t\t\t\tevents,\n\t\t\t\t\t\tservices,\n\t\t\t\t\t\tlogger,\n\t\t\t\t\t\tdb,\n\t\t\t\t\t});\n\t\t\t\t} catch (error) {\n\t\t\t\t\tlogger.error(error as object, 'Error processing subscriber');\n\t\t\t\t\tthrow wrapError(error);\n\t\t\t\t}\n\t\t\t},\n\t\t);\n\t}\n}\n\n/** `url`, sent to `endpoint`'s origin instead of its own. */\nfunction throughEndpoint(url: string, endpoint: string): string {\n\tconst target = new URL(url);\n\tconst origin = new URL(endpoint);\n\ttarget.protocol = origin.protocol;\n\ttarget.host = origin.host;\n\treturn target.toString();\n}\n\nfunction refuse(\n\tstatus: SnsPushResponse['status'],\n\terror: string,\n): SnsPushResponse {\n\treturn { status, body: { status: 'refused', error } };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkDA,IAAa,2BAAb,MAAsC;CAEnB;CACR;CACQ;CAHlB,YACC,WACA,YACA,SACC;EAHgB,KAAA,YAAA;EACR,KAAA,aAAA;EACQ,KAAA,UAAA;CACf;CAEH,MAAM,OAAO,MAAyC;EACrD,MAAM,UAAU;EAChB,IAAI,OAAO,SAAS,SAAS,YAAY,CAAC,QAAQ,UACjD,OAAO,OAAO,KAAK,oBAAoB;EAIxC,IAAI,QAAQ,aAAa,KAAK,QAAQ,UACrC,OAAO,OAAO,KAAK,qBAAqB,QAAQ,UAAU;EAG3D,IAAI,KAAK,QAAQ,QAChB,IAAI;GACH,OAAA,GAAMA,sBAAAA,iBAAAA,CAAiB,OAAO;EAC/B,SAAS,OAAO;GACf,KAAK,WAAW,OAAO,KACtB;IAAE,KAAK;IAAO,UAAU,QAAQ;GAAS,GACzC,4CACD;GACA,OAAO,OAAO,KAAM,MAAgB,IAAI;EACzC;EAGD,QAAQ,QAAQ,MAAhB;GACC,KAAK;IACJ,OAAA,GAAMC,sBAAAA,uBAAAA,CACL,KAAK,QAAQ,oBAAoB,QAAQ,eACtC;KACA,GAAG;KACH,cAAc,gBACb,QAAQ,cACR,KAAK,QAAQ,gBACd;IACD,IACC,OACJ;IACA,KAAK,WAAW,OAAO,KACtB,EAAE,UAAU,QAAQ,SAAS,GAC7B,4BACD;IACA,OAAO;KAAE,QAAQ;KAAK,MAAM,EAAE,QAAQ,YAAY;IAAE;GACrD,KAAK,gBACJ,IAAI;IACH,MAAM,KAAK,OAAO,OAAO;IACzB,OAAO;KAAE,QAAQ;KAAK,MAAM,EAAE,QAAQ,KAAK;IAAE;GAC9C,SAAS,OAAO;IAGf,OAAO,OAAO,KAAM,MAAgB,IAAI;GACzC;GACD,SACC,OAAO;IAAE,QAAQ;IAAK,MAAM,EAAE,QAAQ,UAAU;GAAE;EACpD;CACD;CAEA,MAAc,OAAO,SAAwC;EAC5D,MAAM,YAAY,QAAQ;EAC1B,MAAM,SAAS,KAAK,WAAW,OAAO,MAAM,EAAE,UAAU,CAAC;EAEzD,OAAA,GAAMC,oBAAAA,sBAAAA,CACL;GACC;GACA;GACA,WAAW,KAAK,IAAI;GACpB,WAAW,cAAc,KAAK,WAAW,aAAa;EACvD,GACA,YAAY;GACX,IAAI;IACH,MAAM,EAAE,UAAU,OAAO,MAAMC,sBAAAA,kBAC9B,KAAK,YACL,KAAK,SACN;IACA,MAAM,SAASC,sBAAAA,iBACd,KAAK,aAAA,GACLC,sBAAAA,WAAAA,CAAW,OAAO,GAClB,MACD;IACA,MAAMC,sBAAAA,cAAc,KAAK,YAAY;KACpC;KACA;KACA;KACA;IACD,CAAC;GACF,SAAS,OAAO;IACf,OAAO,MAAM,OAAiB,6BAA6B;IAC3D,OAAA,GAAMC,kBAAAA,UAAAA,CAAU,KAAK;GACtB;EACD,CACD;CACD;AACD;;AAGA,SAAS,gBAAgB,KAAa,UAA0B;CAC/D,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,MAAM,SAAS,IAAI,IAAI,QAAQ;CAC/B,OAAO,WAAW,OAAO;CACzB,OAAO,OAAO,OAAO;CACrB,OAAO,OAAO,SAAS;AACxB;AAEA,SAAS,OACR,QACA,OACkB;CAClB,OAAO;EAAE;EAAQ,MAAM;GAAE,QAAQ;GAAW;EAAM;CAAE;AACrD"}
+{"version":3,"file":"index.cjs","names":["verifySnsMessage","confirmSnsSubscription","runWithRequestContext","consumeTraced","carrierFromAttributes","subscriberContext","subscribedEvents","toSnsEvent","runSubscriber","wrapError"],"sources":["../../src/subscribers/SnsPushSubscriberAdaptor.ts"],"sourcesContent":["import type { EnvironmentParser } from '@geekmidas/envkit';\nimport { wrapError } from '@geekmidas/errors';\nimport { carrierFromAttributes, consumeTraced } from '@geekmidas/events';\nimport {\n\tconfirmSnsSubscription,\n\ttype SnsHttpMessage,\n\ttoSnsEvent,\n\tverifySnsMessage,\n} from '@geekmidas/events/sns';\nimport { runWithRequestContext } from '@geekmidas/services';\nimport {\n\trunSubscriber,\n\tsubscribedEvents,\n\tsubscriberContext,\n} from './runSubscriber';\nimport type { Subscriber } from './Subscriber';\n\nexport interface SnsPushOptions {\n\t/** The topic this subscriber is subscribed to. Anything else is refused. */\n\ttopicArn: string;\n\t/**\n\t * Verify each message's signature. Off only against an emulator, which\n\t * signs nothing — decided by the connection string's endpoint, never by\n\t * anything the request says about itself.\n\t */\n\tverify: boolean;\n\t/**\n\t * The emulator's address, as this server was configured with it. An\n\t * emulator names itself in `SubscribeURL` by the port it listens on inside\n\t * its container, which is not the port published to the host — so against\n\t * one, the confirmation is sent here instead. From configuration, never\n\t * from the request.\n\t */\n\temulatorEndpoint?: string;\n}\n\n/** What to answer SNS with. A non-2xx tells SNS to retry. */\nexport interface SnsPushResponse {\n\tstatus: 200 | 400 | 403 | 500;\n\tbody: { status: string; error?: string };\n}\n\n/**\n * A topic subscriber run by SNS pushing to an HTTP endpoint, rather than by a\n * poller.\n *\n * The notification is read as the Lambda event SNS would have invoked a\n * function with, and run through the same parsing, services and handler as the\n * Lambda adaptor — without its middy wrapper, which is Lambda's alone: a\n * server serving this route has no reason to install `@middy/core`.\n */\nexport class SnsPushSubscriberAdaptor {\n\tconstructor(\n\t\tprivate readonly envParser: EnvironmentParser<{}>,\n\t\treadonly subscriber: Subscriber<any, any, any, any, any, any, any>,\n\t\tprivate readonly options: SnsPushOptions,\n\t) {}\n\n\tasync handle(body: unknown): Promise<SnsPushResponse> {\n\t\tconst message = body as SnsHttpMessage;\n\t\tif (typeof message?.Type !== 'string' || !message.TopicArn) {\n\t\t\treturn refuse(400, 'not an SNS message');\n\t\t}\n\t\t// Checked before the signature: a genuine message for another topic is\n\t\t// still not this subscriber's to confirm or to handle.\n\t\tif (message.TopicArn !== this.options.topicArn) {\n\t\t\treturn refuse(403, `not subscribed to ${message.TopicArn}`);\n\t\t}\n\n\t\tif (this.options.verify) {\n\t\t\ttry {\n\t\t\t\tawait verifySnsMessage(message);\n\t\t\t} catch (error) {\n\t\t\t\tthis.subscriber.logger.warn(\n\t\t\t\t\t{ err: error, topicArn: message.TopicArn },\n\t\t\t\t\t'Refused an SNS message that did not verify',\n\t\t\t\t);\n\t\t\t\treturn refuse(403, (error as Error).name);\n\t\t\t}\n\t\t}\n\n\t\tswitch (message.Type) {\n\t\t\tcase 'SubscriptionConfirmation':\n\t\t\t\tawait confirmSnsSubscription(\n\t\t\t\t\tthis.options.emulatorEndpoint && message.SubscribeURL\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t...message,\n\t\t\t\t\t\t\t\tSubscribeURL: throughEndpoint(\n\t\t\t\t\t\t\t\t\tmessage.SubscribeURL,\n\t\t\t\t\t\t\t\t\tthis.options.emulatorEndpoint,\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: message,\n\t\t\t\t);\n\t\t\t\tthis.subscriber.logger.info(\n\t\t\t\t\t{ topicArn: message.TopicArn },\n\t\t\t\t\t'Confirmed SNS subscription',\n\t\t\t\t);\n\t\t\t\treturn { status: 200, body: { status: 'confirmed' } };\n\t\t\tcase 'Notification':\n\t\t\t\ttry {\n\t\t\t\t\tawait this.notify(message);\n\t\t\t\t\treturn { status: 200, body: { status: 'ok' } };\n\t\t\t\t} catch (error) {\n\t\t\t\t\t// Already logged. A 500 makes SNS retry, which is the point of\n\t\t\t\t\t// answering at all.\n\t\t\t\t\treturn refuse(500, (error as Error).name);\n\t\t\t\t}\n\t\t\tdefault:\n\t\t\t\treturn { status: 200, body: { status: 'ignored' } };\n\t\t}\n\t}\n\n\tprivate async notify(message: SnsHttpMessage): Promise<void> {\n\t\tconst requestId = message.MessageId;\n\t\tconst logger = this.subscriber.logger.child({ requestId });\n\n\t\tawait runWithRequestContext(\n\t\t\t{\n\t\t\t\tlogger,\n\t\t\t\trequestId,\n\t\t\t\tstartTime: Date.now(),\n\t\t\t\toperation: `subscriber ${this.subscriber.topicName ?? 'sns'}`,\n\t\t\t},\n\t\t\t// A CONSUMER span, child of the publisher's: SNS hands the trace\n\t\t\t// context on in the message attributes it was published with.\n\t\t\t() =>\n\t\t\t\tconsumeTraced(\n\t\t\t\t\t{\n\t\t\t\t\t\tsystem: 'aws_sns',\n\t\t\t\t\t\tdestination:\n\t\t\t\t\t\t\tthis.subscriber.topicName ??\n\t\t\t\t\t\t\tmessage.TopicArn.split(':').pop() ??\n\t\t\t\t\t\t\tmessage.TopicArn,\n\t\t\t\t\t\ttype: message.MessageAttributes?.type?.Value,\n\t\t\t\t\t\tmessageId: message.MessageId,\n\t\t\t\t\t},\n\t\t\t\t\tcarrierFromAttributes(message.MessageAttributes),\n\t\t\t\t\t() => this.run(message, logger),\n\t\t\t\t),\n\t\t);\n\t}\n\n\tprivate async run(\n\t\tmessage: SnsHttpMessage,\n\t\tlogger: Subscriber<any, any, any, any, any, any, any>['logger'],\n\t): Promise<void> {\n\t\ttry {\n\t\t\tconst { services, db } = await subscriberContext(\n\t\t\t\tthis.subscriber,\n\t\t\t\tthis.envParser,\n\t\t\t);\n\t\t\tconst events = subscribedEvents(\n\t\t\t\tthis.subscriber,\n\t\t\t\ttoSnsEvent(message),\n\t\t\t\tlogger,\n\t\t\t);\n\t\t\tawait runSubscriber(this.subscriber, {\n\t\t\t\tevents,\n\t\t\t\tservices,\n\t\t\t\tlogger,\n\t\t\t\tdb,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tlogger.error(error as object, 'Error processing subscriber');\n\t\t\tthrow wrapError(error);\n\t\t}\n\t}\n}\n\n/** `url`, sent to `endpoint`'s origin instead of its own. */\nfunction throughEndpoint(url: string, endpoint: string): string {\n\tconst target = new URL(url);\n\tconst origin = new URL(endpoint);\n\ttarget.protocol = origin.protocol;\n\ttarget.host = origin.host;\n\treturn target.toString();\n}\n\nfunction refuse(\n\tstatus: SnsPushResponse['status'],\n\terror: string,\n): SnsPushResponse {\n\treturn { status, body: { status: 'refused', error } };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAmDA,IAAa,2BAAb,MAAsC;CAEnB;CACR;CACQ;CAHlB,YACC,WACA,YACA,SACC;EAHgB,KAAA,YAAA;EACR,KAAA,aAAA;EACQ,KAAA,UAAA;CACf;CAEH,MAAM,OAAO,MAAyC;EACrD,MAAM,UAAU;EAChB,IAAI,OAAO,SAAS,SAAS,YAAY,CAAC,QAAQ,UACjD,OAAO,OAAO,KAAK,oBAAoB;EAIxC,IAAI,QAAQ,aAAa,KAAK,QAAQ,UACrC,OAAO,OAAO,KAAK,qBAAqB,QAAQ,UAAU;EAG3D,IAAI,KAAK,QAAQ,QAChB,IAAI;GACH,OAAA,GAAMA,sBAAAA,iBAAAA,CAAiB,OAAO;EAC/B,SAAS,OAAO;GACf,KAAK,WAAW,OAAO,KACtB;IAAE,KAAK;IAAO,UAAU,QAAQ;GAAS,GACzC,4CACD;GACA,OAAO,OAAO,KAAM,MAAgB,IAAI;EACzC;EAGD,QAAQ,QAAQ,MAAhB;GACC,KAAK;IACJ,OAAA,GAAMC,sBAAAA,uBAAAA,CACL,KAAK,QAAQ,oBAAoB,QAAQ,eACtC;KACA,GAAG;KACH,cAAc,gBACb,QAAQ,cACR,KAAK,QAAQ,gBACd;IACD,IACC,OACJ;IACA,KAAK,WAAW,OAAO,KACtB,EAAE,UAAU,QAAQ,SAAS,GAC7B,4BACD;IACA,OAAO;KAAE,QAAQ;KAAK,MAAM,EAAE,QAAQ,YAAY;IAAE;GACrD,KAAK,gBACJ,IAAI;IACH,MAAM,KAAK,OAAO,OAAO;IACzB,OAAO;KAAE,QAAQ;KAAK,MAAM,EAAE,QAAQ,KAAK;IAAE;GAC9C,SAAS,OAAO;IAGf,OAAO,OAAO,KAAM,MAAgB,IAAI;GACzC;GACD,SACC,OAAO;IAAE,QAAQ;IAAK,MAAM,EAAE,QAAQ,UAAU;GAAE;EACpD;CACD;CAEA,MAAc,OAAO,SAAwC;EAC5D,MAAM,YAAY,QAAQ;EAC1B,MAAM,SAAS,KAAK,WAAW,OAAO,MAAM,EAAE,UAAU,CAAC;EAEzD,OAAA,GAAMC,oBAAAA,sBAAAA,CACL;GACC;GACA;GACA,WAAW,KAAK,IAAI;GACpB,WAAW,cAAc,KAAK,WAAW,aAAa;EACvD,UAAA,GAICC,kBAAAA,cAAAA,CACC;GACC,QAAQ;GACR,aACC,KAAK,WAAW,aAChB,QAAQ,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAChC,QAAQ;GACT,MAAM,QAAQ,mBAAmB,MAAM;GACvC,WAAW,QAAQ;EACpB,IAAA,GACAC,kBAAAA,sBAAAA,CAAsB,QAAQ,iBAAiB,SACzC,KAAK,IAAI,SAAS,MAAM,CAC/B,CACF;CACD;CAEA,MAAc,IACb,SACA,QACgB;EAChB,IAAI;GACH,MAAM,EAAE,UAAU,OAAO,MAAMC,sBAAAA,kBAC9B,KAAK,YACL,KAAK,SACN;GACA,MAAM,SAASC,sBAAAA,iBACd,KAAK,aAAA,GACLC,sBAAAA,WAAAA,CAAW,OAAO,GAClB,MACD;GACA,MAAMC,sBAAAA,cAAc,KAAK,YAAY;IACpC;IACA;IACA;IACA;GACD,CAAC;EACF,SAAS,OAAO;GACf,OAAO,MAAM,OAAiB,6BAA6B;GAC3D,OAAA,GAAMC,kBAAAA,UAAAA,CAAU,KAAK;EACtB;CACD;AACD;;AAGA,SAAS,gBAAgB,KAAa,UAA0B;CAC/D,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,MAAM,SAAS,IAAI,IAAI,QAAQ;CAC/B,OAAO,WAAW,OAAO;CACzB,OAAO,OAAO,OAAO;CACrB,OAAO,OAAO,SAAS;AACxB;AAEA,SAAS,OACR,QACA,OACkB;CAClB,OAAO;EAAE;EAAQ,MAAM;GAAE,QAAQ;GAAW;EAAM;CAAE;AACrD"}

package/dist/subscribers/index.d.cts

@@ -44,6 +44,7 @@ export declare class SnsPushSubscriberAdaptor {
   constructor(envParser: EnvironmentParser<{}>, subscriber: Subscriber<any, any, any, any, any, any, any>, options: SnsPushOptions);
   handle(body: unknown): Promise<SnsPushResponse>;
   private notify;
+  private run;
 }
 //#endregion
 export { type SnsPushOptions, type SnsPushResponse, Subscriber, SubscriberBuilder };

package/dist/subscribers/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/subscribers/SnsPushSubscriberAdaptor.ts"],"mappings":";;;;UAgBiB;;EAEhB;;;;;;EAMA;;;;;;;;EAQA;;;UAIgB;EAChB;EACA;IAAQ;IAAgB;;;;;;;;;;;;qBAYZ;mBAEM;WACR,YAAY;mBACJ;EAHlB,YACkB,WAAW,uBACnB,YAAY,+CACJ,SAAS;EAGrB,OAAO,gBAAgB,QAAQ;UAuDvB"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/subscribers/SnsPushSubscriberAdaptor.ts"],"mappings":";;;;UAiBiB;;EAEhB;;;;;;EAMA;;;;;;;;EAQA;;;UAIgB;EAChB;EACA;IAAQ;IAAgB;;;;;;;;;;;;qBAYZ;mBAEM;WACR,YAAY;mBACJ;EAHlB,YACkB,WAAW,uBACnB,YAAY,+CACJ,SAAS;EAGrB,OAAO,gBAAgB,QAAQ;UAuDvB;UA8BA"}

package/dist/subscribers/index.d.mts

@@ -44,6 +44,7 @@ export declare class SnsPushSubscriberAdaptor {
   constructor(envParser: EnvironmentParser<{}>, subscriber: Subscriber<any, any, any, any, any, any, any>, options: SnsPushOptions);
   handle(body: unknown): Promise<SnsPushResponse>;
   private notify;
+  private run;
 }
 //#endregion
 export { type SnsPushOptions, type SnsPushResponse, Subscriber, SubscriberBuilder };

package/dist/subscribers/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/subscribers/SnsPushSubscriberAdaptor.ts"],"mappings":";;;;UAgBiB;;EAEhB;;;;;;EAMA;;;;;;;;EAQA;;;UAIgB;EAChB;EACA;IAAQ;IAAgB;;;;;;;;;;;;qBAYZ;mBAEM;WACR,YAAY;mBACJ;EAHlB,YACkB,WAAW,uBACnB,YAAY,+CACJ,SAAS;EAGrB,OAAO,gBAAgB,QAAQ;UAuDvB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/subscribers/SnsPushSubscriberAdaptor.ts"],"mappings":";;;;UAiBiB;;EAEhB;;;;;;EAMA;;;;;;;;EAQA;;;UAIgB;EAChB;EACA;IAAQ;IAAgB;;;;;;;;;;;;qBAYZ;mBAEM;WACR,YAAY;mBACJ;EAHlB,YACkB,WAAW,uBACnB,YAAY,+CACJ,SAAS;EAGrB,OAAO,gBAAgB,QAAQ;UAuDvB;UA8BA"}

package/dist/subscribers/index.mjs

@@ -1,5 +1,6 @@
 import { n as Subscriber, t as SubscriberBuilder } from "../SubscriberBuilder-CDy4nHCz.mjs";
 import { n as subscribedEvents, r as subscriberContext, t as runSubscriber } from "../runSubscriber-BHvJ8POr.mjs";
+import { carrierFromAttributes, consumeTraced } from "@geekmidas/events";
 import { wrapError } from "@geekmidas/errors";
 import { runWithRequestContext } from "@geekmidas/services";
 import { confirmSnsSubscription, toSnsEvent, verifySnsMessage } from "@geekmidas/events/sns";
@@ -69,21 +70,27 @@ var SnsPushSubscriberAdaptor = class {
 			requestId,
 			startTime: Date.now(),
 			operation: `subscriber ${this.subscriber.topicName ?? "sns"}`
-		}, async () => {
-			try {
-				const { services, db } = await subscriberContext(this.subscriber, this.envParser);
-				const events = subscribedEvents(this.subscriber, toSnsEvent(message), logger);
-				await runSubscriber(this.subscriber, {
-					events,
-					services,
-					logger,
-					db
-				});
-			} catch (error) {
-				logger.error(error, "Error processing subscriber");
-				throw wrapError(error);
-			}
-		});
+		}, () => consumeTraced({
+			system: "aws_sns",
+			destination: this.subscriber.topicName ?? message.TopicArn.split(":").pop() ?? message.TopicArn,
+			type: message.MessageAttributes?.type?.Value,
+			messageId: message.MessageId
+		}, carrierFromAttributes(message.MessageAttributes), () => this.run(message, logger)));
+	}
+	async run(message, logger) {
+		try {
+			const { services, db } = await subscriberContext(this.subscriber, this.envParser);
+			const events = subscribedEvents(this.subscriber, toSnsEvent(message), logger);
+			await runSubscriber(this.subscriber, {
+				events,
+				services,
+				logger,
+				db
+			});
+		} catch (error) {
+			logger.error(error, "Error processing subscriber");
+			throw wrapError(error);
+		}
 	}
 };
 /** `url`, sent to `endpoint`'s origin instead of its own. */

package/dist/subscribers/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/subscribers/SnsPushSubscriberAdaptor.ts"],"sourcesContent":["import type { EnvironmentParser } from '@geekmidas/envkit';\nimport { wrapError } from '@geekmidas/errors';\nimport {\n\tconfirmSnsSubscription,\n\ttype SnsHttpMessage,\n\ttoSnsEvent,\n\tverifySnsMessage,\n} from '@geekmidas/events/sns';\nimport { runWithRequestContext } from '@geekmidas/services';\nimport {\n\trunSubscriber,\n\tsubscribedEvents,\n\tsubscriberContext,\n} from './runSubscriber';\nimport type { Subscriber } from './Subscriber';\n\nexport interface SnsPushOptions {\n\t/** The topic this subscriber is subscribed to. Anything else is refused. */\n\ttopicArn: string;\n\t/**\n\t * Verify each message's signature. Off only against an emulator, which\n\t * signs nothing — decided by the connection string's endpoint, never by\n\t * anything the request says about itself.\n\t */\n\tverify: boolean;\n\t/**\n\t * The emulator's address, as this server was configured with it. An\n\t * emulator names itself in `SubscribeURL` by the port it listens on inside\n\t * its container, which is not the port published to the host — so against\n\t * one, the confirmation is sent here instead. From configuration, never\n\t * from the request.\n\t */\n\temulatorEndpoint?: string;\n}\n\n/** What to answer SNS with. A non-2xx tells SNS to retry. */\nexport interface SnsPushResponse {\n\tstatus: 200 | 400 | 403 | 500;\n\tbody: { status: string; error?: string };\n}\n\n/**\n * A topic subscriber run by SNS pushing to an HTTP endpoint, rather than by a\n * poller.\n *\n * The notification is read as the Lambda event SNS would have invoked a\n * function with, and run through the same parsing, services and handler as the\n * Lambda adaptor — without its middy wrapper, which is Lambda's alone: a\n * server serving this route has no reason to install `@middy/core`.\n */\nexport class SnsPushSubscriberAdaptor {\n\tconstructor(\n\t\tprivate readonly envParser: EnvironmentParser<{}>,\n\t\treadonly subscriber: Subscriber<any, any, any, any, any, any, any>,\n\t\tprivate readonly options: SnsPushOptions,\n\t) {}\n\n\tasync handle(body: unknown): Promise<SnsPushResponse> {\n\t\tconst message = body as SnsHttpMessage;\n\t\tif (typeof message?.Type !== 'string' || !message.TopicArn) {\n\t\t\treturn refuse(400, 'not an SNS message');\n\t\t}\n\t\t// Checked before the signature: a genuine message for another topic is\n\t\t// still not this subscriber's to confirm or to handle.\n\t\tif (message.TopicArn !== this.options.topicArn) {\n\t\t\treturn refuse(403, `not subscribed to ${message.TopicArn}`);\n\t\t}\n\n\t\tif (this.options.verify) {\n\t\t\ttry {\n\t\t\t\tawait verifySnsMessage(message);\n\t\t\t} catch (error) {\n\t\t\t\tthis.subscriber.logger.warn(\n\t\t\t\t\t{ err: error, topicArn: message.TopicArn },\n\t\t\t\t\t'Refused an SNS message that did not verify',\n\t\t\t\t);\n\t\t\t\treturn refuse(403, (error as Error).name);\n\t\t\t}\n\t\t}\n\n\t\tswitch (message.Type) {\n\t\t\tcase 'SubscriptionConfirmation':\n\t\t\t\tawait confirmSnsSubscription(\n\t\t\t\t\tthis.options.emulatorEndpoint && message.SubscribeURL\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t...message,\n\t\t\t\t\t\t\t\tSubscribeURL: throughEndpoint(\n\t\t\t\t\t\t\t\t\tmessage.SubscribeURL,\n\t\t\t\t\t\t\t\t\tthis.options.emulatorEndpoint,\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: message,\n\t\t\t\t);\n\t\t\t\tthis.subscriber.logger.info(\n\t\t\t\t\t{ topicArn: message.TopicArn },\n\t\t\t\t\t'Confirmed SNS subscription',\n\t\t\t\t);\n\t\t\t\treturn { status: 200, body: { status: 'confirmed' } };\n\t\t\tcase 'Notification':\n\t\t\t\ttry {\n\t\t\t\t\tawait this.notify(message);\n\t\t\t\t\treturn { status: 200, body: { status: 'ok' } };\n\t\t\t\t} catch (error) {\n\t\t\t\t\t// Already logged. A 500 makes SNS retry, which is the point of\n\t\t\t\t\t// answering at all.\n\t\t\t\t\treturn refuse(500, (error as Error).name);\n\t\t\t\t}\n\t\t\tdefault:\n\t\t\t\treturn { status: 200, body: { status: 'ignored' } };\n\t\t}\n\t}\n\n\tprivate async notify(message: SnsHttpMessage): Promise<void> {\n\t\tconst requestId = message.MessageId;\n\t\tconst logger = this.subscriber.logger.child({ requestId });\n\n\t\tawait runWithRequestContext(\n\t\t\t{\n\t\t\t\tlogger,\n\t\t\t\trequestId,\n\t\t\t\tstartTime: Date.now(),\n\t\t\t\toperation: `subscriber ${this.subscriber.topicName ?? 'sns'}`,\n\t\t\t},\n\t\t\tasync () => {\n\t\t\t\ttry {\n\t\t\t\t\tconst { services, db } = await subscriberContext(\n\t\t\t\t\t\tthis.subscriber,\n\t\t\t\t\t\tthis.envParser,\n\t\t\t\t\t);\n\t\t\t\t\tconst events = subscribedEvents(\n\t\t\t\t\t\tthis.subscriber,\n\t\t\t\t\t\ttoSnsEvent(message),\n\t\t\t\t\t\tlogger,\n\t\t\t\t\t);\n\t\t\t\t\tawait runSubscriber(this.subscriber, {\n\t\t\t\t\t\tevents,\n\t\t\t\t\t\tservices,\n\t\t\t\t\t\tlogger,\n\t\t\t\t\t\tdb,\n\t\t\t\t\t});\n\t\t\t\t} catch (error) {\n\t\t\t\t\tlogger.error(error as object, 'Error processing subscriber');\n\t\t\t\t\tthrow wrapError(error);\n\t\t\t\t}\n\t\t\t},\n\t\t);\n\t}\n}\n\n/** `url`, sent to `endpoint`'s origin instead of its own. */\nfunction throughEndpoint(url: string, endpoint: string): string {\n\tconst target = new URL(url);\n\tconst origin = new URL(endpoint);\n\ttarget.protocol = origin.protocol;\n\ttarget.host = origin.host;\n\treturn target.toString();\n}\n\nfunction refuse(\n\tstatus: SnsPushResponse['status'],\n\terror: string,\n): SnsPushResponse {\n\treturn { status, body: { status: 'refused', error } };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkDA,IAAa,2BAAb,MAAsC;CAEnB;CACR;CACQ;CAHlB,YACC,WACA,YACA,SACC;EAHgB,KAAA,YAAA;EACR,KAAA,aAAA;EACQ,KAAA,UAAA;CACf;CAEH,MAAM,OAAO,MAAyC;EACrD,MAAM,UAAU;EAChB,IAAI,OAAO,SAAS,SAAS,YAAY,CAAC,QAAQ,UACjD,OAAO,OAAO,KAAK,oBAAoB;EAIxC,IAAI,QAAQ,aAAa,KAAK,QAAQ,UACrC,OAAO,OAAO,KAAK,qBAAqB,QAAQ,UAAU;EAG3D,IAAI,KAAK,QAAQ,QAChB,IAAI;GACH,MAAM,iBAAiB,OAAO;EAC/B,SAAS,OAAO;GACf,KAAK,WAAW,OAAO,KACtB;IAAE,KAAK;IAAO,UAAU,QAAQ;GAAS,GACzC,4CACD;GACA,OAAO,OAAO,KAAM,MAAgB,IAAI;EACzC;EAGD,QAAQ,QAAQ,MAAhB;GACC,KAAK;IACJ,MAAM,uBACL,KAAK,QAAQ,oBAAoB,QAAQ,eACtC;KACA,GAAG;KACH,cAAc,gBACb,QAAQ,cACR,KAAK,QAAQ,gBACd;IACD,IACC,OACJ;IACA,KAAK,WAAW,OAAO,KACtB,EAAE,UAAU,QAAQ,SAAS,GAC7B,4BACD;IACA,OAAO;KAAE,QAAQ;KAAK,MAAM,EAAE,QAAQ,YAAY;IAAE;GACrD,KAAK,gBACJ,IAAI;IACH,MAAM,KAAK,OAAO,OAAO;IACzB,OAAO;KAAE,QAAQ;KAAK,MAAM,EAAE,QAAQ,KAAK;IAAE;GAC9C,SAAS,OAAO;IAGf,OAAO,OAAO,KAAM,MAAgB,IAAI;GACzC;GACD,SACC,OAAO;IAAE,QAAQ;IAAK,MAAM,EAAE,QAAQ,UAAU;GAAE;EACpD;CACD;CAEA,MAAc,OAAO,SAAwC;EAC5D,MAAM,YAAY,QAAQ;EAC1B,MAAM,SAAS,KAAK,WAAW,OAAO,MAAM,EAAE,UAAU,CAAC;EAEzD,MAAM,sBACL;GACC;GACA;GACA,WAAW,KAAK,IAAI;GACpB,WAAW,cAAc,KAAK,WAAW,aAAa;EACvD,GACA,YAAY;GACX,IAAI;IACH,MAAM,EAAE,UAAU,OAAO,MAAM,kBAC9B,KAAK,YACL,KAAK,SACN;IACA,MAAM,SAAS,iBACd,KAAK,YACL,WAAW,OAAO,GAClB,MACD;IACA,MAAM,cAAc,KAAK,YAAY;KACpC;KACA;KACA;KACA;IACD,CAAC;GACF,SAAS,OAAO;IACf,OAAO,MAAM,OAAiB,6BAA6B;IAC3D,MAAM,UAAU,KAAK;GACtB;EACD,CACD;CACD;AACD;;AAGA,SAAS,gBAAgB,KAAa,UAA0B;CAC/D,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,MAAM,SAAS,IAAI,IAAI,QAAQ;CAC/B,OAAO,WAAW,OAAO;CACzB,OAAO,OAAO,OAAO;CACrB,OAAO,OAAO,SAAS;AACxB;AAEA,SAAS,OACR,QACA,OACkB;CAClB,OAAO;EAAE;EAAQ,MAAM;GAAE,QAAQ;GAAW;EAAM;CAAE;AACrD"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/subscribers/SnsPushSubscriberAdaptor.ts"],"sourcesContent":["import type { EnvironmentParser } from '@geekmidas/envkit';\nimport { wrapError } from '@geekmidas/errors';\nimport { carrierFromAttributes, consumeTraced } from '@geekmidas/events';\nimport {\n\tconfirmSnsSubscription,\n\ttype SnsHttpMessage,\n\ttoSnsEvent,\n\tverifySnsMessage,\n} from '@geekmidas/events/sns';\nimport { runWithRequestContext } from '@geekmidas/services';\nimport {\n\trunSubscriber,\n\tsubscribedEvents,\n\tsubscriberContext,\n} from './runSubscriber';\nimport type { Subscriber } from './Subscriber';\n\nexport interface SnsPushOptions {\n\t/** The topic this subscriber is subscribed to. Anything else is refused. */\n\ttopicArn: string;\n\t/**\n\t * Verify each message's signature. Off only against an emulator, which\n\t * signs nothing — decided by the connection string's endpoint, never by\n\t * anything the request says about itself.\n\t */\n\tverify: boolean;\n\t/**\n\t * The emulator's address, as this server was configured with it. An\n\t * emulator names itself in `SubscribeURL` by the port it listens on inside\n\t * its container, which is not the port published to the host — so against\n\t * one, the confirmation is sent here instead. From configuration, never\n\t * from the request.\n\t */\n\temulatorEndpoint?: string;\n}\n\n/** What to answer SNS with. A non-2xx tells SNS to retry. */\nexport interface SnsPushResponse {\n\tstatus: 200 | 400 | 403 | 500;\n\tbody: { status: string; error?: string };\n}\n\n/**\n * A topic subscriber run by SNS pushing to an HTTP endpoint, rather than by a\n * poller.\n *\n * The notification is read as the Lambda event SNS would have invoked a\n * function with, and run through the same parsing, services and handler as the\n * Lambda adaptor — without its middy wrapper, which is Lambda's alone: a\n * server serving this route has no reason to install `@middy/core`.\n */\nexport class SnsPushSubscriberAdaptor {\n\tconstructor(\n\t\tprivate readonly envParser: EnvironmentParser<{}>,\n\t\treadonly subscriber: Subscriber<any, any, any, any, any, any, any>,\n\t\tprivate readonly options: SnsPushOptions,\n\t) {}\n\n\tasync handle(body: unknown): Promise<SnsPushResponse> {\n\t\tconst message = body as SnsHttpMessage;\n\t\tif (typeof message?.Type !== 'string' || !message.TopicArn) {\n\t\t\treturn refuse(400, 'not an SNS message');\n\t\t}\n\t\t// Checked before the signature: a genuine message for another topic is\n\t\t// still not this subscriber's to confirm or to handle.\n\t\tif (message.TopicArn !== this.options.topicArn) {\n\t\t\treturn refuse(403, `not subscribed to ${message.TopicArn}`);\n\t\t}\n\n\t\tif (this.options.verify) {\n\t\t\ttry {\n\t\t\t\tawait verifySnsMessage(message);\n\t\t\t} catch (error) {\n\t\t\t\tthis.subscriber.logger.warn(\n\t\t\t\t\t{ err: error, topicArn: message.TopicArn },\n\t\t\t\t\t'Refused an SNS message that did not verify',\n\t\t\t\t);\n\t\t\t\treturn refuse(403, (error as Error).name);\n\t\t\t}\n\t\t}\n\n\t\tswitch (message.Type) {\n\t\t\tcase 'SubscriptionConfirmation':\n\t\t\t\tawait confirmSnsSubscription(\n\t\t\t\t\tthis.options.emulatorEndpoint && message.SubscribeURL\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t...message,\n\t\t\t\t\t\t\t\tSubscribeURL: throughEndpoint(\n\t\t\t\t\t\t\t\t\tmessage.SubscribeURL,\n\t\t\t\t\t\t\t\t\tthis.options.emulatorEndpoint,\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: message,\n\t\t\t\t);\n\t\t\t\tthis.subscriber.logger.info(\n\t\t\t\t\t{ topicArn: message.TopicArn },\n\t\t\t\t\t'Confirmed SNS subscription',\n\t\t\t\t);\n\t\t\t\treturn { status: 200, body: { status: 'confirmed' } };\n\t\t\tcase 'Notification':\n\t\t\t\ttry {\n\t\t\t\t\tawait this.notify(message);\n\t\t\t\t\treturn { status: 200, body: { status: 'ok' } };\n\t\t\t\t} catch (error) {\n\t\t\t\t\t// Already logged. A 500 makes SNS retry, which is the point of\n\t\t\t\t\t// answering at all.\n\t\t\t\t\treturn refuse(500, (error as Error).name);\n\t\t\t\t}\n\t\t\tdefault:\n\t\t\t\treturn { status: 200, body: { status: 'ignored' } };\n\t\t}\n\t}\n\n\tprivate async notify(message: SnsHttpMessage): Promise<void> {\n\t\tconst requestId = message.MessageId;\n\t\tconst logger = this.subscriber.logger.child({ requestId });\n\n\t\tawait runWithRequestContext(\n\t\t\t{\n\t\t\t\tlogger,\n\t\t\t\trequestId,\n\t\t\t\tstartTime: Date.now(),\n\t\t\t\toperation: `subscriber ${this.subscriber.topicName ?? 'sns'}`,\n\t\t\t},\n\t\t\t// A CONSUMER span, child of the publisher's: SNS hands the trace\n\t\t\t// context on in the message attributes it was published with.\n\t\t\t() =>\n\t\t\t\tconsumeTraced(\n\t\t\t\t\t{\n\t\t\t\t\t\tsystem: 'aws_sns',\n\t\t\t\t\t\tdestination:\n\t\t\t\t\t\t\tthis.subscriber.topicName ??\n\t\t\t\t\t\t\tmessage.TopicArn.split(':').pop() ??\n\t\t\t\t\t\t\tmessage.TopicArn,\n\t\t\t\t\t\ttype: message.MessageAttributes?.type?.Value,\n\t\t\t\t\t\tmessageId: message.MessageId,\n\t\t\t\t\t},\n\t\t\t\t\tcarrierFromAttributes(message.MessageAttributes),\n\t\t\t\t\t() => this.run(message, logger),\n\t\t\t\t),\n\t\t);\n\t}\n\n\tprivate async run(\n\t\tmessage: SnsHttpMessage,\n\t\tlogger: Subscriber<any, any, any, any, any, any, any>['logger'],\n\t): Promise<void> {\n\t\ttry {\n\t\t\tconst { services, db } = await subscriberContext(\n\t\t\t\tthis.subscriber,\n\t\t\t\tthis.envParser,\n\t\t\t);\n\t\t\tconst events = subscribedEvents(\n\t\t\t\tthis.subscriber,\n\t\t\t\ttoSnsEvent(message),\n\t\t\t\tlogger,\n\t\t\t);\n\t\t\tawait runSubscriber(this.subscriber, {\n\t\t\t\tevents,\n\t\t\t\tservices,\n\t\t\t\tlogger,\n\t\t\t\tdb,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tlogger.error(error as object, 'Error processing subscriber');\n\t\t\tthrow wrapError(error);\n\t\t}\n\t}\n}\n\n/** `url`, sent to `endpoint`'s origin instead of its own. */\nfunction throughEndpoint(url: string, endpoint: string): string {\n\tconst target = new URL(url);\n\tconst origin = new URL(endpoint);\n\ttarget.protocol = origin.protocol;\n\ttarget.host = origin.host;\n\treturn target.toString();\n}\n\nfunction refuse(\n\tstatus: SnsPushResponse['status'],\n\terror: string,\n): SnsPushResponse {\n\treturn { status, body: { status: 'refused', error } };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmDA,IAAa,2BAAb,MAAsC;CAEnB;CACR;CACQ;CAHlB,YACC,WACA,YACA,SACC;EAHgB,KAAA,YAAA;EACR,KAAA,aAAA;EACQ,KAAA,UAAA;CACf;CAEH,MAAM,OAAO,MAAyC;EACrD,MAAM,UAAU;EAChB,IAAI,OAAO,SAAS,SAAS,YAAY,CAAC,QAAQ,UACjD,OAAO,OAAO,KAAK,oBAAoB;EAIxC,IAAI,QAAQ,aAAa,KAAK,QAAQ,UACrC,OAAO,OAAO,KAAK,qBAAqB,QAAQ,UAAU;EAG3D,IAAI,KAAK,QAAQ,QAChB,IAAI;GACH,MAAM,iBAAiB,OAAO;EAC/B,SAAS,OAAO;GACf,KAAK,WAAW,OAAO,KACtB;IAAE,KAAK;IAAO,UAAU,QAAQ;GAAS,GACzC,4CACD;GACA,OAAO,OAAO,KAAM,MAAgB,IAAI;EACzC;EAGD,QAAQ,QAAQ,MAAhB;GACC,KAAK;IACJ,MAAM,uBACL,KAAK,QAAQ,oBAAoB,QAAQ,eACtC;KACA,GAAG;KACH,cAAc,gBACb,QAAQ,cACR,KAAK,QAAQ,gBACd;IACD,IACC,OACJ;IACA,KAAK,WAAW,OAAO,KACtB,EAAE,UAAU,QAAQ,SAAS,GAC7B,4BACD;IACA,OAAO;KAAE,QAAQ;KAAK,MAAM,EAAE,QAAQ,YAAY;IAAE;GACrD,KAAK,gBACJ,IAAI;IACH,MAAM,KAAK,OAAO,OAAO;IACzB,OAAO;KAAE,QAAQ;KAAK,MAAM,EAAE,QAAQ,KAAK;IAAE;GAC9C,SAAS,OAAO;IAGf,OAAO,OAAO,KAAM,MAAgB,IAAI;GACzC;GACD,SACC,OAAO;IAAE,QAAQ;IAAK,MAAM,EAAE,QAAQ,UAAU;GAAE;EACpD;CACD;CAEA,MAAc,OAAO,SAAwC;EAC5D,MAAM,YAAY,QAAQ;EAC1B,MAAM,SAAS,KAAK,WAAW,OAAO,MAAM,EAAE,UAAU,CAAC;EAEzD,MAAM,sBACL;GACC;GACA;GACA,WAAW,KAAK,IAAI;GACpB,WAAW,cAAc,KAAK,WAAW,aAAa;EACvD,SAIC,cACC;GACC,QAAQ;GACR,aACC,KAAK,WAAW,aAChB,QAAQ,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAChC,QAAQ;GACT,MAAM,QAAQ,mBAAmB,MAAM;GACvC,WAAW,QAAQ;EACpB,GACA,sBAAsB,QAAQ,iBAAiB,SACzC,KAAK,IAAI,SAAS,MAAM,CAC/B,CACF;CACD;CAEA,MAAc,IACb,SACA,QACgB;EAChB,IAAI;GACH,MAAM,EAAE,UAAU,OAAO,MAAM,kBAC9B,KAAK,YACL,KAAK,SACN;GACA,MAAM,SAAS,iBACd,KAAK,YACL,WAAW,OAAO,GAClB,MACD;GACA,MAAM,cAAc,KAAK,YAAY;IACpC;IACA;IACA;IACA;GACD,CAAC;EACF,SAAS,OAAO;GACf,OAAO,MAAM,OAAiB,6BAA6B;GAC3D,MAAM,UAAU,KAAK;EACtB;CACD;AACD;;AAGA,SAAS,gBAAgB,KAAa,UAA0B;CAC/D,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,MAAM,SAAS,IAAI,IAAI,QAAQ;CAC/B,OAAO,WAAW,OAAO;CACzB,OAAO,OAAO,OAAO;CACrB,OAAO,OAAO,SAAS;AACxB;AAEA,SAAS,OACR,QACA,OACkB;CAClB,OAAO;EAAE;EAAQ,MAAM;GAAE,QAAQ;GAAW;EAAM;CAAE;AACrD"}

package/dist/topic/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_Topic = require("../Topic-BliAKi5r.cjs");
+const require_Topic = require("../Topic-GHxcU8AG.cjs");
 exports.Topic = require_Topic.Topic;

package/dist/topic/index.mjs

@@ -1,2 +1,2 @@
-import { t as Topic } from "../Topic-DCxIstf9.mjs";
+import { t as Topic } from "../Topic-D74b5cgs.mjs";
 export { Topic };

package/dist/tracing-3PpqRX07.cjs

@@ -0,0 +1,98 @@
+let _geekmidas_events = require("@geekmidas/events");
+let _opentelemetry_api = require("@opentelemetry/api");
+//#region src/tracing.ts
+/**
+* Where the constructs meet OpenTelemetry, beyond the spans `@geekmidas/events`
+* starts for the brokers: the trace context in a Lambda's records, and the
+* spans around an `ExternalApi`'s client.
+*
+* Everything goes through the global API, so without a registered provider
+* none of it records anything.
+*
+* @module
+*/
+/**
+* The trace context a Lambda record carries: an SQS record's message
+* attributes, an SNS record's, or those of the SNS envelope an SQS
+* subscription delivers in its body.
+*/
+function recordCarrier(record) {
+	const r = record;
+	if (r?.Sns) return (0, _geekmidas_events.carrierFromAttributes)(r.Sns.MessageAttributes);
+	const own = (0, _geekmidas_events.carrierFromAttributes)(r?.messageAttributes);
+	if (own || typeof r?.body !== "string") return own;
+	try {
+		const body = JSON.parse(r.body);
+		return body?.Type === "Notification" ? (0, _geekmidas_events.carrierFromAttributes)(body.MessageAttributes) : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* `client`, with a span around each of its methods: `<api>.<method>`, carrying
+* the API's name. An outbound `fetch` the method makes is traced already, and
+* becomes this span's child, so the name is on the trace without anything
+* knowing which URL belongs to which API.
+*
+* Only the client's own methods: what they return is the client's business.
+* Methods are called on the client itself, never on the proxy, so private
+* fields keep working.
+*/
+function traceClient(api, client, attributes = {}) {
+	if (!client || typeof client !== "object" && typeof client !== "function") return client;
+	const wrapped = /* @__PURE__ */ new Map();
+	return new Proxy(client, { get(target, property, receiver) {
+		const value = Reflect.get(target, property, receiver);
+		if (typeof value !== "function" || typeof property === "symbol") return value;
+		if (property === "constructor" || property === "then") return value;
+		const cached = wrapped.get(property);
+		if (cached && cached.original === value) return cached;
+		const traced = Object.assign((...args) => callTraced(api, property, attributes, () => value.apply(target, args)), { original: value });
+		wrapped.set(property, traced);
+		return traced;
+	} });
+}
+function callTraced(api, method, attributes, call) {
+	return _opentelemetry_api.trace.getTracer("@geekmidas/constructs").startActiveSpan(`${api}.${method}`, {
+		kind: _opentelemetry_api.SpanKind.INTERNAL,
+		attributes: {
+			"gkm.external_api.name": api,
+			"gkm.external_api.method": method,
+			...attributes
+		}
+	}, (span) => {
+		const fail = (error) => {
+			if (error instanceof Error) span.recordException(error);
+			span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
+			span.end();
+		};
+		let result;
+		try {
+			result = call();
+		} catch (error) {
+			fail(error);
+			throw error;
+		}
+		if (result instanceof Promise) {
+			result.then(() => span.end(), (error) => fail(error));
+			return result;
+		}
+		span.end();
+		return result;
+	});
+}
+//#endregion
+Object.defineProperty(exports, "recordCarrier", {
+	enumerable: true,
+	get: function() {
+		return recordCarrier;
+	}
+});
+Object.defineProperty(exports, "traceClient", {
+	enumerable: true,
+	get: function() {
+		return traceClient;
+	}
+});
+
+//# sourceMappingURL=tracing-3PpqRX07.cjs.map

package/dist/tracing-3PpqRX07.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing-3PpqRX07.cjs","names":["carrierFromAttributes","trace","SpanKind","SpanStatusCode"],"sources":["../src/tracing.ts"],"sourcesContent":["/**\n * Where the constructs meet OpenTelemetry, beyond the spans `@geekmidas/events`\n * starts for the brokers: the trace context in a Lambda's records, and the\n * spans around an `ExternalApi`'s client.\n *\n * Everything goes through the global API, so without a registered provider\n * none of it records anything.\n *\n * @module\n */\nimport { carrierFromAttributes, type TraceCarrier } from '@geekmidas/events';\nimport { SpanKind, SpanStatusCode, trace } from '@opentelemetry/api';\n\n/**\n * The trace context a Lambda record carries: an SQS record's message\n * attributes, an SNS record's, or those of the SNS envelope an SQS\n * subscription delivers in its body.\n */\nexport function recordCarrier(record: unknown): TraceCarrier | undefined {\n\tconst r = record as {\n\t\tmessageAttributes?: Record<string, unknown>;\n\t\tbody?: string;\n\t\tSns?: { MessageAttributes?: Record<string, unknown> };\n\t};\n\tif (r?.Sns) return carrierFromAttributes(r.Sns.MessageAttributes);\n\n\tconst own = carrierFromAttributes(r?.messageAttributes);\n\tif (own || typeof r?.body !== 'string') return own;\n\ttry {\n\t\tconst body = JSON.parse(r.body);\n\t\treturn body?.Type === 'Notification'\n\t\t\t? carrierFromAttributes(body.MessageAttributes)\n\t\t\t: undefined;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * `client`, with a span around each of its methods: `<api>.<method>`, carrying\n * the API's name. An outbound `fetch` the method makes is traced already, and\n * becomes this span's child, so the name is on the trace without anything\n * knowing which URL belongs to which API.\n *\n * Only the client's own methods: what they return is the client's business.\n * Methods are called on the client itself, never on the proxy, so private\n * fields keep working.\n */\nexport function traceClient<T>(\n\tapi: string,\n\tclient: T,\n\tattributes: Record<string, string> = {},\n): T {\n\tif (!client || (typeof client !== 'object' && typeof client !== 'function')) {\n\t\treturn client;\n\t}\n\tconst wrapped = new Map<PropertyKey, unknown>();\n\treturn new Proxy(client as object, {\n\t\tget(target, property, receiver) {\n\t\t\tconst value = Reflect.get(target, property, receiver);\n\t\t\tif (typeof value !== 'function' || typeof property === 'symbol') {\n\t\t\t\treturn value;\n\t\t\t}\n\t\t\tif (property === 'constructor' || property === 'then') return value;\n\n\t\t\tconst cached = wrapped.get(property);\n\t\t\tif (cached && (cached as { original?: unknown }).original === value) {\n\t\t\t\treturn cached;\n\t\t\t}\n\t\t\tconst traced = Object.assign(\n\t\t\t\t(...args: unknown[]) =>\n\t\t\t\t\tcallTraced(api, property, attributes, () =>\n\t\t\t\t\t\t(value as (...a: unknown[]) => unknown).apply(target, args),\n\t\t\t\t\t),\n\t\t\t\t{ original: value },\n\t\t\t);\n\t\t\twrapped.set(property, traced);\n\t\t\treturn traced;\n\t\t},\n\t}) as T;\n}\n\nfunction callTraced(\n\tapi: string,\n\tmethod: string,\n\tattributes: Record<string, string>,\n\tcall: () => unknown,\n): unknown {\n\treturn trace.getTracer('@geekmidas/constructs').startActiveSpan(\n\t\t`${api}.${method}`,\n\t\t{\n\t\t\tkind: SpanKind.INTERNAL,\n\t\t\tattributes: {\n\t\t\t\t'gkm.external_api.name': api,\n\t\t\t\t'gkm.external_api.method': method,\n\t\t\t\t...attributes,\n\t\t\t},\n\t\t},\n\t\t(span) => {\n\t\t\tconst fail = (error: unknown) => {\n\t\t\t\tif (error instanceof Error) span.recordException(error);\n\t\t\t\tspan.setStatus({ code: SpanStatusCode.ERROR });\n\t\t\t\tspan.end();\n\t\t\t};\n\t\t\tlet result: unknown;\n\t\t\ttry {\n\t\t\t\tresult = call();\n\t\t\t} catch (error) {\n\t\t\t\tfail(error);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\t// Only a native promise is waited on, and the caller gets it back as\n\t\t\t// it was: a lazy thenable runs on `then`, and a promise subclass has\n\t\t\t// methods a chained promise would not.\n\t\t\tif (result instanceof Promise) {\n\t\t\t\tresult.then(\n\t\t\t\t\t() => span.end(),\n\t\t\t\t\t(error) => fail(error),\n\t\t\t\t);\n\t\t\t\treturn result;\n\t\t\t}\n\t\t\tspan.end();\n\t\t\treturn result;\n\t\t},\n\t);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,SAAgB,cAAc,QAA2C;CACxE,MAAM,IAAI;CAKV,IAAI,GAAG,KAAK,QAAA,GAAOA,kBAAAA,sBAAAA,CAAsB,EAAE,IAAI,iBAAiB;CAEhE,MAAM,OAAA,GAAMA,kBAAAA,sBAAAA,CAAsB,GAAG,iBAAiB;CACtD,IAAI,OAAO,OAAO,GAAG,SAAS,UAAU,OAAO;CAC/C,IAAI;EACH,MAAM,OAAO,KAAK,MAAM,EAAE,IAAI;EAC9B,OAAO,MAAM,SAAS,kBAAA,GACnBA,kBAAAA,sBAAAA,CAAsB,KAAK,iBAAiB,IAC5C,KAAA;CACJ,QAAQ;EACP;CACD;AACD;;;;;;;;;;;AAYA,SAAgB,YACf,KACA,QACA,aAAqC,CAAC,GAClC;CACJ,IAAI,CAAC,UAAW,OAAO,WAAW,YAAY,OAAO,WAAW,YAC/D,OAAO;CAER,MAAM,0BAAU,IAAI,IAA0B;CAC9C,OAAO,IAAI,MAAM,QAAkB,EAClC,IAAI,QAAQ,UAAU,UAAU;EAC/B,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;EACpD,IAAI,OAAO,UAAU,cAAc,OAAO,aAAa,UACtD,OAAO;EAER,IAAI,aAAa,iBAAiB,aAAa,QAAQ,OAAO;EAE9D,MAAM,SAAS,QAAQ,IAAI,QAAQ;EACnC,IAAI,UAAW,OAAkC,aAAa,OAC7D,OAAO;EAER,MAAM,SAAS,OAAO,QACpB,GAAG,SACH,WAAW,KAAK,UAAU,kBACxB,MAAuC,MAAM,QAAQ,IAAI,CAC3D,GACD,EAAE,UAAU,MAAM,CACnB;EACA,QAAQ,IAAI,UAAU,MAAM;EAC5B,OAAO;CACR,EACD,CAAC;AACF;AAEA,SAAS,WACR,KACA,QACA,YACA,MACU;CACV,OAAOC,mBAAAA,MAAM,UAAU,uBAAuB,CAAC,CAAC,gBAC/C,GAAG,IAAI,GAAG,UACV;EACC,MAAMC,mBAAAA,SAAS;EACf,YAAY;GACX,yBAAyB;GACzB,2BAA2B;GAC3B,GAAG;EACJ;CACD,IACC,SAAS;EACT,MAAM,QAAQ,UAAmB;GAChC,IAAI,iBAAiB,OAAO,KAAK,gBAAgB,KAAK;GACtD,KAAK,UAAU,EAAE,MAAMC,mBAAAA,eAAe,MAAM,CAAC;GAC7C,KAAK,IAAI;EACV;EACA,IAAI;EACJ,IAAI;GACH,SAAS,KAAK;EACf,SAAS,OAAO;GACf,KAAK,KAAK;GACV,MAAM;EACP;EAIA,IAAI,kBAAkB,SAAS;GAC9B,OAAO,WACA,KAAK,IAAI,IACd,UAAU,KAAK,KAAK,CACtB;GACA,OAAO;EACR;EACA,KAAK,IAAI;EACT,OAAO;CACR,CACD;AACD"}

package/dist/tracing-DbcPuhEy.mjs

@@ -0,0 +1,87 @@
+import { carrierFromAttributes } from "@geekmidas/events";
+import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+//#region src/tracing.ts
+/**
+* Where the constructs meet OpenTelemetry, beyond the spans `@geekmidas/events`
+* starts for the brokers: the trace context in a Lambda's records, and the
+* spans around an `ExternalApi`'s client.
+*
+* Everything goes through the global API, so without a registered provider
+* none of it records anything.
+*
+* @module
+*/
+/**
+* The trace context a Lambda record carries: an SQS record's message
+* attributes, an SNS record's, or those of the SNS envelope an SQS
+* subscription delivers in its body.
+*/
+function recordCarrier(record) {
+	const r = record;
+	if (r?.Sns) return carrierFromAttributes(r.Sns.MessageAttributes);
+	const own = carrierFromAttributes(r?.messageAttributes);
+	if (own || typeof r?.body !== "string") return own;
+	try {
+		const body = JSON.parse(r.body);
+		return body?.Type === "Notification" ? carrierFromAttributes(body.MessageAttributes) : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* `client`, with a span around each of its methods: `<api>.<method>`, carrying
+* the API's name. An outbound `fetch` the method makes is traced already, and
+* becomes this span's child, so the name is on the trace without anything
+* knowing which URL belongs to which API.
+*
+* Only the client's own methods: what they return is the client's business.
+* Methods are called on the client itself, never on the proxy, so private
+* fields keep working.
+*/
+function traceClient(api, client, attributes = {}) {
+	if (!client || typeof client !== "object" && typeof client !== "function") return client;
+	const wrapped = /* @__PURE__ */ new Map();
+	return new Proxy(client, { get(target, property, receiver) {
+		const value = Reflect.get(target, property, receiver);
+		if (typeof value !== "function" || typeof property === "symbol") return value;
+		if (property === "constructor" || property === "then") return value;
+		const cached = wrapped.get(property);
+		if (cached && cached.original === value) return cached;
+		const traced = Object.assign((...args) => callTraced(api, property, attributes, () => value.apply(target, args)), { original: value });
+		wrapped.set(property, traced);
+		return traced;
+	} });
+}
+function callTraced(api, method, attributes, call) {
+	return trace.getTracer("@geekmidas/constructs").startActiveSpan(`${api}.${method}`, {
+		kind: SpanKind.INTERNAL,
+		attributes: {
+			"gkm.external_api.name": api,
+			"gkm.external_api.method": method,
+			...attributes
+		}
+	}, (span) => {
+		const fail = (error) => {
+			if (error instanceof Error) span.recordException(error);
+			span.setStatus({ code: SpanStatusCode.ERROR });
+			span.end();
+		};
+		let result;
+		try {
+			result = call();
+		} catch (error) {
+			fail(error);
+			throw error;
+		}
+		if (result instanceof Promise) {
+			result.then(() => span.end(), (error) => fail(error));
+			return result;
+		}
+		span.end();
+		return result;
+	});
+}
+//#endregion
+export { traceClient as n, recordCarrier as t };
+
+//# sourceMappingURL=tracing-DbcPuhEy.mjs.map

package/dist/tracing-DbcPuhEy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing-DbcPuhEy.mjs","names":[],"sources":["../src/tracing.ts"],"sourcesContent":["/**\n * Where the constructs meet OpenTelemetry, beyond the spans `@geekmidas/events`\n * starts for the brokers: the trace context in a Lambda's records, and the\n * spans around an `ExternalApi`'s client.\n *\n * Everything goes through the global API, so without a registered provider\n * none of it records anything.\n *\n * @module\n */\nimport { carrierFromAttributes, type TraceCarrier } from '@geekmidas/events';\nimport { SpanKind, SpanStatusCode, trace } from '@opentelemetry/api';\n\n/**\n * The trace context a Lambda record carries: an SQS record's message\n * attributes, an SNS record's, or those of the SNS envelope an SQS\n * subscription delivers in its body.\n */\nexport function recordCarrier(record: unknown): TraceCarrier | undefined {\n\tconst r = record as {\n\t\tmessageAttributes?: Record<string, unknown>;\n\t\tbody?: string;\n\t\tSns?: { MessageAttributes?: Record<string, unknown> };\n\t};\n\tif (r?.Sns) return carrierFromAttributes(r.Sns.MessageAttributes);\n\n\tconst own = carrierFromAttributes(r?.messageAttributes);\n\tif (own || typeof r?.body !== 'string') return own;\n\ttry {\n\t\tconst body = JSON.parse(r.body);\n\t\treturn body?.Type === 'Notification'\n\t\t\t? carrierFromAttributes(body.MessageAttributes)\n\t\t\t: undefined;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * `client`, with a span around each of its methods: `<api>.<method>`, carrying\n * the API's name. An outbound `fetch` the method makes is traced already, and\n * becomes this span's child, so the name is on the trace without anything\n * knowing which URL belongs to which API.\n *\n * Only the client's own methods: what they return is the client's business.\n * Methods are called on the client itself, never on the proxy, so private\n * fields keep working.\n */\nexport function traceClient<T>(\n\tapi: string,\n\tclient: T,\n\tattributes: Record<string, string> = {},\n): T {\n\tif (!client || (typeof client !== 'object' && typeof client !== 'function')) {\n\t\treturn client;\n\t}\n\tconst wrapped = new Map<PropertyKey, unknown>();\n\treturn new Proxy(client as object, {\n\t\tget(target, property, receiver) {\n\t\t\tconst value = Reflect.get(target, property, receiver);\n\t\t\tif (typeof value !== 'function' || typeof property === 'symbol') {\n\t\t\t\treturn value;\n\t\t\t}\n\t\t\tif (property === 'constructor' || property === 'then') return value;\n\n\t\t\tconst cached = wrapped.get(property);\n\t\t\tif (cached && (cached as { original?: unknown }).original === value) {\n\t\t\t\treturn cached;\n\t\t\t}\n\t\t\tconst traced = Object.assign(\n\t\t\t\t(...args: unknown[]) =>\n\t\t\t\t\tcallTraced(api, property, attributes, () =>\n\t\t\t\t\t\t(value as (...a: unknown[]) => unknown).apply(target, args),\n\t\t\t\t\t),\n\t\t\t\t{ original: value },\n\t\t\t);\n\t\t\twrapped.set(property, traced);\n\t\t\treturn traced;\n\t\t},\n\t}) as T;\n}\n\nfunction callTraced(\n\tapi: string,\n\tmethod: string,\n\tattributes: Record<string, string>,\n\tcall: () => unknown,\n): unknown {\n\treturn trace.getTracer('@geekmidas/constructs').startActiveSpan(\n\t\t`${api}.${method}`,\n\t\t{\n\t\t\tkind: SpanKind.INTERNAL,\n\t\t\tattributes: {\n\t\t\t\t'gkm.external_api.name': api,\n\t\t\t\t'gkm.external_api.method': method,\n\t\t\t\t...attributes,\n\t\t\t},\n\t\t},\n\t\t(span) => {\n\t\t\tconst fail = (error: unknown) => {\n\t\t\t\tif (error instanceof Error) span.recordException(error);\n\t\t\t\tspan.setStatus({ code: SpanStatusCode.ERROR });\n\t\t\t\tspan.end();\n\t\t\t};\n\t\t\tlet result: unknown;\n\t\t\ttry {\n\t\t\t\tresult = call();\n\t\t\t} catch (error) {\n\t\t\t\tfail(error);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\t// Only a native promise is waited on, and the caller gets it back as\n\t\t\t// it was: a lazy thenable runs on `then`, and a promise subclass has\n\t\t\t// methods a chained promise would not.\n\t\t\tif (result instanceof Promise) {\n\t\t\t\tresult.then(\n\t\t\t\t\t() => span.end(),\n\t\t\t\t\t(error) => fail(error),\n\t\t\t\t);\n\t\t\t\treturn result;\n\t\t\t}\n\t\t\tspan.end();\n\t\t\treturn result;\n\t\t},\n\t);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,SAAgB,cAAc,QAA2C;CACxE,MAAM,IAAI;CAKV,IAAI,GAAG,KAAK,OAAO,sBAAsB,EAAE,IAAI,iBAAiB;CAEhE,MAAM,MAAM,sBAAsB,GAAG,iBAAiB;CACtD,IAAI,OAAO,OAAO,GAAG,SAAS,UAAU,OAAO;CAC/C,IAAI;EACH,MAAM,OAAO,KAAK,MAAM,EAAE,IAAI;EAC9B,OAAO,MAAM,SAAS,iBACnB,sBAAsB,KAAK,iBAAiB,IAC5C,KAAA;CACJ,QAAQ;EACP;CACD;AACD;;;;;;;;;;;AAYA,SAAgB,YACf,KACA,QACA,aAAqC,CAAC,GAClC;CACJ,IAAI,CAAC,UAAW,OAAO,WAAW,YAAY,OAAO,WAAW,YAC/D,OAAO;CAER,MAAM,0BAAU,IAAI,IAA0B;CAC9C,OAAO,IAAI,MAAM,QAAkB,EAClC,IAAI,QAAQ,UAAU,UAAU;EAC/B,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;EACpD,IAAI,OAAO,UAAU,cAAc,OAAO,aAAa,UACtD,OAAO;EAER,IAAI,aAAa,iBAAiB,aAAa,QAAQ,OAAO;EAE9D,MAAM,SAAS,QAAQ,IAAI,QAAQ;EACnC,IAAI,UAAW,OAAkC,aAAa,OAC7D,OAAO;EAER,MAAM,SAAS,OAAO,QACpB,GAAG,SACH,WAAW,KAAK,UAAU,kBACxB,MAAuC,MAAM,QAAQ,IAAI,CAC3D,GACD,EAAE,UAAU,MAAM,CACnB;EACA,QAAQ,IAAI,UAAU,MAAM;EAC5B,OAAO;CACR,EACD,CAAC;AACF;AAEA,SAAS,WACR,KACA,QACA,YACA,MACU;CACV,OAAO,MAAM,UAAU,uBAAuB,CAAC,CAAC,gBAC/C,GAAG,IAAI,GAAG,UACV;EACC,MAAM,SAAS;EACf,YAAY;GACX,yBAAyB;GACzB,2BAA2B;GAC3B,GAAG;EACJ;CACD,IACC,SAAS;EACT,MAAM,QAAQ,UAAmB;GAChC,IAAI,iBAAiB,OAAO,KAAK,gBAAgB,KAAK;GACtD,KAAK,UAAU,EAAE,MAAM,eAAe,MAAM,CAAC;GAC7C,KAAK,IAAI;EACV;EACA,IAAI;EACJ,IAAI;GACH,SAAS,KAAK;EACf,SAAS,OAAO;GACf,KAAK,KAAK;GACV,MAAM;EACP;EAIA,IAAI,kBAAkB,SAAS;GAC9B,OAAO,WACA,KAAK,IAAI,IACd,UAAU,KAAK,KAAK,CACtB;GACA,OAAO;EACR;EACA,KAAK,IAAI;EACT,OAAO;CACR,CACD;AACD"}

package/dist/worker.cjs

@@ -3,7 +3,7 @@ const require_construct_interface = require("./construct-interface.cjs");
 const require_functions = require("./functions-CfzJG9hK.cjs");
 const require_surfaceEnv = require("./surfaceEnv-CNimK76p.cjs");
 const require_CronBuilder = require("./CronBuilder-C0Ek1-RA.cjs");
-const require_QueueBuilder = require("./QueueBuilder-B9ClmXjX.cjs");
+const require_QueueBuilder = require("./QueueBuilder-BjuF0UBl.cjs");
 const require_SubscriberBuilder = require("./SubscriberBuilder-D_owVoHo.cjs");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let _geekmidas_logger_console = require("@geekmidas/logger/console");

package/dist/worker.mjs

@@ -2,7 +2,7 @@ import { edgeTo } from "./construct-interface.mjs";
 import { t as FunctionBuilder } from "./functions-BFizikJU.mjs";
 import { n as envParserFor } from "./surfaceEnv-wMT5QzgZ.mjs";
 import { t as CronBuilder } from "./CronBuilder-Dmix_Pen.mjs";
-import { t as QueueBuilder } from "./QueueBuilder-B0mCqq74.mjs";
+import { t as QueueBuilder } from "./QueueBuilder-Cue73M4t.mjs";
 import { t as SubscriberBuilder } from "./SubscriberBuilder-CDy4nHCz.mjs";
 import { canonicalId } from "@geekmidas/manifest";
 import { DEFAULT_LOGGER } from "@geekmidas/logger/console";