@geekmidas/constructs 10.0.0-alpha.9 → 10.0.0-alpha.91

package/dist/construct-interface.cjs

@@ -1,8 +1,114 @@
-const require_construct_interface = require('./construct-interface-BfjcOD_E.cjs');
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/construct-interface.ts
+/**
+* The edge that points at a construct.
+*
+* A construct's *canonical* node is the one carrying its own id — the others are
+* things it owns rather than things it is, like the signing secret beside an
+* auth server — so the kind an edge records is read off that node instead of
+* being written down beside it. Hand-written kinds are the same fact stated
+* twice, and the copy is what goes stale when a construct changes what it
+* declares.
+*
+* @throws {NotAConstruct} when the value declares nothing under its own id.
+*/
+function edgeTo(construct) {
+	const canonical = construct.declare().find((declaration) => declaration.id === construct.id);
+	if (!canonical) throw new NotAConstruct(construct);
+	return {
+		target: construct.id,
+		kind: canonical.kind
+	};
+}
+/**
+* The services of a list of constructs, at runtime.
+*
+* @throws {NotAConstruct} when handed something else. The type already refuses
+* it, but a JavaScript caller gets no such warning, and a `Service` slipping
+* through would fail later as an undefined key in the handler.
+*/
+function servicesOf(constructs) {
+	return constructs.map((construct) => {
+		if (!isConsumable(construct)) throw new NotAConstruct(construct);
+		return construct.service;
+	});
+}
+/**
+* The other half of `servicesOf`: the same edge, as the manifest records it.
+*
+* `.dependsOn()` used to keep only the services, which is what a handler runs
+* with — and an id cannot be recovered from a service name reliably, so the
+* edges were gone by the time the build could read them. Both halves are taken
+* from one call now, and `existing` is folded in so repeated `.dependsOn()`
+* calls accumulate the way `.services()` already does.
+*/
+function idsOf(constructs, existing = []) {
+	return [.../* @__PURE__ */ new Set([...existing, ...constructs.map(({ id }) => id)])];
+}
+/**
+* The edges after `.database(source)` names a builder's database.
+*
+* A database replaces the one before it — a worker's default, overridden by a
+* runnable that names its own — so the edge the previous one added goes with
+* it. Left behind, a Lambda built from a queue that moved to another database
+* would still be granted the worker's.
+*
+* Only an edge `.database()` added is removed, which is why it is returned as
+* `_databaseEdge` for the next call to read — and not even that one when
+* `.dependsOn()` has since named the same construct, since the handler still
+* reaches it through `services`.
+*/
+function databaseEdges(current, source) {
+	const stillDependedOn = current.service !== void 0 && current.services.includes(current.service);
+	const kept = current.edge && !stillDependedOn ? current.constructs.filter((id) => id !== current.edge) : [...current.constructs];
+	if (!isConsumable(source) || kept.includes(source.id)) return {
+		_constructs: kept,
+		_databaseEdge: void 0
+	};
+	return {
+		_constructs: [...kept, source.id],
+		_databaseEdge: source.id
+	};
+}
+/** Something that is not a construct was passed to `.dependsOn()`. */
+var NotAConstruct = class extends Error {
+	value;
+	constructor(value) {
+		const name = typeof value === "object" && value !== null && "serviceName" in value ? `the service '${String(value.serviceName)}'` : `a ${typeof value}`;
+		super(`.dependsOn() takes constructs, and was given ${name}. Pass it to .services([…]) instead.`);
+		this.value = value;
+		this.name = "NotAConstruct";
+	}
+};
+/**
+* Whether a value is a construct rather than a bare `Service`.
+*
+* Structural rather than `instanceof`: a construct from a second copy of
+* `@geekmidas/constructs` — a linked workspace, two versions in a lockfile — is
+* still a construct, and `instanceof` is exactly the check that says otherwise.
+*/
+function isConsumable(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.id === "string" && typeof candidate.declare === "function" && typeof candidate.service?.serviceName === "string";
+}
+/**
+* The service behind either face.
+*
+* `.database()` and the auditor slot take a construct now; they took a
+* `Service` before and still do, because not every hand-written service has a
+* construct to stand for it.
+*/
+function serviceOf(source) {
+	return isConsumable(source) ? source.service : source;
+}
+//#endregion
+exports.NotAConstruct = NotAConstruct;
+exports.databaseEdges = databaseEdges;
+exports.edgeTo = edgeTo;
+exports.idsOf = idsOf;
+exports.isConsumable = isConsumable;
+exports.serviceOf = serviceOf;
+exports.servicesOf = servicesOf;
 
-exports.NotAConstruct = require_construct_interface.NotAConstruct;
-exports.edgeTo = require_construct_interface.edgeTo;
-exports.idsOf = require_construct_interface.idsOf;
-exports.isConsumable = require_construct_interface.isConsumable;
-exports.serviceOf = require_construct_interface.serviceOf;
-exports.servicesOf = require_construct_interface.servicesOf;
+//# sourceMappingURL=construct-interface.cjs.map

package/dist/construct-interface.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"construct-interface.cjs","names":[],"sources":["../src/construct-interface.ts"],"sourcesContent":["/**\n * The construct contract.\n *\n * A construct is three things at once — an infrastructure requirement at build\n * time, a runtime capability, and something other code can consume — which is\n * what forces exactly these three members.\n *\n * An **interface**, not a base class: `Endpoint`, `Cron`, `Queue`, and `Topic`\n * can satisfy it without inheritance surgery, a lifted `Service` can satisfy it\n * as a plain object, and `.dependsOn()` gets its enforcement structurally — a\n * `Service` (`{ serviceName, register }`) simply does not match\n * `{ id, declare, service }`, with no `instanceof` anywhere.\n *\n * Lives in its own module while the existing abstract `Construct` class is\n * still in use; it takes that name once the class is gone.\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Declaration, Dependency } from '@geekmidas/manifest';\nimport type { Service } from '@geekmidas/services';\n\n/**\n * @typeParam TName - the construct's canonical id, PascalCase. Keeping it a\n * literal is what lets the service key be `Uncapitalize<TName>` — a TypeScript\n * intrinsic, so no custom transform needs a runtime twin.\n * @typeParam TClient - what consuming this construct hands you. `never` means it\n * owns no address and cannot be consumed: a `Cron` is fired by a schedule and a\n * `Subscriber` is reached through its topic, so `.dependsOn()` on either is a\n * compile error rather than a stub that throws.\n */\nexport interface Construct<TName extends string = string, TClient = never> {\n\t/** Canonical, PascalCase, unique within the manifest. */\n\treadonly id: TName;\n\n\t/**\n\t * The build-time face: what this construct contributes to the manifest.\n\t *\n\t * Returns an array because some constructs contribute more than one node — a\n\t * queue declares the queue and its worker, a database declares its migrator\n\t * and seeder. Most return one.\n\t */\n\tdeclare(): Declaration[];\n\n\t/**\n\t * The consumable face — the address this construct owns, as a client.\n\t *\n\t * A field assigned once rather than a getter. `Construct.getEnvironment`\n\t * and `ServiceDiscovery` cache by service *object*, so a getter returning a\n\t * fresh literal on every access would never hit either cache.\n\t */\n\treadonly service: [TClient] extends [never]\n\t\t? never\n\t\t: Service<Uncapitalize<TName>, TClient>;\n}\n\n/**\n * The build-time face alone — an id and what it contributes to the manifest.\n *\n * Weaker than {@link Consumable} on purpose. An edge is not always an\n * injection: a site depending on an API needs that API's *address at build\n * time* and has no service record to put a client into, so requiring one would\n * make the weakest kind of edge impossible to express with the strongest\n * interface. Discovery asks this same question and nothing more.\n */\nexport interface Declarable<TName extends string = string> {\n\treadonly id: TName;\n\tdeclare(): Declaration[];\n}\n\n/**\n * A construct that authenticates requests — what `RestApi.auth()` takes.\n *\n * `verify` is the one thing every provider shares: given a request's headers,\n * whose request is it — the session, or `null` when there is none. Whether the\n * provider is a server mounted beside the API, deployed elsewhere, or an issuer\n * somebody else runs is its own business; a surface only ever asks this.\n */\nexport interface Authenticator<TSession = unknown> extends Declarable {\n\tverify(\n\t\theaders: Headers,\n\t\tenvParser: EnvironmentParser<{}>,\n\t): Promise<TSession | null>;\n}\n\n/**\n * The edge that points at a construct.\n *\n * A construct's *canonical* node is the one carrying its own id — the others are\n * things it owns rather than things it is, like the signing secret beside an\n * auth server — so the kind an edge records is read off that node instead of\n * being written down beside it. Hand-written kinds are the same fact stated\n * twice, and the copy is what goes stale when a construct changes what it\n * declares.\n *\n * @throws {NotAConstruct} when the value declares nothing under its own id.\n */\nexport function edgeTo(construct: Declarable): Dependency {\n\tconst canonical = construct\n\t\t.declare()\n\t\t.find((declaration) => declaration.id === construct.id);\n\n\tif (!canonical) throw new NotAConstruct(construct);\n\n\treturn { target: construct.id, kind: canonical.kind };\n}\n\n/** What consuming a construct hands you. */\nexport type Infer<C> =\n\tC extends Construct<string, infer TClient> ? TClient : never;\n\n/** A construct's canonical id. */\nexport type NameOf<C> =\n\tC extends Construct<infer TName, unknown> ? TName : never;\n\n/**\n * What `.dependsOn([…])` accepts: a construct that owns a client.\n *\n * Structural, and deliberately narrower than {@link Construct} — it is the\n * face a *consumer* needs, so the builders can accept a database, a bucket, a\n * mail sender, a queue, or a topic without importing any of them. A plain\n * `Service` is not one of these, which is the point: constructs-only confines\n * env sniffing to `.services()` and the explicit lift, so retiring that method\n * retires implicit inference with it.\n */\nexport interface Consumable<TName extends string = string, TClient = unknown> {\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, TClient>;\n\tdeclare(): Declaration[];\n}\n\n/**\n * The services a list of constructs dissolves into.\n *\n * A mapped tuple, so `[db, uploads]` types as `[Service<'orders', Kysely<DB>>,\n * Service<'uploads', StorageClient>]` and the handler's service record gains\n * both keys — the same machinery `.services()` already uses, which is why\n * `dependsOn` needs no type plumbing of its own.\n */\nexport type ServicesOf<T extends readonly Consumable[]> = {\n\t[K in keyof T]: T[K]['service'];\n};\n\n/**\n * The services of a list of constructs, at runtime.\n *\n * @throws {NotAConstruct} when handed something else. The type already refuses\n * it, but a JavaScript caller gets no such warning, and a `Service` slipping\n * through would fail later as an undefined key in the handler.\n */\nexport function servicesOf<const T extends readonly Consumable[]>(\n\tconstructs: T,\n): ServicesOf<T> {\n\treturn constructs.map((construct) => {\n\t\tif (!isConsumable(construct)) throw new NotAConstruct(construct);\n\n\t\treturn construct.service;\n\t}) as ServicesOf<T>;\n}\n\n/**\n * The other half of `servicesOf`: the same edge, as the manifest records it.\n *\n * `.dependsOn()` used to keep only the services, which is what a handler runs\n * with — and an id cannot be recovered from a service name reliably, so the\n * edges were gone by the time the build could read them. Both halves are taken\n * from one call now, and `existing` is folded in so repeated `.dependsOn()`\n * calls accumulate the way `.services()` already does.\n */\nexport function idsOf(\n\tconstructs: readonly Consumable[],\n\texisting: readonly string[] = [],\n): string[] {\n\treturn [...new Set([...existing, ...constructs.map(({ id }) => id)])];\n}\n\n/**\n * The edges after `.database(source)` names a builder's database.\n *\n * A database replaces the one before it — a worker's default, overridden by a\n * runnable that names its own — so the edge the previous one added goes with\n * it. Left behind, a Lambda built from a queue that moved to another database\n * would still be granted the worker's.\n *\n * Only an edge `.database()` added is removed, which is why it is returned as\n * `_databaseEdge` for the next call to read — and not even that one when\n * `.dependsOn()` has since named the same construct, since the handler still\n * reaches it through `services`.\n */\nexport function databaseEdges(\n\tcurrent: {\n\t\tconstructs: readonly string[];\n\t\tedge: string | undefined;\n\t\tservice: Service | undefined;\n\t\tservices: readonly Service[];\n\t},\n\tsource: unknown,\n): { _constructs: string[]; _databaseEdge: string | undefined } {\n\tconst stillDependedOn =\n\t\tcurrent.service !== undefined && current.services.includes(current.service);\n\tconst kept =\n\t\tcurrent.edge && !stillDependedOn\n\t\t\t? current.constructs.filter((id) => id !== current.edge)\n\t\t\t: [...current.constructs];\n\n\tif (!isConsumable(source) || kept.includes(source.id)) {\n\t\treturn { _constructs: kept, _databaseEdge: undefined };\n\t}\n\n\treturn { _constructs: [...kept, source.id], _databaseEdge: source.id };\n}\n\n/** Something that is not a construct was passed to `.dependsOn()`. */\nexport class NotAConstruct extends Error {\n\tconstructor(readonly value: unknown) {\n\t\tconst name =\n\t\t\ttypeof value === 'object' && value !== null && 'serviceName' in value\n\t\t\t\t? `the service '${String((value as { serviceName: unknown }).serviceName)}'`\n\t\t\t\t: `a ${typeof value}`;\n\n\t\tsuper(\n\t\t\t`.dependsOn() takes constructs, and was given ${name}. ` +\n\t\t\t\t`Pass it to .services([…]) instead.`,\n\t\t);\n\t\tthis.name = 'NotAConstruct';\n\t}\n}\n\n/**\n * Whether a value is a construct rather than a bare `Service`.\n *\n * Structural rather than `instanceof`: a construct from a second copy of\n * `@geekmidas/constructs` — a linked workspace, two versions in a lockfile — is\n * still a construct, and `instanceof` is exactly the check that says otherwise.\n */\nexport function isConsumable(value: unknown): value is Consumable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Consumable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\ttypeof candidate.declare === 'function' &&\n\t\ttypeof (candidate.service as Service | undefined)?.serviceName === 'string'\n\t);\n}\n\n/**\n * The service behind either face.\n *\n * `.database()` and the auditor slot take a construct now; they took a\n * `Service` before and still do, because not every hand-written service has a\n * construct to stand for it.\n */\nexport function serviceOf<TName extends string, TClient>(\n\tsource: Consumable<TName, TClient> | Service<TName, TClient>,\n): Service<TName, TClient> {\n\t// A construct's service key is `Uncapitalize<TName>` and the slot is typed\n\t// by `TName`; the two describe the same key, and only the cast says so.\n\treturn isConsumable(source)\n\t\t? (source.service as unknown as Service<TName, TClient>)\n\t\t: (source as Service<TName, TClient>);\n}\n"],"mappings":";;;;;;;;;;;;;;AAgGA,SAAgB,OAAO,WAAmC;CACzD,MAAM,YAAY,UAChB,QAAQ,CAAC,CACT,MAAM,gBAAgB,YAAY,OAAO,UAAU,EAAE;CAEvD,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,SAAS;CAEjD,OAAO;EAAE,QAAQ,UAAU;EAAI,MAAM,UAAU;CAAK;AACrD;;;;;;;;AA6CA,SAAgB,WACf,YACgB;CAChB,OAAO,WAAW,KAAK,cAAc;EACpC,IAAI,CAAC,aAAa,SAAS,GAAG,MAAM,IAAI,cAAc,SAAS;EAE/D,OAAO,UAAU;CAClB,CAAC;AACF;;;;;;;;;;AAWA,SAAgB,MACf,YACA,WAA8B,CAAC,GACpB;CACX,OAAO,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,WAAW,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACrE;;;;;;;;;;;;;;AAeA,SAAgB,cACf,SAMA,QAC+D;CAC/D,MAAM,kBACL,QAAQ,YAAY,KAAA,KAAa,QAAQ,SAAS,SAAS,QAAQ,OAAO;CAC3E,MAAM,OACL,QAAQ,QAAQ,CAAC,kBACd,QAAQ,WAAW,QAAQ,OAAO,OAAO,QAAQ,IAAI,IACrD,CAAC,GAAG,QAAQ,UAAU;CAE1B,IAAI,CAAC,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE,GACnD,OAAO;EAAE,aAAa;EAAM,eAAe,KAAA;CAAU;CAGtD,OAAO;EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,EAAE;EAAG,eAAe,OAAO;CAAG;AACtE;;AAGA,IAAa,gBAAb,cAAmC,MAAM;CACnB;CAArB,YAAY,OAAyB;EACpC,MAAM,OACL,OAAO,UAAU,YAAY,UAAU,QAAQ,iBAAiB,QAC7D,gBAAgB,OAAQ,MAAmC,WAAW,EAAE,KACxE,KAAK,OAAO;EAEhB,MACC,gDAAgD,KAAK,qCAEtD;EAToB,KAAA,QAAA;EAUpB,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,SAAgB,aAAa,OAAqC;CACjE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,YAAY;CAElB,OACC,OAAO,UAAU,OAAO,YACxB,OAAO,UAAU,YAAY,cAC7B,OAAQ,UAAU,SAAiC,gBAAgB;AAErE;;;;;;;;AASA,SAAgB,UACf,QAC0B;CAG1B,OAAO,aAAa,MAAM,IACtB,OAAO,UACP;AACL"}

package/dist/construct-interface.d.cts

@@ -1,2 +1,2 @@
-import { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf } from "./construct-interface-D9d4Gm4p.cjs";
-export { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };
+import { a as Infer, c as ServicesOf, d as idsOf, f as isConsumable, i as Declarable, l as databaseEdges, m as servicesOf, n as Construct, o as NameOf, p as serviceOf, r as Consumable, s as NotAConstruct, t as Authenticator, u as edgeTo } from "./construct-interface-B1AfqRl4.cjs";
+export { Authenticator, Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, databaseEdges, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };

package/dist/construct-interface.d.mts

@@ -1,2 +1,2 @@
-import { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf } from "./construct-interface-g5GM5pwR.mjs";
-export { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };
+import { a as Infer, c as ServicesOf, d as idsOf, f as isConsumable, i as Declarable, l as databaseEdges, m as servicesOf, n as Construct, o as NameOf, p as serviceOf, r as Consumable, s as NotAConstruct, t as Authenticator, u as edgeTo } from "./construct-interface-DluK3_da.mjs";
+export { Authenticator, Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, databaseEdges, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };

package/dist/construct-interface.mjs

@@ -1,3 +1,107 @@
-import { NotAConstruct, edgeTo, idsOf, isConsumable, serviceOf, servicesOf } from "./construct-interface-Z4CpS8tK.mjs";
+//#region src/construct-interface.ts
+/**
+* The edge that points at a construct.
+*
+* A construct's *canonical* node is the one carrying its own id — the others are
+* things it owns rather than things it is, like the signing secret beside an
+* auth server — so the kind an edge records is read off that node instead of
+* being written down beside it. Hand-written kinds are the same fact stated
+* twice, and the copy is what goes stale when a construct changes what it
+* declares.
+*
+* @throws {NotAConstruct} when the value declares nothing under its own id.
+*/
+function edgeTo(construct) {
+	const canonical = construct.declare().find((declaration) => declaration.id === construct.id);
+	if (!canonical) throw new NotAConstruct(construct);
+	return {
+		target: construct.id,
+		kind: canonical.kind
+	};
+}
+/**
+* The services of a list of constructs, at runtime.
+*
+* @throws {NotAConstruct} when handed something else. The type already refuses
+* it, but a JavaScript caller gets no such warning, and a `Service` slipping
+* through would fail later as an undefined key in the handler.
+*/
+function servicesOf(constructs) {
+	return constructs.map((construct) => {
+		if (!isConsumable(construct)) throw new NotAConstruct(construct);
+		return construct.service;
+	});
+}
+/**
+* The other half of `servicesOf`: the same edge, as the manifest records it.
+*
+* `.dependsOn()` used to keep only the services, which is what a handler runs
+* with — and an id cannot be recovered from a service name reliably, so the
+* edges were gone by the time the build could read them. Both halves are taken
+* from one call now, and `existing` is folded in so repeated `.dependsOn()`
+* calls accumulate the way `.services()` already does.
+*/
+function idsOf(constructs, existing = []) {
+	return [.../* @__PURE__ */ new Set([...existing, ...constructs.map(({ id }) => id)])];
+}
+/**
+* The edges after `.database(source)` names a builder's database.
+*
+* A database replaces the one before it — a worker's default, overridden by a
+* runnable that names its own — so the edge the previous one added goes with
+* it. Left behind, a Lambda built from a queue that moved to another database
+* would still be granted the worker's.
+*
+* Only an edge `.database()` added is removed, which is why it is returned as
+* `_databaseEdge` for the next call to read — and not even that one when
+* `.dependsOn()` has since named the same construct, since the handler still
+* reaches it through `services`.
+*/
+function databaseEdges(current, source) {
+	const stillDependedOn = current.service !== void 0 && current.services.includes(current.service);
+	const kept = current.edge && !stillDependedOn ? current.constructs.filter((id) => id !== current.edge) : [...current.constructs];
+	if (!isConsumable(source) || kept.includes(source.id)) return {
+		_constructs: kept,
+		_databaseEdge: void 0
+	};
+	return {
+		_constructs: [...kept, source.id],
+		_databaseEdge: source.id
+	};
+}
+/** Something that is not a construct was passed to `.dependsOn()`. */
+var NotAConstruct = class extends Error {
+	value;
+	constructor(value) {
+		const name = typeof value === "object" && value !== null && "serviceName" in value ? `the service '${String(value.serviceName)}'` : `a ${typeof value}`;
+		super(`.dependsOn() takes constructs, and was given ${name}. Pass it to .services([…]) instead.`);
+		this.value = value;
+		this.name = "NotAConstruct";
+	}
+};
+/**
+* Whether a value is a construct rather than a bare `Service`.
+*
+* Structural rather than `instanceof`: a construct from a second copy of
+* `@geekmidas/constructs` — a linked workspace, two versions in a lockfile — is
+* still a construct, and `instanceof` is exactly the check that says otherwise.
+*/
+function isConsumable(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.id === "string" && typeof candidate.declare === "function" && typeof candidate.service?.serviceName === "string";
+}
+/**
+* The service behind either face.
+*
+* `.database()` and the auditor slot take a construct now; they took a
+* `Service` before and still do, because not every hand-written service has a
+* construct to stand for it.
+*/
+function serviceOf(source) {
+	return isConsumable(source) ? source.service : source;
+}
+//#endregion
+export { NotAConstruct, databaseEdges, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };
 
-export { NotAConstruct, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };
+//# sourceMappingURL=construct-interface.mjs.map

package/dist/construct-interface.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"construct-interface.mjs","names":[],"sources":["../src/construct-interface.ts"],"sourcesContent":["/**\n * The construct contract.\n *\n * A construct is three things at once — an infrastructure requirement at build\n * time, a runtime capability, and something other code can consume — which is\n * what forces exactly these three members.\n *\n * An **interface**, not a base class: `Endpoint`, `Cron`, `Queue`, and `Topic`\n * can satisfy it without inheritance surgery, a lifted `Service` can satisfy it\n * as a plain object, and `.dependsOn()` gets its enforcement structurally — a\n * `Service` (`{ serviceName, register }`) simply does not match\n * `{ id, declare, service }`, with no `instanceof` anywhere.\n *\n * Lives in its own module while the existing abstract `Construct` class is\n * still in use; it takes that name once the class is gone.\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Declaration, Dependency } from '@geekmidas/manifest';\nimport type { Service } from '@geekmidas/services';\n\n/**\n * @typeParam TName - the construct's canonical id, PascalCase. Keeping it a\n * literal is what lets the service key be `Uncapitalize<TName>` — a TypeScript\n * intrinsic, so no custom transform needs a runtime twin.\n * @typeParam TClient - what consuming this construct hands you. `never` means it\n * owns no address and cannot be consumed: a `Cron` is fired by a schedule and a\n * `Subscriber` is reached through its topic, so `.dependsOn()` on either is a\n * compile error rather than a stub that throws.\n */\nexport interface Construct<TName extends string = string, TClient = never> {\n\t/** Canonical, PascalCase, unique within the manifest. */\n\treadonly id: TName;\n\n\t/**\n\t * The build-time face: what this construct contributes to the manifest.\n\t *\n\t * Returns an array because some constructs contribute more than one node — a\n\t * queue declares the queue and its worker, a database declares its migrator\n\t * and seeder. Most return one.\n\t */\n\tdeclare(): Declaration[];\n\n\t/**\n\t * The consumable face — the address this construct owns, as a client.\n\t *\n\t * A field assigned once rather than a getter. `Construct.getEnvironment`\n\t * and `ServiceDiscovery` cache by service *object*, so a getter returning a\n\t * fresh literal on every access would never hit either cache.\n\t */\n\treadonly service: [TClient] extends [never]\n\t\t? never\n\t\t: Service<Uncapitalize<TName>, TClient>;\n}\n\n/**\n * The build-time face alone — an id and what it contributes to the manifest.\n *\n * Weaker than {@link Consumable} on purpose. An edge is not always an\n * injection: a site depending on an API needs that API's *address at build\n * time* and has no service record to put a client into, so requiring one would\n * make the weakest kind of edge impossible to express with the strongest\n * interface. Discovery asks this same question and nothing more.\n */\nexport interface Declarable<TName extends string = string> {\n\treadonly id: TName;\n\tdeclare(): Declaration[];\n}\n\n/**\n * A construct that authenticates requests — what `RestApi.auth()` takes.\n *\n * `verify` is the one thing every provider shares: given a request's headers,\n * whose request is it — the session, or `null` when there is none. Whether the\n * provider is a server mounted beside the API, deployed elsewhere, or an issuer\n * somebody else runs is its own business; a surface only ever asks this.\n */\nexport interface Authenticator<TSession = unknown> extends Declarable {\n\tverify(\n\t\theaders: Headers,\n\t\tenvParser: EnvironmentParser<{}>,\n\t): Promise<TSession | null>;\n}\n\n/**\n * The edge that points at a construct.\n *\n * A construct's *canonical* node is the one carrying its own id — the others are\n * things it owns rather than things it is, like the signing secret beside an\n * auth server — so the kind an edge records is read off that node instead of\n * being written down beside it. Hand-written kinds are the same fact stated\n * twice, and the copy is what goes stale when a construct changes what it\n * declares.\n *\n * @throws {NotAConstruct} when the value declares nothing under its own id.\n */\nexport function edgeTo(construct: Declarable): Dependency {\n\tconst canonical = construct\n\t\t.declare()\n\t\t.find((declaration) => declaration.id === construct.id);\n\n\tif (!canonical) throw new NotAConstruct(construct);\n\n\treturn { target: construct.id, kind: canonical.kind };\n}\n\n/** What consuming a construct hands you. */\nexport type Infer<C> =\n\tC extends Construct<string, infer TClient> ? TClient : never;\n\n/** A construct's canonical id. */\nexport type NameOf<C> =\n\tC extends Construct<infer TName, unknown> ? TName : never;\n\n/**\n * What `.dependsOn([…])` accepts: a construct that owns a client.\n *\n * Structural, and deliberately narrower than {@link Construct} — it is the\n * face a *consumer* needs, so the builders can accept a database, a bucket, a\n * mail sender, a queue, or a topic without importing any of them. A plain\n * `Service` is not one of these, which is the point: constructs-only confines\n * env sniffing to `.services()` and the explicit lift, so retiring that method\n * retires implicit inference with it.\n */\nexport interface Consumable<TName extends string = string, TClient = unknown> {\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, TClient>;\n\tdeclare(): Declaration[];\n}\n\n/**\n * The services a list of constructs dissolves into.\n *\n * A mapped tuple, so `[db, uploads]` types as `[Service<'orders', Kysely<DB>>,\n * Service<'uploads', StorageClient>]` and the handler's service record gains\n * both keys — the same machinery `.services()` already uses, which is why\n * `dependsOn` needs no type plumbing of its own.\n */\nexport type ServicesOf<T extends readonly Consumable[]> = {\n\t[K in keyof T]: T[K]['service'];\n};\n\n/**\n * The services of a list of constructs, at runtime.\n *\n * @throws {NotAConstruct} when handed something else. The type already refuses\n * it, but a JavaScript caller gets no such warning, and a `Service` slipping\n * through would fail later as an undefined key in the handler.\n */\nexport function servicesOf<const T extends readonly Consumable[]>(\n\tconstructs: T,\n): ServicesOf<T> {\n\treturn constructs.map((construct) => {\n\t\tif (!isConsumable(construct)) throw new NotAConstruct(construct);\n\n\t\treturn construct.service;\n\t}) as ServicesOf<T>;\n}\n\n/**\n * The other half of `servicesOf`: the same edge, as the manifest records it.\n *\n * `.dependsOn()` used to keep only the services, which is what a handler runs\n * with — and an id cannot be recovered from a service name reliably, so the\n * edges were gone by the time the build could read them. Both halves are taken\n * from one call now, and `existing` is folded in so repeated `.dependsOn()`\n * calls accumulate the way `.services()` already does.\n */\nexport function idsOf(\n\tconstructs: readonly Consumable[],\n\texisting: readonly string[] = [],\n): string[] {\n\treturn [...new Set([...existing, ...constructs.map(({ id }) => id)])];\n}\n\n/**\n * The edges after `.database(source)` names a builder's database.\n *\n * A database replaces the one before it — a worker's default, overridden by a\n * runnable that names its own — so the edge the previous one added goes with\n * it. Left behind, a Lambda built from a queue that moved to another database\n * would still be granted the worker's.\n *\n * Only an edge `.database()` added is removed, which is why it is returned as\n * `_databaseEdge` for the next call to read — and not even that one when\n * `.dependsOn()` has since named the same construct, since the handler still\n * reaches it through `services`.\n */\nexport function databaseEdges(\n\tcurrent: {\n\t\tconstructs: readonly string[];\n\t\tedge: string | undefined;\n\t\tservice: Service | undefined;\n\t\tservices: readonly Service[];\n\t},\n\tsource: unknown,\n): { _constructs: string[]; _databaseEdge: string | undefined } {\n\tconst stillDependedOn =\n\t\tcurrent.service !== undefined && current.services.includes(current.service);\n\tconst kept =\n\t\tcurrent.edge && !stillDependedOn\n\t\t\t? current.constructs.filter((id) => id !== current.edge)\n\t\t\t: [...current.constructs];\n\n\tif (!isConsumable(source) || kept.includes(source.id)) {\n\t\treturn { _constructs: kept, _databaseEdge: undefined };\n\t}\n\n\treturn { _constructs: [...kept, source.id], _databaseEdge: source.id };\n}\n\n/** Something that is not a construct was passed to `.dependsOn()`. */\nexport class NotAConstruct extends Error {\n\tconstructor(readonly value: unknown) {\n\t\tconst name =\n\t\t\ttypeof value === 'object' && value !== null && 'serviceName' in value\n\t\t\t\t? `the service '${String((value as { serviceName: unknown }).serviceName)}'`\n\t\t\t\t: `a ${typeof value}`;\n\n\t\tsuper(\n\t\t\t`.dependsOn() takes constructs, and was given ${name}. ` +\n\t\t\t\t`Pass it to .services([…]) instead.`,\n\t\t);\n\t\tthis.name = 'NotAConstruct';\n\t}\n}\n\n/**\n * Whether a value is a construct rather than a bare `Service`.\n *\n * Structural rather than `instanceof`: a construct from a second copy of\n * `@geekmidas/constructs` — a linked workspace, two versions in a lockfile — is\n * still a construct, and `instanceof` is exactly the check that says otherwise.\n */\nexport function isConsumable(value: unknown): value is Consumable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Consumable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\ttypeof candidate.declare === 'function' &&\n\t\ttypeof (candidate.service as Service | undefined)?.serviceName === 'string'\n\t);\n}\n\n/**\n * The service behind either face.\n *\n * `.database()` and the auditor slot take a construct now; they took a\n * `Service` before and still do, because not every hand-written service has a\n * construct to stand for it.\n */\nexport function serviceOf<TName extends string, TClient>(\n\tsource: Consumable<TName, TClient> | Service<TName, TClient>,\n): Service<TName, TClient> {\n\t// A construct's service key is `Uncapitalize<TName>` and the slot is typed\n\t// by `TName`; the two describe the same key, and only the cast says so.\n\treturn isConsumable(source)\n\t\t? (source.service as unknown as Service<TName, TClient>)\n\t\t: (source as Service<TName, TClient>);\n}\n"],"mappings":";;;;;;;;;;;;;AAgGA,SAAgB,OAAO,WAAmC;CACzD,MAAM,YAAY,UAChB,QAAQ,CAAC,CACT,MAAM,gBAAgB,YAAY,OAAO,UAAU,EAAE;CAEvD,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,SAAS;CAEjD,OAAO;EAAE,QAAQ,UAAU;EAAI,MAAM,UAAU;CAAK;AACrD;;;;;;;;AA6CA,SAAgB,WACf,YACgB;CAChB,OAAO,WAAW,KAAK,cAAc;EACpC,IAAI,CAAC,aAAa,SAAS,GAAG,MAAM,IAAI,cAAc,SAAS;EAE/D,OAAO,UAAU;CAClB,CAAC;AACF;;;;;;;;;;AAWA,SAAgB,MACf,YACA,WAA8B,CAAC,GACpB;CACX,OAAO,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,WAAW,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACrE;;;;;;;;;;;;;;AAeA,SAAgB,cACf,SAMA,QAC+D;CAC/D,MAAM,kBACL,QAAQ,YAAY,KAAA,KAAa,QAAQ,SAAS,SAAS,QAAQ,OAAO;CAC3E,MAAM,OACL,QAAQ,QAAQ,CAAC,kBACd,QAAQ,WAAW,QAAQ,OAAO,OAAO,QAAQ,IAAI,IACrD,CAAC,GAAG,QAAQ,UAAU;CAE1B,IAAI,CAAC,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE,GACnD,OAAO;EAAE,aAAa;EAAM,eAAe,KAAA;CAAU;CAGtD,OAAO;EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,EAAE;EAAG,eAAe,OAAO;CAAG;AACtE;;AAGA,IAAa,gBAAb,cAAmC,MAAM;CACnB;CAArB,YAAY,OAAyB;EACpC,MAAM,OACL,OAAO,UAAU,YAAY,UAAU,QAAQ,iBAAiB,QAC7D,gBAAgB,OAAQ,MAAmC,WAAW,EAAE,KACxE,KAAK,OAAO;EAEhB,MACC,gDAAgD,KAAK,qCAEtD;EAToB,KAAA,QAAA;EAUpB,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,SAAgB,aAAa,OAAqC;CACjE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,YAAY;CAElB,OACC,OAAO,UAAU,OAAO,YACxB,OAAO,UAAU,YAAY,cAC7B,OAAQ,UAAU,SAAiC,gBAAgB;AAErE;;;;;;;;AASA,SAAgB,UACf,QAC0B;CAG1B,OAAO,aAAa,MAAM,IACtB,OAAO,UACP;AACL"}

package/dist/credential.cjs

@@ -1,9 +1,40 @@
-const require_chunk = require('./chunk-DWy1uDak.cjs');
-const __geekmidas_manifest = require_chunk.__toESM(require("@geekmidas/manifest"));
-const __geekmidas_schema_parser = require_chunk.__toESM(require("@geekmidas/schema/parser"));
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let _geekmidas_schema_parser = require("@geekmidas/schema/parser");
 //#region src/credential.ts
+/**
+* `Credential` — a third-party credential with a shape.
+*
+* The answer to the design's first open question, "where does `Secret` sit?".
+* It sits beside a secret rather than replacing it, because the two differ by
+* *lifecycle* and that is the only difference worth two kinds for: a secret is
+* generated and rotated by the platform and is one opaque string, while a
+* credential is issued by someone else, arrives with several fields, and is
+* worth validating on the way in.
+*
+* ```ts
+* export const stripe = new Credential('Stripe', {
+*   schema: z.object({ secretKey: z.string(), webhookSecret: z.string() }),
+* });
+*
+* // in a handler — no await, already parsed and validated
+* services.stripe.secretKey
+* ```
+*
+* **Nothing about it is async at the call site**, which is the part that looks
+* like it should be hard and is not. `Service.register()` may return a promise
+* and `ServiceDiscovery` awaits every one before a handler runs, so fetching a
+* value and validating it — including when a StandardSchema's `~standard.validate`
+* returns a promise of its own — both happen inside that existing seam.
+*
+* **One key holding JSON, not one key per field.** That is the shape a secret
+* manager stores, and it is the only shape that works with an arbitrary
+* StandardSchema: the spec has no introspection API, so enumerating a schema's
+* fields means reaching into one library's internals (`.shape`) and being wrong
+* for every other.
+*/
 var Credential = class {
+	options;
 	id;
 	service;
 	/**
@@ -21,19 +52,28 @@ var Credential = class {
 	resolved;
 	constructor(id, options) {
 		this.options = options;
-		const canonical = (0, __geekmidas_manifest.canonicalId)(id);
+		const canonical = (0, _geekmidas_manifest.canonicalId)(id);
 		this.id = canonical;
-		this.keys = { credential: (0, __geekmidas_manifest.provideKey)(canonical, "credential") };
+		this.keys = { credentials: (0, _geekmidas_manifest.provideKey)(canonical, "credentials") };
 		this.service = {
-			serviceName: (0, __geekmidas_manifest.serviceKey)(canonical),
+			serviceName: (0, _geekmidas_manifest.serviceKey)(canonical),
 			register: (registerOptions) => this.connect(registerOptions)
 		};
 	}
+	/**
+	* What the stage's `<ID>_CREDENTIALS` must look like — the schema the value
+	* is validated against where it is read. Public so a tool setting the value
+	* (`gkm secrets:add`) can check it, and describe its fields, before it is
+	* stored rather than at the first request.
+	*/
+	get credentialsSchema() {
+		return this.options.schema;
+	}
 	declare() {
 		return [{
 			kind: "credential",
 			id: this.id,
-			provides: [this.keys.credential]
+			provides: [this.keys.credentials]
 		}];
 	}
 	connect(options) {
@@ -41,23 +81,38 @@ var Credential = class {
 		this.resolved ??= this.resolve(options);
 		return this.resolved;
 	}
-	async resolve(options) {
-		const { raw } = options.envParser.create((get) => ({ raw: get(this.keys.credential).string() })).parse();
-		try {
-			return await (0, __geekmidas_schema_parser.parseSchema)(this.options.schema, decode(raw));
-		} catch (issues) {
-			throw new MalformedCredential(this.id, this.keys.credential, issues);
-		}
+	resolve(options) {
+		return readCredentials(this.id, this.keys.credentials, this.options.schema, options.envParser);
 	}
 };
 /**
+* A credentials key, read and validated against its schema.
+*
+* Shared with every construct that holds a third party's credentials — an
+* `ExternalApi` reads its own the same way — so the shape a stage stores and
+* the error a bad value raises are the same everywhere.
+*
+* @throws {MalformedCredential} when the value is not what the schema says.
+*/
+async function readCredentials(id, key, schema, envParser) {
+	const { raw } = envParser.create((get) => ({ raw: get(key).string() })).parse();
+	try {
+		return await (0, _geekmidas_schema_parser.parseSchema)(schema, decodeCredentials(raw));
+	} catch (issues) {
+		throw new MalformedCredential(id, key, issues);
+	}
+}
+/**
 * The raw environment value as the thing the schema should see.
 *
 * JSON when it is JSON, and the string itself when it is not — a credential
 * with a single opaque field is ordinary, and requiring `"…"` around it would
 * be ceremony that every operator setting one by hand would get wrong once.
+*
+* Exported so a tool checking a value before it is stored reads it exactly as
+* the process that uses it will.
 */
-function decode(raw) {
+function decodeCredentials(raw) {
 	const value = raw.startsWith(JSON_SCHEME) ? raw.slice(JSON_SCHEME.length) : raw;
 	try {
 		return JSON.parse(value);
@@ -73,6 +128,9 @@ function decode(raw) {
 const JSON_SCHEME = "json:";
 /** A credential was set, and is not what its schema says it should be. */
 var MalformedCredential = class extends Error {
+	id;
+	key;
+	issues;
 	constructor(id, key, issues) {
 		super(`${key} is not a valid ${id} credential. It is validated where it is read, so this is the value that is set rather than the code that uses it: ${describe(issues)}`);
 		this.id = id;
@@ -89,8 +147,10 @@ function describe(issues) {
 		return path ? `${path}: ${issue.message}` : issue.message;
 	}).join("; ");
 }
-
 //#endregion
 exports.Credential = Credential;
 exports.MalformedCredential = MalformedCredential;
+exports.decodeCredentials = decodeCredentials;
+exports.readCredentials = readCredentials;
+
 //# sourceMappingURL=credential.cjs.map

package/dist/credential.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"credential.cjs","names":["id: ConstructName<TName>","options: CredentialOptions<TSchema>","options: ServiceRegisterOptions","raw: string","id: string","key: string","issues: unknown","issue: StandardSchemaV1.Issue"],"sources":["../src/credential.ts"],"sourcesContent":["/**\n * `Credential` — a third-party credential with a shape.\n *\n * The answer to the design's first open question, \"where does `Secret` sit?\".\n * It sits beside a secret rather than replacing it, because the two differ by\n * *lifecycle* and that is the only difference worth two kinds for: a secret is\n * generated and rotated by the platform and is one opaque string, while a\n * credential is issued by someone else, arrives with several fields, and is\n * worth validating on the way in.\n *\n * ```ts\n * export const stripe = new Credential('Stripe', {\n *   schema: z.object({ secretKey: z.string(), webhookSecret: z.string() }),\n * });\n *\n * // in a handler — no await, already parsed and validated\n * services.stripe.secretKey\n * ```\n *\n * **Nothing about it is async at the call site**, which is the part that looks\n * like it should be hard and is not. `Service.register()` may return a promise\n * and `ServiceDiscovery` awaits every one before a handler runs, so fetching a\n * value and validating it — including when a StandardSchema's `~standard.validate`\n * returns a promise of its own — both happen inside that existing seam.\n *\n * **One key holding JSON, not one key per field.** That is the shape a secret\n * manager stores, and it is the only shape that works with an arbitrary\n * StandardSchema: the spec has no introspection API, so enumerating a schema's\n * fields means reaching into one library's internals (`.shape`) and being wrong\n * for every other.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport { parseSchema } from '@geekmidas/schema/parser';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport type { Consumable } from './construct-interface';\n\n/** What a credential's schema yields. */\ntype Value<TSchema extends StandardSchemaV1> =\n\tStandardSchemaV1.InferOutput<TSchema>;\n\nexport interface CredentialOptions<TSchema extends StandardSchemaV1> {\n\t/**\n\t * What the credential must look like.\n\t *\n\t * Validated at registration, so a malformed or half-set credential fails\n\t * when the process starts rather than on the first request that needs the\n\t * one field somebody forgot.\n\t */\n\tschema: TSchema;\n\t/**\n\t * Re-resolve on every registration instead of once per process.\n\t *\n\t * Off by default: a credential is resolved once and reused, because the\n\t * alternative is a fetch on every request. The cost of that default is that\n\t * a rotated credential needs a restart, which is the right trade for a value\n\t * that changes a few times a year — and this is the escape hatch for when it\n\t * is not.\n\t */\n\trefresh?: boolean;\n}\n\nexport class Credential<\n\tTName extends string = string,\n\tTSchema extends StandardSchemaV1 = StandardSchemaV1,\n> implements Consumable<TName, Value<TSchema>>\n{\n\t// `Consumable` rather than `Construct`, and not by preference: `Construct`\n\t// types its service as `[TClient] extends [never] ? never : Service<…>` so\n\t// that a `Cron` cannot be depended on, and TypeScript cannot evaluate that\n\t// conditional while `TClient` is still a type parameter. Every construct\n\t// with a concrete client satisfies `Construct`; the first one whose client\n\t// is generic cannot. `Consumable` is the face `.dependsOn()` requires and\n\t// carries no conditional, so it is the honest annotation here.\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, Value<TSchema>>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * target publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly keys: { credential: string };\n\n\t/**\n\t * The resolved value, held as the *promise* rather than the value.\n\t *\n\t * Caching the promise is what makes two concurrent registrations share one\n\t * resolution: caching the value would let both start before either finished,\n\t * which is a duplicated fetch every cold start rather than never.\n\t */\n\tprivate resolved?: Promise<Value<TSchema>>;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: CredentialOptions<TSchema>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.keys = { credential: provideKey(canonical, 'credential') };\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (registerOptions) => this.connect(registerOptions),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'credential',\n\t\t\t\tid: this.id,\n\t\t\t\tprovides: [this.keys.credential],\n\t\t\t},\n\t\t];\n\t}\n\n\tprivate connect(options: ServiceRegisterOptions): Promise<Value<TSchema>> {\n\t\tif (this.options.refresh) return this.resolve(options);\n\n\t\tthis.resolved ??= this.resolve(options);\n\n\t\treturn this.resolved;\n\t}\n\n\tprivate async resolve(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<Value<TSchema>> {\n\t\tconst { raw } = options.envParser\n\t\t\t.create((get) => ({ raw: get(this.keys.credential).string() }))\n\t\t\t.parse();\n\n\t\ttry {\n\t\t\treturn await parseSchema(this.options.schema, decode(raw));\n\t\t} catch (issues) {\n\t\t\tthrow new MalformedCredential(this.id, this.keys.credential, issues);\n\t\t}\n\t}\n}\n\n/**\n * The raw environment value as the thing the schema should see.\n *\n * JSON when it is JSON, and the string itself when it is not — a credential\n * with a single opaque field is ordinary, and requiring `\"…\"` around it would\n * be ceremony that every operator setting one by hand would get wrong once.\n */\nfunction decode(raw: string): unknown {\n\tconst value = raw.startsWith(JSON_SCHEME)\n\t\t? raw.slice(JSON_SCHEME.length)\n\t\t: raw;\n\n\ttry {\n\t\treturn JSON.parse(value);\n\t} catch {\n\t\treturn value;\n\t}\n}\n\n/**\n * The explicit form, for the case a credential legitimately *is* a JSON string\n * and must not be parsed into an object. Rare, and cheaper to support than to\n * explain.\n */\nconst JSON_SCHEME = 'json:';\n\n/** A credential was set, and is not what its schema says it should be. */\nexport class MalformedCredential extends Error {\n\tconstructor(\n\t\treadonly id: string,\n\t\treadonly key: string,\n\t\treadonly issues: unknown,\n\t) {\n\t\tsuper(\n\t\t\t`${key} is not a valid ${id} credential. ` +\n\t\t\t\t`It is validated where it is read, so this is the value that is set ` +\n\t\t\t\t`rather than the code that uses it: ${describe(issues)}`,\n\t\t);\n\t\tthis.name = 'MalformedCredential';\n\t}\n}\n\n/** StandardSchema issues as one line. */\nfunction describe(issues: unknown): string {\n\tif (!Array.isArray(issues)) return String(issues);\n\n\treturn issues\n\t\t.map((issue: StandardSchemaV1.Issue) => {\n\t\t\tconst path = issue.path\n\t\t\t\t?.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.');\n\n\t\t\treturn path ? `${path}: ${issue.message}` : issue.message;\n\t\t})\n\t\t.join('; ');\n}\n"],"mappings":";;;;;AAqEA,IAAa,aAAb,MAIA;CAQC,AAAS;CACT,AAAS;;;;;CAMT,AAAiB;;;;;;;;CASjB,AAAQ;CAER,YACCA,IACiBC,SAChB;EADgB;EAEjB,MAAM,YAAY,sCAAY,GAAa;AAE3C,OAAK,KAAK;AACV,OAAK,OAAO,EAAE,YAAY,qCAAW,WAAW,aAAa,CAAE;AAG/D,OAAK,UAAU;GACd,aAAa,qCAAW,UAAU;GAClC,UAAU,CAAC,oBAAoB,KAAK,QAAQ,gBAAgB;EAC5D;CACD;CAED,UAAyB;AACxB,SAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,UAAU,CAAC,KAAK,KAAK,UAAW;EAChC,CACD;CACD;CAED,AAAQ,QAAQC,SAA0D;AACzE,MAAI,KAAK,QAAQ,QAAS,QAAO,KAAK,QAAQ,QAAQ;AAEtD,OAAK,aAAa,KAAK,QAAQ,QAAQ;AAEvC,SAAO,KAAK;CACZ;CAED,MAAc,QACbA,SAC0B;EAC1B,MAAM,EAAE,KAAK,GAAG,QAAQ,UACtB,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,KAAK,KAAK,WAAW,CAAC,QAAQ,CAAE,GAAE,CAC9D,OAAO;AAET,MAAI;AACH,UAAO,MAAM,2CAAY,KAAK,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAC1D,SAAQ,QAAQ;AAChB,SAAM,IAAI,oBAAoB,KAAK,IAAI,KAAK,KAAK,YAAY;EAC7D;CACD;AACD;;;;;;;;AASD,SAAS,OAAOC,KAAsB;CACrC,MAAM,QAAQ,IAAI,WAAW,YAAY,GACtC,IAAI,MAAM,YAAY,OAAO,GAC7B;AAEH,KAAI;AACH,SAAO,KAAK,MAAM,MAAM;CACxB,QAAO;AACP,SAAO;CACP;AACD;;;;;;AAOD,MAAM,cAAc;;AAGpB,IAAa,sBAAb,cAAyC,MAAM;CAC9C,YACUC,IACAC,KACAC,QACR;AACD,SACE,EAAE,IAAI,kBAAkB,GAAG,qHAEW,SAAS,OAAO,CAAC,EACxD;EARQ;EACA;EACA;AAOT,OAAK,OAAO;CACZ;AACD;;AAGD,SAAS,SAASA,QAAyB;AAC1C,MAAK,MAAM,QAAQ,OAAO,CAAE,QAAO,OAAO,OAAO;AAEjD,QAAO,OACL,IAAI,CAACC,UAAkC;EACvC,MAAM,OAAO,MAAM,MAChB,IAAI,CAAC,mBACC,YAAY,WAAW,OAAO,QAAQ,IAAI,GAAG,OAAO,QAAQ,CACnE,CACA,KAAK,IAAI;AAEX,SAAO,QAAQ,EAAE,KAAK,IAAI,MAAM,QAAQ,IAAI,MAAM;CAClD,EAAC,CACD,KAAK,KAAK;AACZ"}
+{"version":3,"file":"credential.cjs","names":["canonicalId","provideKey","serviceKey","parseSchema"],"sources":["../src/credential.ts"],"sourcesContent":["/**\n * `Credential` — a third-party credential with a shape.\n *\n * The answer to the design's first open question, \"where does `Secret` sit?\".\n * It sits beside a secret rather than replacing it, because the two differ by\n * *lifecycle* and that is the only difference worth two kinds for: a secret is\n * generated and rotated by the platform and is one opaque string, while a\n * credential is issued by someone else, arrives with several fields, and is\n * worth validating on the way in.\n *\n * ```ts\n * export const stripe = new Credential('Stripe', {\n *   schema: z.object({ secretKey: z.string(), webhookSecret: z.string() }),\n * });\n *\n * // in a handler — no await, already parsed and validated\n * services.stripe.secretKey\n * ```\n *\n * **Nothing about it is async at the call site**, which is the part that looks\n * like it should be hard and is not. `Service.register()` may return a promise\n * and `ServiceDiscovery` awaits every one before a handler runs, so fetching a\n * value and validating it — including when a StandardSchema's `~standard.validate`\n * returns a promise of its own — both happen inside that existing seam.\n *\n * **One key holding JSON, not one key per field.** That is the shape a secret\n * manager stores, and it is the only shape that works with an arbitrary\n * StandardSchema: the spec has no introspection API, so enumerating a schema's\n * fields means reaching into one library's internals (`.shape`) and being wrong\n * for every other.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport { parseSchema } from '@geekmidas/schema/parser';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport type { Consumable } from './construct-interface';\n\n/** What a credential's schema yields. */\ntype Value<TSchema extends StandardSchemaV1> =\n\tStandardSchemaV1.InferOutput<TSchema>;\n\nexport interface CredentialOptions<TSchema extends StandardSchemaV1> {\n\t/**\n\t * What the credential must look like.\n\t *\n\t * Validated at registration, so a malformed or half-set credential fails\n\t * when the process starts rather than on the first request that needs the\n\t * one field somebody forgot.\n\t */\n\tschema: TSchema;\n\t/**\n\t * Re-resolve on every registration instead of once per process.\n\t *\n\t * Off by default: a credential is resolved once and reused, because the\n\t * alternative is a fetch on every request. The cost of that default is that\n\t * a rotated credential needs a restart, which is the right trade for a value\n\t * that changes a few times a year — and this is the escape hatch for when it\n\t * is not.\n\t */\n\trefresh?: boolean;\n}\n\nexport class Credential<\n\tTName extends string = string,\n\tTSchema extends StandardSchemaV1 = StandardSchemaV1,\n> implements Consumable<TName, Value<TSchema>>\n{\n\t// `Consumable` rather than `Construct`, and not by preference: `Construct`\n\t// types its service as `[TClient] extends [never] ? never : Service<…>` so\n\t// that a `Cron` cannot be depended on, and TypeScript cannot evaluate that\n\t// conditional while `TClient` is still a type parameter. Every construct\n\t// with a concrete client satisfies `Construct`; the first one whose client\n\t// is generic cannot. `Consumable` is the face `.dependsOn()` requires and\n\t// carries no conditional, so it is the honest annotation here.\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, Value<TSchema>>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * target publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly keys: { credentials: string };\n\n\t/**\n\t * The resolved value, held as the *promise* rather than the value.\n\t *\n\t * Caching the promise is what makes two concurrent registrations share one\n\t * resolution: caching the value would let both start before either finished,\n\t * which is a duplicated fetch every cold start rather than never.\n\t */\n\tprivate resolved?: Promise<Value<TSchema>>;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: CredentialOptions<TSchema>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.keys = { credentials: provideKey(canonical, 'credentials') };\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (registerOptions) => this.connect(registerOptions),\n\t\t};\n\t}\n\n\t/**\n\t * What the stage's `<ID>_CREDENTIALS` must look like — the schema the value\n\t * is validated against where it is read. Public so a tool setting the value\n\t * (`gkm secrets:add`) can check it, and describe its fields, before it is\n\t * stored rather than at the first request.\n\t */\n\tget credentialsSchema(): TSchema {\n\t\treturn this.options.schema;\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'credential',\n\t\t\t\tid: this.id,\n\t\t\t\tprovides: [this.keys.credentials],\n\t\t\t},\n\t\t];\n\t}\n\n\tprivate connect(options: ServiceRegisterOptions): Promise<Value<TSchema>> {\n\t\tif (this.options.refresh) return this.resolve(options);\n\n\t\tthis.resolved ??= this.resolve(options);\n\n\t\treturn this.resolved;\n\t}\n\n\tprivate resolve(options: ServiceRegisterOptions): Promise<Value<TSchema>> {\n\t\treturn readCredentials(\n\t\t\tthis.id,\n\t\t\tthis.keys.credentials,\n\t\t\tthis.options.schema,\n\t\t\toptions.envParser,\n\t\t);\n\t}\n}\n\n/**\n * A credentials key, read and validated against its schema.\n *\n * Shared with every construct that holds a third party's credentials — an\n * `ExternalApi` reads its own the same way — so the shape a stage stores and\n * the error a bad value raises are the same everywhere.\n *\n * @throws {MalformedCredential} when the value is not what the schema says.\n */\nexport async function readCredentials<TSchema extends StandardSchemaV1>(\n\tid: string,\n\tkey: string,\n\tschema: TSchema,\n\tenvParser: ServiceRegisterOptions['envParser'],\n): Promise<Value<TSchema>> {\n\tconst { raw } = envParser\n\t\t.create((get) => ({ raw: get(key).string() }))\n\t\t.parse();\n\n\ttry {\n\t\treturn await parseSchema(schema, decodeCredentials(raw));\n\t} catch (issues) {\n\t\tthrow new MalformedCredential(id, key, issues);\n\t}\n}\n\n/**\n * The raw environment value as the thing the schema should see.\n *\n * JSON when it is JSON, and the string itself when it is not — a credential\n * with a single opaque field is ordinary, and requiring `\"…\"` around it would\n * be ceremony that every operator setting one by hand would get wrong once.\n *\n * Exported so a tool checking a value before it is stored reads it exactly as\n * the process that uses it will.\n */\nexport function decodeCredentials(raw: string): unknown {\n\tconst value = raw.startsWith(JSON_SCHEME)\n\t\t? raw.slice(JSON_SCHEME.length)\n\t\t: raw;\n\n\ttry {\n\t\treturn JSON.parse(value);\n\t} catch {\n\t\treturn value;\n\t}\n}\n\n/**\n * The explicit form, for the case a credential legitimately *is* a JSON string\n * and must not be parsed into an object. Rare, and cheaper to support than to\n * explain.\n */\nconst JSON_SCHEME = 'json:';\n\n/** A credential was set, and is not what its schema says it should be. */\nexport class MalformedCredential extends Error {\n\tconstructor(\n\t\treadonly id: string,\n\t\treadonly key: string,\n\t\treadonly issues: unknown,\n\t) {\n\t\tsuper(\n\t\t\t`${key} is not a valid ${id} credential. ` +\n\t\t\t\t`It is validated where it is read, so this is the value that is set ` +\n\t\t\t\t`rather than the code that uses it: ${describe(issues)}`,\n\t\t);\n\t\tthis.name = 'MalformedCredential';\n\t}\n}\n\n/** StandardSchema issues as one line. */\nfunction describe(issues: unknown): string {\n\tif (!Array.isArray(issues)) return String(issues);\n\n\treturn issues\n\t\t.map((issue: StandardSchemaV1.Issue) => {\n\t\t\tconst path = issue.path\n\t\t\t\t?.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.');\n\n\t\t\treturn path ? `${path}: ${issue.message}` : issue.message;\n\t\t})\n\t\t.join('; ');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqEA,IAAa,aAAb,MAIA;CA4BmB;CApBlB;CACA;;;;;CAMA;;;;;;;;CASA;CAEA,YACC,IACA,SACC;EADgB,KAAA,UAAA;EAEjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,OAAO,EAAE,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,WAAW,aAAa,EAAE;EAGhE,KAAK,UAAU;GACd,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,SAAS;GACjC,WAAW,oBAAoB,KAAK,QAAQ,eAAe;EAC5D;CACD;;;;;;;CAQA,IAAI,oBAA6B;EAChC,OAAO,KAAK,QAAQ;CACrB;CAEA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,UAAU,CAAC,KAAK,KAAK,WAAW;EACjC,CACD;CACD;CAEA,QAAgB,SAA0D;EACzE,IAAI,KAAK,QAAQ,SAAS,OAAO,KAAK,QAAQ,OAAO;EAErD,KAAK,aAAa,KAAK,QAAQ,OAAO;EAEtC,OAAO,KAAK;CACb;CAEA,QAAgB,SAA0D;EACzE,OAAO,gBACN,KAAK,IACL,KAAK,KAAK,aACV,KAAK,QAAQ,QACb,QAAQ,SACT;CACD;AACD;;;;;;;;;;AAWA,eAAsB,gBACrB,IACA,KACA,QACA,WAC0B;CAC1B,MAAM,EAAE,QAAQ,UACd,QAAQ,SAAS,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAC7C,MAAM;CAER,IAAI;EACH,OAAO,OAAA,GAAMC,yBAAAA,YAAAA,CAAY,QAAQ,kBAAkB,GAAG,CAAC;CACxD,SAAS,QAAQ;EAChB,MAAM,IAAI,oBAAoB,IAAI,KAAK,MAAM;CAC9C;AACD;;;;;;;;;;;AAYA,SAAgB,kBAAkB,KAAsB;CACvD,MAAM,QAAQ,IAAI,WAAW,WAAW,IACrC,IAAI,MAAM,YAAY,MAAM,IAC5B;CAEH,IAAI;EACH,OAAO,KAAK,MAAM,KAAK;CACxB,QAAQ;EACP,OAAO;CACR;AACD;;;;;;AAOA,MAAM,cAAc;;AAGpB,IAAa,sBAAb,cAAyC,MAAM;CAEpC;CACA;CACA;CAHV,YACC,IACA,KACA,QACC;EACD,MACC,GAAG,IAAI,kBAAkB,GAAG,qHAEW,SAAS,MAAM,GACvD;EARS,KAAA,KAAA;EACA,KAAA,MAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,SAAS,QAAyB;CAC1C,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG,OAAO,OAAO,MAAM;CAEhD,OAAO,OACL,KAAK,UAAkC;EACvC,MAAM,OAAO,MAAM,MAChB,KAAK,YACN,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;EAEV,OAAO,OAAO,GAAG,KAAK,IAAI,MAAM,YAAY,MAAM;CACnD,CAAC,CAAC,CACD,KAAK,IAAI;AACZ"}

package/dist/credential.d.cts

@@ -1,13 +1,11 @@
-import { Consumable } from "./construct-interface-D9d4Gm4p.cjs";
-import { Service } from "@geekmidas/services";
-import { StandardSchemaV1 } from "@standard-schema/spec";
+import { t as StandardSchemaV1 } from "./index-CeEtxDmK.cjs";
+import { r as Consumable } from "./construct-interface-B1AfqRl4.cjs";
+import { Service, ServiceRegisterOptions } from "@geekmidas/services";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
-
 //#region src/credential.d.ts
-
 /** What a credential's schema yields. */
 type Value<TSchema extends StandardSchemaV1> = StandardSchemaV1.InferOutput<TSchema>;
-interface CredentialOptions<TSchema extends StandardSchemaV1> {
+export interface CredentialOptions<TSchema extends StandardSchemaV1> {
   /**
    * What the credential must look like.
    *
@@ -27,7 +25,7 @@ interface CredentialOptions<TSchema extends StandardSchemaV1> {
    */
   refresh?: boolean;
 }
-declare class Credential<TName extends string = string, TSchema extends StandardSchemaV1 = StandardSchemaV1> implements Consumable<TName, Value<TSchema>> {
+export declare class Credential<TName extends string = string, TSchema extends StandardSchemaV1 = StandardSchemaV1> implements Consumable<TName, Value<TSchema>> {
   private readonly options;
   readonly id: TName;
   readonly service: Service<Uncapitalize<TName>, Value<TSchema>>;
@@ -45,17 +43,44 @@ declare class Credential<TName extends string = string, TSchema extends Standard
    */
   private resolved?;
   constructor(id: ConstructName<TName>, options: CredentialOptions<TSchema>);
+  /**
+   * What the stage's `<ID>_CREDENTIALS` must look like — the schema the value
+   * is validated against where it is read. Public so a tool setting the value
+   * (`gkm secrets:add`) can check it, and describe its fields, before it is
+   * stored rather than at the first request.
+   */
+  get credentialsSchema(): TSchema;
   declare(): Declaration[];
   private connect;
   private resolve;
 }
+/**
+ * A credentials key, read and validated against its schema.
+ *
+ * Shared with every construct that holds a third party's credentials — an
+ * `ExternalApi` reads its own the same way — so the shape a stage stores and
+ * the error a bad value raises are the same everywhere.
+ *
+ * @throws {MalformedCredential} when the value is not what the schema says.
+ */
+export declare function readCredentials<TSchema extends StandardSchemaV1>(id: string, key: string, schema: TSchema, envParser: ServiceRegisterOptions['envParser']): Promise<Value<TSchema>>;
+/**
+ * The raw environment value as the thing the schema should see.
+ *
+ * JSON when it is JSON, and the string itself when it is not — a credential
+ * with a single opaque field is ordinary, and requiring `"…"` around it would
+ * be ceremony that every operator setting one by hand would get wrong once.
+ *
+ * Exported so a tool checking a value before it is stored reads it exactly as
+ * the process that uses it will.
+ */
+export declare function decodeCredentials(raw: string): unknown;
 /** A credential was set, and is not what its schema says it should be. */
-declare class MalformedCredential extends Error {
+export declare class MalformedCredential extends Error {
   readonly id: string;
   readonly key: string;
   readonly issues: unknown;
   constructor(id: string, key: string, issues: unknown);
 }
 //#endregion
-export { Credential, CredentialOptions, MalformedCredential };
 //# sourceMappingURL=credential.d.cts.map

package/dist/credential.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"credential.d.cts","names":[],"sources":["../src/credential.ts"],"sourcesContent":[],"mappings":";;;;;;;;AAwEuB,KA3BlB,KA2BkB,CAAA,gBA3BI,gBA2BJ,CAAA,GA1BtB,gBAAA,CAAiB,WA0BK,CA1BO,OA0BP,CAAA;AAuGV,UA/HI,iBA+HgB,CAAA,gBA/HkB,gBA+HL,CAAA,CAAA;;;;;;;;UAvHrC;;;;;;;;;;;;cAaI,0DAEI,mBAAmB,6BACvB,WAAW,OAAO,MAAM;;eASvB;oBACK,QAAQ,aAAa,QAAQ,MAAM;;;;;;;;;;;;;;kBAkBhD,cAAc,iBACQ,kBAAkB;aAclC;;;;;cA4DC,mBAAA,SAA4B,KAAK"}
+{"version":3,"file":"credential.d.cts","names":[],"sources":["../src/credential.ts"],"mappings":";;;;;;KA6CK,MAAM,gBAAgB,oBAC1B,iBAAiB,YAAY;iBAEb,kBAAkB,gBAAgB;;;;;;;;EAQlD,QAAQ;;;;;;;;;;EAUR;;qBAGY,WACZ,+BACA,gBAAgB,mBAAmB,6BACvB,WAAW,OAAO,MAAM;mBA6BlB;WApBT,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQ,MAAM;;;;;mBAMpC;;;;;;;;UAST;EAER,YACC,IAAI,cAAc,QACD,SAAS,kBAAkB;;;;;;;MAoBzC,qBAAqB;EAIzB,WAAW;UAUH;UAQA;;;;;;;;;;;wBAmBa,gBAAgB,gBAAgB,kBACrD,YACA,aACA,QAAQ,SACR,WAAW,sCACT,QAAQ,MAAM;;;;;;;;;;;wBAsBD,kBAAkB;;qBAoBrB,4BAA4B;WAE9B;WACA;WACA;EAHV,YACU,YACA,aACA"}