@geekmidas/constructs 10.0.0-alpha.9 → 10.0.0-alpha.91

package/dist/index-CTkKOer4.d.mts

@@ -0,0 +1,115 @@
+import { t as StandardSchemaV1 } from "./index-CeEtxDmK.mjs";
+import { a as EventFor, c as Topic, n as ConstructType, o as TopicEvent } from "./Construct-QXnl3VqT.mjs";
+import { i as FunctionHandler, n as Function } from "./Function-DuqGcbOI.mjs";
+import { c as ServicesOf, r as Consumable } from "./construct-interface-DluK3_da.mjs";
+import { Service } from "@geekmidas/services";
+import { AuditStorage, AuditableAction } from "@geekmidas/audit";
+import { Logger } from "@geekmidas/logger";
+import { ComposableStandardSchema, InferComposableStandardSchema, InferStandardSchema } from "@geekmidas/schema";
+//#region src/functions/BaseFunctionBuilder.d.ts
+declare abstract class BaseFunctionBuilder<TInput extends ComposableStandardSchema, OutSchema extends StandardSchemaV1 | undefined = undefined, TServices extends Service[] = [], TLogger extends Logger = Logger, TAuditStorage extends AuditStorage | undefined = undefined, TAuditStorageServiceName extends string = string, TDatabase = undefined, TDatabaseServiceName extends string = string> {
+  type: ConstructType;
+  protected inputSchema?: TInput;
+  protected outputSchema?: OutSchema;
+  protected _timeout?: number;
+  _services: TServices;
+  /**
+   * The construct ids `.dependsOn()` was given.
+   *
+   * Beside the services rather than instead of them: a handler *runs* with
+   * clients and the manifest *records* which constructs it reaches, and
+   * dissolving one into the other is what lost the edges. Shared by every
+   * builder because every one of them can depend on something.
+   */
+  _constructs: string[];
+  _logger: TLogger;
+  /**
+   * The deploy unit everything built from this builder belongs to.
+   *
+   * Seeded by the factory a `Worker` or `RestApi` hands out, so a cron knows
+   * which process runs it without a directory having to imply it.
+   */
+  _owner?: string;
+  /**
+   * Where a cron built from this factory keeps its schedule.
+   *
+   * Set by the worker that handed the factory out, the same way the logger
+   * and the owner are — so a cron file names a schedule and nothing else.
+   * Only a server target reads it; on AWS the schedule is an EventBridge rule.
+   */
+  _scheduleStore?: unknown;
+  /** What the built construct publishes, each event bound to its topic. */
+  _events: TopicEvent[];
+  protected _auditorStorage?: Service<TAuditStorageServiceName, TAuditStorage>;
+  protected _databaseService?: Service<TDatabaseServiceName, TDatabase>;
+  /** The edge `.database()` added, so the next one can replace it. */
+  protected _databaseEdge?: string;
+  static isStandardSchemaV1(s: unknown): s is StandardSchemaV1;
+  static parseComposableStandardSchema<T extends ComposableStandardSchema | undefined>(data: unknown, schema: T): Promise<InferComposableStandardSchema<T>>;
+  constructor(type?: ConstructType);
+  abstract services<T extends Service[]>(services: T): any;
+  abstract logger<T extends Logger>(logger: T): any;
+  timeout(timeout: number): this;
+  abstract output<T extends StandardSchemaV1>(schema: T): any;
+  abstract input<T extends ComposableStandardSchema>(schema: T): any;
+  /**
+   * A clone that publishes `event` to `topic` once the handler succeeds, and
+   * has the topic as a dependency the way `.dependsOn([topic])` would: in
+   * `services`, and an edge in the manifest. Each builder types it as its own
+   * `event()`, since only it knows how its services widen.
+   */
+  protected withEvent(topic: Topic<any, any>, event: EventFor<Topic<any, any>, any>): this;
+  auditor<T extends AuditStorage, TName extends string>(storage: Service<TName, T>): BaseFunctionBuilder<TInput, OutSchema, TServices, TLogger, T, TName, TDatabase, TDatabaseServiceName>;
+  /**
+   * Set the database service for this function.
+   * The database will be available in the handler context as `db`.
+   */
+  database<T, TName extends string>(source: Consumable<TName, T> | Service<TName, T>): BaseFunctionBuilder<TInput, OutSchema, TServices, TLogger, TAuditStorage, TAuditStorageServiceName, T, TName>;
+}
+//#endregion
+//#region src/functions/FunctionBuilder.d.ts
+declare class FunctionBuilder<TInput extends ComposableStandardSchema, OutSchema extends StandardSchemaV1 | undefined = undefined, TServices extends Service[] = [], TLogger extends Logger = Logger, TAuditStorage extends AuditStorage | undefined = undefined, TAuditStorageServiceName extends string = string, TDatabase = undefined, TDatabaseServiceName extends string = string, TAuditAction extends AuditableAction<string, unknown> = AuditableAction<string, unknown>> extends BaseFunctionBuilder<TInput, OutSchema, TServices, TLogger, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName> {
+  type: ConstructType;
+  protected _memorySize?: number;
+  constructor(type?: ConstructType);
+  timeout(timeout: number): this;
+  memorySize(memorySize: number): this;
+  output<T extends StandardSchemaV1>(schema: T): FunctionBuilder<TInput, T, TServices, TLogger, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName, TAuditAction>;
+  input<T extends ComposableStandardSchema>(schema: T): FunctionBuilder<T, OutSchema, TServices, TLogger, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName, TAuditAction>;
+  /**
+   * Depend on constructs — a database, a bucket, a mail sender, a queue, a
+   * topic.
+   *
+   * It records the edge and dissolves each construct's client into the
+   * handler's service record under the construct's own id, so
+   * `.dependsOn([uploads])` is what makes `services.uploads` exist and type.
+   *
+   * Constructs only. A `Service` does not match the shape, which is what keeps
+   * env sniffing confined to `.services()` and the explicit lift.
+   */
+  dependsOn<const T extends readonly Consumable[]>(constructs: T): FunctionBuilder<TInput, OutSchema, [...TServices, ...ServicesOf<T>], TLogger, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName, TAuditAction>;
+  services<T extends Service[]>(services: T): FunctionBuilder<TInput, OutSchema, [...TServices, ...T], TLogger, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName, TAuditAction>;
+  logger<T extends Logger>(logger: T): FunctionBuilder<TInput, OutSchema, TServices, T, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName, TAuditAction>;
+  /**
+   * Publish `event` to `topic` once the function has succeeded — repeatable,
+   * one call per event, to as many topics as it names. The topic becomes a
+   * dependency as with `.dependsOn([topic])`, so `services.<topic>` is there
+   * for events the handler decides on itself.
+   */
+  event<TTopic extends Topic<any, any>>(topic: TTopic, event: EventFor<TTopic, InferStandardSchema<OutSchema>>): FunctionBuilder<TInput, OutSchema, [...TServices, TTopic['service']], TLogger, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName, TAuditAction>;
+  auditor<T extends AuditStorage, TName extends string>(storage: Service<TName, T>): FunctionBuilder<TInput, OutSchema, TServices, TLogger, T, TName, TDatabase, TDatabaseServiceName, TAuditAction>;
+  /**
+   * Set the audit action types for this function.
+   * This provides type-safety for the auditor in the handler context.
+   */
+  actions<T extends AuditableAction<string, unknown>>(): FunctionBuilder<TInput, OutSchema, TServices, TLogger, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName, T>;
+  /**
+   * Set the database service for this function.
+   * The database will be available in the handler context as `db`.
+   */
+  database<T, TName extends string>(source: Consumable<TName, T> | Service<TName, T>): FunctionBuilder<TInput, OutSchema, TServices, TLogger, TAuditStorage, TAuditStorageServiceName, T, TName, TAuditAction>;
+  handle(fn: FunctionHandler<TInput, TServices, TLogger, OutSchema, TDatabase, TAuditStorage, TAuditAction>): Function<TInput, TServices, TLogger, OutSchema, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName, TAuditAction, FunctionHandler<TInput, TServices, TLogger, OutSchema, TDatabase, TAuditStorage, TAuditAction>>;
+}
+//#endregion
+export { BaseFunctionBuilder as n, FunctionBuilder as t };
+//# sourceMappingURL=index-CTkKOer4.d.mts.map

package/dist/index-CTkKOer4.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-CTkKOer4.d.mts","names":[],"sources":["../src/functions/BaseFunctionBuilder.ts","../src/functions/FunctionBuilder.ts"],"mappings":";;;;;;;;;uBAsBsB,oBACrB,eAAe,0BACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,sBAAsB,sCACtB,kDACA,uBACA;EAoFmB,MAAI;YAlFb,cAAc;YACd,eAAe;YACf;EAEH,WAAW;;;;;;;;;EASX;EACA,SAAS;;;;;;;EAQT;;;;;;;;EASA;;EAGA,SAAS;YACN,kBAAkB,QAAQ,0BAA0B;YACpD,mBAAmB,QAAQ,sBAAsB;;YAEjD;SAEH,mBAAmB,aAAa,KAAK;SAM/B,8BACZ,UAAU,sCACT,eAAe,QAAQ,IAAI,QAAQ,8BAA8B;EAkCnE,YAAmB,OAAI;WAEd,SAAS,UAAU,WAAW,UAAU;WAExC,OAAO,UAAU,QAAQ,QAAQ;EAE1C,QAAQ;WAIC,OAAO,UAAU,kBAAkB,QAAQ;WAE3C,MAAM,UAAU,0BAA0B,QAAQ;;;;;;;YAQjD,UACT,OAAO,iBACP,OAAO,SAAS;EAcjB,QAAQ,UAAU,cAAc,sBAC/B,SAAS,QAAQ,OAAO,KACtB,oBACF,QACA,WACA,WACA,SACA,GACA,OACA,WACA;;;;;EAuBD,SAAS,GAAG,sBACX,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,oBACF,QACA,WACA,WACA,SACA,eACA,0BACA,GACA;;;;cCzKW,gBACZ,eAAe,0BACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,sBAAsB,sCACtB,kDACA,uBACA,8CACA,qBAAqB,mCAAmC,0CAI/C,oBACT,QACA,WACA,WACA,SACA,eACA,0BACA,WACA;EAI4B,MAAI;YAFtB;EAEV,YAA4B,OAAI;EAIvB,QAAQ;EAIjB,WAAW;EAIX,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,GACA,WACA,SACA,eACA,0BACA,WACA,sBACA;EAiBD,MAAM,UAAU,0BACf,QAAQ,IACN,gBACF,GACA,WACA,WACA,SACA,eACA,0BACA,WACA,sBACA;;;;;;;;;;;;EA4BD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,gBACF,QACA,eACI,cAAc,WAAW,KAC7B,SACA,eACA,0BACA,WACA,sBACA;EA8BD,SAAS,UAAU,WAClB,UAAU,IACR,gBACF,QACA,eACI,cAAc,IAClB,SACA,eACA,0BACA,WACA,sBACA;EAoBD,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,QACA,WACA,WACA,GACA,eACA,0BACA,WACA,sBACA;;;;;;;EAuBD,MAAM,eAAe,iBACpB,OAAO,QACP,OAAO,SAAS,QAAQ,oBAAoB,cAC1C,gBACF,QACA,eACI,WAAW,oBACf,SACA,eACA,0BACA,WACA,sBACA;EAeQ,QAAQ,UAAU,cAAc,sBACxC,SAAS,QAAQ,OAAO,KACtB,gBACF,QACA,WACA,WACA,SACA,GACA,OACA,WACA,sBACA;;;;;EAwBD,QAAQ,UAAU,qCAAqC,gBACtD,QACA,WACA,WACA,SACA,eACA,0BACA,WACA,sBACA;;;;;EAmBQ,SAAS,GAAG,sBACpB,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,QACA,WACA,WACA,SACA,eACA,0BACA,GACA,OACA;EAkCD,OACC,IAAI,gBACH,QACA,WACA,SACA,WACA,WACA,eACA,gBAEC,SACF,QACA,WACA,SACA,WACA,eACA,0BACA,WACA,sBACA,cACA,gBACC,QACA,WACA,SACA,WACA,WACA,eACA"}

package/dist/index-CeEtxDmK.d.cts

@@ -0,0 +1,79 @@
+//#region ../../node_modules/.pnpm/@standard-schema+spec@1.1.0/node_modules/@standard-schema/spec/dist/index.d.ts
+/** The Standard Typed interface. This is a base type extended by other specs. */
+interface StandardTypedV1<Input = unknown, Output = Input> {
+  /** The Standard properties. */
+  readonly "~standard": StandardTypedV1.Props<Input, Output>;
+}
+declare namespace StandardTypedV1 {
+  /** The Standard Typed properties interface. */
+  interface Props<Input = unknown, Output = Input> {
+    /** The version number of the standard. */
+    readonly version: 1;
+    /** The vendor name of the schema library. */
+    readonly vendor: string;
+    /** Inferred types associated with the schema. */
+    readonly types?: Types<Input, Output> | undefined;
+  }
+  /** The Standard Typed types interface. */
+  interface Types<Input = unknown, Output = Input> {
+    /** The input type of the schema. */
+    readonly input: Input;
+    /** The output type of the schema. */
+    readonly output: Output;
+  }
+  /** Infers the input type of a Standard Typed. */
+  type InferInput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["input"];
+  /** Infers the output type of a Standard Typed. */
+  type InferOutput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["output"];
+}
+/** The Standard Schema interface. */
+interface StandardSchemaV1<Input = unknown, Output = Input> {
+  /** The Standard Schema properties. */
+  readonly "~standard": StandardSchemaV1.Props<Input, Output>;
+}
+declare namespace StandardSchemaV1 {
+  /** The Standard Schema properties interface. */
+  interface Props<Input = unknown, Output = Input> extends StandardTypedV1.Props<Input, Output> {
+    /** Validates unknown input values. */
+    readonly validate: (value: unknown, options?: StandardSchemaV1.Options | undefined) => Result<Output> | Promise<Result<Output>>;
+  }
+  /** The result interface of the validate function. */
+  type Result<Output> = SuccessResult<Output> | FailureResult;
+  /** The result interface if validation succeeds. */
+  interface SuccessResult<Output> {
+    /** The typed output value. */
+    readonly value: Output;
+    /** A falsy value for `issues` indicates success. */
+    readonly issues?: undefined;
+  }
+  interface Options {
+    /** Explicit support for additional vendor-specific parameters, if needed. */
+    readonly libraryOptions?: Record<string, unknown> | undefined;
+  }
+  /** The result interface if validation fails. */
+  interface FailureResult {
+    /** The issues of failed validation. */
+    readonly issues: ReadonlyArray<Issue>;
+  }
+  /** The issue interface of the failure output. */
+  interface Issue {
+    /** The error message of the issue. */
+    readonly message: string;
+    /** The path of the issue, if any. */
+    readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
+  }
+  /** The path segment interface of the issue. */
+  interface PathSegment {
+    /** The key representing a path segment. */
+    readonly key: PropertyKey;
+  }
+  /** The Standard types interface. */
+  interface Types<Input = unknown, Output = Input> extends StandardTypedV1.Types<Input, Output> {}
+  /** Infers the input type of a Standard. */
+  type InferInput<Schema extends StandardTypedV1> = StandardTypedV1.InferInput<Schema>;
+  /** Infers the output type of a Standard. */
+  type InferOutput<Schema extends StandardTypedV1> = StandardTypedV1.InferOutput<Schema>;
+}
+//#endregion
+export { StandardSchemaV1 as t };
+//# sourceMappingURL=index-CeEtxDmK.d.cts.map

package/dist/index-CeEtxDmK.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-CeEtxDmK.d.cts","names":[],"sources":["../../../node_modules/.pnpm/@standard-schema+spec@1.1.0/node_modules/@standard-schema/spec/dist/index.d.ts"],"x_google_ignoreList":[0],"mappings":";;UACU,gBAAgB,iBAAiB,SAAS;;WAEvC,aAAa,gBAAgB,MAAM,OAAO;;kBAErC;;YAEJ,MAAM,iBAAiB,SAAS;;aAE7B;;aAEA;;aAEA,QAAQ,MAAM,OAAO;;;YAGxB,MAAM,iBAAiB,SAAS;;aAE7B,OAAO;;aAEP,QAAQ;;;OAGhB,WAAW,eAAe,mBAAmB,YAAY;;OAEzD,YAAY,eAAe,mBAAmB,YAAY;;;UAGzD,iBAAiB,iBAAiB,SAAS;;WAExC,aAAa,iBAAiB,MAAM,OAAO;;kBAEtC;;YAEJ,MAAM,iBAAiB,SAAS,eAAe,gBAAgB,MAAM,OAAO;;aAEzE,WAAW,gBAAgB,UAAU,iBAAiB,wBAAwB,OAAO,UAAU,QAAQ,OAAO;;;OAGtH,OAAO,UAAU,cAAc,UAAU;;YAEpC,cAAc;;aAEX,OAAO;;aAEP;;YAEH;;aAEG,iBAAiB;;;YAGpB;;aAEG,QAAQ,cAAc;;;YAGzB;;aAEG;;aAEA,OAAO,cAAc,cAAc;;;YAGtC;;aAEG,KAAK;;;YAGR,MAAM,iBAAiB,SAAS,eAAe,gBAAgB,MAAM,OAAO;;OAGjF,WAAW,eAAe,mBAAmB,gBAAgB,WAAW;;OAExE,YAAY,eAAe,mBAAmB,gBAAgB,YAAY"}

package/dist/index-CeEtxDmK.d.mts

@@ -0,0 +1,79 @@
+//#region ../../node_modules/.pnpm/@standard-schema+spec@1.1.0/node_modules/@standard-schema/spec/dist/index.d.ts
+/** The Standard Typed interface. This is a base type extended by other specs. */
+interface StandardTypedV1<Input = unknown, Output = Input> {
+  /** The Standard properties. */
+  readonly "~standard": StandardTypedV1.Props<Input, Output>;
+}
+declare namespace StandardTypedV1 {
+  /** The Standard Typed properties interface. */
+  interface Props<Input = unknown, Output = Input> {
+    /** The version number of the standard. */
+    readonly version: 1;
+    /** The vendor name of the schema library. */
+    readonly vendor: string;
+    /** Inferred types associated with the schema. */
+    readonly types?: Types<Input, Output> | undefined;
+  }
+  /** The Standard Typed types interface. */
+  interface Types<Input = unknown, Output = Input> {
+    /** The input type of the schema. */
+    readonly input: Input;
+    /** The output type of the schema. */
+    readonly output: Output;
+  }
+  /** Infers the input type of a Standard Typed. */
+  type InferInput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["input"];
+  /** Infers the output type of a Standard Typed. */
+  type InferOutput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["output"];
+}
+/** The Standard Schema interface. */
+interface StandardSchemaV1<Input = unknown, Output = Input> {
+  /** The Standard Schema properties. */
+  readonly "~standard": StandardSchemaV1.Props<Input, Output>;
+}
+declare namespace StandardSchemaV1 {
+  /** The Standard Schema properties interface. */
+  interface Props<Input = unknown, Output = Input> extends StandardTypedV1.Props<Input, Output> {
+    /** Validates unknown input values. */
+    readonly validate: (value: unknown, options?: StandardSchemaV1.Options | undefined) => Result<Output> | Promise<Result<Output>>;
+  }
+  /** The result interface of the validate function. */
+  type Result<Output> = SuccessResult<Output> | FailureResult;
+  /** The result interface if validation succeeds. */
+  interface SuccessResult<Output> {
+    /** The typed output value. */
+    readonly value: Output;
+    /** A falsy value for `issues` indicates success. */
+    readonly issues?: undefined;
+  }
+  interface Options {
+    /** Explicit support for additional vendor-specific parameters, if needed. */
+    readonly libraryOptions?: Record<string, unknown> | undefined;
+  }
+  /** The result interface if validation fails. */
+  interface FailureResult {
+    /** The issues of failed validation. */
+    readonly issues: ReadonlyArray<Issue>;
+  }
+  /** The issue interface of the failure output. */
+  interface Issue {
+    /** The error message of the issue. */
+    readonly message: string;
+    /** The path of the issue, if any. */
+    readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
+  }
+  /** The path segment interface of the issue. */
+  interface PathSegment {
+    /** The key representing a path segment. */
+    readonly key: PropertyKey;
+  }
+  /** The Standard types interface. */
+  interface Types<Input = unknown, Output = Input> extends StandardTypedV1.Types<Input, Output> {}
+  /** Infers the input type of a Standard. */
+  type InferInput<Schema extends StandardTypedV1> = StandardTypedV1.InferInput<Schema>;
+  /** Infers the output type of a Standard. */
+  type InferOutput<Schema extends StandardTypedV1> = StandardTypedV1.InferOutput<Schema>;
+}
+//#endregion
+export { StandardSchemaV1 as t };
+//# sourceMappingURL=index-CeEtxDmK.d.mts.map

package/dist/index-CeEtxDmK.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-CeEtxDmK.d.mts","names":[],"sources":["../../../node_modules/.pnpm/@standard-schema+spec@1.1.0/node_modules/@standard-schema/spec/dist/index.d.ts"],"x_google_ignoreList":[0],"mappings":";;UACU,gBAAgB,iBAAiB,SAAS;;WAEvC,aAAa,gBAAgB,MAAM,OAAO;;kBAErC;;YAEJ,MAAM,iBAAiB,SAAS;;aAE7B;;aAEA;;aAEA,QAAQ,MAAM,OAAO;;;YAGxB,MAAM,iBAAiB,SAAS;;aAE7B,OAAO;;aAEP,QAAQ;;;OAGhB,WAAW,eAAe,mBAAmB,YAAY;;OAEzD,YAAY,eAAe,mBAAmB,YAAY;;;UAGzD,iBAAiB,iBAAiB,SAAS;;WAExC,aAAa,iBAAiB,MAAM,OAAO;;kBAEtC;;YAEJ,MAAM,iBAAiB,SAAS,eAAe,gBAAgB,MAAM,OAAO;;aAEzE,WAAW,gBAAgB,UAAU,iBAAiB,wBAAwB,OAAO,UAAU,QAAQ,OAAO;;;OAGtH,OAAO,UAAU,cAAc,UAAU;;YAEpC,cAAc;;aAEX,OAAO;;aAEP;;YAEH;;aAEG,iBAAiB;;;YAGpB;;aAEG,QAAQ,cAAc;;;YAGzB;;aAEG;;aAEA,OAAO,cAAc,cAAc;;;YAGtC;;aAEG,KAAK;;;YAGR,MAAM,iBAAiB,SAAS,eAAe,gBAAgB,MAAM,OAAO;;OAGjF,WAAW,eAAe,mBAAmB,gBAAgB,WAAW;;OAExE,YAAY,eAAe,mBAAmB,gBAAgB,YAAY"}

package/dist/index.cjs

@@ -1,6 +1,9 @@
-const require_Construct = require('./Construct-CyS3RpTL.cjs');
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_Construct = require("./Construct-DUSXuTHP.cjs");
+const require_shutdown = require("./shutdown-BMJmAhSt.cjs");
 exports.Construct = require_Construct.Construct;
 exports.ConstructType = require_Construct.ConstructType;
+exports.onShutdown = require_shutdown.onShutdown;
+exports.runShutdownHooks = require_shutdown.runShutdownHooks;
 exports.sniffService = require_Construct.sniffService;
-exports.snifferContext = require_Construct.snifferContext;
+exports.snifferContext = require_Construct.snifferContext;

package/dist/index.d.cts

@@ -1,5 +1,28 @@
-import { Construct, ConstructType, sniffService, snifferContext } from "./Construct-C0ijr2qp.cjs";
-import { HttpMethod, LowerHttpMethod, RemoveUndefined } from "./types-BlAkSuGI.cjs";
-import { Telemetry, TelemetryContext, TelemetryRequest, TelemetryResponse } from "./telemetry-C3L0iS28.cjs";
+import { i as snifferContext, n as ConstructType, r as sniffService, t as Construct } from "./Construct-BQALFCh2.cjs";
+import { n as LowerHttpMethod, r as RemoveUndefined, t as HttpMethod } from "./types-DMuSQeLL.cjs";
+import { i as TelemetryResponse, n as TelemetryContext, r as TelemetryRequest, t as Telemetry } from "./lambdaTelemetry-8vnmVZQ5.cjs";
+import { a as Stages, i as SeedContext, n as DeployedStage, o as TestStage, r as LocalStage, t as AnyStage } from "./stages-BSCF19o2.cjs";
 import { Service, ServiceRecord } from "@geekmidas/services";
-export { Construct, ConstructType, HttpMethod, LowerHttpMethod, RemoveUndefined, Service, ServiceRecord, Telemetry, TelemetryContext, TelemetryRequest, TelemetryResponse, sniffService, snifferContext };
+//#region src/shutdown.d.ts
+/**
+ * What a server releases when it stops: the connections constructs opened.
+ *
+ * A construct that holds something open — a database's pool — registers how to
+ * close it here, and the generated server runs every hook once it has stopped
+ * taking requests. Without that, a rolling deploy has the old task and the new
+ * one both holding connections until the old process dies.
+ *
+ * Kept free of any driver import so the server entry can always import it,
+ * whether or not the app has a database.
+ */
+type ShutdownHook = () => Promise<void> | void;
+/** Run `hook` when the server shuts down. Returns a function that removes it. */
+export declare function onShutdown(hook: ShutdownHook): () => void;
+/**
+ * Run every registered hook, together, and wait for them. A hook that fails is
+ * reported to `onError` and does not stop the others.
+ */
+export declare function runShutdownHooks(onError?: (error: unknown) => void): Promise<void>;
+//#endregion
+export { type AnyStage, Construct, ConstructType, type DeployedStage, type HttpMethod, type LocalStage, type LowerHttpMethod, type RemoveUndefined, type SeedContext, type Service, type ServiceRecord, type Stages, type Telemetry, type TelemetryContext, type TelemetryRequest, type TelemetryResponse, type TestStage, sniffService, snifferContext };
+//# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/shutdown.ts"],"mappings":";;;;;;;;;;;;;;;;;KAYK,qBAAqB;;wBAUV,WAAW,MAAM;;;;;wBASX,iBACrB,WAAU,0BACR"}

package/dist/index.d.mts

@@ -1,5 +1,28 @@
-import { Construct, ConstructType, sniffService, snifferContext } from "./Construct-Ct8nalEi.mjs";
-import { HttpMethod, LowerHttpMethod, RemoveUndefined } from "./types-aKksMEWL.mjs";
-import { Telemetry, TelemetryContext, TelemetryRequest, TelemetryResponse } from "./telemetry-D7bVFLGi.mjs";
+import { i as snifferContext, n as ConstructType, r as sniffService, t as Construct } from "./Construct-QXnl3VqT.mjs";
+import { n as LowerHttpMethod, r as RemoveUndefined, t as HttpMethod } from "./types-DMuSQeLL.mjs";
+import { i as TelemetryResponse, n as TelemetryContext, r as TelemetryRequest, t as Telemetry } from "./lambdaTelemetry-8vnmVZQ5.mjs";
+import { a as Stages, i as SeedContext, n as DeployedStage, o as TestStage, r as LocalStage, t as AnyStage } from "./stages-BSCF19o2.mjs";
 import { Service, ServiceRecord } from "@geekmidas/services";
-export { Construct, ConstructType, HttpMethod, LowerHttpMethod, RemoveUndefined, Service, ServiceRecord, Telemetry, TelemetryContext, TelemetryRequest, TelemetryResponse, sniffService, snifferContext };
+//#region src/shutdown.d.ts
+/**
+ * What a server releases when it stops: the connections constructs opened.
+ *
+ * A construct that holds something open — a database's pool — registers how to
+ * close it here, and the generated server runs every hook once it has stopped
+ * taking requests. Without that, a rolling deploy has the old task and the new
+ * one both holding connections until the old process dies.
+ *
+ * Kept free of any driver import so the server entry can always import it,
+ * whether or not the app has a database.
+ */
+type ShutdownHook = () => Promise<void> | void;
+/** Run `hook` when the server shuts down. Returns a function that removes it. */
+export declare function onShutdown(hook: ShutdownHook): () => void;
+/**
+ * Run every registered hook, together, and wait for them. A hook that fails is
+ * reported to `onError` and does not stop the others.
+ */
+export declare function runShutdownHooks(onError?: (error: unknown) => void): Promise<void>;
+//#endregion
+export { type AnyStage, Construct, ConstructType, type DeployedStage, type HttpMethod, type LocalStage, type LowerHttpMethod, type RemoveUndefined, type SeedContext, type Service, type ServiceRecord, type Stages, type Telemetry, type TelemetryContext, type TelemetryRequest, type TelemetryResponse, type TestStage, sniffService, snifferContext };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/shutdown.ts"],"mappings":";;;;;;;;;;;;;;;;;KAYK,qBAAqB;;wBAUV,WAAW,MAAM;;;;;wBASX,iBACrB,WAAU,0BACR"}

package/dist/index.mjs

@@ -1,3 +1,3 @@
-import { Construct, ConstructType, sniffService, snifferContext } from "./Construct-BD5neF7w.mjs";
-
-export { Construct, ConstructType, sniffService, snifferContext };
+import { i as snifferContext, n as ConstructType, r as sniffService, t as Construct } from "./Construct-B1vGBPme.mjs";
+import { n as runShutdownHooks, t as onShutdown } from "./shutdown-C7xa8x9S.mjs";
+export { Construct, ConstructType, onShutdown, runShutdownHooks, sniffService, snifferContext };

package/dist/kms-B-Hm3d5r.cjs

@@ -0,0 +1,85 @@
+const require_cipher = require("./cipher-CVxfwLjk.cjs");
+let _aws_sdk_client_kms = require("@aws-sdk/client-kms");
+//#region src/encryption/kms.ts
+/**
+* The `kms://` cipher: envelope encryption under an AWS KMS key.
+*
+* Each `encrypt` asks KMS for a fresh data key, seals the plaintext with it
+* locally, and stores the data key *as KMS encrypted it* beside the data. The
+* plaintext data key is used once and dropped, and the master key never leaves
+* KMS — every decrypt is a KMS call IAM can refuse and CloudTrail records.
+*
+* Rotation is KMS's: it keeps every backing version of the key, and the
+* encrypted data key names the one that wrapped it, so nothing here tracks a
+* version and `reencrypt` has nothing to move. The ciphertext's key field is
+* `kms` for that reason.
+*
+* The blind index is a KMS HMAC key's `GenerateMac`: deterministic, and the
+* key is as unextractable as the encryption key.
+*
+* In its own module, loaded only when a URL says `kms://`, so a project that
+* never deploys to AWS never needs `@aws-sdk/client-kms` installed.
+*/
+/** The ciphertext's key field: the version lives inside KMS's own blob. */
+const KMS_KEY_ID = "kms";
+function kmsCipher(construct, url) {
+	const parsed = new URL(url);
+	const region = parsed.hostname;
+	const keyId = parsed.searchParams.get("key");
+	const indexKeyId = parsed.searchParams.get("index");
+	if (!region || !keyId || !indexKeyId) throw new require_cipher.EncryptionUrlInvalid(construct, "a kms:// URL names a region, a key and an index key");
+	const endpoint = parsed.searchParams.get("endpoint");
+	const kms = new _aws_sdk_client_kms.KMSClient({
+		region,
+		...endpoint ? { endpoint } : {}
+	});
+	const context = { construct };
+	const aad = require_cipher.associatedData(construct, KMS_KEY_ID);
+	return {
+		async encrypt(plaintext) {
+			const dataKey = await kms.send(new _aws_sdk_client_kms.GenerateDataKeyCommand({
+				KeyId: keyId,
+				KeySpec: "AES_256",
+				EncryptionContext: context
+			}));
+			const wrapped = Buffer.from(dataKey.CiphertextBlob);
+			const sealed = require_cipher.seal(Buffer.from(dataKey.Plaintext), Buffer.from(plaintext, "utf8"), aad);
+			const length = Buffer.alloc(2);
+			length.writeUInt16BE(wrapped.length);
+			return require_cipher.formatCiphertext(KMS_KEY_ID, Buffer.concat([
+				length,
+				wrapped,
+				sealed
+			]));
+		},
+		async decrypt(ciphertext) {
+			const { payload } = require_cipher.parseCiphertext(construct, ciphertext);
+			const length = payload.length >= 2 ? payload.readUInt16BE(0) : 0;
+			const wrapped = payload.subarray(2, 2 + length);
+			if (!length || wrapped.length !== length) throw new require_cipher.CiphertextNotAuthentic(construct);
+			const dataKey = await kms.send(new _aws_sdk_client_kms.DecryptCommand({
+				CiphertextBlob: wrapped,
+				EncryptionContext: context
+			}));
+			const plaintext = require_cipher.open(Buffer.from(dataKey.Plaintext), payload.subarray(2 + length), aad);
+			if (!plaintext) throw new require_cipher.CiphertextNotAuthentic(construct);
+			return plaintext.toString("utf8");
+		},
+		async index(value) {
+			const { Mac } = await kms.send(new _aws_sdk_client_kms.GenerateMacCommand({
+				KeyId: indexKeyId,
+				MacAlgorithm: "HMAC_SHA_256",
+				Message: Buffer.from(value, "utf8")
+			}));
+			return Buffer.from(Mac).toString("base64url");
+		},
+		async reencrypt(ciphertext) {
+			require_cipher.parseCiphertext(construct, ciphertext);
+			return ciphertext;
+		}
+	};
+}
+//#endregion
+exports.kmsCipher = kmsCipher;
+
+//# sourceMappingURL=kms-B-Hm3d5r.cjs.map

package/dist/kms-B-Hm3d5r.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms-B-Hm3d5r.cjs","names":["EncryptionUrlInvalid","KMSClient","associatedData","GenerateDataKeyCommand","seal","formatCiphertext","parseCiphertext","CiphertextNotAuthentic","DecryptCommand","open","GenerateMacCommand"],"sources":["../src/encryption/kms.ts"],"sourcesContent":["/**\n * The `kms://` cipher: envelope encryption under an AWS KMS key.\n *\n * Each `encrypt` asks KMS for a fresh data key, seals the plaintext with it\n * locally, and stores the data key *as KMS encrypted it* beside the data. The\n * plaintext data key is used once and dropped, and the master key never leaves\n * KMS — every decrypt is a KMS call IAM can refuse and CloudTrail records.\n *\n * Rotation is KMS's: it keeps every backing version of the key, and the\n * encrypted data key names the one that wrapped it, so nothing here tracks a\n * version and `reencrypt` has nothing to move. The ciphertext's key field is\n * `kms` for that reason.\n *\n * The blind index is a KMS HMAC key's `GenerateMac`: deterministic, and the\n * key is as unextractable as the encryption key.\n *\n * In its own module, loaded only when a URL says `kms://`, so a project that\n * never deploys to AWS never needs `@aws-sdk/client-kms` installed.\n */\n\nimport {\n\tDecryptCommand,\n\tGenerateDataKeyCommand,\n\tGenerateMacCommand,\n\tKMSClient,\n} from '@aws-sdk/client-kms';\nimport {\n\tassociatedData,\n\ttype Cipher,\n\tCiphertextNotAuthentic,\n\tEncryptionUrlInvalid,\n\tformatCiphertext,\n\topen,\n\tparseCiphertext,\n\tseal,\n} from './cipher';\n\n/** The ciphertext's key field: the version lives inside KMS's own blob. */\nconst KMS_KEY_ID = 'kms';\n\nexport function kmsCipher(construct: string, url: string): Cipher {\n\tconst parsed = new URL(url);\n\tconst region = parsed.hostname;\n\tconst keyId = parsed.searchParams.get('key');\n\tconst indexKeyId = parsed.searchParams.get('index');\n\tif (!region || !keyId || !indexKeyId) {\n\t\tthrow new EncryptionUrlInvalid(\n\t\t\tconstruct,\n\t\t\t'a kms:// URL names a region, a key and an index key',\n\t\t);\n\t}\n\n\tconst endpoint = parsed.searchParams.get('endpoint');\n\t// Credentials are not part of the address: the default chain — a Lambda's\n\t// role deployed, the environment against an emulator.\n\tconst kms = new KMSClient({ region, ...(endpoint ? { endpoint } : {}) });\n\t// What KMS checks on every decrypt, and what CloudTrail shows each call was\n\t// for — a data key minted for one construct will not open for another.\n\tconst context = { construct };\n\tconst aad = associatedData(construct, KMS_KEY_ID);\n\n\treturn {\n\t\tasync encrypt(plaintext) {\n\t\t\tconst dataKey = await kms.send(\n\t\t\t\tnew GenerateDataKeyCommand({\n\t\t\t\t\tKeyId: keyId,\n\t\t\t\t\tKeySpec: 'AES_256',\n\t\t\t\t\tEncryptionContext: context,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tconst wrapped = Buffer.from(dataKey.CiphertextBlob!);\n\t\t\tconst sealed = seal(\n\t\t\t\tBuffer.from(dataKey.Plaintext!),\n\t\t\t\tBuffer.from(plaintext, 'utf8'),\n\t\t\t\taad,\n\t\t\t);\n\n\t\t\tconst length = Buffer.alloc(2);\n\t\t\tlength.writeUInt16BE(wrapped.length);\n\t\t\treturn formatCiphertext(\n\t\t\t\tKMS_KEY_ID,\n\t\t\t\tBuffer.concat([length, wrapped, sealed]),\n\t\t\t);\n\t\t},\n\n\t\tasync decrypt(ciphertext) {\n\t\t\tconst { payload } = parseCiphertext(construct, ciphertext);\n\t\t\tconst length = payload.length >= 2 ? payload.readUInt16BE(0) : 0;\n\t\t\tconst wrapped = payload.subarray(2, 2 + length);\n\t\t\tif (!length || wrapped.length !== length) {\n\t\t\t\tthrow new CiphertextNotAuthentic(construct);\n\t\t\t}\n\n\t\t\tconst dataKey = await kms.send(\n\t\t\t\tnew DecryptCommand({\n\t\t\t\t\tCiphertextBlob: wrapped,\n\t\t\t\t\tEncryptionContext: context,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tconst plaintext = open(\n\t\t\t\tBuffer.from(dataKey.Plaintext!),\n\t\t\t\tpayload.subarray(2 + length),\n\t\t\t\taad,\n\t\t\t);\n\t\t\tif (!plaintext) throw new CiphertextNotAuthentic(construct);\n\n\t\t\treturn plaintext.toString('utf8');\n\t\t},\n\n\t\tasync index(value) {\n\t\t\tconst { Mac } = await kms.send(\n\t\t\t\tnew GenerateMacCommand({\n\t\t\t\t\tKeyId: indexKeyId,\n\t\t\t\t\tMacAlgorithm: 'HMAC_SHA_256',\n\t\t\t\t\tMessage: Buffer.from(value, 'utf8'),\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn Buffer.from(Mac!).toString('base64url');\n\t\t},\n\n\t\t// KMS keeps every version it rotated through, so a value is never under\n\t\t// a key that could be retired from under it.\n\t\tasync reencrypt(ciphertext) {\n\t\t\tparseCiphertext(construct, ciphertext);\n\t\t\treturn ciphertext;\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsCA,MAAM,aAAa;AAEnB,SAAgB,UAAU,WAAmB,KAAqB;CACjE,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,MAAM,SAAS,OAAO;CACtB,MAAM,QAAQ,OAAO,aAAa,IAAI,KAAK;CAC3C,MAAM,aAAa,OAAO,aAAa,IAAI,OAAO;CAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,YACzB,MAAM,IAAIA,eAAAA,qBACT,WACA,qDACD;CAGD,MAAM,WAAW,OAAO,aAAa,IAAI,UAAU;CAGnD,MAAM,MAAM,IAAIC,oBAAAA,UAAU;EAAE;EAAQ,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CAAG,CAAC;CAGvE,MAAM,UAAU,EAAE,UAAU;CAC5B,MAAM,MAAMC,eAAAA,eAAe,WAAW,UAAU;CAEhD,OAAO;EACN,MAAM,QAAQ,WAAW;GACxB,MAAM,UAAU,MAAM,IAAI,KACzB,IAAIC,oBAAAA,uBAAuB;IAC1B,OAAO;IACP,SAAS;IACT,mBAAmB;GACpB,CAAC,CACF;GACA,MAAM,UAAU,OAAO,KAAK,QAAQ,cAAe;GACnD,MAAM,SAASC,eAAAA,KACd,OAAO,KAAK,QAAQ,SAAU,GAC9B,OAAO,KAAK,WAAW,MAAM,GAC7B,GACD;GAEA,MAAM,SAAS,OAAO,MAAM,CAAC;GAC7B,OAAO,cAAc,QAAQ,MAAM;GACnC,OAAOC,eAAAA,iBACN,YACA,OAAO,OAAO;IAAC;IAAQ;IAAS;GAAM,CAAC,CACxC;EACD;EAEA,MAAM,QAAQ,YAAY;GACzB,MAAM,EAAE,YAAYC,eAAAA,gBAAgB,WAAW,UAAU;GACzD,MAAM,SAAS,QAAQ,UAAU,IAAI,QAAQ,aAAa,CAAC,IAAI;GAC/D,MAAM,UAAU,QAAQ,SAAS,GAAG,IAAI,MAAM;GAC9C,IAAI,CAAC,UAAU,QAAQ,WAAW,QACjC,MAAM,IAAIC,eAAAA,uBAAuB,SAAS;GAG3C,MAAM,UAAU,MAAM,IAAI,KACzB,IAAIC,oBAAAA,eAAe;IAClB,gBAAgB;IAChB,mBAAmB;GACpB,CAAC,CACF;GACA,MAAM,YAAYC,eAAAA,KACjB,OAAO,KAAK,QAAQ,SAAU,GAC9B,QAAQ,SAAS,IAAI,MAAM,GAC3B,GACD;GACA,IAAI,CAAC,WAAW,MAAM,IAAIF,eAAAA,uBAAuB,SAAS;GAE1D,OAAO,UAAU,SAAS,MAAM;EACjC;EAEA,MAAM,MAAM,OAAO;GAClB,MAAM,EAAE,QAAQ,MAAM,IAAI,KACzB,IAAIG,oBAAAA,mBAAmB;IACtB,OAAO;IACP,cAAc;IACd,SAAS,OAAO,KAAK,OAAO,MAAM;GACnC,CAAC,CACF;GACA,OAAO,OAAO,KAAK,GAAI,CAAC,CAAC,SAAS,WAAW;EAC9C;EAIA,MAAM,UAAU,YAAY;GAC3B,eAAA,gBAAgB,WAAW,UAAU;GACrC,OAAO;EACR;CACD;AACD"}

package/dist/kms-BdUlMJEZ.mjs

@@ -0,0 +1,85 @@
+import { a as EncryptionUrlInvalid, c as associatedData, l as formatCiphertext, m as parseCiphertext, n as CiphertextNotAuthentic, p as open, v as seal } from "./cipher-C1lEFX63.mjs";
+import { DecryptCommand, GenerateDataKeyCommand, GenerateMacCommand, KMSClient } from "@aws-sdk/client-kms";
+//#region src/encryption/kms.ts
+/**
+* The `kms://` cipher: envelope encryption under an AWS KMS key.
+*
+* Each `encrypt` asks KMS for a fresh data key, seals the plaintext with it
+* locally, and stores the data key *as KMS encrypted it* beside the data. The
+* plaintext data key is used once and dropped, and the master key never leaves
+* KMS — every decrypt is a KMS call IAM can refuse and CloudTrail records.
+*
+* Rotation is KMS's: it keeps every backing version of the key, and the
+* encrypted data key names the one that wrapped it, so nothing here tracks a
+* version and `reencrypt` has nothing to move. The ciphertext's key field is
+* `kms` for that reason.
+*
+* The blind index is a KMS HMAC key's `GenerateMac`: deterministic, and the
+* key is as unextractable as the encryption key.
+*
+* In its own module, loaded only when a URL says `kms://`, so a project that
+* never deploys to AWS never needs `@aws-sdk/client-kms` installed.
+*/
+/** The ciphertext's key field: the version lives inside KMS's own blob. */
+const KMS_KEY_ID = "kms";
+function kmsCipher(construct, url) {
+	const parsed = new URL(url);
+	const region = parsed.hostname;
+	const keyId = parsed.searchParams.get("key");
+	const indexKeyId = parsed.searchParams.get("index");
+	if (!region || !keyId || !indexKeyId) throw new EncryptionUrlInvalid(construct, "a kms:// URL names a region, a key and an index key");
+	const endpoint = parsed.searchParams.get("endpoint");
+	const kms = new KMSClient({
+		region,
+		...endpoint ? { endpoint } : {}
+	});
+	const context = { construct };
+	const aad = associatedData(construct, KMS_KEY_ID);
+	return {
+		async encrypt(plaintext) {
+			const dataKey = await kms.send(new GenerateDataKeyCommand({
+				KeyId: keyId,
+				KeySpec: "AES_256",
+				EncryptionContext: context
+			}));
+			const wrapped = Buffer.from(dataKey.CiphertextBlob);
+			const sealed = seal(Buffer.from(dataKey.Plaintext), Buffer.from(plaintext, "utf8"), aad);
+			const length = Buffer.alloc(2);
+			length.writeUInt16BE(wrapped.length);
+			return formatCiphertext(KMS_KEY_ID, Buffer.concat([
+				length,
+				wrapped,
+				sealed
+			]));
+		},
+		async decrypt(ciphertext) {
+			const { payload } = parseCiphertext(construct, ciphertext);
+			const length = payload.length >= 2 ? payload.readUInt16BE(0) : 0;
+			const wrapped = payload.subarray(2, 2 + length);
+			if (!length || wrapped.length !== length) throw new CiphertextNotAuthentic(construct);
+			const dataKey = await kms.send(new DecryptCommand({
+				CiphertextBlob: wrapped,
+				EncryptionContext: context
+			}));
+			const plaintext = open(Buffer.from(dataKey.Plaintext), payload.subarray(2 + length), aad);
+			if (!plaintext) throw new CiphertextNotAuthentic(construct);
+			return plaintext.toString("utf8");
+		},
+		async index(value) {
+			const { Mac } = await kms.send(new GenerateMacCommand({
+				KeyId: indexKeyId,
+				MacAlgorithm: "HMAC_SHA_256",
+				Message: Buffer.from(value, "utf8")
+			}));
+			return Buffer.from(Mac).toString("base64url");
+		},
+		async reencrypt(ciphertext) {
+			parseCiphertext(construct, ciphertext);
+			return ciphertext;
+		}
+	};
+}
+//#endregion
+export { kmsCipher };
+
+//# sourceMappingURL=kms-BdUlMJEZ.mjs.map

package/dist/kms-BdUlMJEZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms-BdUlMJEZ.mjs","names":[],"sources":["../src/encryption/kms.ts"],"sourcesContent":["/**\n * The `kms://` cipher: envelope encryption under an AWS KMS key.\n *\n * Each `encrypt` asks KMS for a fresh data key, seals the plaintext with it\n * locally, and stores the data key *as KMS encrypted it* beside the data. The\n * plaintext data key is used once and dropped, and the master key never leaves\n * KMS — every decrypt is a KMS call IAM can refuse and CloudTrail records.\n *\n * Rotation is KMS's: it keeps every backing version of the key, and the\n * encrypted data key names the one that wrapped it, so nothing here tracks a\n * version and `reencrypt` has nothing to move. The ciphertext's key field is\n * `kms` for that reason.\n *\n * The blind index is a KMS HMAC key's `GenerateMac`: deterministic, and the\n * key is as unextractable as the encryption key.\n *\n * In its own module, loaded only when a URL says `kms://`, so a project that\n * never deploys to AWS never needs `@aws-sdk/client-kms` installed.\n */\n\nimport {\n\tDecryptCommand,\n\tGenerateDataKeyCommand,\n\tGenerateMacCommand,\n\tKMSClient,\n} from '@aws-sdk/client-kms';\nimport {\n\tassociatedData,\n\ttype Cipher,\n\tCiphertextNotAuthentic,\n\tEncryptionUrlInvalid,\n\tformatCiphertext,\n\topen,\n\tparseCiphertext,\n\tseal,\n} from './cipher';\n\n/** The ciphertext's key field: the version lives inside KMS's own blob. */\nconst KMS_KEY_ID = 'kms';\n\nexport function kmsCipher(construct: string, url: string): Cipher {\n\tconst parsed = new URL(url);\n\tconst region = parsed.hostname;\n\tconst keyId = parsed.searchParams.get('key');\n\tconst indexKeyId = parsed.searchParams.get('index');\n\tif (!region || !keyId || !indexKeyId) {\n\t\tthrow new EncryptionUrlInvalid(\n\t\t\tconstruct,\n\t\t\t'a kms:// URL names a region, a key and an index key',\n\t\t);\n\t}\n\n\tconst endpoint = parsed.searchParams.get('endpoint');\n\t// Credentials are not part of the address: the default chain — a Lambda's\n\t// role deployed, the environment against an emulator.\n\tconst kms = new KMSClient({ region, ...(endpoint ? { endpoint } : {}) });\n\t// What KMS checks on every decrypt, and what CloudTrail shows each call was\n\t// for — a data key minted for one construct will not open for another.\n\tconst context = { construct };\n\tconst aad = associatedData(construct, KMS_KEY_ID);\n\n\treturn {\n\t\tasync encrypt(plaintext) {\n\t\t\tconst dataKey = await kms.send(\n\t\t\t\tnew GenerateDataKeyCommand({\n\t\t\t\t\tKeyId: keyId,\n\t\t\t\t\tKeySpec: 'AES_256',\n\t\t\t\t\tEncryptionContext: context,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tconst wrapped = Buffer.from(dataKey.CiphertextBlob!);\n\t\t\tconst sealed = seal(\n\t\t\t\tBuffer.from(dataKey.Plaintext!),\n\t\t\t\tBuffer.from(plaintext, 'utf8'),\n\t\t\t\taad,\n\t\t\t);\n\n\t\t\tconst length = Buffer.alloc(2);\n\t\t\tlength.writeUInt16BE(wrapped.length);\n\t\t\treturn formatCiphertext(\n\t\t\t\tKMS_KEY_ID,\n\t\t\t\tBuffer.concat([length, wrapped, sealed]),\n\t\t\t);\n\t\t},\n\n\t\tasync decrypt(ciphertext) {\n\t\t\tconst { payload } = parseCiphertext(construct, ciphertext);\n\t\t\tconst length = payload.length >= 2 ? payload.readUInt16BE(0) : 0;\n\t\t\tconst wrapped = payload.subarray(2, 2 + length);\n\t\t\tif (!length || wrapped.length !== length) {\n\t\t\t\tthrow new CiphertextNotAuthentic(construct);\n\t\t\t}\n\n\t\t\tconst dataKey = await kms.send(\n\t\t\t\tnew DecryptCommand({\n\t\t\t\t\tCiphertextBlob: wrapped,\n\t\t\t\t\tEncryptionContext: context,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tconst plaintext = open(\n\t\t\t\tBuffer.from(dataKey.Plaintext!),\n\t\t\t\tpayload.subarray(2 + length),\n\t\t\t\taad,\n\t\t\t);\n\t\t\tif (!plaintext) throw new CiphertextNotAuthentic(construct);\n\n\t\t\treturn plaintext.toString('utf8');\n\t\t},\n\n\t\tasync index(value) {\n\t\t\tconst { Mac } = await kms.send(\n\t\t\t\tnew GenerateMacCommand({\n\t\t\t\t\tKeyId: indexKeyId,\n\t\t\t\t\tMacAlgorithm: 'HMAC_SHA_256',\n\t\t\t\t\tMessage: Buffer.from(value, 'utf8'),\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn Buffer.from(Mac!).toString('base64url');\n\t\t},\n\n\t\t// KMS keeps every version it rotated through, so a value is never under\n\t\t// a key that could be retired from under it.\n\t\tasync reencrypt(ciphertext) {\n\t\t\tparseCiphertext(construct, ciphertext);\n\t\t\treturn ciphertext;\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsCA,MAAM,aAAa;AAEnB,SAAgB,UAAU,WAAmB,KAAqB;CACjE,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,MAAM,SAAS,OAAO;CACtB,MAAM,QAAQ,OAAO,aAAa,IAAI,KAAK;CAC3C,MAAM,aAAa,OAAO,aAAa,IAAI,OAAO;CAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,YACzB,MAAM,IAAI,qBACT,WACA,qDACD;CAGD,MAAM,WAAW,OAAO,aAAa,IAAI,UAAU;CAGnD,MAAM,MAAM,IAAI,UAAU;EAAE;EAAQ,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CAAG,CAAC;CAGvE,MAAM,UAAU,EAAE,UAAU;CAC5B,MAAM,MAAM,eAAe,WAAW,UAAU;CAEhD,OAAO;EACN,MAAM,QAAQ,WAAW;GACxB,MAAM,UAAU,MAAM,IAAI,KACzB,IAAI,uBAAuB;IAC1B,OAAO;IACP,SAAS;IACT,mBAAmB;GACpB,CAAC,CACF;GACA,MAAM,UAAU,OAAO,KAAK,QAAQ,cAAe;GACnD,MAAM,SAAS,KACd,OAAO,KAAK,QAAQ,SAAU,GAC9B,OAAO,KAAK,WAAW,MAAM,GAC7B,GACD;GAEA,MAAM,SAAS,OAAO,MAAM,CAAC;GAC7B,OAAO,cAAc,QAAQ,MAAM;GACnC,OAAO,iBACN,YACA,OAAO,OAAO;IAAC;IAAQ;IAAS;GAAM,CAAC,CACxC;EACD;EAEA,MAAM,QAAQ,YAAY;GACzB,MAAM,EAAE,YAAY,gBAAgB,WAAW,UAAU;GACzD,MAAM,SAAS,QAAQ,UAAU,IAAI,QAAQ,aAAa,CAAC,IAAI;GAC/D,MAAM,UAAU,QAAQ,SAAS,GAAG,IAAI,MAAM;GAC9C,IAAI,CAAC,UAAU,QAAQ,WAAW,QACjC,MAAM,IAAI,uBAAuB,SAAS;GAG3C,MAAM,UAAU,MAAM,IAAI,KACzB,IAAI,eAAe;IAClB,gBAAgB;IAChB,mBAAmB;GACpB,CAAC,CACF;GACA,MAAM,YAAY,KACjB,OAAO,KAAK,QAAQ,SAAU,GAC9B,QAAQ,SAAS,IAAI,MAAM,GAC3B,GACD;GACA,IAAI,CAAC,WAAW,MAAM,IAAI,uBAAuB,SAAS;GAE1D,OAAO,UAAU,SAAS,MAAM;EACjC;EAEA,MAAM,MAAM,OAAO;GAClB,MAAM,EAAE,QAAQ,MAAM,IAAI,KACzB,IAAI,mBAAmB;IACtB,OAAO;IACP,cAAc;IACd,SAAS,OAAO,KAAK,OAAO,MAAM;GACnC,CAAC,CACF;GACA,OAAO,OAAO,KAAK,GAAI,CAAC,CAAC,SAAS,WAAW;EAC9C;EAIA,MAAM,UAAU,YAAY;GAC3B,gBAAgB,WAAW,UAAU;GACrC,OAAO;EACR;CACD;AACD"}