@geekmidas/constructs 9.0.2 → 10.0.0-alpha.1

package/dist/auth.d.mts

@@ -0,0 +1,108 @@
+import { Construct, Consumable } from "./construct-interface-BqwRNYA2.mjs";
+import { AppSpec, ConstructName, Declaration } from "@geekmidas/manifest";
+import { betterAuth } from "better-auth";
+import { Service, ServiceRegisterOptions } from "@geekmidas/services";
+import { Hono } from "hono";
+
+//#region src/auth.d.ts
+
+/** The server better-auth hands back. */
+type AuthServer = ReturnType<typeof betterAuth>;
+/** Everything better-auth takes, minus what the construct owns. */
+type BetterAuthOptions = Omit<Parameters<typeof betterAuth>[0], 'database' | 'secret' | 'basePath' | 'baseURL'>;
+interface BetterAuthConfig<TDatabase extends Consumable> {
+  /**
+   * The schema tenant its tables live in.
+   *
+   * A construct rather than a URL: the tenant already declares its schema and
+   * its role, and taking the declaration is what puts the edge in the graph
+   * instead of a connection string in two places.
+   */
+  database: TDatabase;
+  /**
+   * Where the auth routes are mounted, e.g. `/api/auth`.
+   *
+   * Structural — it is part of the URL every client calls, so it cannot differ
+   * between stages the way the host can.
+   */
+  basePath?: string;
+  /**
+   * The app that serves this auth server — its own container.
+   *
+   * An auth server holds the session secret and reaches the identity tables.
+   * Its own process is the default because sharing one means the surface it
+   * shares with can read both.
+   */
+  app?: AppSpec;
+  /**
+   * The rest of better-auth's options: providers, plugins, email settings.
+   *
+   * A function when they need another construct — a magic-link plugin has to
+   * *send* the link, and the thing that sends mail is a construct whose client
+   * has to be registered. It is handed the same `ServiceRegisterOptions` this
+   * construct was, so the env parser flows through the graph rather than being
+   * imported out of application config.
+   */
+  options?: BetterAuthOptions | ((options: ServiceRegisterOptions) => BetterAuthOptions | Promise<BetterAuthOptions>);
+}
+declare class BetterAuth<TName extends string = string, TDatabase extends Consumable = Consumable> implements Construct<TName, AuthServer> {
+  private readonly config;
+  readonly id: TName;
+  readonly service: Service<Uncapitalize<TName>, AuthServer>;
+  readonly basePath: string;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the keys the
+   * target publishes and the keys the server reads cannot drift.
+   */
+  private readonly keys;
+  constructor(id: ConstructName<TName>, config: BetterAuthConfig<TDatabase>);
+  /**
+   * A signing secret and a surface.
+   *
+   * The database is *not* declared here — the tenant that was passed in
+   * declares it, and declaring it twice is the duplication the whole model
+   * removes. What is declared is what this construct owns: the key it signs
+   * with, and the routes it answers on.
+   *
+   * One endpoint, wildcarded. Better Auth routes internally and the set of
+   * paths depends on which capabilities are enabled, so enumerating them here
+   * would be a copy of its router that goes stale on its next release. The
+   * surface's job is to send everything under `basePath` to one handler, which
+   * is exactly what the declaration says.
+   */
+  declare(): Declaration[];
+  /**
+   * Better Auth's own migrations, for the app's migrate step.
+   *
+   * It brings its own schema — users, sessions, accounts, verifications — so
+   * the app never writes those tables and never gets to drift from them.
+   */
+  migrations(options: ServiceRegisterOptions): Promise<() => Promise<void>>;
+  /**
+   * The server this surface runs as, built from its own declaration.
+   *
+   * A surface is a deploy unit, so something has to serve it, and the thing
+   * that knows how is the construct — not a generator writing a mount into
+   * somebody else's entry point. That is how the auth server came to be
+   * mounted by a hook in the application it was supposed to be separate from,
+   * and then to be served by nothing at all when the hook was deleted.
+   *
+   * The routes come from {@link declare}: one wildcard under `basePath`, read
+   * off the same declaration the manifest carries, so the surface the graph
+   * describes and the surface that answers requests cannot disagree.
+   *
+   * ```ts
+   * // .gkm/server/app.ts — the whole generated entry
+   * import { auth } from '@acme/constructs/auth.js';
+   * export const { app } = await auth.server({ envParser });
+   * ```
+   */
+  server(options: ServiceRegisterOptions): Promise<{
+    app: Hono;
+  }>;
+  private connect;
+}
+//# sourceMappingURL=auth.d.ts.map
+//#endregion
+export { AuthServer, BetterAuth, BetterAuthConfig, BetterAuthOptions };
+//# sourceMappingURL=auth.d.mts.map

package/dist/auth.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.mts","names":[],"sources":["../src/auth.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AA+FgC,KApDpB,UAAA,GAAa,UAoDO,CAAA,OApDW,UAoDX,CAAA;;AACF,KAlDlB,iBAAA,GAAoB,IAkDF,CAjD7B,UAiD6B,CAAA,OAjDX,UAiDW,CAAA,CAAA,CAAA,CAAA,EAAA,UAAA,GAAA,QAAA,GAAA,UAAA,GAAA,SAAA,CAAA;AAEhB,UA/CG,gBA+CH,CAAA,kBA/CsC,UA+CtC,CAAA,CAAA;EAAK;;;;;;;EAkBkC,QAA1B,EAzDhB,SAyDgB;EAAgB;;;;;;EAgHwB,QAAnB,CAAA,EAAA,MAAA;EAAO;AApIjC;;;;;;QAtBf;;;;;;;;;;YAWH,+BAES,2BACJ,oBAAoB,QAAQ;;cAKxB,4DAEM,aAAa,uBACnB,UAAU,OAAO;;eAEhB;oBACK,QAAQ,aAAa,QAAQ;;;;;;;kBAgB1C,cAAc,gBACO,iBAAiB;;;;;;;;;;;;;;;aAuChC;;;;;;;sBAyCD,yBACP,cAAc;;;;;;;;;;;;;;;;;;;;kBA+BK,yBAAyB;SAAe"}

package/dist/auth.mjs

@@ -0,0 +1,164 @@
+import { edgeTo } from "./construct-interface-Z4CpS8tK.mjs";
+import { canonicalId, environmentCase, provideKey, serviceKey } from "@geekmidas/manifest";
+import { betterAuth } from "better-auth";
+
+//#region src/auth.ts
+const DEFAULT_BASE_PATH = "/api/auth";
+var BetterAuth = class {
+	id;
+	service;
+	basePath;
+	/**
+	* Declared once and read by both `declare()` and `connect()`, so the keys the
+	* target publishes and the keys the server reads cannot drift.
+	*/
+	keys;
+	constructor(id, config) {
+		this.config = config;
+		const canonical = canonicalId(id);
+		this.id = canonical;
+		this.basePath = config.basePath ?? DEFAULT_BASE_PATH;
+		const secretId = `${canonical}Secret`;
+		this.keys = {
+			secretId,
+			secret: environmentCase(secretId),
+			url: provideKey(canonical, "url"),
+			trustedOrigins: provideKey(canonical, "trustedOrigins"),
+			cookieDomain: provideKey(canonical, "cookieDomain")
+		};
+		this.service = {
+			serviceName: serviceKey(canonical),
+			register: (options) => this.connect(options)
+		};
+	}
+	/**
+	* A signing secret and a surface.
+	*
+	* The database is *not* declared here — the tenant that was passed in
+	* declares it, and declaring it twice is the duplication the whole model
+	* removes. What is declared is what this construct owns: the key it signs
+	* with, and the routes it answers on.
+	*
+	* One endpoint, wildcarded. Better Auth routes internally and the set of
+	* paths depends on which capabilities are enabled, so enumerating them here
+	* would be a copy of its router that goes stale on its next release. The
+	* surface's job is to send everything under `basePath` to one handler, which
+	* is exactly what the declaration says.
+	*/
+	declare() {
+		return [{
+			kind: "secret",
+			id: this.keys.secretId,
+			provides: [this.keys.secret]
+		}, {
+			kind: "rest-api",
+			id: this.id,
+			...this.config.app ? { app: this.config.app } : {},
+			provides: [
+				this.keys.url,
+				this.keys.trustedOrigins,
+				this.keys.cookieDomain
+			],
+			endpoints: [{
+				id: `${this.id}Handler`,
+				handler: `${this.id}.handler`,
+				method: "ANY",
+				path: `${this.basePath}/*`,
+				dependencies: [edgeTo(this.config.database)],
+				requires: [this.keys.secret]
+			}]
+		}];
+	}
+	/**
+	* Better Auth's own migrations, for the app's migrate step.
+	*
+	* It brings its own schema — users, sessions, accounts, verifications — so
+	* the app never writes those tables and never gets to drift from them.
+	*/
+	async migrations(options) {
+		const auth = await this.connect(options, { owner: true });
+		const { getMigrations } = await import("better-auth/db");
+		const { runMigrations } = await getMigrations(auth.options);
+		return runMigrations;
+	}
+	/**
+	* The server this surface runs as, built from its own declaration.
+	*
+	* A surface is a deploy unit, so something has to serve it, and the thing
+	* that knows how is the construct — not a generator writing a mount into
+	* somebody else's entry point. That is how the auth server came to be
+	* mounted by a hook in the application it was supposed to be separate from,
+	* and then to be served by nothing at all when the hook was deleted.
+	*
+	* The routes come from {@link declare}: one wildcard under `basePath`, read
+	* off the same declaration the manifest carries, so the surface the graph
+	* describes and the surface that answers requests cannot disagree.
+	*
+	* ```ts
+	* // .gkm/server/app.ts — the whole generated entry
+	* import { auth } from '@acme/constructs/auth.js';
+	* export const { app } = await auth.server({ envParser });
+	* ```
+	*/
+	async server(options) {
+		const { Hono } = await import("hono");
+		const { cors } = await import("hono/cors");
+		const app = new Hono();
+		const server = await this.connect(options);
+		const { origins } = options.envParser.create((get) => ({ origins: get(this.keys.trustedOrigins).string().default("").transform((value) => value.split(",").map((origin) => origin.trim()).filter(Boolean)) })).parse();
+		app.use("*", cors({
+			origin: origins,
+			credentials: true,
+			maxAge: 3600
+		}));
+		const [surface] = this.declare().filter((d) => d.kind === "rest-api");
+		for (const endpoint of surface?.endpoints ?? []) {
+			const methods = endpoint.method === "ANY" ? [
+				"GET",
+				"POST",
+				"PUT",
+				"PATCH",
+				"DELETE",
+				"OPTIONS"
+			] : [endpoint.method];
+			app.on([...methods], endpoint.path, (c) => server.handler(c.req.raw));
+		}
+		return { app };
+	}
+	async connect(options, as = {}) {
+		const { secret, baseUrl, trustedOrigins, cookieDomain } = options.envParser.create((get) => ({
+			secret: get(this.keys.secret).string(),
+			baseUrl: get(this.keys.url).string(),
+			trustedOrigins: get(this.keys.trustedOrigins).string().default("").transform((value) => value.split(",").map((origin) => origin.trim()).filter(Boolean)),
+			cookieDomain: get(this.keys.cookieDomain).string().optional()
+		})).parse();
+		const tenant = this.config.database;
+		const source = as.owner && tenant.owner ? tenant.owner : tenant.service;
+		const db = await source.register(options);
+		const configure = this.config.options;
+		const configured = typeof configure === "function" ? await configure(options) : configure ?? {};
+		return betterAuth({
+			...configured,
+			secret,
+			baseURL: baseUrl,
+			basePath: this.basePath,
+			database: {
+				db,
+				type: "postgres"
+			},
+			trustedOrigins: [...trustedOrigins, ...configured.trustedOrigins && Array.isArray(configured.trustedOrigins) ? configured.trustedOrigins : []],
+			advanced: {
+				...configured.advanced,
+				...cookieDomain ? { crossSubDomainCookies: {
+					enabled: true,
+					domain: cookieDomain,
+					...configured.advanced?.crossSubDomainCookies
+				} } : {}
+			}
+		});
+	}
+};
+
+//#endregion
+export { BetterAuth };
+//# sourceMappingURL=auth.mjs.map

package/dist/auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.mjs","names":["id: ConstructName<TName>","config: BetterAuthConfig<TDatabase>","options: ServiceRegisterOptions","value: string","as: { owner?: boolean }","configured: BetterAuthOptions"],"sources":["../src/auth.ts"],"sourcesContent":["/**\n * `BetterAuth` — a declared auth server.\n *\n * It is three things at once, which is what makes it the construct that\n * exercises most of the model: a consumer of a database, a producer of an\n * authorizer, and a set of endpoints. This lands the first two.\n *\n * Its tables live in a schema tenant it is *given* — `orders.schema('AuthDb')`\n * — rather than one it invents. The tenant declares the schema and the role;\n * this declares the one thing left, the signing secret, and reads back the keys\n * it needs.\n *\n * :::caution\n * The isolation that arrangement is *for* — the application's own role holding\n * no grant on these tables, so a compromised handler cannot read sessions — does\n * **not hold yet**. No target creates the per-schema role: both connect as the\n * database owner, so today the tenant is a `search_path`, which is a namespace\n * and not a privilege boundary. See \"Roles are declared and never created\" in\n * `docs/design/constructs-outstanding.md`.\n * :::\n *\n * It declares its own surface, so where it answers, who may call it, and the\n * domain its cookies are scoped to all arrive as environment resolved by the\n * target — none of them guessed from a port, and none of them listed by hand in\n * application config.\n */\n\nimport {\n\ttype AppSpec,\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tenvironmentCase,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport { betterAuth } from 'better-auth';\nimport type { Hono } from 'hono';\nimport type { Kysely } from 'kysely';\nimport { type Construct, type Consumable, edgeTo } from './construct-interface';\n\n/** The server better-auth hands back. */\nexport type AuthServer = ReturnType<typeof betterAuth>;\n\n/** Everything better-auth takes, minus what the construct owns. */\nexport type BetterAuthOptions = Omit<\n\tParameters<typeof betterAuth>[0],\n\t'database' | 'secret' | 'basePath' | 'baseURL'\n>;\n\nexport interface BetterAuthConfig<TDatabase extends Consumable> {\n\t/**\n\t * The schema tenant its tables live in.\n\t *\n\t * A construct rather than a URL: the tenant already declares its schema and\n\t * its role, and taking the declaration is what puts the edge in the graph\n\t * instead of a connection string in two places.\n\t */\n\tdatabase: TDatabase;\n\t/**\n\t * Where the auth routes are mounted, e.g. `/api/auth`.\n\t *\n\t * Structural — it is part of the URL every client calls, so it cannot differ\n\t * between stages the way the host can.\n\t */\n\tbasePath?: string;\n\t/**\n\t * The app that serves this auth server — its own container.\n\t *\n\t * An auth server holds the session secret and reaches the identity tables.\n\t * Its own process is the default because sharing one means the surface it\n\t * shares with can read both.\n\t */\n\tapp?: AppSpec;\n\t/**\n\t * The rest of better-auth's options: providers, plugins, email settings.\n\t *\n\t * A function when they need another construct — a magic-link plugin has to\n\t * *send* the link, and the thing that sends mail is a construct whose client\n\t * has to be registered. It is handed the same `ServiceRegisterOptions` this\n\t * construct was, so the env parser flows through the graph rather than being\n\t * imported out of application config.\n\t */\n\toptions?:\n\t\t| BetterAuthOptions\n\t\t| ((\n\t\t\t\toptions: ServiceRegisterOptions,\n\t\t  ) => BetterAuthOptions | Promise<BetterAuthOptions>);\n}\n\nconst DEFAULT_BASE_PATH = '/api/auth';\n\nexport class BetterAuth<\n\tTName extends string = string,\n\tTDatabase extends Consumable = Consumable,\n> implements Construct<TName, AuthServer>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, AuthServer>;\n\treadonly basePath: string;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the keys the\n\t * target publishes and the keys the server reads cannot drift.\n\t */\n\tprivate readonly keys: {\n\t\tsecretId: string;\n\t\tsecret: string;\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: BetterAuthConfig<TDatabase>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.basePath = config.basePath ?? DEFAULT_BASE_PATH;\n\n\t\t// A secret's name is its key: `Auth` signs with `AUTH_SECRET`, which is\n\t\t// also what better-auth's own tooling looks for.\n\t\tconst secretId = `${canonical}Secret`;\n\t\tthis.keys = {\n\t\t\tsecretId,\n\t\t\tsecret: environmentCase(secretId),\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\t/**\n\t * A signing secret and a surface.\n\t *\n\t * The database is *not* declared here — the tenant that was passed in\n\t * declares it, and declaring it twice is the duplication the whole model\n\t * removes. What is declared is what this construct owns: the key it signs\n\t * with, and the routes it answers on.\n\t *\n\t * One endpoint, wildcarded. Better Auth routes internally and the set of\n\t * paths depends on which capabilities are enabled, so enumerating them here\n\t * would be a copy of its router that goes stale on its next release. The\n\t * surface's job is to send everything under `basePath` to one handler, which\n\t * is exactly what the declaration says.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'secret',\n\t\t\t\tid: this.keys.secretId,\n\t\t\t\tprovides: [this.keys.secret],\n\t\t\t},\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\t...(this.config.app ? { app: this.config.app } : {}),\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t\tendpoints: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: `${this.id}Handler`,\n\t\t\t\t\t\thandler: `${this.id}.handler`,\n\t\t\t\t\t\tmethod: 'ANY',\n\t\t\t\t\t\tpath: `${this.basePath}/*`,\n\t\t\t\t\t\t// Read off the tenant rather than written down: this\n\t\t\t\t\t\t// construct takes whatever database it is given, and a\n\t\t\t\t\t\t// hardcoded kind is a second statement of a fact the\n\t\t\t\t\t\t// tenant already makes.\n\t\t\t\t\t\tdependencies: [edgeTo(this.config.database)],\n\t\t\t\t\t\trequires: [this.keys.secret],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Better Auth's own migrations, for the app's migrate step.\n\t *\n\t * It brings its own schema — users, sessions, accounts, verifications — so\n\t * the app never writes those tables and never gets to drift from them.\n\t */\n\tasync migrations(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<() => Promise<void>> {\n\t\t// As the owner, not the runtime role. Creating tables is DDL, and the\n\t\t// whole point of the split is that a handler's role cannot do it — so a\n\t\t// migrator that connected the way a handler does would fail on the first\n\t\t// `CREATE TABLE` rather than working by accident.\n\t\tconst auth = await this.connect(options, { owner: true });\n\t\tconst { getMigrations } = await import('better-auth/db');\n\t\tconst { runMigrations } = await getMigrations(auth.options);\n\n\t\treturn runMigrations;\n\t}\n\n\t/**\n\t * The server this surface runs as, built from its own declaration.\n\t *\n\t * A surface is a deploy unit, so something has to serve it, and the thing\n\t * that knows how is the construct — not a generator writing a mount into\n\t * somebody else's entry point. That is how the auth server came to be\n\t * mounted by a hook in the application it was supposed to be separate from,\n\t * and then to be served by nothing at all when the hook was deleted.\n\t *\n\t * The routes come from {@link declare}: one wildcard under `basePath`, read\n\t * off the same declaration the manifest carries, so the surface the graph\n\t * describes and the surface that answers requests cannot disagree.\n\t *\n\t * ```ts\n\t * // .gkm/server/app.ts — the whole generated entry\n\t * import { auth } from '@acme/constructs/auth.js';\n\t * export const { app } = await auth.server({ envParser });\n\t * ```\n\t */\n\tasync server(options: ServiceRegisterOptions): Promise<{ app: Hono }> {\n\t\tconst { Hono } = await import('hono');\n\t\tconst { cors } = await import('hono/cors');\n\t\tconst app = new Hono();\n\t\tconst server = await this.connect(options);\n\n\t\t// Who may call this surface, read off the graph. The same list Better\n\t\t// Auth checks for CSRF — it arrives as `<ID>_TRUSTED_ORIGINS`, composed\n\t\t// by the target from whatever declared an edge to this construct, so a\n\t\t// site that depends on the auth server is allowed to reach it and\n\t\t// nothing else is. Nobody writes an origin down.\n\t\tconst { origins } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\torigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value: string) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\tapp.use('*', cors({ origin: origins, credentials: true, maxAge: 3600 }));\n\n\t\t// Read off the declaration rather than restated here. `ANY` is every\n\t\t// method Better Auth routes internally, which is the reason the\n\t\t// declaration wildcards rather than enumerating.\n\t\tconst [surface] = this.declare().filter(\n\t\t\t(d): d is Extract<Declaration, { kind: 'rest-api' }> =>\n\t\t\t\td.kind === 'rest-api',\n\t\t);\n\n\t\tfor (const endpoint of surface?.endpoints ?? []) {\n\t\t\tconst methods =\n\t\t\t\tendpoint.method === 'ANY'\n\t\t\t\t\t? (['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'] as const)\n\t\t\t\t\t: ([endpoint.method] as const);\n\n\t\t\tapp.on([...methods], endpoint.path, (c) => server.handler(c.req.raw));\n\t\t}\n\n\t\treturn { app };\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<AuthServer> {\n\t\tconst { secret, baseUrl, trustedOrigins, cookieDomain } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\tsecret: get(this.keys.secret).string(),\n\t\t\t\t// The surface's own URL, resolved by the target — not guessed from\n\t\t\t\t// a port, which was wrong the moment the server moved to 3001.\n\t\t\t\tbaseUrl: get(this.keys.url).string(),\n\t\t\t\t// Better Auth's CSRF check applies to every caller, not just\n\t\t\t\t// browsers, so an API calling the auth server is rejected unless\n\t\t\t\t// its origin is trusted. The list is derived from the graph and\n\t\t\t\t// arrives as one comma-separated value, for the same reason every\n\t\t\t\t// other derived value arrives as a string: it crosses a process\n\t\t\t\t// boundary as env.\n\t\t\t\ttrustedOrigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t\t// The domain a session cookie has to carry to be readable by a\n\t\t\t\t// frontend on a sibling host. Optional because there is often\n\t\t\t\t// nothing to widen to: locally everything shares `localhost`,\n\t\t\t\t// where cookies ignore the port and a `Domain` would only be a\n\t\t\t\t// value the browser refuses.\n\t\t\t\tcookieDomain: get(this.keys.cookieDomain).string().optional(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\t// The tenant's own client: one construct, one connection, so what auth\n\t\t// writes and what the browser inspects cannot be two different databases.\n\t\t// A migration asks the tenant for its owner connection, which the tenant\n\t\t// exposes as a `Service` and not as anything `.dependsOn()` would take.\n\t\tconst tenant = this.config.database as Consumable & {\n\t\t\towner?: Service<string, unknown>;\n\t\t};\n\t\tconst source = as.owner && tenant.owner ? tenant.owner : tenant.service;\n\n\t\tconst db = (await source.register(options)) as Kysely<\n\t\t\tRecord<string, never>\n\t\t>;\n\n\t\t// Hoisted: narrowing a property of `this` is not preserved across the\n\t\t// await, and the false branch is the plain-object form.\n\t\tconst configure = this.config.options;\n\t\tconst configured: BetterAuthOptions =\n\t\t\ttypeof configure === 'function'\n\t\t\t\t? await configure(options)\n\t\t\t\t: (configure ?? {});\n\n\t\treturn betterAuth({\n\t\t\t...configured,\n\t\t\tsecret,\n\t\t\tbaseURL: baseUrl,\n\t\t\tbasePath: this.basePath,\n\t\t\tdatabase: { db, type: 'postgres' },\n\t\t\t// Whatever the app added wins over the derived list rather than\n\t\t\t// replacing it: an origin nobody declared is still sometimes real.\n\t\t\ttrustedOrigins: [\n\t\t\t\t...trustedOrigins,\n\t\t\t\t...(configured.trustedOrigins &&\n\t\t\t\tArray.isArray(configured.trustedOrigins)\n\t\t\t\t\t? configured.trustedOrigins\n\t\t\t\t\t: []),\n\t\t\t],\n\t\t\tadvanced: {\n\t\t\t\t...configured.advanced,\n\t\t\t\t// Only when a domain was derived. Better Auth reads the presence\n\t\t\t\t// of this block as intent, so enabling it with no domain would\n\t\t\t\t// widen the cookie to whatever host happened to set it — and the\n\t\t\t\t// case with nothing to widen to is the common one, not an error.\n\t\t\t\t...(cookieDomain\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tcrossSubDomainCookies: {\n\t\t\t\t\t\t\t\tenabled: true,\n\t\t\t\t\t\t\t\tdomain: cookieDomain,\n\t\t\t\t\t\t\t\t...configured.advanced?.crossSubDomainCookies,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t});\n\t}\n}\n"],"mappings":";;;;;AA2FA,MAAM,oBAAoB;AAE1B,IAAa,aAAb,MAIA;CACC,AAAS;CACT,AAAS;CACT,AAAS;;;;;CAMT,AAAiB;CAQjB,YACCA,IACiBC,QAChB;EADgB;EAEjB,MAAM,YAAY,YAAY,GAAa;AAE3C,OAAK,KAAK;AACV,OAAK,WAAW,OAAO,YAAY;EAInC,MAAM,YAAY,EAAE,UAAU;AAC9B,OAAK,OAAO;GACX;GACA,QAAQ,gBAAgB,SAAS;GACjC,KAAK,WAAW,WAAW,MAAM;GACjC,gBAAgB,WAAW,WAAW,iBAAiB;GACvD,cAAc,WAAW,WAAW,eAAe;EACnD;AAGD,OAAK,UAAU;GACd,aAAa,WAAW,UAAU;GAClC,UAAU,CAAC,YAAY,KAAK,QAAQ,QAAQ;EAC5C;CACD;;;;;;;;;;;;;;;CAgBD,UAAyB;AACxB,SAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK,KAAK;GACd,UAAU,CAAC,KAAK,KAAK,MAAO;EAC5B,GACD;GACC,MAAM;GACN,IAAI,KAAK;GACT,GAAI,KAAK,OAAO,MAAM,EAAE,KAAK,KAAK,OAAO,IAAK,IAAG,CAAE;GACnD,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACV;GACD,WAAW,CACV;IACC,KAAK,EAAE,KAAK,GAAG;IACf,UAAU,EAAE,KAAK,GAAG;IACpB,QAAQ;IACR,OAAO,EAAE,KAAK,SAAS;IAKvB,cAAc,CAAC,OAAO,KAAK,OAAO,SAAS,AAAC;IAC5C,UAAU,CAAC,KAAK,KAAK,MAAO;GAC5B,CACD;EACD,CACD;CACD;;;;;;;CAQD,MAAM,WACLC,SAC+B;EAK/B,MAAM,OAAO,MAAM,KAAK,QAAQ,SAAS,EAAE,OAAO,KAAM,EAAC;EACzD,MAAM,EAAE,eAAe,GAAG,MAAM,OAAO;EACvC,MAAM,EAAE,eAAe,GAAG,MAAM,cAAc,KAAK,QAAQ;AAE3D,SAAO;CACP;;;;;;;;;;;;;;;;;;;;CAqBD,MAAM,OAAOA,SAAyD;EACrE,MAAM,EAAE,MAAM,GAAG,MAAM,OAAO;EAC9B,MAAM,EAAE,MAAM,GAAG,MAAM,OAAO;EAC9B,MAAM,MAAM,IAAI;EAChB,MAAM,SAAS,MAAM,KAAK,QAAQ,QAAQ;EAO1C,MAAM,EAAE,SAAS,GAAG,QAAQ,UAC1B,OAAO,CAAC,SAAS,EACjB,SAAS,IAAI,KAAK,KAAK,eAAe,CACpC,QAAQ,CACR,QAAQ,GAAG,CACX,UAAU,CAACC,UACX,MACE,MAAM,IAAI,CACV,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAC9B,OAAO,QAAQ,CACjB,CACF,GAAE,CACF,OAAO;AAET,MAAI,IAAI,KAAK,KAAK;GAAE,QAAQ;GAAS,aAAa;GAAM,QAAQ;EAAM,EAAC,CAAC;EAKxE,MAAM,CAAC,QAAQ,GAAG,KAAK,SAAS,CAAC,OAChC,CAAC,MACA,EAAE,SAAS,WACZ;AAED,OAAK,MAAM,YAAY,SAAS,aAAa,CAAE,GAAE;GAChD,MAAM,UACL,SAAS,WAAW,QAChB;IAAC;IAAO;IAAQ;IAAO;IAAS;IAAU;GAAU,IACpD,CAAC,SAAS,MAAO;AAEtB,OAAI,GAAG,CAAC,GAAG,OAAQ,GAAE,SAAS,MAAM,CAAC,MAAM,OAAO,QAAQ,EAAE,IAAI,IAAI,CAAC;EACrE;AAED,SAAO,EAAE,IAAK;CACd;CAED,MAAc,QACbD,SACAE,KAA0B,CAAE,GACN;EACtB,MAAM,EAAE,QAAQ,SAAS,gBAAgB,cAAc,GAAG,QAAQ,UAChE,OAAO,CAAC,SAAS;GACjB,QAAQ,IAAI,KAAK,KAAK,OAAO,CAAC,QAAQ;GAGtC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ;GAOpC,gBAAgB,IAAI,KAAK,KAAK,eAAe,CAC3C,QAAQ,CACR,QAAQ,GAAG,CACX,UAAU,CAAC,UACX,MACE,MAAM,IAAI,CACV,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAC9B,OAAO,QAAQ,CACjB;GAMF,cAAc,IAAI,KAAK,KAAK,aAAa,CAAC,QAAQ,CAAC,UAAU;EAC7D,GAAE,CACF,OAAO;EAMT,MAAM,SAAS,KAAK,OAAO;EAG3B,MAAM,SAAS,GAAG,SAAS,OAAO,QAAQ,OAAO,QAAQ,OAAO;EAEhE,MAAM,KAAM,MAAM,OAAO,SAAS,QAAQ;EAM1C,MAAM,YAAY,KAAK,OAAO;EAC9B,MAAMC,oBACE,cAAc,aAClB,MAAM,UAAU,QAAQ,GACvB,aAAa,CAAE;AAEpB,SAAO,WAAW;GACjB,GAAG;GACH;GACA,SAAS;GACT,UAAU,KAAK;GACf,UAAU;IAAE;IAAI,MAAM;GAAY;GAGlC,gBAAgB,CACf,GAAG,gBACH,GAAI,WAAW,kBACf,MAAM,QAAQ,WAAW,eAAe,GACrC,WAAW,iBACX,CAAE,CACL;GACD,UAAU;IACT,GAAG,WAAW;IAKd,GAAI,eACD,EACA,uBAAuB;KACtB,SAAS;KACT,QAAQ;KACR,GAAG,WAAW,UAAU;IACxB,EACD,IACA,CAAE;GACL;EACD,EAAC;CACF;AACD"}

package/dist/cache-0ANvRQnD.mjs

@@ -0,0 +1,51 @@
+import { canonicalId, provideKey, serviceKey } from "@geekmidas/manifest";
+import { createCacheClient } from "@geekmidas/cache";
+
+//#region src/cache.ts
+var Cache$1 = class {
+	id;
+	service;
+	/**
+	* Declared once and read by both `declare()` and `connect()`, so the key the
+	* target publishes and the key the client reads cannot drift.
+	*/
+	key;
+	constructor(id, options = {}) {
+		this.options = options;
+		const canonical = canonicalId(id);
+		this.id = canonical;
+		this.key = provideKey(canonical, "url");
+		this.service = {
+			serviceName: serviceKey(canonical),
+			register: (options$1) => this.connect(options$1)
+		};
+	}
+	declare() {
+		return [{
+			kind: "cache",
+			id: this.id,
+			...this.options.of ? { of: this.options.of } : {},
+			...this.options.table ? { table: this.options.table } : {},
+			provides: [this.key]
+		}];
+	}
+	/**
+	* Builds the client from the single URL the target supplied.
+	*
+	* Any credential travels in that URL's userinfo rather than in a second key,
+	* for the same reason a Postgres password does: an address and the thing that
+	* opens it are one fact, and splitting them is one more thing to keep in step.
+	*
+	* The scheme selects the driver, so this construct imports no provider and
+	* an app that caches in Postgres never resolves a Redis client. Whoever
+	* assembles the application registers the drivers its target needs.
+	*/
+	async connect({ envParser }) {
+		const { url } = envParser.create((get) => ({ url: get(this.key).string() })).parse();
+		return createCacheClient(url);
+	}
+};
+
+//#endregion
+export { Cache$1 as Cache };
+//# sourceMappingURL=cache-0ANvRQnD.mjs.map

package/dist/cache-0ANvRQnD.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-0ANvRQnD.mjs","names":["Cache","id: ConstructName<TName>","options: CacheOptions","options"],"sources":["../src/cache.ts"],"sourcesContent":["/**\n * `Cache` — a declared key/value cache.\n *\n * The same three-package meeting point as `ObjectStorage` and `Email`: it\n * implements the construct contract, derives its env key through\n * `@geekmidas/manifest`, and hands back a `@geekmidas/cache` client.\n *\n * It names no provider — and unlike `Email`, it cannot name one protocol\n * either. Every mail backend speaks SMTP, so an `smtp://` URL is true of all of\n * them; cache backends genuinely differ, because Upstash speaks HTTP, a Redis\n * speaks its wire protocol, and a table in Postgres speaks SQL. So the scheme in\n * the URL picks the driver, exactly as it does for object storage, and which\n * drivers exist is the generated entry point's decision.\n *\n * The backend is chosen at deploy, not here. An app caching in Postgres and an\n * app caching in Upstash are the same application code.\n */\n\nimport { type Cache as CacheClient, createCacheClient } from '@geekmidas/cache';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport type { Construct } from './construct-interface';\n\nexport interface CacheOptions {\n\t/**\n\t * The database this cache lives in.\n\t *\n\t * Set by `database.cache()` rather than written by hand — the point of the\n\t * method is that the parent's id comes from the parent rather than from a\n\t * string somebody has to keep in step.\n\t */\n\tof?: string;\n\t/** The table entries are kept in. Defaults to `cache`. */\n\ttable?: string;\n}\n\nexport class Cache<TName extends string = string>\n\timplements Construct<TName, CacheClient>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, CacheClient>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * target publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly key: string;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: CacheOptions = {},\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.key = provideKey(canonical, 'url');\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'cache',\n\t\t\t\tid: this.id,\n\t\t\t\t...(this.options.of ? { of: this.options.of } : {}),\n\t\t\t\t...(this.options.table ? { table: this.options.table } : {}),\n\t\t\t\tprovides: [this.key],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Builds the client from the single URL the target supplied.\n\t *\n\t * Any credential travels in that URL's userinfo rather than in a second key,\n\t * for the same reason a Postgres password does: an address and the thing that\n\t * opens it are one fact, and splitting them is one more thing to keep in step.\n\t *\n\t * The scheme selects the driver, so this construct imports no provider and\n\t * an app that caches in Postgres never resolves a Redis client. Whoever\n\t * assembles the application registers the drivers its target needs.\n\t */\n\tprivate async connect({\n\t\tenvParser,\n\t}: ServiceRegisterOptions): Promise<CacheClient> {\n\t\tconst { url } = envParser\n\t\t\t.create((get) => ({ url: get(this.key).string() }))\n\t\t\t.parse();\n\n\t\treturn createCacheClient(url);\n\t}\n}\n"],"mappings":";;;;AA0CA,IAAaA,UAAb,MAEA;CACC,AAAS;CACT,AAAS;;;;;CAMT,AAAiB;CAEjB,YACCC,IACiBC,UAAwB,CAAE,GAC1C;EADgB;EAEjB,MAAM,YAAY,YAAY,GAAa;AAE3C,OAAK,KAAK;AACV,OAAK,MAAM,WAAW,WAAW,MAAM;AAGvC,OAAK,UAAU;GACd,aAAa,WAAW,UAAU;GAClC,UAAU,CAACC,cAAY,KAAK,QAAQA,UAAQ;EAC5C;CACD;CAED,UAAyB;AACxB,SAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,GAAI,KAAK,QAAQ,KAAK,EAAE,IAAI,KAAK,QAAQ,GAAI,IAAG,CAAE;GAClD,GAAI,KAAK,QAAQ,QAAQ,EAAE,OAAO,KAAK,QAAQ,MAAO,IAAG,CAAE;GAC3D,UAAU,CAAC,KAAK,GAAI;EACpB,CACD;CACD;;;;;;;;;;;;CAaD,MAAc,QAAQ,EACrB,WACwB,EAAwB;EAChD,MAAM,EAAE,KAAK,GAAG,UACd,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAE,GAAE,CAClD,OAAO;AAET,SAAO,kBAAkB,IAAI;CAC7B;AACD"}

package/dist/cache-3WSvAulx.cjs

@@ -0,0 +1,57 @@
+const require_chunk = require('./chunk-DWy1uDak.cjs');
+const __geekmidas_manifest = require_chunk.__toESM(require("@geekmidas/manifest"));
+const __geekmidas_cache = require_chunk.__toESM(require("@geekmidas/cache"));
+
+//#region src/cache.ts
+var Cache = class {
+	id;
+	service;
+	/**
+	* Declared once and read by both `declare()` and `connect()`, so the key the
+	* target publishes and the key the client reads cannot drift.
+	*/
+	key;
+	constructor(id, options = {}) {
+		this.options = options;
+		const canonical = (0, __geekmidas_manifest.canonicalId)(id);
+		this.id = canonical;
+		this.key = (0, __geekmidas_manifest.provideKey)(canonical, "url");
+		this.service = {
+			serviceName: (0, __geekmidas_manifest.serviceKey)(canonical),
+			register: (options$1) => this.connect(options$1)
+		};
+	}
+	declare() {
+		return [{
+			kind: "cache",
+			id: this.id,
+			...this.options.of ? { of: this.options.of } : {},
+			...this.options.table ? { table: this.options.table } : {},
+			provides: [this.key]
+		}];
+	}
+	/**
+	* Builds the client from the single URL the target supplied.
+	*
+	* Any credential travels in that URL's userinfo rather than in a second key,
+	* for the same reason a Postgres password does: an address and the thing that
+	* opens it are one fact, and splitting them is one more thing to keep in step.
+	*
+	* The scheme selects the driver, so this construct imports no provider and
+	* an app that caches in Postgres never resolves a Redis client. Whoever
+	* assembles the application registers the drivers its target needs.
+	*/
+	async connect({ envParser }) {
+		const { url } = envParser.create((get) => ({ url: get(this.key).string() })).parse();
+		return (0, __geekmidas_cache.createCacheClient)(url);
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'Cache', {
+  enumerable: true,
+  get: function () {
+    return Cache;
+  }
+});
+//# sourceMappingURL=cache-3WSvAulx.cjs.map

package/dist/cache-3WSvAulx.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-3WSvAulx.cjs","names":["id: ConstructName<TName>","options: CacheOptions","options"],"sources":["../src/cache.ts"],"sourcesContent":["/**\n * `Cache` — a declared key/value cache.\n *\n * The same three-package meeting point as `ObjectStorage` and `Email`: it\n * implements the construct contract, derives its env key through\n * `@geekmidas/manifest`, and hands back a `@geekmidas/cache` client.\n *\n * It names no provider — and unlike `Email`, it cannot name one protocol\n * either. Every mail backend speaks SMTP, so an `smtp://` URL is true of all of\n * them; cache backends genuinely differ, because Upstash speaks HTTP, a Redis\n * speaks its wire protocol, and a table in Postgres speaks SQL. So the scheme in\n * the URL picks the driver, exactly as it does for object storage, and which\n * drivers exist is the generated entry point's decision.\n *\n * The backend is chosen at deploy, not here. An app caching in Postgres and an\n * app caching in Upstash are the same application code.\n */\n\nimport { type Cache as CacheClient, createCacheClient } from '@geekmidas/cache';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport type { Construct } from './construct-interface';\n\nexport interface CacheOptions {\n\t/**\n\t * The database this cache lives in.\n\t *\n\t * Set by `database.cache()` rather than written by hand — the point of the\n\t * method is that the parent's id comes from the parent rather than from a\n\t * string somebody has to keep in step.\n\t */\n\tof?: string;\n\t/** The table entries are kept in. Defaults to `cache`. */\n\ttable?: string;\n}\n\nexport class Cache<TName extends string = string>\n\timplements Construct<TName, CacheClient>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, CacheClient>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * target publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly key: string;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: CacheOptions = {},\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.key = provideKey(canonical, 'url');\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'cache',\n\t\t\t\tid: this.id,\n\t\t\t\t...(this.options.of ? { of: this.options.of } : {}),\n\t\t\t\t...(this.options.table ? { table: this.options.table } : {}),\n\t\t\t\tprovides: [this.key],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Builds the client from the single URL the target supplied.\n\t *\n\t * Any credential travels in that URL's userinfo rather than in a second key,\n\t * for the same reason a Postgres password does: an address and the thing that\n\t * opens it are one fact, and splitting them is one more thing to keep in step.\n\t *\n\t * The scheme selects the driver, so this construct imports no provider and\n\t * an app that caches in Postgres never resolves a Redis client. Whoever\n\t * assembles the application registers the drivers its target needs.\n\t */\n\tprivate async connect({\n\t\tenvParser,\n\t}: ServiceRegisterOptions): Promise<CacheClient> {\n\t\tconst { url } = envParser\n\t\t\t.create((get) => ({ url: get(this.key).string() }))\n\t\t\t.parse();\n\n\t\treturn createCacheClient(url);\n\t}\n}\n"],"mappings":";;;;;AA0CA,IAAa,QAAb,MAEA;CACC,AAAS;CACT,AAAS;;;;;CAMT,AAAiB;CAEjB,YACCA,IACiBC,UAAwB,CAAE,GAC1C;EADgB;EAEjB,MAAM,YAAY,sCAAY,GAAa;AAE3C,OAAK,KAAK;AACV,OAAK,MAAM,qCAAW,WAAW,MAAM;AAGvC,OAAK,UAAU;GACd,aAAa,qCAAW,UAAU;GAClC,UAAU,CAACC,cAAY,KAAK,QAAQA,UAAQ;EAC5C;CACD;CAED,UAAyB;AACxB,SAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,GAAI,KAAK,QAAQ,KAAK,EAAE,IAAI,KAAK,QAAQ,GAAI,IAAG,CAAE;GAClD,GAAI,KAAK,QAAQ,QAAQ,EAAE,OAAO,KAAK,QAAQ,MAAO,IAAG,CAAE;GAC3D,UAAU,CAAC,KAAK,GAAI;EACpB,CACD;CACD;;;;;;;;;;;;CAaD,MAAc,QAAQ,EACrB,WACwB,EAAwB;EAChD,MAAM,EAAE,KAAK,GAAG,UACd,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAE,GAAE,CAClD,OAAO;AAET,SAAO,yCAAkB,IAAI;CAC7B;AACD"}

package/dist/cache-CdQ7OLpR.d.cts

@@ -0,0 +1,47 @@
+import { Construct } from "./construct-interface-D2nNkHUN.cjs";
+import { Service } from "@geekmidas/services";
+import { ConstructName, Declaration } from "@geekmidas/manifest";
+import { Cache } from "@geekmidas/cache";
+
+//#region src/cache.d.ts
+
+interface CacheOptions {
+  /**
+   * The database this cache lives in.
+   *
+   * Set by `database.cache()` rather than written by hand — the point of the
+   * method is that the parent's id comes from the parent rather than from a
+   * string somebody has to keep in step.
+   */
+  of?: string;
+  /** The table entries are kept in. Defaults to `cache`. */
+  table?: string;
+}
+declare class Cache$1<TName extends string = string> implements Construct<TName, Cache> {
+  private readonly options;
+  readonly id: TName;
+  readonly service: Service<Uncapitalize<TName>, Cache>;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the key the
+   * target publishes and the key the client reads cannot drift.
+   */
+  private readonly key;
+  constructor(id: ConstructName<TName>, options?: CacheOptions);
+  declare(): Declaration[];
+  /**
+   * Builds the client from the single URL the target supplied.
+   *
+   * Any credential travels in that URL's userinfo rather than in a second key,
+   * for the same reason a Postgres password does: an address and the thing that
+   * opens it are one fact, and splitting them is one more thing to keep in step.
+   *
+   * The scheme selects the driver, so this construct imports no provider and
+   * an app that caches in Postgres never resolves a Redis client. Whoever
+   * assembles the application registers the drivers its target needs.
+   */
+  private connect;
+}
+//# sourceMappingURL=cache.d.ts.map
+//#endregion
+export { Cache$1 as Cache, CacheOptions };
+//# sourceMappingURL=cache-CdQ7OLpR.d.cts.map

package/dist/cache-CdQ7OLpR.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-CdQ7OLpR.d.cts","names":[],"sources":["../src/cache.ts"],"sourcesContent":[],"mappings":";;;;;;;AA2CqB,UAdJ,YAAA,CAcI;;;;;;;;;;;;cADR,kDACD,UAAU,OAAO;;eAEf;oBACK,QAAQ,aAAa,QAAQ;;;;;;kBAS1C,cAAc,kBACQ;aAchB"}

package/dist/cache-DYoJFcfd.d.mts

@@ -0,0 +1,47 @@
+import { Construct } from "./construct-interface-BqwRNYA2.mjs";
+import { ConstructName, Declaration } from "@geekmidas/manifest";
+import { Cache } from "@geekmidas/cache";
+import { Service } from "@geekmidas/services";
+
+//#region src/cache.d.ts
+
+interface CacheOptions {
+  /**
+   * The database this cache lives in.
+   *
+   * Set by `database.cache()` rather than written by hand — the point of the
+   * method is that the parent's id comes from the parent rather than from a
+   * string somebody has to keep in step.
+   */
+  of?: string;
+  /** The table entries are kept in. Defaults to `cache`. */
+  table?: string;
+}
+declare class Cache$1<TName extends string = string> implements Construct<TName, Cache> {
+  private readonly options;
+  readonly id: TName;
+  readonly service: Service<Uncapitalize<TName>, Cache>;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the key the
+   * target publishes and the key the client reads cannot drift.
+   */
+  private readonly key;
+  constructor(id: ConstructName<TName>, options?: CacheOptions);
+  declare(): Declaration[];
+  /**
+   * Builds the client from the single URL the target supplied.
+   *
+   * Any credential travels in that URL's userinfo rather than in a second key,
+   * for the same reason a Postgres password does: an address and the thing that
+   * opens it are one fact, and splitting them is one more thing to keep in step.
+   *
+   * The scheme selects the driver, so this construct imports no provider and
+   * an app that caches in Postgres never resolves a Redis client. Whoever
+   * assembles the application registers the drivers its target needs.
+   */
+  private connect;
+}
+//# sourceMappingURL=cache.d.ts.map
+//#endregion
+export { Cache$1 as Cache, CacheOptions };
+//# sourceMappingURL=cache-DYoJFcfd.d.mts.map

package/dist/cache-DYoJFcfd.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-DYoJFcfd.d.mts","names":[],"sources":["../src/cache.ts"],"sourcesContent":[],"mappings":";;;;;;;AA2CqB,UAdJ,YAAA,CAcI;;;;;;;;;;;;cADR,kDACD,UAAU,OAAO;;eAEf;oBACK,QAAQ,aAAa,QAAQ;;;;;;kBAS1C,cAAc,kBACQ;aAchB"}

package/dist/cache.cjs

@@ -0,0 +1,3 @@
+const require_cache = require('./cache-3WSvAulx.cjs');
+
+exports.Cache = require_cache.Cache;

package/dist/cache.d.cts

@@ -0,0 +1,3 @@
+import "./construct-interface-D2nNkHUN.cjs";
+import { Cache, CacheOptions } from "./cache-CdQ7OLpR.cjs";
+export { Cache, CacheOptions };

package/dist/cache.d.mts

@@ -0,0 +1,3 @@
+import "./construct-interface-BqwRNYA2.mjs";
+import { Cache, CacheOptions } from "./cache-DYoJFcfd.mjs";
+export { Cache, CacheOptions };

package/dist/cache.mjs

@@ -0,0 +1,3 @@
+import { Cache } from "./cache-0ANvRQnD.mjs";
+
+export { Cache };

package/dist/chunk-DWy1uDak.cjs

@@ -0,0 +1,39 @@
+//#region rolldown:runtime
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function() {
+	return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
+
+Object.defineProperty(exports, '__commonJS', {
+  enumerable: true,
+  get: function () {
+    return __commonJS;
+  }
+});
+Object.defineProperty(exports, '__toESM', {
+  enumerable: true,
+  get: function () {
+    return __toESM;
+  }
+});

package/dist/clone-DblgEZZa.mjs

@@ -0,0 +1,39 @@
+//#region src/clone.ts
+/**
+* Cloning a builder, without enumerating its fields.
+*
+* The builders were mutable singletons that reset themselves by listing every
+* field at the end of `.handle()`. Two things followed from that, and both were
+* real:
+*
+* A configured base could not be reused. `const fn = f.logger(log)` handed back
+* `f` itself, and the first `.handle()` reset `_logger` to the default — so the
+* second handler built from that base silently logged somewhere else. Every
+* field in the reset block behaved the same way, which made
+* `f.logger(l).timeout(60_000)` a base that worked exactly once.
+*
+* And a field left out of the reset list leaked into the next handler instead.
+* `_constructs` was left out, so a function was granted a bucket a *previous*
+* function had declared — an over-grant in the field a deploy reads to size an
+* IAM policy.
+*
+* Both are the same defect: a hand-maintained list of fields that has to be
+* edited every time a field is added, and is silent when it isn't. So this
+* copies whatever the instance actually has, and the list stops existing. The
+* prototype is carried over, so `instanceof` and every method still resolve,
+* and the constructor is deliberately not re-run — this copies state rather
+* than initialising it.
+*
+* Fields must be replaced rather than mutated in place: a clone and its parent
+* share whatever array a field points at, so `_events.push(…)` would be seen by
+* both. Every builder assigns a fresh array instead, which is what makes
+* sharing the reference safe.
+*/
+function cloneWith(instance, delta) {
+	const next = Object.create(Object.getPrototypeOf(instance));
+	return Object.assign(next, instance, delta);
+}
+
+//#endregion
+export { cloneWith };
+//# sourceMappingURL=clone-DblgEZZa.mjs.map