@geekmidas/envkit 10.0.0-alpha.10 → 10.0.0-alpha.100

package/dist/sst.cjs

@@ -1,32 +1,35 @@
-const require_EnvironmentBuilder = require('./EnvironmentBuilder-15SdFJdK.cjs');
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_EnvironmentBuilder = require("./EnvironmentBuilder-wJH3EBbJ.cjs");
 //#region src/SstEnvironmentBuilder.ts
 /**
 * Enumeration of supported SST (Serverless Stack Toolkit) resource types.
 * Used to identify and process different AWS and SST resources.
 */
-let ResourceType = /* @__PURE__ */ function(ResourceType$1) {
-	ResourceType$1["ApiGatewayV2"] = "sst.aws.ApiGatewayV2";
-	ResourceType$1["Postgres"] = "sst.aws.Postgres";
-	ResourceType$1["Function"] = "sst.aws.Function";
-	ResourceType$1["ObjectStorage"] = "sst.aws.Bucket";
-	ResourceType$1["Vpc"] = "sst.aws.Vpc";
-	ResourceType$1["Secret"] = "sst.sst.Secret";
-	ResourceType$1["Dynamo"] = "sst.aws.Dynamo";
-	ResourceType$1["Queue"] = "sst.aws.Queue";
-	ResourceType$1["SSTSecret"] = "sst:sst:Secret";
-	ResourceType$1["SSTFunction"] = "sst:sst:Function";
-	ResourceType$1["SSTApiGatewayV2"] = "sst:aws:ApiGatewayV2";
-	ResourceType$1["SSTPostgres"] = "sst:aws:Postgres";
-	ResourceType$1["SSTObjectStorage"] = "sst:aws:Bucket";
-	ResourceType$1["SnsTopic"] = "sst:aws:SnsTopic";
-	ResourceType$1["SSTDynamo"] = "sst:aws:Dynamo";
-	ResourceType$1["SSTQueue"] = "sst:aws:Queue";
-	ResourceType$1["FileServer"] = "sst:aws:Router";
-	ResourceType$1["StaticSite"] = "sst:aws:StaticSite";
-	ResourceType$1["Email"] = "gkm:aws:Email";
-	ResourceType$1["Cache"] = "gkm:aws:Cache";
-	return ResourceType$1;
+let ResourceType = /* @__PURE__ */ function(ResourceType) {
+	ResourceType["ApiGatewayV2"] = "sst.aws.ApiGatewayV2";
+	ResourceType["Postgres"] = "sst.aws.Postgres";
+	ResourceType["Function"] = "sst.aws.Function";
+	ResourceType["ObjectStorage"] = "sst.aws.Bucket";
+	ResourceType["Vpc"] = "sst.aws.Vpc";
+	ResourceType["Secret"] = "sst.sst.Secret";
+	ResourceType["Dynamo"] = "sst.aws.Dynamo";
+	ResourceType["Queue"] = "sst.aws.Queue";
+	ResourceType["SSTSecret"] = "sst:sst:Secret";
+	ResourceType["SSTFunction"] = "sst:sst:Function";
+	ResourceType["SSTApiGatewayV2"] = "sst:aws:ApiGatewayV2";
+	ResourceType["SSTPostgres"] = "sst:aws:Postgres";
+	ResourceType["SSTObjectStorage"] = "sst:aws:Bucket";
+	ResourceType["SnsTopic"] = "sst:aws:SnsTopic";
+	ResourceType["SSTDynamo"] = "sst:aws:Dynamo";
+	ResourceType["SSTQueue"] = "sst:aws:Queue";
+	ResourceType["FileServer"] = "sst:aws:Router";
+	ResourceType["StaticSite"] = "sst:aws:StaticSite";
+	ResourceType["Email"] = "gkm:aws:Email";
+	ResourceType["Cache"] = "gkm:aws:Cache";
+	ResourceType["ExternalApi"] = "gkm:aws:ExternalApi";
+	ResourceType["Credential"] = "gkm:aws:Credential";
+	ResourceType["Encryption"] = "gkm:aws:Encryption";
+	return ResourceType;
 }({});
 const secretResolver = (name, value) => ({ [name]: value.value });
 const postgresResolver = (key, value) => ({
@@ -51,27 +54,36 @@ const queueResolver = (name, value) => ({
 	[`${name}PublisherConnectionString`]: `sqs://?queueUrl=${encodeURIComponent(value.url)}`
 });
 const dynamoResolver = (name, value) => ({ [`${name}Name`]: value.name });
+const externalApiResolver = (name, value) => ({
+	[`${name}Url`]: value.url,
+	[`${name}Credentials`]: value.credentials
+});
+const credentialResolver = (name, value) => ({ [`${name}Credentials`]: value.credentials });
+const encryptionResolver = (name, value) => ({ [`${name}Url`]: value.url });
 const noopResolver = () => ({});
 /**
 * Pre-configured resolvers for all SST resource types.
 */
 const sstResolvers = {
-	[ResourceType.ApiGatewayV2]: noopResolver,
-	[ResourceType.Function]: noopResolver,
-	[ResourceType.Vpc]: noopResolver,
-	[ResourceType.Secret]: secretResolver,
-	[ResourceType.Postgres]: postgresResolver,
-	[ResourceType.ObjectStorage]: bucketResolver,
-	[ResourceType.Dynamo]: dynamoResolver,
-	[ResourceType.Queue]: queueResolver,
-	[ResourceType.SSTSecret]: secretResolver,
-	[ResourceType.SSTObjectStorage]: bucketResolver,
-	[ResourceType.SSTFunction]: noopResolver,
-	[ResourceType.SSTPostgres]: postgresResolver,
-	[ResourceType.SSTApiGatewayV2]: noopResolver,
-	[ResourceType.SnsTopic]: topicResolver,
-	[ResourceType.SSTDynamo]: dynamoResolver,
-	[ResourceType.SSTQueue]: queueResolver
+	["sst.aws.ApiGatewayV2"]: noopResolver,
+	["sst.aws.Function"]: noopResolver,
+	["sst.aws.Vpc"]: noopResolver,
+	["sst.sst.Secret"]: secretResolver,
+	["sst.aws.Postgres"]: postgresResolver,
+	["sst.aws.Bucket"]: bucketResolver,
+	["sst.aws.Dynamo"]: dynamoResolver,
+	["sst.aws.Queue"]: queueResolver,
+	["sst:sst:Secret"]: secretResolver,
+	["sst:aws:Bucket"]: bucketResolver,
+	["sst:sst:Function"]: noopResolver,
+	["sst:aws:Postgres"]: postgresResolver,
+	["sst:aws:ApiGatewayV2"]: noopResolver,
+	["sst:aws:SnsTopic"]: topicResolver,
+	["sst:aws:Dynamo"]: dynamoResolver,
+	["sst:aws:Queue"]: queueResolver,
+	["gkm:aws:ExternalApi"]: externalApiResolver,
+	["gkm:aws:Credential"]: credentialResolver,
+	["gkm:aws:Encryption"]: encryptionResolver
 };
 /**
 * SST-specific environment builder with built-in resolvers for all known
@@ -127,7 +139,6 @@ var SstEnvironmentBuilder = class {
 		return this.builder.build();
 	}
 };
-
 //#endregion
 //#region src/SstEnvValidator.ts
 /**
@@ -215,9 +226,7 @@ function similarity(a, b) {
 	const editSim = 1 - levenshtein(a, b) / Math.max(a.length, b.length, 1);
 	const ta = new Set(a.split("_").filter(Boolean));
 	const tb = new Set(b.split("_").filter(Boolean));
-	const shared = [...ta].filter((t) => tb.has(t)).length;
-	const union = new Set([...ta, ...tb]).size || 1;
-	const tokenSim = shared / union;
+	const tokenSim = [...ta].filter((t) => tb.has(t)).length / ((/* @__PURE__ */ new Set([...ta, ...tb])).size || 1);
 	return Math.max(editSim, tokenSim * 1.15);
 }
 /**
@@ -261,11 +270,7 @@ var EnvValidationError = class EnvValidationError extends Error {
 		});
 		let provided;
 		if (linkVars.length === 0) provided = "(no links provide environment variables)";
-		else {
-			const shown = linkVars.slice(0, MAX_LISTED_VARS).join(", ");
-			const extra = linkVars.length > MAX_LISTED_VARS ? ` ...(+${linkVars.length - MAX_LISTED_VARS})` : "";
-			provided = `Provided by links: ${shown}${extra}`;
-		}
+		else provided = `Provided by links: ${linkVars.slice(0, MAX_LISTED_VARS).join(", ")}${linkVars.length > MAX_LISTED_VARS ? ` ...(+${linkVars.length - MAX_LISTED_VARS})` : ""}`;
 		return `${who} is missing required env vars:\n${lines.join("\n")}\n\n${provided}`;
 	}
 };
@@ -385,7 +390,6 @@ var EnvValidator = class {
 		return this.availableSet.has(envVar);
 	}
 };
-
 //#endregion
 //#region src/sst.ts
 /**
@@ -407,7 +411,6 @@ var EnvValidator = class {
 function normalizeResourceEnv(record) {
 	return new SstEnvironmentBuilder(record).build();
 }
-
 //#endregion
 exports.AWS_RUNTIME_ENV_VARS = AWS_RUNTIME_ENV_VARS;
 exports.CLOUDFLARE_RUNTIME_ENV_VARS = CLOUDFLARE_RUNTIME_ENV_VARS;
@@ -422,4 +425,5 @@ exports.normalizeResourceEnv = normalizeResourceEnv;
 exports.platformEnvVars = platformEnvVars;
 exports.resolveEnvKeys = resolveEnvKeys;
 exports.sstResolvers = sstResolvers;
+
 //# sourceMappingURL=sst.cjs.map

package/dist/sst.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"sst.cjs","names":["name: string","value: SecretValue","key: string","value: PostgresValue","value: BucketValue","value: SnsTopicValue","value: QueueValue","value: DynamoValue","sstResolvers: Resolvers","record: TRecord","additionalResolvers?: CustomResolvers<TRecord>","options?: EnvironmentBuilderOptions","mergedResolvers: Resolvers","EnvironmentBuilder","platform: Platform","a: string","b: string","curr: number[]","missing: string","available: readonly string[]","args: {\n\t\tmissing: string[];\n\t\tavailable: string[];\n\t\tlinkVars: string[];\n\t\tsuggestions: Record<string, string[]>;\n\t\tcontext?: string;\n\t}","args: {\n\t\tmissing: string[];\n\t\tlinkVars: string[];\n\t\tsuggestions: Record<string, string[]>;\n\t\tcontext?: string;\n\t}","provided: string","record: LinkRecord","typeOnly: Record<string, InputValue>","EnvironmentBuilder","links: LinkRecord","options: EnvValidatorOptions","requestedEnvVars: readonly string[]","providers: string[]","suggestions: Record<string, string[]>","envVar: string","record: Record<string, SstResource | string>"],"sources":["../src/SstEnvironmentBuilder.ts","../src/SstEnvValidator.ts","../src/sst.ts"],"sourcesContent":["import {\n\tEnvironmentBuilder,\n\ttype EnvironmentBuilderOptions,\n\ttype EnvironmentResolver,\n\ttype EnvRecord,\n\ttype InputValue,\n\ttype Resolvers,\n} from './EnvironmentBuilder';\n\n/**\n * Enumeration of supported SST (Serverless Stack Toolkit) resource types.\n * Used to identify and process different AWS and SST resources.\n */\nexport enum ResourceType {\n\t// Legacy format (dot notation)\n\tApiGatewayV2 = 'sst.aws.ApiGatewayV2',\n\tPostgres = 'sst.aws.Postgres',\n\tFunction = 'sst.aws.Function',\n\tObjectStorage = 'sst.aws.Bucket',\n\tVpc = 'sst.aws.Vpc',\n\tSecret = 'sst.sst.Secret',\n\tDynamo = 'sst.aws.Dynamo',\n\tQueue = 'sst.aws.Queue',\n\n\t// Modern format (colon notation)\n\tSSTSecret = 'sst:sst:Secret',\n\tSSTFunction = 'sst:sst:Function',\n\tSSTApiGatewayV2 = 'sst:aws:ApiGatewayV2',\n\tSSTPostgres = 'sst:aws:Postgres',\n\tSSTObjectStorage = 'sst:aws:Bucket',\n\tSnsTopic = 'sst:aws:SnsTopic',\n\tSSTDynamo = 'sst:aws:Dynamo',\n\tSSTQueue = 'sst:aws:Queue',\n\t// A distribution, twice over: a file server and a static site are the same\n\t// infrastructure with different contents behind it, and they are separate\n\t// entries because what they provide is read under different ids, not\n\t// because SST builds them differently.\n\tFileServer = 'sst:aws:Router',\n\tStaticSite = 'sst:aws:StaticSite',\n\t// Neither is an SST component: mail is an IAM chain and a composed URL, and\n\t// a cache is whatever the selected backend turned out to be.\n\tEmail = 'gkm:aws:Email',\n\tCache = 'gkm:aws:Cache',\n}\n\n/**\n * AWS API Gateway V2 resource type.\n * Represents an HTTP/WebSocket API.\n */\nexport type ApiGatewayV2 = {\n\ttype: ResourceType.ApiGatewayV2 | ResourceType.SSTApiGatewayV2;\n\turl: string;\n};\n\n/**\n * PostgreSQL database resource type.\n * Contains all connection details needed to connect to the database.\n */\nexport type Postgres = {\n\ttype: ResourceType.Postgres | ResourceType.SSTPostgres;\n\tdatabase: string;\n\thost: string;\n\tpassword: string;\n\tport: number;\n\tusername: string;\n};\n\n/**\n * AWS Lambda Function resource type.\n */\nexport type Function = {\n\ttype: ResourceType.Function | ResourceType.SSTFunction;\n\tname: string;\n};\n\n/**\n * AWS S3 Bucket resource type.\n */\nexport type Bucket = {\n\ttype: ResourceType.ObjectStorage | ResourceType.SSTObjectStorage;\n\tname: string;\n\t/**\n\t * Supplied by `@geekmidas/cloud`'s ObjectStorage, which widens SST's link to\n\t * carry them — a bucket may not be in the reader's region, and the URL is\n\t * composed where the resource's shape is known.\n\t */\n\tregion?: string;\n\turl?: string;\n};\n\n/**\n * AWS VPC (Virtual Private Cloud) resource type.\n */\nexport type Vpc = {\n\ttype: ResourceType.Vpc;\n\tbastion: string;\n};\n\n/**\n * Secret resource type for storing sensitive values.\n */\nexport type Secret = {\n\ttype: ResourceType.Secret | ResourceType.SSTSecret;\n\tvalue: string;\n};\n\n/**\n * AWS SNS Topic resource type.\n */\nexport type SnsTopic = {\n\ttype: ResourceType.SnsTopic;\n\tarn: string;\n};\n\n/**\n * AWS SQS Queue resource type.\n */\nexport type Queue = {\n\ttype: ResourceType.Queue | ResourceType.SSTQueue;\n\turl: string;\n\tarn: string;\n};\n\n/**\n * AWS DynamoDB Table resource type.\n */\nexport type Dynamo = {\n\ttype: ResourceType.Dynamo | ResourceType.SSTDynamo;\n\tname: string;\n};\n\n/**\n * Union type of all supported SST resource types.\n */\nexport type SstResource =\n\t| ApiGatewayV2\n\t| Postgres\n\t| Function\n\t| Bucket\n\t| Vpc\n\t| Secret\n\t| SnsTopic\n\t| Queue\n\t| Dynamo;\n\n// Value types without the `type` key (for resolver parameters)\ntype SecretValue = Omit<Secret, 'type'>;\ntype PostgresValue = Omit<Postgres, 'type'>;\ntype BucketValue = Omit<Bucket, 'type'>;\ntype SnsTopicValue = Omit<SnsTopic, 'type'>;\ntype QueueValue = Omit<Queue, 'type'>;\ntype DynamoValue = Omit<Dynamo, 'type'>;\n\n/**\n * Function type for processing a specific resource type into environment variables.\n *\n * @template K - The specific resource type (without `type` key)\n * @param name - The resource name\n * @param value - The resource value (without `type` key)\n * @returns Object mapping environment variable names to values\n */\nexport type ResourceProcessor<K> = (name: string, value: K) => EnvRecord;\n\n// SST Resource Resolvers (receive values without `type` key)\n\nconst secretResolver = (name: string, value: SecretValue) => ({\n\t[name]: value.value,\n});\n\nconst postgresResolver = (key: string, value: PostgresValue) => ({\n\t[`${key}Name`]: value.database,\n\t[`${key}Host`]: value.host,\n\t[`${key}Password`]: value.password,\n\t[`${key}Port`]: value.port,\n\t[`${key}Username`]: value.username,\n\t[`${key}Url`]: `postgresql://${encodeURIComponent(value.username)}:${encodeURIComponent(value.password)}@${value.host}:${value.port}/${value.database}`,\n});\n\nconst bucketResolver = (name: string, value: BucketValue) => ({\n\t[`${name}Name`]: value.name,\n\t// The single URL a construct reads. Composed by the component, which knows\n\t// its own shape; this only renames it into env case. Always emitted, even\n\t// when absent, so `resolveEnvKeys` can derive the key from the link's type\n\t// alone — a bucket linked without our component yields an empty one.\n\t[`${name}Url`]: value.url ?? '',\n});\n\nconst topicResolver = (name: string, value: SnsTopicValue) => ({\n\t[`${name}Arn`]: value.arn,\n\t// A publisher connection string for `@geekmidas/events` (SNS); region is\n\t// resolved from the ARN / AWS_REGION at runtime.\n\t[`${name}PublisherConnectionString`]: `sns://?topicArn=${encodeURIComponent(value.arn)}`,\n});\n\nconst queueResolver = (name: string, value: QueueValue) => ({\n\t[`${name}Url`]: value.url,\n\t[`${name}Arn`]: value.arn,\n\t// A publisher connection string for `@geekmidas/events` (SQS); region is\n\t// resolved from the URL / AWS_REGION at runtime.\n\t[`${name}PublisherConnectionString`]: `sqs://?queueUrl=${encodeURIComponent(value.url)}`,\n});\n\nconst dynamoResolver = (name: string, value: DynamoValue) => ({\n\t[`${name}Name`]: value.name,\n});\n\nconst noopResolver = () => ({});\n\n/**\n * Pre-configured resolvers for all SST resource types.\n */\nexport const sstResolvers: Resolvers = {\n\t// Legacy format\n\t[ResourceType.ApiGatewayV2]: noopResolver,\n\t[ResourceType.Function]: noopResolver,\n\t[ResourceType.Vpc]: noopResolver,\n\t[ResourceType.Secret]: secretResolver,\n\t[ResourceType.Postgres]: postgresResolver,\n\t[ResourceType.ObjectStorage]: bucketResolver,\n\t[ResourceType.Dynamo]: dynamoResolver,\n\t[ResourceType.Queue]: queueResolver,\n\n\t// Modern format\n\t[ResourceType.SSTSecret]: secretResolver,\n\t[ResourceType.SSTObjectStorage]: bucketResolver,\n\t[ResourceType.SSTFunction]: noopResolver,\n\t[ResourceType.SSTPostgres]: postgresResolver,\n\t[ResourceType.SSTApiGatewayV2]: noopResolver,\n\t[ResourceType.SnsTopic]: topicResolver,\n\t[ResourceType.SSTDynamo]: dynamoResolver,\n\t[ResourceType.SSTQueue]: queueResolver,\n};\n\n/**\n * All known SST resource type strings.\n */\ntype SstResourceTypeString = `${ResourceType}`;\n\n/**\n * Extracts the `type` string value from an input value.\n */\ntype ExtractType<T> = T extends { type: infer U extends string } ? U : never;\n\n/**\n * Removes the `type` key from an object type.\n */\ntype OmitType<T> = T extends { type: string } ? Omit<T, 'type'> : never;\n\n/**\n * Extracts all unique `type` values from a record (excluding plain strings).\n */\ntype AllTypeValues<TRecord extends Record<string, InputValue>> = {\n\t[K in keyof TRecord]: ExtractType<TRecord[K]>;\n}[keyof TRecord];\n\n/**\n * Extracts only the custom (non-SST) type values from a record.\n */\ntype CustomTypeValues<TRecord extends Record<string, InputValue>> = Exclude<\n\tAllTypeValues<TRecord>,\n\tSstResourceTypeString\n>;\n\n/**\n * For a given type value, finds the corresponding value type (without `type` key).\n */\ntype ValueForType<\n\tTRecord extends Record<string, InputValue>,\n\tTType extends string,\n> = {\n\t[K in keyof TRecord]: TRecord[K] extends { type: TType }\n\t\t? OmitType<TRecord[K]>\n\t\t: never;\n}[keyof TRecord];\n\n/**\n * Generates typed resolvers for custom (non-SST) types in the input record.\n */\ntype CustomResolvers<TRecord extends Record<string, InputValue>> =\n\tCustomTypeValues<TRecord> extends never\n\t\t? Resolvers | undefined\n\t\t: {\n\t\t\t\t[TType in CustomTypeValues<TRecord>]: EnvironmentResolver<\n\t\t\t\t\tValueForType<TRecord, TType>\n\t\t\t\t>;\n\t\t\t};\n\n/**\n * SST-specific environment builder with built-in resolvers for all known\n * SST resource types.\n *\n * Wraps the generic EnvironmentBuilder with pre-configured SST resolvers.\n *\n * @template TRecord - The input record type for type inference\n *\n * @example\n * ```typescript\n * const env = new SstEnvironmentBuilder({\n *   database: { type: 'sst:aws:Postgres', host: '...', ... },\n *   apiKey: { type: 'sst:sst:Secret', value: 'secret' },\n *   appName: 'my-app',\n * }).build();\n *\n * // With custom resolvers (typed based on input)\n * const env = new SstEnvironmentBuilder(\n *   {\n *     database: postgresResource,\n *     custom: { type: 'my-custom' as const, data: 'foo' },\n *   },\n *   {\n *     // TypeScript requires 'my-custom' resolver with typed value\n *     'my-custom': (key, value) => ({ [`${key}Data`]: value.data }),\n *   }\n * ).build();\n * ```\n */\nexport class SstEnvironmentBuilder<\n\tTRecord extends Record<string, SstResource | InputValue | string>,\n> {\n\tprivate readonly builder: EnvironmentBuilder<\n\t\tRecord<string, InputValue>,\n\t\tResolvers\n\t>;\n\n\t/**\n\t * Create a new SST environment builder.\n\t *\n\t * @param record - Object containing SST resources, custom resources, and/or string values\n\t * @param additionalResolvers - Optional custom resolvers (typed based on custom types in record)\n\t * @param options - Optional configuration options\n\t */\n\tconstructor(\n\t\trecord: TRecord,\n\t\tadditionalResolvers?: CustomResolvers<TRecord>,\n\t\toptions?: EnvironmentBuilderOptions,\n\t) {\n\t\t// Merge resolvers with custom ones taking precedence\n\t\tconst mergedResolvers: Resolvers = additionalResolvers\n\t\t\t? { ...sstResolvers, ...additionalResolvers }\n\t\t\t: sstResolvers;\n\n\t\tthis.builder = new EnvironmentBuilder(\n\t\t\trecord as Record<string, InputValue>,\n\t\t\tmergedResolvers,\n\t\t\toptions,\n\t\t);\n\t}\n\n\t/**\n\t * Build environment variables from the input record.\n\t *\n\t * @returns A record of environment variables\n\t */\n\tbuild(): EnvRecord {\n\t\treturn this.builder.build();\n\t}\n}\n\nexport type {\n\tEnvironmentBuilderOptions,\n\tEnvRecord,\n\tEnvValue,\n} from './EnvironmentBuilder';\n// Re-export useful types\nexport { environmentCase } from './EnvironmentBuilder';\n","import { EnvironmentBuilder, type InputValue } from './EnvironmentBuilder';\nimport { type SstResource, sstResolvers } from './SstEnvironmentBuilder';\n\n/**\n * Variables AWS Lambda injects into the runtime. Always valid on AWS, but never\n * assumed — opt in via `platform: 'aws'` or by spreading {@link AWS_RUNTIME_ENV_VARS}\n * into `whitelist`.\n */\nexport const AWS_RUNTIME_ENV_VARS = [\n\t'AWS_REGION',\n\t'AWS_DEFAULT_REGION',\n\t'AWS_ENDPOINT_URL',\n\t'AWS_ENDPOINT',\n\t'AWS_ACCESS_KEY_ID',\n\t'AWS_SECRET_ACCESS_KEY',\n\t'AWS_SESSION_TOKEN',\n\t'AWS_LAMBDA_FUNCTION_NAME',\n\t'AWS_LAMBDA_FUNCTION_VERSION',\n] as const;\n\n/**\n * Variables GCP injects into Cloud Functions / Cloud Run.\n */\nexport const GCP_RUNTIME_ENV_VARS = [\n\t'GOOGLE_CLOUD_PROJECT',\n\t'GCP_PROJECT',\n\t'FUNCTION_TARGET',\n\t'FUNCTION_SIGNATURE_TYPE',\n\t'K_SERVICE',\n\t'K_REVISION',\n\t'K_CONFIGURATION',\n\t'PORT',\n] as const;\n\n/**\n * Variables Cloudflare exposes to Workers. Workers inject almost nothing into\n * the global env, so this is intentionally minimal.\n */\nexport const CLOUDFLARE_RUNTIME_ENV_VARS = [\n\t'CF_PAGES',\n\t'CF_PAGES_URL',\n] as const;\n\n/**\n * Registry of platform → always-valid runtime variables. Export, don't assume:\n * a caller states the platform it deploys to and the matching set is trusted.\n */\nexport const PLATFORM_ENV_VARS = {\n\taws: AWS_RUNTIME_ENV_VARS,\n\tgcp: GCP_RUNTIME_ENV_VARS,\n\tcloudflare: CLOUDFLARE_RUNTIME_ENV_VARS,\n} as const;\n\nexport type Platform = keyof typeof PLATFORM_ENV_VARS;\n\n/**\n * The always-valid runtime variables for a platform. The \"whitelist construct\":\n * resolve a platform to its set, to spread into `whitelist` or compare against.\n */\nexport function platformEnvVars(platform: Platform): readonly string[] {\n\treturn PLATFORM_ENV_VARS[platform];\n}\n\n/** How many link-provided vars to list in an error before truncating. */\nconst MAX_LISTED_VARS = 8;\n\n/** Minimum similarity for a variable to be offered as a \"did you mean\". */\nconst SUGGESTION_THRESHOLD = 0.3;\n\n/**\n * Input shape for the validator: the same record `SstEnvironmentBuilder`\n * accepts — keyed by resource name, valued by an SST resource (or a plain\n * string for pass-through env vars).\n */\nexport type LinkRecord = Record<string, SstResource | InputValue | string>;\n\nexport interface ValidationResult {\n\tvalid: boolean;\n\t/** Requested variables that are not available (excluding optional `?` vars). */\n\tinvalidVars: string[];\n\t/** Every variable the links + whitelist make available. */\n\tavailableVars: string[];\n\t/** Nearest available matches for each invalid variable (best first). */\n\tsuggestions: Record<string, string[]>;\n}\n\nexport interface EnvValidatorOptions {\n\t/**\n\t * Platform whose runtime-injected variables are always valid. Omit to assume\n\t * none — the validator never bakes in a platform's variables.\n\t */\n\tplatform?: Platform;\n\t/**\n\t * Extra always-valid variables in addition to the platform set — typically\n\t * the keys of a function's explicit `environment`.\n\t */\n\twhitelist?: readonly string[];\n\t/**\n\t * Label for the deployable unit (e.g. a function name), used in error\n\t * messages so a failure points at exactly one unit.\n\t */\n\tcontext?: string;\n}\n\n/**\n * Levenshtein edit distance between two strings.\n */\nfunction levenshtein(a: string, b: string): number {\n\tconst m = a.length;\n\tconst n = b.length;\n\tif (m === 0) return n;\n\tif (n === 0) return m;\n\n\tlet prev = Array.from({ length: n + 1 }, (_, i) => i);\n\n\tfor (let i = 1; i <= m; i++) {\n\t\tconst curr: number[] = [i];\n\t\tfor (let j = 1; j <= n; j++) {\n\t\t\tconst cost = a[i - 1] === b[j - 1] ? 0 : 1;\n\t\t\tconst del = (prev[j] ?? 0) + 1;\n\t\t\tconst ins = (curr[j - 1] ?? 0) + 1;\n\t\t\tconst sub = (prev[j - 1] ?? 0) + cost;\n\t\t\tcurr[j] = Math.min(del, ins, sub);\n\t\t}\n\t\tprev = curr;\n\t}\n\n\treturn prev[n] ?? 0;\n}\n\n/**\n * Similarity in `[0, 1]` combining edit distance with `_`-token overlap, so both\n * near-typos (a missing underscore) and renames (`DATABASE_URL` ~ `DB_URL`,\n * which share the `URL` token) are caught.\n */\nfunction similarity(a: string, b: string): number {\n\tconst editSim = 1 - levenshtein(a, b) / Math.max(a.length, b.length, 1);\n\n\tconst ta = new Set(a.split('_').filter(Boolean));\n\tconst tb = new Set(b.split('_').filter(Boolean));\n\tconst shared = [...ta].filter((t) => tb.has(t)).length;\n\tconst union = new Set([...ta, ...tb]).size || 1;\n\tconst tokenSim = shared / union;\n\n\t// Nudge token-overlap matches ahead of coincidental edit-distance ones, so a\n\t// rename like DATABASE_URL prefers DB_URL (shares `URL`) over DB_PASSWORD.\n\treturn Math.max(editSim, tokenSim * 1.15);\n}\n\n/**\n * Returns the nearest available variables to `missing`, best first, limited to\n * those above {@link SUGGESTION_THRESHOLD}.\n */\nfunction suggestionsFor(\n\tmissing: string,\n\tavailable: readonly string[],\n\tmax = 1,\n): string[] {\n\treturn available\n\t\t.map((candidate) => ({ candidate, score: similarity(missing, candidate) }))\n\t\t.filter((s) => s.score >= SUGGESTION_THRESHOLD)\n\t\t.sort((a, b) => b.score - a.score)\n\t\t.slice(0, max)\n\t\t.map((s) => s.candidate);\n}\n\n/**\n * Thrown when a deployable unit requires environment variables its links do not\n * provide. Carries the structured `missing`/`available`/`suggestions` so callers\n * can inspect the failure programmatically, not just read the message.\n */\nexport class EnvValidationError extends Error {\n\treadonly isEnvValidationError = true;\n\treadonly missing: string[];\n\treadonly available: string[];\n\treadonly suggestions: Record<string, string[]>;\n\treadonly context?: string;\n\n\tconstructor(args: {\n\t\tmissing: string[];\n\t\tavailable: string[];\n\t\tlinkVars: string[];\n\t\tsuggestions: Record<string, string[]>;\n\t\tcontext?: string;\n\t}) {\n\t\tsuper(EnvValidationError.format(args));\n\t\tthis.name = 'EnvValidationError';\n\t\tthis.missing = args.missing;\n\t\tthis.available = args.available;\n\t\tthis.suggestions = args.suggestions;\n\t\tthis.context = args.context;\n\t\t// V8-only; keeps the constructor out of the stack trace.\n\t\t(\n\t\t\tError as unknown as {\n\t\t\t\tcaptureStackTrace?(target: object, ctor?: unknown): void;\n\t\t\t}\n\t\t).captureStackTrace?.(this, EnvValidationError);\n\t}\n\n\tprivate static format(args: {\n\t\tmissing: string[];\n\t\tlinkVars: string[];\n\t\tsuggestions: Record<string, string[]>;\n\t\tcontext?: string;\n\t}): string {\n\t\tconst { missing, linkVars, suggestions, context } = args;\n\t\tconst who = context ? `'${context}'` : 'a deployable unit';\n\n\t\tconst width = Math.max(...missing.map((v) => v.length));\n\t\tconst lines = missing.map((v) => {\n\t\t\tconst hints = suggestions[v] ?? [];\n\t\t\tconst hint = hints.length ? `(did you mean ${hints.join(' or ')}?)` : '';\n\t\t\treturn `  - ${v.padEnd(width)}  ${hint}`.trimEnd();\n\t\t});\n\n\t\tlet provided: string;\n\t\tif (linkVars.length === 0) {\n\t\t\tprovided = '(no links provide environment variables)';\n\t\t} else {\n\t\t\tconst shown = linkVars.slice(0, MAX_LISTED_VARS).join(', ');\n\t\t\tconst extra =\n\t\t\t\tlinkVars.length > MAX_LISTED_VARS\n\t\t\t\t\t? ` ...(+${linkVars.length - MAX_LISTED_VARS})`\n\t\t\t\t\t: '';\n\t\t\tprovided = `Provided by links: ${shown}${extra}`;\n\t\t}\n\n\t\treturn `${who} is missing required env vars:\\n${lines.join('\\n')}\\n\\n${provided}`;\n\t}\n}\n\n/**\n * Derives the set of environment-variable **keys** a group of linked resources\n * will produce at runtime — without resolving any value.\n *\n * This reuses the runtime resolvers (`sstResolvers`) via {@link EnvironmentBuilder},\n * so the keys computed here are exactly the keys a deployed function receives:\n * the validator and the runtime resolution share a single source of truth and\n * cannot drift. Because every resolver's output keys depend only on the record\n * key and the resource `type` (never the value), each resource is reduced to\n * `{ type }` before building, so no SST `Output` is ever read.\n *\n * @example\n * resolveEnvKeys({ db: { type: ResourceType.Postgres } });\n * // ['DB_NAME', 'DB_HOST', 'DB_PASSWORD', 'DB_PORT', 'DB_USERNAME', 'DB_URL']\n */\nexport function resolveEnvKeys(record: LinkRecord): string[] {\n\tconst typeOnly: Record<string, InputValue> = {};\n\tfor (const [key, value] of Object.entries(record)) {\n\t\ttypeOnly[key] = typeof value === 'string' ? '' : { type: value.type };\n\t}\n\treturn Object.keys(new EnvironmentBuilder(typeOnly, sstResolvers).build());\n}\n\n/**\n * Validates that the environment variables a deployable unit requires are\n * actually provided by its linked resources — at infra time, before deploy.\n *\n * Available variables are the union of the keys derived from `links`\n * ({@link resolveEnvKeys}), the chosen platform's runtime variables (only when\n * `options.platform` is set — nothing is assumed), and any `options.whitelist`\n * (e.g. the keys of a function's explicit `environment`). A requested variable\n * suffixed with `?` is treated as optional and never causes a failure.\n *\n * @example\n * const validator = new EnvValidator(\n *   { db: { type: ResourceType.Postgres } },\n *   { platform: 'aws', whitelist: ['APP_NAME'], context: 'orders-fn' },\n * );\n * validator.assert(['DB_HOST', 'AWS_REGION', 'APP_NAME', 'SENTRY_DSN?']); // ok\n * validator.assert(['DATABASE_URL']); // throws EnvValidationError (did you mean DB_URL?)\n */\nexport class EnvValidator {\n\t/** Every variable available — link-derived, platform, and extra whitelist. */\n\treadonly availableVars: string[];\n\t/** Just the variables the links provide (used for error context). */\n\treadonly linkVars: string[];\n\treadonly context?: string;\n\tprivate readonly availableSet: Set<string>;\n\t/** Per-link (record key → its env-var keys), for least-privilege filtering. */\n\tprivate readonly linkVarsByName: Map<string, string[]>;\n\n\tconstructor(links: LinkRecord, options: EnvValidatorOptions = {}) {\n\t\tconst { platform, whitelist = [], context } = options;\n\t\tthis.context = context;\n\t\tthis.linkVarsByName = new Map(\n\t\t\tObject.entries(links).map(([name, value]) => [\n\t\t\t\tname,\n\t\t\t\tresolveEnvKeys({ [name]: value }),\n\t\t\t]),\n\t\t);\n\t\tthis.linkVars = [...this.linkVarsByName.values()].flat();\n\t\tthis.availableVars = [\n\t\t\t...this.linkVars,\n\t\t\t...(platform ? PLATFORM_ENV_VARS[platform] : []),\n\t\t\t...whitelist,\n\t\t];\n\t\tthis.availableSet = new Set(this.availableVars);\n\t}\n\n\t/**\n\t * Returns the names of the links that provide at least one of the requested\n\t * variables — so a construct can attach only the links a unit actually needs\n\t * (least privilege) rather than the whole pool. Trailing `?` is ignored.\n\t */\n\tgetProvidersForEnvVars(requestedEnvVars: readonly string[]): string[] {\n\t\tconst requested = new Set(\n\t\t\trequestedEnvVars.map((v) => (v.endsWith('?') ? v.slice(0, -1) : v)),\n\t\t);\n\t\tconst providers: string[] = [];\n\t\tfor (const [name, vars] of this.linkVarsByName) {\n\t\t\tif (vars.some((v) => requested.has(v))) providers.push(name);\n\t\t}\n\t\treturn providers;\n\t}\n\n\t/**\n\t * Checks every requested variable against the available set. Variables\n\t * ending in `?` are optional and never reported as invalid. Invalid\n\t * variables come back with their nearest available matches.\n\t */\n\tvalidate(requestedEnvVars: readonly string[]): ValidationResult {\n\t\tconst invalidVars = requestedEnvVars.filter((envVar) => {\n\t\t\tif (envVar.endsWith('?')) return false;\n\t\t\treturn !this.availableSet.has(envVar);\n\t\t});\n\n\t\tconst suggestions: Record<string, string[]> = {};\n\t\tfor (const envVar of invalidVars) {\n\t\t\tconst matches = suggestionsFor(envVar, this.availableVars);\n\t\t\tif (matches.length) suggestions[envVar] = matches;\n\t\t}\n\n\t\treturn {\n\t\t\tvalid: invalidVars.length === 0,\n\t\t\tinvalidVars,\n\t\t\tavailableVars: this.availableVars,\n\t\t\tsuggestions,\n\t\t};\n\t}\n\n\t/**\n\t * Asserts that every requested variable is available, throwing an\n\t * {@link EnvValidationError} otherwise. Intended to run in a construct's\n\t * constructor so a misconfigured `sst.config.ts` fails at synth time, before\n\t * any AWS call.\n\t */\n\tassert(requestedEnvVars: readonly string[]): void {\n\t\tconst { valid, invalidVars, suggestions } = this.validate(requestedEnvVars);\n\n\t\tif (!valid) {\n\t\t\tthrow new EnvValidationError({\n\t\t\t\tmissing: invalidVars,\n\t\t\t\tavailable: this.availableVars,\n\t\t\t\tlinkVars: this.linkVars,\n\t\t\t\tsuggestions,\n\t\t\t\tcontext: this.context,\n\t\t\t});\n\t\t}\n\t}\n\n\t/**\n\t * Whether a single variable is available. Does not treat a trailing `?` as\n\t * optional — pass the bare name.\n\t */\n\thas(envVar: string): boolean {\n\t\treturn this.availableSet.has(envVar);\n\t}\n}\n","// Re-export everything from SstEnvironmentBuilder\n\n// Re-export types from EnvironmentBuilder\nexport type {\n\tEnvironmentBuilderOptions,\n\tEnvRecord,\n\tEnvValue,\n} from './EnvironmentBuilder';\n\n// Re-export environmentCase from EnvironmentBuilder\nexport { environmentCase } from './EnvironmentBuilder';\nexport {\n\ttype ApiGatewayV2,\n\ttype Bucket,\n\ttype Dynamo,\n\ttype Function,\n\ttype Postgres,\n\ttype Queue,\n\ttype ResourceProcessor,\n\tResourceType,\n\ttype Secret,\n\ttype SnsTopic,\n\tSstEnvironmentBuilder,\n\ttype SstResource,\n\tsstResolvers,\n\ttype Vpc,\n} from './SstEnvironmentBuilder';\n\nexport {\n\tAWS_RUNTIME_ENV_VARS,\n\tCLOUDFLARE_RUNTIME_ENV_VARS,\n\tEnvValidationError,\n\tEnvValidator,\n\ttype EnvValidatorOptions,\n\tGCP_RUNTIME_ENV_VARS,\n\ttype LinkRecord,\n\tPLATFORM_ENV_VARS,\n\ttype Platform,\n\tplatformEnvVars,\n\tresolveEnvKeys,\n\ttype ValidationResult,\n} from './SstEnvValidator';\n\n// Import for deprecated function\nimport {\n\tSstEnvironmentBuilder,\n\ttype SstResource,\n} from './SstEnvironmentBuilder';\n\n/**\n * @deprecated Use `new SstEnvironmentBuilder(record).build()` instead.\n *\n * Normalizes SST resources and plain strings into environment variables.\n * Processes resources based on their type and converts names to environment case.\n *\n * @param record - Object containing resources and/or string values\n * @returns Normalized environment variables object\n *\n * @example\n * // Old usage (deprecated):\n * normalizeResourceEnv({ database: postgresResource })\n *\n * // New usage:\n * new SstEnvironmentBuilder({ database: postgresResource }).build()\n */\nexport function normalizeResourceEnv(\n\trecord: Record<string, SstResource | string>,\n): Record<string, string | number | boolean | Record<string, unknown>> {\n\treturn new SstEnvironmentBuilder(record).build();\n}\n\n// Keep Resource type as deprecated alias for backwards compatibility\n/**\n * @deprecated Use `SstResource` instead.\n */\nexport type Resource = SstResource;\n"],"mappings":";;;;;;;AAaA,IAAY,wDAAL;AAEN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAKA;AACA;AAGA;AACA;;AACA;AA0HD,MAAM,iBAAiB,CAACA,MAAcC,WAAwB,GAC5D,OAAO,MAAM,MACd;AAED,MAAM,mBAAmB,CAACC,KAAaC,WAA0B;GAC9D,EAAE,IAAI,QAAQ,MAAM;GACpB,EAAE,IAAI,QAAQ,MAAM;GACpB,EAAE,IAAI,YAAY,MAAM;GACxB,EAAE,IAAI,QAAQ,MAAM;GACpB,EAAE,IAAI,YAAY,MAAM;GACxB,EAAE,IAAI,QAAQ,eAAe,mBAAmB,MAAM,SAAS,CAAC,GAAG,mBAAmB,MAAM,SAAS,CAAC,GAAG,MAAM,KAAK,GAAG,MAAM,KAAK,GAAG,MAAM,SAAS;AACtJ;AAED,MAAM,iBAAiB,CAACH,MAAcI,WAAwB;GAC3D,EAAE,KAAK,QAAQ,MAAM;GAKrB,EAAE,KAAK,OAAO,MAAM,OAAO;AAC7B;AAED,MAAM,gBAAgB,CAACJ,MAAcK,WAA0B;GAC5D,EAAE,KAAK,OAAO,MAAM;GAGpB,EAAE,KAAK,8BAA8B,kBAAkB,mBAAmB,MAAM,IAAI,CAAC;AACvF;AAED,MAAM,gBAAgB,CAACL,MAAcM,WAAuB;GACzD,EAAE,KAAK,OAAO,MAAM;GACpB,EAAE,KAAK,OAAO,MAAM;GAGpB,EAAE,KAAK,8BAA8B,kBAAkB,mBAAmB,MAAM,IAAI,CAAC;AACvF;AAED,MAAM,iBAAiB,CAACN,MAAcO,WAAwB,IAC3D,EAAE,KAAK,QAAQ,MAAM,KACvB;AAED,MAAM,eAAe,OAAO,CAAE;;;;AAK9B,MAAaC,eAA0B;EAErC,aAAa,eAAe;EAC5B,aAAa,WAAW;EACxB,aAAa,MAAM;EACnB,aAAa,SAAS;EACtB,aAAa,WAAW;EACxB,aAAa,gBAAgB;EAC7B,aAAa,SAAS;EACtB,aAAa,QAAQ;EAGrB,aAAa,YAAY;EACzB,aAAa,mBAAmB;EAChC,aAAa,cAAc;EAC3B,aAAa,cAAc;EAC3B,aAAa,kBAAkB;EAC/B,aAAa,WAAW;EACxB,aAAa,YAAY;EACzB,aAAa,WAAW;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqFD,IAAa,wBAAb,MAEE;CACD,AAAiB;;;;;;;;CAYjB,YACCC,QACAC,qBACAC,SACC;EAED,MAAMC,kBAA6B,sBAChC;GAAE,GAAG;GAAc,GAAG;EAAqB,IAC3C;AAEH,OAAK,UAAU,IAAIC,8CAClB,QACA,iBACA;CAED;;;;;;CAOD,QAAmB;AAClB,SAAO,KAAK,QAAQ,OAAO;CAC3B;AACD;;;;;;;;;AC5VD,MAAa,uBAAuB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACA;;;;AAKD,MAAa,uBAAuB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACA;;;;;AAMD,MAAa,8BAA8B,CAC1C,YACA,cACA;;;;;AAMD,MAAa,oBAAoB;CAChC,KAAK;CACL,KAAK;CACL,YAAY;AACZ;;;;;AAQD,SAAgB,gBAAgBC,UAAuC;AACtE,QAAO,kBAAkB;AACzB;;AAGD,MAAM,kBAAkB;;AAGxB,MAAM,uBAAuB;;;;AAwC7B,SAAS,YAAYC,GAAWC,GAAmB;CAClD,MAAM,IAAI,EAAE;CACZ,MAAM,IAAI,EAAE;AACZ,KAAI,MAAM,EAAG,QAAO;AACpB,KAAI,MAAM,EAAG,QAAO;CAEpB,IAAI,OAAO,MAAM,KAAK,EAAE,QAAQ,IAAI,EAAG,GAAE,CAAC,GAAG,MAAM,EAAE;AAErD,MAAK,IAAI,IAAI,GAAG,KAAK,GAAG,KAAK;EAC5B,MAAMC,OAAiB,CAAC,CAAE;AAC1B,OAAK,IAAI,IAAI,GAAG,KAAK,GAAG,KAAK;GAC5B,MAAM,OAAO,EAAE,IAAI,OAAO,EAAE,IAAI,KAAK,IAAI;GACzC,MAAM,OAAO,KAAK,MAAM,KAAK;GAC7B,MAAM,OAAO,KAAK,IAAI,MAAM,KAAK;GACjC,MAAM,OAAO,KAAK,IAAI,MAAM,KAAK;AACjC,QAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;EACjC;AACD,SAAO;CACP;AAED,QAAO,KAAK,MAAM;AAClB;;;;;;AAOD,SAAS,WAAWF,GAAWC,GAAmB;CACjD,MAAM,UAAU,IAAI,YAAY,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE;CAEvE,MAAM,KAAK,IAAI,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,QAAQ;CAC/C,MAAM,KAAK,IAAI,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,QAAQ;CAC/C,MAAM,SAAS,CAAC,GAAG,EAAG,EAAC,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;CAChD,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,EAAG,GAAE,QAAQ;CAC9C,MAAM,WAAW,SAAS;AAI1B,QAAO,KAAK,IAAI,SAAS,WAAW,KAAK;AACzC;;;;;AAMD,SAAS,eACRE,SACAC,WACA,MAAM,GACK;AACX,QAAO,UACL,IAAI,CAAC,eAAe;EAAE;EAAW,OAAO,WAAW,SAAS,UAAU;CAAE,GAAE,CAC1E,OAAO,CAAC,MAAM,EAAE,SAAS,qBAAqB,CAC9C,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CACjC,MAAM,GAAG,IAAI,CACb,IAAI,CAAC,MAAM,EAAE,UAAU;AACzB;;;;;;AAOD,IAAa,qBAAb,MAAa,2BAA2B,MAAM;CAC7C,AAAS,uBAAuB;CAChC,AAAS;CACT,AAAS;CACT,AAAS;CACT,AAAS;CAET,YAAYC,MAMT;AACF,QAAM,mBAAmB,OAAO,KAAK,CAAC;AACtC,OAAK,OAAO;AACZ,OAAK,UAAU,KAAK;AACpB,OAAK,YAAY,KAAK;AACtB,OAAK,cAAc,KAAK;AACxB,OAAK,UAAU,KAAK;AAEpB,EACC,MAGC,oBAAoB,MAAM,mBAAmB;CAC/C;CAED,OAAe,OAAOC,MAKX;EACV,MAAM,EAAE,SAAS,UAAU,aAAa,SAAS,GAAG;EACpD,MAAM,MAAM,WAAW,GAAG,QAAQ,KAAK;EAEvC,MAAM,QAAQ,KAAK,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;EACvD,MAAM,QAAQ,QAAQ,IAAI,CAAC,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM,CAAE;GAClC,MAAM,OAAO,MAAM,UAAU,gBAAgB,MAAM,KAAK,OAAO,CAAC,MAAM;AACtE,UAAO,CAAC,MAAM,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,EAAE,SAAS;EAClD,EAAC;EAEF,IAAIC;AACJ,MAAI,SAAS,WAAW,EACvB,YAAW;OACL;GACN,MAAM,QAAQ,SAAS,MAAM,GAAG,gBAAgB,CAAC,KAAK,KAAK;GAC3D,MAAM,QACL,SAAS,SAAS,mBACd,QAAQ,SAAS,SAAS,gBAAgB,KAC3C;AACJ,eAAY,qBAAqB,MAAM,EAAE,MAAM;EAC/C;AAED,UAAQ,EAAE,IAAI,kCAAkC,MAAM,KAAK,KAAK,CAAC,MAAM,SAAS;CAChF;AACD;;;;;;;;;;;;;;;;AAiBD,SAAgB,eAAeC,QAA8B;CAC5D,MAAMC,WAAuC,CAAE;AAC/C,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,OAAO,CAChD,UAAS,cAAc,UAAU,WAAW,KAAK,EAAE,MAAM,MAAM,KAAM;AAEtE,QAAO,OAAO,KAAK,IAAIC,8CAAmB,UAAU,cAAc,OAAO,CAAC;AAC1E;;;;;;;;;;;;;;;;;;;AAoBD,IAAa,eAAb,MAA0B;;CAEzB,AAAS;;CAET,AAAS;CACT,AAAS;CACT,AAAiB;;CAEjB,AAAiB;CAEjB,YAAYC,OAAmBC,UAA+B,CAAE,GAAE;EACjE,MAAM,EAAE,UAAU,YAAY,CAAE,GAAE,SAAS,GAAG;AAC9C,OAAK,UAAU;AACf,OAAK,iBAAiB,IAAI,IACzB,OAAO,QAAQ,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,MAAM,KAAK,CAC5C,MACA,eAAe,GAAG,OAAO,MAAO,EAAC,AACjC,EAAC;AAEH,OAAK,WAAW,CAAC,GAAG,KAAK,eAAe,QAAQ,AAAC,EAAC,MAAM;AACxD,OAAK,gBAAgB;GACpB,GAAG,KAAK;GACR,GAAI,WAAW,kBAAkB,YAAY,CAAE;GAC/C,GAAG;EACH;AACD,OAAK,eAAe,IAAI,IAAI,KAAK;CACjC;;;;;;CAOD,uBAAuBC,kBAA+C;EACrE,MAAM,YAAY,IAAI,IACrB,iBAAiB,IAAI,CAAC,MAAO,EAAE,SAAS,IAAI,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG,EAAG;EAEpE,MAAMC,YAAsB,CAAE;AAC9B,OAAK,MAAM,CAAC,MAAM,KAAK,IAAI,KAAK,eAC/B,KAAI,KAAK,KAAK,CAAC,MAAM,UAAU,IAAI,EAAE,CAAC,CAAE,WAAU,KAAK,KAAK;AAE7D,SAAO;CACP;;;;;;CAOD,SAASD,kBAAuD;EAC/D,MAAM,cAAc,iBAAiB,OAAO,CAAC,WAAW;AACvD,OAAI,OAAO,SAAS,IAAI,CAAE,QAAO;AACjC,WAAQ,KAAK,aAAa,IAAI,OAAO;EACrC,EAAC;EAEF,MAAME,cAAwC,CAAE;AAChD,OAAK,MAAM,UAAU,aAAa;GACjC,MAAM,UAAU,eAAe,QAAQ,KAAK,cAAc;AAC1D,OAAI,QAAQ,OAAQ,aAAY,UAAU;EAC1C;AAED,SAAO;GACN,OAAO,YAAY,WAAW;GAC9B;GACA,eAAe,KAAK;GACpB;EACA;CACD;;;;;;;CAQD,OAAOF,kBAA2C;EACjD,MAAM,EAAE,OAAO,aAAa,aAAa,GAAG,KAAK,SAAS,iBAAiB;AAE3E,OAAK,MACJ,OAAM,IAAI,mBAAmB;GAC5B,SAAS;GACT,WAAW,KAAK;GAChB,UAAU,KAAK;GACf;GACA,SAAS,KAAK;EACd;CAEF;;;;;CAMD,IAAIG,QAAyB;AAC5B,SAAO,KAAK,aAAa,IAAI,OAAO;CACpC;AACD;;;;;;;;;;;;;;;;;;;;AC/SD,SAAgB,qBACfC,QACsE;AACtE,QAAO,IAAI,sBAAsB,QAAQ,OAAO;AAChD"}
+{"version":3,"file":"sst.cjs","names":["EnvironmentBuilder","EnvironmentBuilder"],"sources":["../src/SstEnvironmentBuilder.ts","../src/SstEnvValidator.ts","../src/sst.ts"],"sourcesContent":["import {\n\tEnvironmentBuilder,\n\ttype EnvironmentBuilderOptions,\n\ttype EnvironmentResolver,\n\ttype EnvRecord,\n\ttype InputValue,\n\ttype Resolvers,\n} from './EnvironmentBuilder';\n\n/**\n * Enumeration of supported SST (Serverless Stack Toolkit) resource types.\n * Used to identify and process different AWS and SST resources.\n */\nexport enum ResourceType {\n\t// Legacy format (dot notation)\n\tApiGatewayV2 = 'sst.aws.ApiGatewayV2',\n\tPostgres = 'sst.aws.Postgres',\n\tFunction = 'sst.aws.Function',\n\tObjectStorage = 'sst.aws.Bucket',\n\tVpc = 'sst.aws.Vpc',\n\tSecret = 'sst.sst.Secret',\n\tDynamo = 'sst.aws.Dynamo',\n\tQueue = 'sst.aws.Queue',\n\n\t// Modern format (colon notation)\n\tSSTSecret = 'sst:sst:Secret',\n\tSSTFunction = 'sst:sst:Function',\n\tSSTApiGatewayV2 = 'sst:aws:ApiGatewayV2',\n\tSSTPostgres = 'sst:aws:Postgres',\n\tSSTObjectStorage = 'sst:aws:Bucket',\n\tSnsTopic = 'sst:aws:SnsTopic',\n\tSSTDynamo = 'sst:aws:Dynamo',\n\tSSTQueue = 'sst:aws:Queue',\n\t// A distribution, twice over: a file server and a static site are the same\n\t// infrastructure with different contents behind it, and they are separate\n\t// entries because what they provide is read under different ids, not\n\t// because SST builds them differently.\n\tFileServer = 'sst:aws:Router',\n\tStaticSite = 'sst:aws:StaticSite',\n\t// Neither is an SST component: mail is an IAM chain and a composed URL, and\n\t// a cache is whatever the selected backend turned out to be.\n\tEmail = 'gkm:aws:Email',\n\tCache = 'gkm:aws:Cache',\n\t// Somebody else's API: an address and the credentials it was issued.\n\tExternalApi = 'gkm:aws:ExternalApi',\n\t// A third party's credentials: stored as an SST secret, read under its own\n\t// key rather than the secret's bare name.\n\tCredential = 'gkm:aws:Credential',\n\t// A KMS key and its HMAC key, handed over as one `kms://` URL.\n\tEncryption = 'gkm:aws:Encryption',\n}\n\n/**\n * AWS API Gateway V2 resource type.\n * Represents an HTTP/WebSocket API.\n */\nexport type ApiGatewayV2 = {\n\ttype: ResourceType.ApiGatewayV2 | ResourceType.SSTApiGatewayV2;\n\turl: string;\n};\n\n/**\n * PostgreSQL database resource type.\n * Contains all connection details needed to connect to the database.\n */\nexport type Postgres = {\n\ttype: ResourceType.Postgres | ResourceType.SSTPostgres;\n\tdatabase: string;\n\thost: string;\n\tpassword: string;\n\tport: number;\n\tusername: string;\n};\n\n/**\n * AWS Lambda Function resource type.\n */\nexport type Function = {\n\ttype: ResourceType.Function | ResourceType.SSTFunction;\n\tname: string;\n};\n\n/**\n * AWS S3 Bucket resource type.\n */\nexport type Bucket = {\n\ttype: ResourceType.ObjectStorage | ResourceType.SSTObjectStorage;\n\tname: string;\n\t/**\n\t * Supplied by `@geekmidas/cloud`'s ObjectStorage, which widens SST's link to\n\t * carry them — a bucket may not be in the reader's region, and the URL is\n\t * composed where the resource's shape is known.\n\t */\n\tregion?: string;\n\turl?: string;\n};\n\n/**\n * AWS VPC (Virtual Private Cloud) resource type.\n */\nexport type Vpc = {\n\ttype: ResourceType.Vpc;\n\tbastion: string;\n};\n\n/**\n * Secret resource type for storing sensitive values.\n */\nexport type Secret = {\n\ttype: ResourceType.Secret | ResourceType.SSTSecret;\n\tvalue: string;\n};\n\n/**\n * AWS SNS Topic resource type.\n */\nexport type SnsTopic = {\n\ttype: ResourceType.SnsTopic;\n\tarn: string;\n};\n\n/**\n * AWS SQS Queue resource type.\n */\nexport type Queue = {\n\ttype: ResourceType.Queue | ResourceType.SSTQueue;\n\turl: string;\n\tarn: string;\n};\n\n/**\n * AWS DynamoDB Table resource type.\n */\nexport type Dynamo = {\n\ttype: ResourceType.Dynamo | ResourceType.SSTDynamo;\n\tname: string;\n};\n\n/**\n * Union type of all supported SST resource types.\n */\nexport type SstResource =\n\t| ApiGatewayV2\n\t| Postgres\n\t| Function\n\t| Bucket\n\t| Vpc\n\t| Secret\n\t| SnsTopic\n\t| Queue\n\t| Dynamo;\n\n// Value types without the `type` key (for resolver parameters)\ntype SecretValue = Omit<Secret, 'type'>;\ntype ExternalApiValue = { url: string; credentials: string };\ntype CredentialValue = { credentials: string };\ntype EncryptionValue = { url: string };\ntype PostgresValue = Omit<Postgres, 'type'>;\ntype BucketValue = Omit<Bucket, 'type'>;\ntype SnsTopicValue = Omit<SnsTopic, 'type'>;\ntype QueueValue = Omit<Queue, 'type'>;\ntype DynamoValue = Omit<Dynamo, 'type'>;\n\n/**\n * Function type for processing a specific resource type into environment variables.\n *\n * @template K - The specific resource type (without `type` key)\n * @param name - The resource name\n * @param value - The resource value (without `type` key)\n * @returns Object mapping environment variable names to values\n */\nexport type ResourceProcessor<K> = (name: string, value: K) => EnvRecord;\n\n// SST Resource Resolvers (receive values without `type` key)\n\nconst secretResolver = (name: string, value: SecretValue) => ({\n\t[name]: value.value,\n});\n\nconst postgresResolver = (key: string, value: PostgresValue) => ({\n\t[`${key}Name`]: value.database,\n\t[`${key}Host`]: value.host,\n\t[`${key}Password`]: value.password,\n\t[`${key}Port`]: value.port,\n\t[`${key}Username`]: value.username,\n\t[`${key}Url`]: `postgresql://${encodeURIComponent(value.username)}:${encodeURIComponent(value.password)}@${value.host}:${value.port}/${value.database}`,\n});\n\nconst bucketResolver = (name: string, value: BucketValue) => ({\n\t[`${name}Name`]: value.name,\n\t// The single URL a construct reads. Composed by the component, which knows\n\t// its own shape; this only renames it into env case. Always emitted, even\n\t// when absent, so `resolveEnvKeys` can derive the key from the link's type\n\t// alone — a bucket linked without our component yields an empty one.\n\t[`${name}Url`]: value.url ?? '',\n});\n\nconst topicResolver = (name: string, value: SnsTopicValue) => ({\n\t[`${name}Arn`]: value.arn,\n\t// A publisher connection string for `@geekmidas/events` (SNS); region is\n\t// resolved from the ARN / AWS_REGION at runtime.\n\t[`${name}PublisherConnectionString`]: `sns://?topicArn=${encodeURIComponent(value.arn)}`,\n});\n\nconst queueResolver = (name: string, value: QueueValue) => ({\n\t[`${name}Url`]: value.url,\n\t[`${name}Arn`]: value.arn,\n\t// A publisher connection string for `@geekmidas/events` (SQS); region is\n\t// resolved from the URL / AWS_REGION at runtime.\n\t[`${name}PublisherConnectionString`]: `sqs://?queueUrl=${encodeURIComponent(value.url)}`,\n});\n\nconst dynamoResolver = (name: string, value: DynamoValue) => ({\n\t[`${name}Name`]: value.name,\n});\n\nconst externalApiResolver = (name: string, value: ExternalApiValue) => ({\n\t[`${name}Url`]: value.url,\n\t[`${name}Credentials`]: value.credentials,\n});\n\nconst credentialResolver = (name: string, value: CredentialValue) => ({\n\t[`${name}Credentials`]: value.credentials,\n});\n\nconst encryptionResolver = (name: string, value: EncryptionValue) => ({\n\t[`${name}Url`]: value.url,\n});\n\nconst noopResolver = () => ({});\n\n/**\n * Pre-configured resolvers for all SST resource types.\n */\nexport const sstResolvers: Resolvers = {\n\t// Legacy format\n\t[ResourceType.ApiGatewayV2]: noopResolver,\n\t[ResourceType.Function]: noopResolver,\n\t[ResourceType.Vpc]: noopResolver,\n\t[ResourceType.Secret]: secretResolver,\n\t[ResourceType.Postgres]: postgresResolver,\n\t[ResourceType.ObjectStorage]: bucketResolver,\n\t[ResourceType.Dynamo]: dynamoResolver,\n\t[ResourceType.Queue]: queueResolver,\n\n\t// Modern format\n\t[ResourceType.SSTSecret]: secretResolver,\n\t[ResourceType.SSTObjectStorage]: bucketResolver,\n\t[ResourceType.SSTFunction]: noopResolver,\n\t[ResourceType.SSTPostgres]: postgresResolver,\n\t[ResourceType.SSTApiGatewayV2]: noopResolver,\n\t[ResourceType.SnsTopic]: topicResolver,\n\t[ResourceType.SSTDynamo]: dynamoResolver,\n\t[ResourceType.SSTQueue]: queueResolver,\n\t[ResourceType.ExternalApi]: externalApiResolver,\n\t[ResourceType.Credential]: credentialResolver,\n\t[ResourceType.Encryption]: encryptionResolver,\n};\n\n/**\n * All known SST resource type strings.\n */\ntype SstResourceTypeString = `${ResourceType}`;\n\n/**\n * Extracts the `type` string value from an input value.\n */\ntype ExtractType<T> = T extends { type: infer U extends string } ? U : never;\n\n/**\n * Removes the `type` key from an object type.\n */\ntype OmitType<T> = T extends { type: string } ? Omit<T, 'type'> : never;\n\n/**\n * Extracts all unique `type` values from a record (excluding plain strings).\n */\ntype AllTypeValues<TRecord extends Record<string, InputValue>> = {\n\t[K in keyof TRecord]: ExtractType<TRecord[K]>;\n}[keyof TRecord];\n\n/**\n * Extracts only the custom (non-SST) type values from a record.\n */\ntype CustomTypeValues<TRecord extends Record<string, InputValue>> = Exclude<\n\tAllTypeValues<TRecord>,\n\tSstResourceTypeString\n>;\n\n/**\n * For a given type value, finds the corresponding value type (without `type` key).\n */\ntype ValueForType<\n\tTRecord extends Record<string, InputValue>,\n\tTType extends string,\n> = {\n\t[K in keyof TRecord]: TRecord[K] extends { type: TType }\n\t\t? OmitType<TRecord[K]>\n\t\t: never;\n}[keyof TRecord];\n\n/**\n * Generates typed resolvers for custom (non-SST) types in the input record.\n */\ntype CustomResolvers<TRecord extends Record<string, InputValue>> =\n\tCustomTypeValues<TRecord> extends never\n\t\t? Resolvers | undefined\n\t\t: {\n\t\t\t\t[TType in CustomTypeValues<TRecord>]: EnvironmentResolver<\n\t\t\t\t\tValueForType<TRecord, TType>\n\t\t\t\t>;\n\t\t\t};\n\n/**\n * SST-specific environment builder with built-in resolvers for all known\n * SST resource types.\n *\n * Wraps the generic EnvironmentBuilder with pre-configured SST resolvers.\n *\n * @template TRecord - The input record type for type inference\n *\n * @example\n * ```typescript\n * const env = new SstEnvironmentBuilder({\n *   database: { type: 'sst:aws:Postgres', host: '...', ... },\n *   apiKey: { type: 'sst:sst:Secret', value: 'secret' },\n *   appName: 'my-app',\n * }).build();\n *\n * // With custom resolvers (typed based on input)\n * const env = new SstEnvironmentBuilder(\n *   {\n *     database: postgresResource,\n *     custom: { type: 'my-custom' as const, data: 'foo' },\n *   },\n *   {\n *     // TypeScript requires 'my-custom' resolver with typed value\n *     'my-custom': (key, value) => ({ [`${key}Data`]: value.data }),\n *   }\n * ).build();\n * ```\n */\nexport class SstEnvironmentBuilder<\n\tTRecord extends Record<string, SstResource | InputValue | string>,\n> {\n\tprivate readonly builder: EnvironmentBuilder<\n\t\tRecord<string, InputValue>,\n\t\tResolvers\n\t>;\n\n\t/**\n\t * Create a new SST environment builder.\n\t *\n\t * @param record - Object containing SST resources, custom resources, and/or string values\n\t * @param additionalResolvers - Optional custom resolvers (typed based on custom types in record)\n\t * @param options - Optional configuration options\n\t */\n\tconstructor(\n\t\trecord: TRecord,\n\t\tadditionalResolvers?: CustomResolvers<TRecord>,\n\t\toptions?: EnvironmentBuilderOptions,\n\t) {\n\t\t// Merge resolvers with custom ones taking precedence\n\t\tconst mergedResolvers: Resolvers = additionalResolvers\n\t\t\t? { ...sstResolvers, ...additionalResolvers }\n\t\t\t: sstResolvers;\n\n\t\tthis.builder = new EnvironmentBuilder(\n\t\t\trecord as Record<string, InputValue>,\n\t\t\tmergedResolvers,\n\t\t\toptions,\n\t\t);\n\t}\n\n\t/**\n\t * Build environment variables from the input record.\n\t *\n\t * @returns A record of environment variables\n\t */\n\tbuild(): EnvRecord {\n\t\treturn this.builder.build();\n\t}\n}\n\nexport type {\n\tEnvironmentBuilderOptions,\n\tEnvRecord,\n\tEnvValue,\n} from './EnvironmentBuilder';\n// Re-export useful types\nexport { environmentCase } from './EnvironmentBuilder';\n","import { EnvironmentBuilder, type InputValue } from './EnvironmentBuilder';\nimport { type SstResource, sstResolvers } from './SstEnvironmentBuilder';\n\n/**\n * Variables AWS Lambda injects into the runtime. Always valid on AWS, but never\n * assumed — opt in via `platform: 'aws'` or by spreading {@link AWS_RUNTIME_ENV_VARS}\n * into `whitelist`.\n */\nexport const AWS_RUNTIME_ENV_VARS = [\n\t'AWS_REGION',\n\t'AWS_DEFAULT_REGION',\n\t'AWS_ENDPOINT_URL',\n\t'AWS_ENDPOINT',\n\t'AWS_ACCESS_KEY_ID',\n\t'AWS_SECRET_ACCESS_KEY',\n\t'AWS_SESSION_TOKEN',\n\t'AWS_LAMBDA_FUNCTION_NAME',\n\t'AWS_LAMBDA_FUNCTION_VERSION',\n] as const;\n\n/**\n * Variables GCP injects into Cloud Functions / Cloud Run.\n */\nexport const GCP_RUNTIME_ENV_VARS = [\n\t'GOOGLE_CLOUD_PROJECT',\n\t'GCP_PROJECT',\n\t'FUNCTION_TARGET',\n\t'FUNCTION_SIGNATURE_TYPE',\n\t'K_SERVICE',\n\t'K_REVISION',\n\t'K_CONFIGURATION',\n\t'PORT',\n] as const;\n\n/**\n * Variables Cloudflare exposes to Workers. Workers inject almost nothing into\n * the global env, so this is intentionally minimal.\n */\nexport const CLOUDFLARE_RUNTIME_ENV_VARS = [\n\t'CF_PAGES',\n\t'CF_PAGES_URL',\n] as const;\n\n/**\n * Registry of platform → always-valid runtime variables. Export, don't assume:\n * a caller states the platform it deploys to and the matching set is trusted.\n */\nexport const PLATFORM_ENV_VARS = {\n\taws: AWS_RUNTIME_ENV_VARS,\n\tgcp: GCP_RUNTIME_ENV_VARS,\n\tcloudflare: CLOUDFLARE_RUNTIME_ENV_VARS,\n} as const;\n\nexport type Platform = keyof typeof PLATFORM_ENV_VARS;\n\n/**\n * The always-valid runtime variables for a platform. The \"whitelist construct\":\n * resolve a platform to its set, to spread into `whitelist` or compare against.\n */\nexport function platformEnvVars(platform: Platform): readonly string[] {\n\treturn PLATFORM_ENV_VARS[platform];\n}\n\n/** How many link-provided vars to list in an error before truncating. */\nconst MAX_LISTED_VARS = 8;\n\n/** Minimum similarity for a variable to be offered as a \"did you mean\". */\nconst SUGGESTION_THRESHOLD = 0.3;\n\n/**\n * Input shape for the validator: the same record `SstEnvironmentBuilder`\n * accepts — keyed by resource name, valued by an SST resource (or a plain\n * string for pass-through env vars).\n */\nexport type LinkRecord = Record<string, SstResource | InputValue | string>;\n\nexport interface ValidationResult {\n\tvalid: boolean;\n\t/** Requested variables that are not available (excluding optional `?` vars). */\n\tinvalidVars: string[];\n\t/** Every variable the links + whitelist make available. */\n\tavailableVars: string[];\n\t/** Nearest available matches for each invalid variable (best first). */\n\tsuggestions: Record<string, string[]>;\n}\n\nexport interface EnvValidatorOptions {\n\t/**\n\t * Platform whose runtime-injected variables are always valid. Omit to assume\n\t * none — the validator never bakes in a platform's variables.\n\t */\n\tplatform?: Platform;\n\t/**\n\t * Extra always-valid variables in addition to the platform set — typically\n\t * the keys of a function's explicit `environment`.\n\t */\n\twhitelist?: readonly string[];\n\t/**\n\t * Label for the deployable unit (e.g. a function name), used in error\n\t * messages so a failure points at exactly one unit.\n\t */\n\tcontext?: string;\n}\n\n/**\n * Levenshtein edit distance between two strings.\n */\nfunction levenshtein(a: string, b: string): number {\n\tconst m = a.length;\n\tconst n = b.length;\n\tif (m === 0) return n;\n\tif (n === 0) return m;\n\n\tlet prev = Array.from({ length: n + 1 }, (_, i) => i);\n\n\tfor (let i = 1; i <= m; i++) {\n\t\tconst curr: number[] = [i];\n\t\tfor (let j = 1; j <= n; j++) {\n\t\t\tconst cost = a[i - 1] === b[j - 1] ? 0 : 1;\n\t\t\tconst del = (prev[j] ?? 0) + 1;\n\t\t\tconst ins = (curr[j - 1] ?? 0) + 1;\n\t\t\tconst sub = (prev[j - 1] ?? 0) + cost;\n\t\t\tcurr[j] = Math.min(del, ins, sub);\n\t\t}\n\t\tprev = curr;\n\t}\n\n\treturn prev[n] ?? 0;\n}\n\n/**\n * Similarity in `[0, 1]` combining edit distance with `_`-token overlap, so both\n * near-typos (a missing underscore) and renames (`DATABASE_URL` ~ `DB_URL`,\n * which share the `URL` token) are caught.\n */\nfunction similarity(a: string, b: string): number {\n\tconst editSim = 1 - levenshtein(a, b) / Math.max(a.length, b.length, 1);\n\n\tconst ta = new Set(a.split('_').filter(Boolean));\n\tconst tb = new Set(b.split('_').filter(Boolean));\n\tconst shared = [...ta].filter((t) => tb.has(t)).length;\n\tconst union = new Set([...ta, ...tb]).size || 1;\n\tconst tokenSim = shared / union;\n\n\t// Nudge token-overlap matches ahead of coincidental edit-distance ones, so a\n\t// rename like DATABASE_URL prefers DB_URL (shares `URL`) over DB_PASSWORD.\n\treturn Math.max(editSim, tokenSim * 1.15);\n}\n\n/**\n * Returns the nearest available variables to `missing`, best first, limited to\n * those above {@link SUGGESTION_THRESHOLD}.\n */\nfunction suggestionsFor(\n\tmissing: string,\n\tavailable: readonly string[],\n\tmax = 1,\n): string[] {\n\treturn available\n\t\t.map((candidate) => ({ candidate, score: similarity(missing, candidate) }))\n\t\t.filter((s) => s.score >= SUGGESTION_THRESHOLD)\n\t\t.sort((a, b) => b.score - a.score)\n\t\t.slice(0, max)\n\t\t.map((s) => s.candidate);\n}\n\n/**\n * Thrown when a deployable unit requires environment variables its links do not\n * provide. Carries the structured `missing`/`available`/`suggestions` so callers\n * can inspect the failure programmatically, not just read the message.\n */\nexport class EnvValidationError extends Error {\n\treadonly isEnvValidationError = true;\n\treadonly missing: string[];\n\treadonly available: string[];\n\treadonly suggestions: Record<string, string[]>;\n\treadonly context?: string;\n\n\tconstructor(args: {\n\t\tmissing: string[];\n\t\tavailable: string[];\n\t\tlinkVars: string[];\n\t\tsuggestions: Record<string, string[]>;\n\t\tcontext?: string;\n\t}) {\n\t\tsuper(EnvValidationError.format(args));\n\t\tthis.name = 'EnvValidationError';\n\t\tthis.missing = args.missing;\n\t\tthis.available = args.available;\n\t\tthis.suggestions = args.suggestions;\n\t\tthis.context = args.context;\n\t\t// V8-only; keeps the constructor out of the stack trace.\n\t\t(\n\t\t\tError as unknown as {\n\t\t\t\tcaptureStackTrace?(target: object, ctor?: unknown): void;\n\t\t\t}\n\t\t).captureStackTrace?.(this, EnvValidationError);\n\t}\n\n\tprivate static format(args: {\n\t\tmissing: string[];\n\t\tlinkVars: string[];\n\t\tsuggestions: Record<string, string[]>;\n\t\tcontext?: string;\n\t}): string {\n\t\tconst { missing, linkVars, suggestions, context } = args;\n\t\tconst who = context ? `'${context}'` : 'a deployable unit';\n\n\t\tconst width = Math.max(...missing.map((v) => v.length));\n\t\tconst lines = missing.map((v) => {\n\t\t\tconst hints = suggestions[v] ?? [];\n\t\t\tconst hint = hints.length ? `(did you mean ${hints.join(' or ')}?)` : '';\n\t\t\treturn `  - ${v.padEnd(width)}  ${hint}`.trimEnd();\n\t\t});\n\n\t\tlet provided: string;\n\t\tif (linkVars.length === 0) {\n\t\t\tprovided = '(no links provide environment variables)';\n\t\t} else {\n\t\t\tconst shown = linkVars.slice(0, MAX_LISTED_VARS).join(', ');\n\t\t\tconst extra =\n\t\t\t\tlinkVars.length > MAX_LISTED_VARS\n\t\t\t\t\t? ` ...(+${linkVars.length - MAX_LISTED_VARS})`\n\t\t\t\t\t: '';\n\t\t\tprovided = `Provided by links: ${shown}${extra}`;\n\t\t}\n\n\t\treturn `${who} is missing required env vars:\\n${lines.join('\\n')}\\n\\n${provided}`;\n\t}\n}\n\n/**\n * Derives the set of environment-variable **keys** a group of linked resources\n * will produce at runtime — without resolving any value.\n *\n * This reuses the runtime resolvers (`sstResolvers`) via {@link EnvironmentBuilder},\n * so the keys computed here are exactly the keys a deployed function receives:\n * the validator and the runtime resolution share a single source of truth and\n * cannot drift. Because every resolver's output keys depend only on the record\n * key and the resource `type` (never the value), each resource is reduced to\n * `{ type }` before building, so no SST `Output` is ever read.\n *\n * @example\n * resolveEnvKeys({ db: { type: ResourceType.Postgres } });\n * // ['DB_NAME', 'DB_HOST', 'DB_PASSWORD', 'DB_PORT', 'DB_USERNAME', 'DB_URL']\n */\nexport function resolveEnvKeys(record: LinkRecord): string[] {\n\tconst typeOnly: Record<string, InputValue> = {};\n\tfor (const [key, value] of Object.entries(record)) {\n\t\ttypeOnly[key] = typeof value === 'string' ? '' : { type: value.type };\n\t}\n\treturn Object.keys(new EnvironmentBuilder(typeOnly, sstResolvers).build());\n}\n\n/**\n * Validates that the environment variables a deployable unit requires are\n * actually provided by its linked resources — at infra time, before deploy.\n *\n * Available variables are the union of the keys derived from `links`\n * ({@link resolveEnvKeys}), the chosen platform's runtime variables (only when\n * `options.platform` is set — nothing is assumed), and any `options.whitelist`\n * (e.g. the keys of a function's explicit `environment`). A requested variable\n * suffixed with `?` is treated as optional and never causes a failure.\n *\n * @example\n * const validator = new EnvValidator(\n *   { db: { type: ResourceType.Postgres } },\n *   { platform: 'aws', whitelist: ['APP_NAME'], context: 'orders-fn' },\n * );\n * validator.assert(['DB_HOST', 'AWS_REGION', 'APP_NAME', 'SENTRY_DSN?']); // ok\n * validator.assert(['DATABASE_URL']); // throws EnvValidationError (did you mean DB_URL?)\n */\nexport class EnvValidator {\n\t/** Every variable available — link-derived, platform, and extra whitelist. */\n\treadonly availableVars: string[];\n\t/** Just the variables the links provide (used for error context). */\n\treadonly linkVars: string[];\n\treadonly context?: string;\n\tprivate readonly availableSet: Set<string>;\n\t/** Per-link (record key → its env-var keys), for least-privilege filtering. */\n\tprivate readonly linkVarsByName: Map<string, string[]>;\n\n\tconstructor(links: LinkRecord, options: EnvValidatorOptions = {}) {\n\t\tconst { platform, whitelist = [], context } = options;\n\t\tthis.context = context;\n\t\tthis.linkVarsByName = new Map(\n\t\t\tObject.entries(links).map(([name, value]) => [\n\t\t\t\tname,\n\t\t\t\tresolveEnvKeys({ [name]: value }),\n\t\t\t]),\n\t\t);\n\t\tthis.linkVars = [...this.linkVarsByName.values()].flat();\n\t\tthis.availableVars = [\n\t\t\t...this.linkVars,\n\t\t\t...(platform ? PLATFORM_ENV_VARS[platform] : []),\n\t\t\t...whitelist,\n\t\t];\n\t\tthis.availableSet = new Set(this.availableVars);\n\t}\n\n\t/**\n\t * Returns the names of the links that provide at least one of the requested\n\t * variables — so a construct can attach only the links a unit actually needs\n\t * (least privilege) rather than the whole pool. Trailing `?` is ignored.\n\t */\n\tgetProvidersForEnvVars(requestedEnvVars: readonly string[]): string[] {\n\t\tconst requested = new Set(\n\t\t\trequestedEnvVars.map((v) => (v.endsWith('?') ? v.slice(0, -1) : v)),\n\t\t);\n\t\tconst providers: string[] = [];\n\t\tfor (const [name, vars] of this.linkVarsByName) {\n\t\t\tif (vars.some((v) => requested.has(v))) providers.push(name);\n\t\t}\n\t\treturn providers;\n\t}\n\n\t/**\n\t * Checks every requested variable against the available set. Variables\n\t * ending in `?` are optional and never reported as invalid. Invalid\n\t * variables come back with their nearest available matches.\n\t */\n\tvalidate(requestedEnvVars: readonly string[]): ValidationResult {\n\t\tconst invalidVars = requestedEnvVars.filter((envVar) => {\n\t\t\tif (envVar.endsWith('?')) return false;\n\t\t\treturn !this.availableSet.has(envVar);\n\t\t});\n\n\t\tconst suggestions: Record<string, string[]> = {};\n\t\tfor (const envVar of invalidVars) {\n\t\t\tconst matches = suggestionsFor(envVar, this.availableVars);\n\t\t\tif (matches.length) suggestions[envVar] = matches;\n\t\t}\n\n\t\treturn {\n\t\t\tvalid: invalidVars.length === 0,\n\t\t\tinvalidVars,\n\t\t\tavailableVars: this.availableVars,\n\t\t\tsuggestions,\n\t\t};\n\t}\n\n\t/**\n\t * Asserts that every requested variable is available, throwing an\n\t * {@link EnvValidationError} otherwise. Intended to run in a construct's\n\t * constructor so a misconfigured `sst.config.ts` fails at synth time, before\n\t * any AWS call.\n\t */\n\tassert(requestedEnvVars: readonly string[]): void {\n\t\tconst { valid, invalidVars, suggestions } = this.validate(requestedEnvVars);\n\n\t\tif (!valid) {\n\t\t\tthrow new EnvValidationError({\n\t\t\t\tmissing: invalidVars,\n\t\t\t\tavailable: this.availableVars,\n\t\t\t\tlinkVars: this.linkVars,\n\t\t\t\tsuggestions,\n\t\t\t\tcontext: this.context,\n\t\t\t});\n\t\t}\n\t}\n\n\t/**\n\t * Whether a single variable is available. Does not treat a trailing `?` as\n\t * optional — pass the bare name.\n\t */\n\thas(envVar: string): boolean {\n\t\treturn this.availableSet.has(envVar);\n\t}\n}\n","// Re-export everything from SstEnvironmentBuilder\n\n// Re-export types from EnvironmentBuilder\nexport type {\n\tEnvironmentBuilderOptions,\n\tEnvRecord,\n\tEnvValue,\n} from './EnvironmentBuilder';\n\n// Re-export environmentCase from EnvironmentBuilder\nexport { environmentCase } from './EnvironmentBuilder';\nexport {\n\ttype ApiGatewayV2,\n\ttype Bucket,\n\ttype Dynamo,\n\ttype Function,\n\ttype Postgres,\n\ttype Queue,\n\ttype ResourceProcessor,\n\tResourceType,\n\ttype Secret,\n\ttype SnsTopic,\n\tSstEnvironmentBuilder,\n\ttype SstResource,\n\tsstResolvers,\n\ttype Vpc,\n} from './SstEnvironmentBuilder';\n\nexport {\n\tAWS_RUNTIME_ENV_VARS,\n\tCLOUDFLARE_RUNTIME_ENV_VARS,\n\tEnvValidationError,\n\tEnvValidator,\n\ttype EnvValidatorOptions,\n\tGCP_RUNTIME_ENV_VARS,\n\ttype LinkRecord,\n\tPLATFORM_ENV_VARS,\n\ttype Platform,\n\tplatformEnvVars,\n\tresolveEnvKeys,\n\ttype ValidationResult,\n} from './SstEnvValidator';\n\n// Import for deprecated function\nimport {\n\tSstEnvironmentBuilder,\n\ttype SstResource,\n} from './SstEnvironmentBuilder';\n\n/**\n * @deprecated Use `new SstEnvironmentBuilder(record).build()` instead.\n *\n * Normalizes SST resources and plain strings into environment variables.\n * Processes resources based on their type and converts names to environment case.\n *\n * @param record - Object containing resources and/or string values\n * @returns Normalized environment variables object\n *\n * @example\n * // Old usage (deprecated):\n * normalizeResourceEnv({ database: postgresResource })\n *\n * // New usage:\n * new SstEnvironmentBuilder({ database: postgresResource }).build()\n */\nexport function normalizeResourceEnv(\n\trecord: Record<string, SstResource | string>,\n): Record<string, string | number | boolean | Record<string, unknown>> {\n\treturn new SstEnvironmentBuilder(record).build();\n}\n\n// Keep Resource type as deprecated alias for backwards compatibility\n/**\n * @deprecated Use `SstResource` instead.\n */\nexport type Resource = SstResource;\n"],"mappings":";;;;;;;AAaA,IAAY,eAAL,yBAAA,cAAA;CAEN,aAAA,kBAAA;CACA,aAAA,cAAA;CACA,aAAA,cAAA;CACA,aAAA,mBAAA;CACA,aAAA,SAAA;CACA,aAAA,YAAA;CACA,aAAA,YAAA;CACA,aAAA,WAAA;CAGA,aAAA,eAAA;CACA,aAAA,iBAAA;CACA,aAAA,qBAAA;CACA,aAAA,iBAAA;CACA,aAAA,sBAAA;CACA,aAAA,cAAA;CACA,aAAA,eAAA;CACA,aAAA,cAAA;CAKA,aAAA,gBAAA;CACA,aAAA,gBAAA;CAGA,aAAA,WAAA;CACA,aAAA,WAAA;CAEA,aAAA,iBAAA;CAGA,aAAA,gBAAA;CAEA,aAAA,gBAAA;;AACD,EAAA,CAAA,CAAA;AA6HA,MAAM,kBAAkB,MAAc,WAAwB,GAC5D,OAAO,MAAM,MACf;AAEA,MAAM,oBAAoB,KAAa,WAA0B;EAC/D,GAAG,IAAI,QAAQ,MAAM;EACrB,GAAG,IAAI,QAAQ,MAAM;EACrB,GAAG,IAAI,YAAY,MAAM;EACzB,GAAG,IAAI,QAAQ,MAAM;EACrB,GAAG,IAAI,YAAY,MAAM;EACzB,GAAG,IAAI,OAAO,gBAAgB,mBAAmB,MAAM,QAAQ,EAAE,GAAG,mBAAmB,MAAM,QAAQ,EAAE,GAAG,MAAM,KAAK,GAAG,MAAM,KAAK,GAAG,MAAM;AAC9I;AAEA,MAAM,kBAAkB,MAAc,WAAwB;EAC5D,GAAG,KAAK,QAAQ,MAAM;EAKtB,GAAG,KAAK,OAAO,MAAM,OAAO;AAC9B;AAEA,MAAM,iBAAiB,MAAc,WAA0B;EAC7D,GAAG,KAAK,OAAO,MAAM;EAGrB,GAAG,KAAK,6BAA6B,mBAAmB,mBAAmB,MAAM,GAAG;AACtF;AAEA,MAAM,iBAAiB,MAAc,WAAuB;EAC1D,GAAG,KAAK,OAAO,MAAM;EACrB,GAAG,KAAK,OAAO,MAAM;EAGrB,GAAG,KAAK,6BAA6B,mBAAmB,mBAAmB,MAAM,GAAG;AACtF;AAEA,MAAM,kBAAkB,MAAc,WAAwB,GAC5D,GAAG,KAAK,QAAQ,MAAM,KACxB;AAEA,MAAM,uBAAuB,MAAc,WAA6B;EACtE,GAAG,KAAK,OAAO,MAAM;EACrB,GAAG,KAAK,eAAe,MAAM;AAC/B;AAEA,MAAM,sBAAsB,MAAc,WAA4B,GACpE,GAAG,KAAK,eAAe,MAAM,YAC/B;AAEA,MAAM,sBAAsB,MAAc,WAA4B,GACpE,GAAG,KAAK,OAAO,MAAM,IACvB;AAEA,MAAM,sBAAsB,CAAC;;;;AAK7B,MAAa,eAA0B;EAET,yBAAA;EACJ,qBAAA;EACL,gBAAA;EACG,mBAAA;EACE,qBAAA;EACK,mBAAA;EACP,mBAAA;EACD,kBAAA;EAGI,mBAAA;EACO,mBAAA;EACL,qBAAA;EACA,qBAAA;EACI,yBAAA;EACP,qBAAA;EACC,mBAAA;EACD,kBAAA;EACG,wBAAA;EACD,uBAAA;EACA,uBAAA;AAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqFA,IAAa,wBAAb,MAEE;CACD;;;;;;;;CAYA,YACC,QACA,qBACA,SACC;EAED,MAAM,kBAA6B,sBAChC;GAAE,GAAG;GAAc,GAAG;EAAoB,IAC1C;EAEH,KAAK,UAAU,IAAIA,2BAAAA,mBAClB,QACA,iBACA,OACD;CACD;;;;;;CAOA,QAAmB;EAClB,OAAO,KAAK,QAAQ,MAAM;CAC3B;AACD;;;;;;;;ACtXA,MAAa,uBAAuB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;;;AAKA,MAAa,uBAAuB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;;;;AAMA,MAAa,8BAA8B,CAC1C,YACA,cACD;;;;;AAMA,MAAa,oBAAoB;CAChC,KAAK;CACL,KAAK;CACL,YAAY;AACb;;;;;AAQA,SAAgB,gBAAgB,UAAuC;CACtE,OAAO,kBAAkB;AAC1B;;AAGA,MAAM,kBAAkB;;AAGxB,MAAM,uBAAuB;;;;AAwC7B,SAAS,YAAY,GAAW,GAAmB;CAClD,MAAM,IAAI,EAAE;CACZ,MAAM,IAAI,EAAE;CACZ,IAAI,MAAM,GAAG,OAAO;CACpB,IAAI,MAAM,GAAG,OAAO;CAEpB,IAAI,OAAO,MAAM,KAAK,EAAE,QAAQ,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC;CAEpD,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,KAAK;EAC5B,MAAM,OAAiB,CAAC,CAAC;EACzB,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,KAAK;GAC5B,MAAM,OAAO,EAAE,IAAI,OAAO,EAAE,IAAI,KAAK,IAAI;GACzC,MAAM,OAAO,KAAK,MAAM,KAAK;GAC7B,MAAM,OAAO,KAAK,IAAI,MAAM,KAAK;GACjC,MAAM,OAAO,KAAK,IAAI,MAAM,KAAK;GACjC,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG;EACjC;EACA,OAAO;CACR;CAEA,OAAO,KAAK,MAAM;AACnB;;;;;;AAOA,SAAS,WAAW,GAAW,GAAmB;CACjD,MAAM,UAAU,IAAI,YAAY,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;CAEtE,MAAM,KAAK,IAAI,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC;CAC/C,MAAM,KAAK,IAAI,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC;CAG/C,MAAM,WAFS,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,2BAClC,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,EAAA,CAAE,QAAQ;CAK9C,OAAO,KAAK,IAAI,SAAS,WAAW,IAAI;AACzC;;;;;AAMA,SAAS,eACR,SACA,WACA,MAAM,GACK;CACX,OAAO,UACL,KAAK,eAAe;EAAE;EAAW,OAAO,WAAW,SAAS,SAAS;CAAE,EAAE,CAAC,CAC1E,QAAQ,MAAM,EAAE,SAAS,oBAAoB,CAAC,CAC9C,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CACjC,MAAM,GAAG,GAAG,CAAC,CACb,KAAK,MAAM,EAAE,SAAS;AACzB;;;;;;AAOA,IAAa,qBAAb,MAAa,2BAA2B,MAAM;CAC7C,uBAAgC;CAChC;CACA;CACA;CACA;CAEA,YAAY,MAMT;EACF,MAAM,mBAAmB,OAAO,IAAI,CAAC;EACrC,KAAK,OAAO;EACZ,KAAK,UAAU,KAAK;EACpB,KAAK,YAAY,KAAK;EACtB,KAAK,cAAc,KAAK;EACxB,KAAK,UAAU,KAAK;EAEpB,MAIE,oBAAoB,MAAM,kBAAkB;CAC/C;CAEA,OAAe,OAAO,MAKX;EACV,MAAM,EAAE,SAAS,UAAU,aAAa,YAAY;EACpD,MAAM,MAAM,UAAU,IAAI,QAAQ,KAAK;EAEvC,MAAM,QAAQ,KAAK,IAAI,GAAG,QAAQ,KAAK,MAAM,EAAE,MAAM,CAAC;EACtD,MAAM,QAAQ,QAAQ,KAAK,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM,CAAC;GACjC,MAAM,OAAO,MAAM,SAAS,iBAAiB,MAAM,KAAK,MAAM,EAAE,MAAM;GACtE,OAAO,OAAO,EAAE,OAAO,KAAK,EAAE,IAAI,OAAO,QAAQ;EAClD,CAAC;EAED,IAAI;EACJ,IAAI,SAAS,WAAW,GACvB,WAAW;OAOX,WAAW,sBALG,SAAS,MAAM,GAAG,eAAe,CAAC,CAAC,KAAK,IAKjB,IAHpC,SAAS,SAAS,kBACf,SAAS,SAAS,SAAS,gBAAgB,KAC3C;EAIL,OAAO,GAAG,IAAI,kCAAkC,MAAM,KAAK,IAAI,EAAE,MAAM;CACxE;AACD;;;;;;;;;;;;;;;;AAiBA,SAAgB,eAAe,QAA8B;CAC5D,MAAM,WAAuC,CAAC;CAC9C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAC/C,SAAS,OAAO,OAAO,UAAU,WAAW,KAAK,EAAE,MAAM,MAAM,KAAK;CAErE,OAAO,OAAO,KAAK,IAAIC,2BAAAA,mBAAmB,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC;AAC1E;;;;;;;;;;;;;;;;;;;AAoBA,IAAa,eAAb,MAA0B;;CAEzB;;CAEA;CACA;CACA;;CAEA;CAEA,YAAY,OAAmB,UAA+B,CAAC,GAAG;EACjE,MAAM,EAAE,UAAU,YAAY,CAAC,GAAG,YAAY;EAC9C,KAAK,UAAU;EACf,KAAK,iBAAiB,IAAI,IACzB,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAC5C,MACA,eAAe,GAAG,OAAO,MAAM,CAAC,CACjC,CAAC,CACF;EACA,KAAK,WAAW,CAAC,GAAG,KAAK,eAAe,OAAO,CAAC,CAAC,CAAC,KAAK;EACvD,KAAK,gBAAgB;GACpB,GAAG,KAAK;GACR,GAAI,WAAW,kBAAkB,YAAY,CAAC;GAC9C,GAAG;EACJ;EACA,KAAK,eAAe,IAAI,IAAI,KAAK,aAAa;CAC/C;;;;;;CAOA,uBAAuB,kBAA+C;EACrE,MAAM,YAAY,IAAI,IACrB,iBAAiB,KAAK,MAAO,EAAE,SAAS,GAAG,IAAI,EAAE,MAAM,GAAG,EAAE,IAAI,CAAE,CACnE;EACA,MAAM,YAAsB,CAAC;EAC7B,KAAK,MAAM,CAAC,MAAM,SAAS,KAAK,gBAC/B,IAAI,KAAK,MAAM,MAAM,UAAU,IAAI,CAAC,CAAC,GAAG,UAAU,KAAK,IAAI;EAE5D,OAAO;CACR;;;;;;CAOA,SAAS,kBAAuD;EAC/D,MAAM,cAAc,iBAAiB,QAAQ,WAAW;GACvD,IAAI,OAAO,SAAS,GAAG,GAAG,OAAO;GACjC,OAAO,CAAC,KAAK,aAAa,IAAI,MAAM;EACrC,CAAC;EAED,MAAM,cAAwC,CAAC;EAC/C,KAAK,MAAM,UAAU,aAAa;GACjC,MAAM,UAAU,eAAe,QAAQ,KAAK,aAAa;GACzD,IAAI,QAAQ,QAAQ,YAAY,UAAU;EAC3C;EAEA,OAAO;GACN,OAAO,YAAY,WAAW;GAC9B;GACA,eAAe,KAAK;GACpB;EACD;CACD;;;;;;;CAQA,OAAO,kBAA2C;EACjD,MAAM,EAAE,OAAO,aAAa,gBAAgB,KAAK,SAAS,gBAAgB;EAE1E,IAAI,CAAC,OACJ,MAAM,IAAI,mBAAmB;GAC5B,SAAS;GACT,WAAW,KAAK;GAChB,UAAU,KAAK;GACf;GACA,SAAS,KAAK;EACf,CAAC;CAEH;;;;;CAMA,IAAI,QAAyB;EAC5B,OAAO,KAAK,aAAa,IAAI,MAAM;CACpC;AACD;;;;;;;;;;;;;;;;;;;AC/SA,SAAgB,qBACf,QACsE;CACtE,OAAO,IAAI,sBAAsB,MAAM,CAAC,CAAC,MAAM;AAChD"}

package/dist/sst.d.cts

@@ -1,12 +1,10 @@
-import { EnvRecord, EnvValue, EnvironmentBuilderOptions, EnvironmentResolver, InputValue, Resolvers, environmentCase } from "./EnvironmentBuilder-DeIle4QN.cjs";
-
+import { a as EnvironmentResolver, i as EnvironmentBuilderOptions, n as EnvValue, o as InputValue, s as Resolvers, t as EnvRecord, u as environmentCase } from "./EnvironmentBuilder-DTZ8o3se.cjs";
 //#region src/SstEnvironmentBuilder.d.ts
-
 /**
  * Enumeration of supported SST (Serverless Stack Toolkit) resource types.
  * Used to identify and process different AWS and SST resources.
  */
-declare enum ResourceType {
+export declare enum ResourceType {
   ApiGatewayV2 = "sst.aws.ApiGatewayV2",
   Postgres = "sst.aws.Postgres",
   Function = "sst.aws.Function",
@@ -27,6 +25,9 @@ declare enum ResourceType {
   StaticSite = "sst:aws:StaticSite",
   Email = "gkm:aws:Email",
   Cache = "gkm:aws:Cache",
+  ExternalApi = "gkm:aws:ExternalApi",
+  Credential = "gkm:aws:Credential",
+  Encryption = "gkm:aws:Encryption"
 }
 /**
  * AWS API Gateway V2 resource type.
@@ -121,7 +122,7 @@ type ResourceProcessor<K> = (name: string, value: K) => EnvRecord;
 /**
  * Pre-configured resolvers for all SST resource types.
  */
-declare const sstResolvers: Resolvers;
+export declare const sstResolvers: Resolvers;
 /**
  * All known SST resource type strings.
  */
@@ -141,7 +142,7 @@ type OmitType<T> = T extends {
 /**
  * Extracts all unique `type` values from a record (excluding plain strings).
  */
-type AllTypeValues<TRecord extends Record<string, InputValue>> = { [K in keyof TRecord]: ExtractType<TRecord[K]> }[keyof TRecord];
+type AllTypeValues<TRecord extends Record<string, InputValue>> = { [K in keyof TRecord]: ExtractType<TRecord[K]>; }[keyof TRecord];
 /**
  * Extracts only the custom (non-SST) type values from a record.
  */
@@ -151,11 +152,11 @@ type CustomTypeValues<TRecord extends Record<string, InputValue>> = Exclude<AllT
  */
 type ValueForType<TRecord extends Record<string, InputValue>, TType extends string> = { [K in keyof TRecord]: TRecord[K] extends {
   type: TType;
-} ? OmitType<TRecord[K]> : never }[keyof TRecord];
+} ? OmitType<TRecord[K]> : never; }[keyof TRecord];
 /**
  * Generates typed resolvers for custom (non-SST) types in the input record.
  */
-type CustomResolvers<TRecord extends Record<string, InputValue>> = CustomTypeValues<TRecord> extends never ? Resolvers | undefined : { [TType in CustomTypeValues<TRecord>]: EnvironmentResolver<ValueForType<TRecord, TType>> };
+type CustomResolvers<TRecord extends Record<string, InputValue>> = CustomTypeValues<TRecord> extends never ? Resolvers | undefined : { [TType in CustomTypeValues<TRecord>]: EnvironmentResolver<ValueForType<TRecord, TType>>; };
 /**
  * SST-specific environment builder with built-in resolvers for all known
  * SST resource types.
@@ -185,7 +186,7 @@ type CustomResolvers<TRecord extends Record<string, InputValue>> = CustomTypeVal
  * ).build();
  * ```
  */
-declare class SstEnvironmentBuilder<TRecord extends Record<string, SstResource | InputValue | string>> {
+export declare class SstEnvironmentBuilder<TRecord extends Record<string, SstResource | InputValue | string>> {
   private readonly builder;
   /**
    * Create a new SST environment builder.
@@ -209,21 +210,21 @@ declare class SstEnvironmentBuilder<TRecord extends Record<string, SstResource |
  * assumed — opt in via `platform: 'aws'` or by spreading {@link AWS_RUNTIME_ENV_VARS}
  * into `whitelist`.
  */
-declare const AWS_RUNTIME_ENV_VARS: readonly ["AWS_REGION", "AWS_DEFAULT_REGION", "AWS_ENDPOINT_URL", "AWS_ENDPOINT", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_VERSION"];
+export declare const AWS_RUNTIME_ENV_VARS: readonly ['AWS_REGION', 'AWS_DEFAULT_REGION', 'AWS_ENDPOINT_URL', 'AWS_ENDPOINT', 'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN', 'AWS_LAMBDA_FUNCTION_NAME', 'AWS_LAMBDA_FUNCTION_VERSION'];
 /**
  * Variables GCP injects into Cloud Functions / Cloud Run.
  */
-declare const GCP_RUNTIME_ENV_VARS: readonly ["GOOGLE_CLOUD_PROJECT", "GCP_PROJECT", "FUNCTION_TARGET", "FUNCTION_SIGNATURE_TYPE", "K_SERVICE", "K_REVISION", "K_CONFIGURATION", "PORT"];
+export declare const GCP_RUNTIME_ENV_VARS: readonly ['GOOGLE_CLOUD_PROJECT', 'GCP_PROJECT', 'FUNCTION_TARGET', 'FUNCTION_SIGNATURE_TYPE', 'K_SERVICE', 'K_REVISION', 'K_CONFIGURATION', 'PORT'];
 /**
  * Variables Cloudflare exposes to Workers. Workers inject almost nothing into
  * the global env, so this is intentionally minimal.
  */
-declare const CLOUDFLARE_RUNTIME_ENV_VARS: readonly ["CF_PAGES", "CF_PAGES_URL"];
+export declare const CLOUDFLARE_RUNTIME_ENV_VARS: readonly ['CF_PAGES', 'CF_PAGES_URL'];
 /**
  * Registry of platform → always-valid runtime variables. Export, don't assume:
  * a caller states the platform it deploys to and the matching set is trusted.
  */
-declare const PLATFORM_ENV_VARS: {
+export declare const PLATFORM_ENV_VARS: {
   readonly aws: readonly ["AWS_REGION", "AWS_DEFAULT_REGION", "AWS_ENDPOINT_URL", "AWS_ENDPOINT", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_VERSION"];
   readonly gcp: readonly ["GOOGLE_CLOUD_PROJECT", "GCP_PROJECT", "FUNCTION_TARGET", "FUNCTION_SIGNATURE_TYPE", "K_SERVICE", "K_REVISION", "K_CONFIGURATION", "PORT"];
   readonly cloudflare: readonly ["CF_PAGES", "CF_PAGES_URL"];
@@ -233,7 +234,7 @@ type Platform = keyof typeof PLATFORM_ENV_VARS;
  * The always-valid runtime variables for a platform. The "whitelist construct":
  * resolve a platform to its set, to spread into `whitelist` or compare against.
  */
-declare function platformEnvVars(platform: Platform): readonly string[];
+export declare function platformEnvVars(platform: Platform): readonly string[];
 /**
  * Input shape for the validator: the same record `SstEnvironmentBuilder`
  * accepts — keyed by resource name, valued by an SST resource (or a plain
@@ -271,7 +272,7 @@ interface EnvValidatorOptions {
  * provide. Carries the structured `missing`/`available`/`suggestions` so callers
  * can inspect the failure programmatically, not just read the message.
  */
-declare class EnvValidationError extends Error {
+export declare class EnvValidationError extends Error {
   readonly isEnvValidationError = true;
   readonly missing: string[];
   readonly available: string[];
@@ -301,7 +302,7 @@ declare class EnvValidationError extends Error {
  * resolveEnvKeys({ db: { type: ResourceType.Postgres } });
  * // ['DB_NAME', 'DB_HOST', 'DB_PASSWORD', 'DB_PORT', 'DB_USERNAME', 'DB_URL']
  */
-declare function resolveEnvKeys(record: LinkRecord): string[];
+export declare function resolveEnvKeys(record: LinkRecord): string[];
 /**
  * Validates that the environment variables a deployable unit requires are
  * actually provided by its linked resources — at infra time, before deploy.
@@ -320,7 +321,7 @@ declare function resolveEnvKeys(record: LinkRecord): string[];
  * validator.assert(['DB_HOST', 'AWS_REGION', 'APP_NAME', 'SENTRY_DSN?']); // ok
  * validator.assert(['DATABASE_URL']); // throws EnvValidationError (did you mean DB_URL?)
  */
-declare class EnvValidator {
+export declare class EnvValidator {
   /** Every variable available — link-derived, platform, and extra whitelist. */
   readonly availableVars: string[];
   /** Just the variables the links provide (used for error context). */
@@ -355,7 +356,6 @@ declare class EnvValidator {
    */
   has(envVar: string): boolean;
 }
-//# sourceMappingURL=SstEnvValidator.d.ts.map
 //#endregion
 //#region src/sst.d.ts
 /**
@@ -374,13 +374,11 @@ declare class EnvValidator {
  * // New usage:
  * new SstEnvironmentBuilder({ database: postgresResource }).build()
  */
-declare function normalizeResourceEnv(record: Record<string, SstResource | string>): Record<string, string | number | boolean | Record<string, unknown>>;
+export declare function normalizeResourceEnv(record: Record<string, SstResource | string>): Record<string, string | number | boolean | Record<string, unknown>>;
 /**
  * @deprecated Use `SstResource` instead.
  */
-type Resource = SstResource;
-//# sourceMappingURL=sst.d.ts.map
-
+export type Resource = SstResource;
 //#endregion
-export { AWS_RUNTIME_ENV_VARS, ApiGatewayV2, Bucket, CLOUDFLARE_RUNTIME_ENV_VARS, Dynamo, EnvRecord, EnvValidationError, EnvValidator, EnvValidatorOptions, EnvValue, EnvironmentBuilderOptions, Function, GCP_RUNTIME_ENV_VARS, LinkRecord, PLATFORM_ENV_VARS, Platform, Postgres, Queue, Resource, ResourceProcessor, ResourceType, Secret, SnsTopic, SstEnvironmentBuilder, SstResource, ValidationResult, Vpc, environmentCase, normalizeResourceEnv, platformEnvVars, resolveEnvKeys, sstResolvers };
+export { type ApiGatewayV2, type Bucket, type Dynamo, type EnvRecord, type EnvValidatorOptions, type EnvValue, type EnvironmentBuilderOptions, type Function, type LinkRecord, type Platform, type Postgres, type Queue, type ResourceProcessor, type Secret, type SnsTopic, type SstResource, type ValidationResult, type Vpc, environmentCase };
 //# sourceMappingURL=sst.d.cts.map

package/dist/sst.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"sst.d.cts","names":[],"sources":["../src/SstEnvironmentBuilder.ts","../src/SstEnvValidator.ts","../src/sst.ts"],"sourcesContent":[],"mappings":";;;;;;AAaA;AAoCA;AAAwB,aApCZ,YAAA;EAoCY,YACjB,GAAA,sBAAa;EAAY,QAAG,GAAA,kBAAa;EAAe,QAAA,GAAA,kBAAA;EAQnD,aAAQ,GAAA,gBAAA;EAAA,GAAA,GAAA,aAAA;EAAA,MACb,GAAA,gBAAa;EAAQ,MAAG,GAAA,gBAAa;EAAW,KAAA,GAAA,eAAA;EAW3C,SAAA,GAAQ,gBAAA;EAAA,WAAA,GAAA,kBAAA;EAAA,eACb,GAAa,sBAAA;EAAQ,WAAG,GAAA,kBAAa;EAAW,gBAAA,GAAA,gBAAA;EAO3C,QAAA,GAAM,kBAAA;EAAA,SAAA,GAAA,gBAAA;EAAA,QACX,GAAA,eAAa;EAAa,UAAG,GAAA,gBAAa;EAAgB,UAAA,GAAA,oBAAA;EAcrD,KAAA,GAAG,eACR;EAOK,KAAA,GAAA,eAAM;;;;AACiC;AAOnD;AAQY,KApEA,YAAA,GAoEK;EAAA,IAAA,EAnEV,YAAA,CAAa,YAmEH,GAnEkB,YAAA,CAAa,eAmE/B;EAAA,GACV,EAAA,MAAA;CAAkB;AAAwB;AAQjD;;;AAC6B,KArEjB,QAAA,GAqE8B;EAAS,IAAA,EApE5C,YAAA,CAAa,QAoE+B,GApEpB,YAAA,CAAa,WAoEO;EAOvC,QAAA,EAAA,MAAW;EAAA,IAAA,EAAA,MAAA;EAAA,QACpB,EAAA,MAAA;EAAY,IACZ,EAAA,MAAA;EAAQ,QACR,EAAA,MAAA;CAAQ;;;;AAKR,KAxES,QAAA,GAwET;EAAK,IACL,EAxEI,YAAA,CAAa,QAwEjB,GAxE4B,YAAA,CAAa,WAwEzC;EAAM,IAAA,EAAA,MAAA;AAkBT,CAAA;;;;AAAwE,KAnF5D,MAAA,GAmF4D;EAkD3D,IAAA,EApIN,YAAA,CAAa,aAoIO,GApIS,YAAA,CAAa,gBAwJhD;EAKI,IAAA,EAAA,MAAA;EAKA;;;;AAA+D;EAK/D,MAAA,CAAA,EAAA,MAAQ;EAAA,GAAA,CAAA,EAAA,MAAA;CAAA;;;AAAuC;AAK/C,KA9JO,GAAA,GA8JP;EAAa,IAAA,EA7JX,YAAA,CAAa,GA6JF;EAAA,OAAgC,EAAA,MAAA;CAAU;;;;AACrC,KAvJX,MAAA,GAuJW;EAAW,IAC1B,EAvJD,YAAA,CAAa,MAuJZ,GAvJqB,YAAA,CAAa,SAuJlC;EAAO,KAAA,EAAA,MAAA;AAAA,CAAA;;;;AAMA,KAtJH,QAAA,GAsJG;EAAO,IAArB,EArJM,YAAA,CAAa,QAqJnB;EAAa,GACb,EAAA,MAAA;CAAqB;AAFqD;AAAA;;AAS3C,KAtJpB,KAAA,GAsJoB;EAAU,IAAzB,EArJV,YAAA,CAAa,KAqJH,GArJW,YAAA,CAAa,QAqJxB;EAAM,GAGV,EAAA,MAAA;EAAO,GAAG,EAAA,MAAA;CAAO;;;;AAC1B,KAjJQ,MAAA,GAiJR;EAAQ,IAEJ,EAlJD,YAAA,CAAa,MAkJZ,GAlJqB,YAAA,CAAa,SAkJlC;EAAO,IAAA,EAAA,MAAA;AAAA,CAAA;;;;AAMG,KAjJN,WAAA,GACT,YAgJe,GA/If,QA+Ie,GA9If,QA8Ie,GA7If,MA6Ie,GA5If,GA4Ie,GA3If,MA2Ie,GA1If,QA0Ie,GAzIf,KAyIe,GAxIf,MAwIe;;;;;;;;;AAG2C,KAzHjD,iBAyHiD,CAAA,CAAA,CAAA,GAAA,CAAA,IAAA,EAAA,MAAA,EAAA,KAAA,EAzHJ,CAyHI,EAAA,GAzHE,SAyHF;AAkC7D;;;AAC8C,cA1GjC,YA0GiC,EA1GnB,SA0GmB;;;;KAjFzC,qBAAA,GAiGmB,GAjGQ,YAiGR,EAAA;;;AAoBL;KAhHd,iBAAiB;;IAA6C;ACzOnE;AAeA;AAeA;AASA,KDuMK,QCvMQ,CAAA,CAAA,CAAA,GDuMM,CCvMN,SAIH;EAEE,IAAA,EAAA,MAAQ;AAMpB,CAAA,GD2LgD,IC3LhC,CD2LqC,CC3LrC,EAAA,MAAA,CAAA,GAAe,KAAA;AAe/B;;;KDiLK,aCjLiD,CAAA,gBDiLnB,MCjLmB,CAAA,MAAA,EDiLJ,UCjLI,CAAA,CAAA,GAAA,QAA7B,MDkLZ,OClLY,GDkLF,WClLE,CDkLU,OClLV,CDkLkB,CClLlB,CAAA,CAAA,EAAM,CAAA,MDmLvB,OCnLuB,CAAA;AAE/B;AAUA;AAqFA;KDuFK,gBCvF2B,CAAA,gBDuFM,MCvFN,CAAA,MAAA,EDuFqB,UCvFrB,CAAA,CAAA,GDuFoC,OCvFpC,CDwF/B,aCxF+B,CDwFjB,OCxFiB,CAAA,EDyF/B,qBCzF+B,CAAA;;;;AAAa,KD+FxC,YC/FwC,CAAA,gBDgG5B,MChG4B,CAAA,MAAA,EDgGb,UChGa,CAAA,EAAA,cAAA,MAAA,CAAA,GAAA,QA2E7B,MDwBH,OCxBiB,GDwBP,OCxBgB,CDwBR,CCxBQ,CAAA,SAAU;EA0BpC,IAAA,EDFqC,KCEzB;AAAA,CAAA,GDDrB,QCCqB,CDDZ,OCCY,CDDJ,CCCI,CAAA,CAAA,GAAA,KAAA,EAAA,CAAA,MDCjB,OCSY,CAAA;;;AAuC4C;KD3C3D,gCAAgC,eAAe,eACnD,iBAAiB,yBACd,oCAEU,iBAAiB,WAAW,oBACrC,aAAa,SAAS;AE1N3B;;;;;;AAES;AAQT;;;;;;;;;;;;;;;;;;;;;;cFiPa,sCACI,eAAe,cAAc;;;;;;;;;sBAepC,+BACc,gBAAgB,oBAC5B;;;;;;WAmBF;;;;;AApVV;AAoCA;;;AACmC,cC1CtB,oBD0CmC,EAAA,SAAA,CAAA,YAAA,EAAA,oBAAA,EAAA,kBAAA,EAAA,cAAA,EAAA,mBAAA,EAAA,uBAAA,EAAA,mBAAA,EAAA,0BAAA,EAAA,6BAAA,CAAA;AAAe;AAQ/D;;AACO,cCpCM,oBDoCO,EAAA,SAAA,CAAA,sBAAA,EAAA,aAAA,EAAA,iBAAA,EAAA,yBAAA,EAAA,WAAA,EAAA,YAAA,EAAA,iBAAA,EAAA,MAAA,CAAA;;AAAmC;AAWvD;;AACO,cCjCM,2BDiCO,EAAA,SAAA,CAAA,UAAA,EAAA,cAAA,CAAA;;AAAmC;AAOvD;;AACO,cChCM,iBDgCO,EAAA;EAAa,SAAG,GAAA,EAAA,SAAa,CAAA,YAAA,EAAA,oBAAA,EAAA,kBAAA,EAAA,cAAA,EAAA,mBAAA,EAAA,uBAAA,EAAA,mBAAA,EAAA,0BAAA,EAAA,6BAAA,CAAA;EAAgB,SAAA,GAAA,EAAA,SAAA,CAAA,sBAAA,EAAA,aAAA,EAAA,iBAAA,EAAA,yBAAA,EAAA,WAAA,EAAA,YAAA,EAAA,iBAAA,EAAA,MAAA,CAAA;EAcrD,SAAG,UACR,EAAA,SAAa,CAAA,UAAG,EAAA,cAAA,CAAA;AAOvB,CAAA;AAAkB,KChDN,QAAA,GDgDM,MAAA,OChDkB,iBDgDlB;;;AACiC;AAOnD;AAQY,iBC1DI,eAAA,CD0DC,QAAA,EC1DyB,QD0DzB,CAAA,EAAA,SAAA,MAAA,EAAA;;;;AACgC;AAQjD;AAAkB,KCpDN,UAAA,GAAa,MDoDP,CAAA,MAAA,ECpDsB,WDoDtB,GCpDoC,UDoDpC,GAAA,MAAA,CAAA;AACX,UCnDU,gBAAA,CDmDG;EAAM,KAAG,EAAA,OAAA;EAAsB;EAOvC,WAAA,EAAA,MAAW,EAAA;EAAA;EAAA,aACpB,EAAA,MAAA,EAAA;EAAY;EACJ,WACR,ECtDW,MDsDX,CAAA,MAAA,EAAA,MAAA,EAAA,CAAA;;AAEA,UCrDc,mBAAA,CDqDd;EAAG;;;;EAIG,QAAA,CAAA,ECpDG,QDoDH;EAkBG;;;;EAA4D,SAAA,CAAA,EAAA,SAAA,MAAA,EAAA;EAkD3D;AAoBX;AAK0C;;EAK5B,OAAM,CAAA,EAAA,MAAA;;AAA8C;AAAA;;;;AAKpB,cC3EnC,kBAAA,SAA2B,KAAA,CD2EQ;EAAI,SAAA,oBAAA,GAAA,IAAA;EAK/C,SAAA,OAAa,EAAA,MAAA,EAAA;EAAA,SAAA,SAAA,EAAA,MAAA,EAAA;EAAA,SAAgC,WAAA,EC5E3B,MD4E2B,CAAA,MAAA,EAAA,MAAA,EAAA,CAAA;EAAU,SAAzB,OAAA,CAAA,EAAA,MAAA;EAAM,WAC5B,CAAA,IAAA,EAAA;IAAsB,OAAA,EAAA,MAAA,EAAA;IAAQ,SAAA,EAAA,MAAA,EAAA;IAApB,QAAA,EAAA,MAAA,EAAA;IACf,WAAA,ECvEO,MDuEP,CAAA,MAAA,EAAA,MAAA,EAAA,CAAA;IAAO,OAAA,CAAA,EAAA,MAAA;EAKV,CAAA;EAAgB,eAAA,MAAA;;;;;;;AAAsD;AAAA;;;;;;;;;AAatD,iBCzBL,cAAA,CDyBK,MAAA,ECzBkB,UDyBlB,CAAA,EAAA,MAAA,EAAA;;;AAEN;AAAA;;;;;;;;;;;;;AAS8C;AAkC7D;AAAkC,cC5CrB,YAAA,CD4CqB;EAAA;EACS,SAAG,aAAA,EAAA,MAAA,EAAA;EAAU;EAAjC,SAeb,QAAA,EAAA,MAAA,EAAA;EAAO,SACuB,OAAA,CAAA,EAAA,MAAA;EAAO,iBAAvB,YAAA;EAAe;EACF,iBAmB3B,cAAA;EAAS,WAAA,CAAA,KAAA,ECvEC,UDuED,EAAA,OAAA,CAAA,ECvEsB,mBDuEtB;;;;ACzVnB;AAeA;EAea,sBAAA,CAAA,gBAGH,EAAA,SAAA,MAAA,EAAA,CAAA,EAAA,MAAA,EAAA;EAMG;AAMb;AAMA;AAeA;;EAAsB,QAAkB,CAAA,gBAAA,EAAA,SAAA,MAAA,EAAA,CAAA,EAuPQ,gBAvPR;EAAW;;AAApB;AAE/B;AAUA;AAqFA;EAAgC,MAAA,CAAA,gBAAA,EAAA,SAAA,MAAA,EAAA,CAAA,EAAA,IAAA;EAAA;;;AAAa;EA2E7B,GAAA,CAAA,MAAA,EAAA,MAAc,CAAA,EAAA,OAAS;AA0BvC;;;;;;;AD9N+D;AAQ/D;;;;AACuD;AAWvD;;;;AACuD;AAOvD;;AACO,iBEdS,oBAAA,CFcI,MAAA,EEbX,MFaW,CAAA,MAAA,EEbI,WFaJ,GAAA,MAAA,CAAA,CAAA,EEZjB,MFYiB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,GEZ0B,MFY1B,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA;;AAA6C;AAcjE;AAQY,KE1BA,QAAA,GAAW,WF0BL"}
+{"version":3,"file":"sst.d.cts","names":[],"sources":["../src/SstEnvironmentBuilder.ts","../src/SstEnvValidator.ts","../src/sst.ts"],"mappings":";;;;;;oBAaY;EAEX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAGA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAKA;EACA;EAGA;EACA;EAEA;EAGA;EAEA;;;;;;KAOW;EACX,MAAM,aAAa,eAAe,aAAa;EAC/C;;;;;;KAOW;EACX,MAAM,aAAa,WAAW,aAAa;EAC3C;EACA;EACA;EACA;EACA;;;;;KAMW;EACX,MAAM,aAAa,WAAW,aAAa;EAC3C;;;;;KAMW;EACX,MAAM,aAAa,gBAAgB,aAAa;EAChD;;;;;;EAMA;EACA;;;;;KAMW;EACX,MAAM,aAAa;EACnB;;;;;KAMW;EACX,MAAM,aAAa,SAAS,aAAa;EACzC;;;;;KAMW;EACX,MAAM,aAAa;EACnB;;;;;KAMW;EACX,MAAM,aAAa,QAAQ,aAAa;EACxC;EACA;;;;;KAMW;EACX,MAAM,aAAa,SAAS,aAAa;EACzC;;;;;KAMW,cACT,eACA,WACA,WACA,SACA,MACA,SACA,WACA,QACA;;;;;;;;;KAqBS,kBAAkB,MAAM,cAAc,OAAO,MAAM;;;;qBA+DlD,cAAc;;;;KA4BtB,2BAA2B;;;;KAK3B,YAAY,KAAK;EAAY,YAAY;IAAqB;;;;KAK9D,SAAS,KAAK;EAAY;IAAiB,KAAK;;;;KAKhD,cAAc,gBAAgB,eAAe,kBAChD,WAAW,UAAU,YAAY,QAAQ,aACnC;;;;KAKH,iBAAiB,gBAAgB,eAAe,eAAe,QACnE,cAAc,UACd;;;;KAMI,aACJ,gBAAgB,eAAe,aAC/B,2BAEC,WAAW,UAAU,QAAQ;EAAa,MAAM;IAC9C,SAAS,QAAQ,qBAEb;;;;KAKH,gBAAgB,gBAAgB,eAAe,eACnD,iBAAiB,yBACd,2BAEC,SAAS,iBAAiB,WAAW,oBACrC,aAAa,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAiCd,sBACZ,gBAAgB,eAAe,cAAc;mBAE5B;;;;;;;;EAYjB,YACC,QAAQ,SACR,sBAAsB,gBAAgB,UACtC,UAAU;;;;;;EAmBX,SAAS;;;;;;;;;qBCnXG;;;;qBAeA;;;;;qBAeA;;;;;qBASA;WACZ;WACA;WACA;;KAGW,wBAAwB;;;;;wBAMpB,gBAAgB,UAAU;;;;;;KAe9B,aAAa,eAAe,cAAc;UAErC;EAChB;;EAEA;;EAEA;;EAEA,aAAa;;UAGG;;;;;EAKhB,WAAW;;;;;EAKX;;;;;EAKA;;;;;;;qBAsEY,2BAA2B;WAC9B;WACA;WACA;WACA,aAAa;WACb;EAET,YAAY;IACX;IACA;IACA;IACA,aAAa;IACb;;iBAgBc;;;;;;;;;;;;;;;;;wBA+CA,eAAe,QAAQ;;;;;;;;;;;;;;;;;;;qBA0B1B;;WAEH;;WAEA;WACA;mBACQ;;mBAEA;EAEjB,YAAY,OAAO,YAAY,UAAS;;;;;;EAuBxC,uBAAuB;;;;;;EAgBvB,SAAS,sCAAsC;;;;;;;EA0B/C,OAAO;;;;;EAkBP,IAAI;;;;;;;;;;;;;;;;;;;;wBC5SW,qBACf,QAAQ,eAAe,wBACrB,2CAA2C;;;;YAQlC,WAAW"}