@geekmidas/manifest 10.0.0-alpha.11 → 10.0.0-alpha.110

package/dist/index.cjs

@@ -1,13 +1,12 @@
-//#region rolldown:runtime
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJS = (cb, mod) => function() {
-	return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];
@@ -18,13 +17,11 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
-
 //#endregion
-
 //#region src/declaration.ts
 /**
 * The version used when a database names none.
@@ -37,6 +34,19 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 */
 const DEFAULT_POSTGRES_VERSION = 18;
 /**
+* What a `Telemetry` node provides to each process with an edge to it.
+*
+* `OTEL_SERVICE_NAME` is resolved per process — the app's name — so it is
+* listed here but composed by whichever target hands it over.
+*/
+const TELEMETRY_KEYS = [
+	"OTEL_EXPORTER_OTLP_ENDPOINT",
+	"OTEL_EXPORTER_OTLP_HEADERS",
+	"OTEL_SERVICE_NAME",
+	"OTEL_TRACES_SAMPLER",
+	"OTEL_TRACES_SAMPLER_ARG"
+];
+/**
 * What each kind may derive from.
 *
 * Small enough to state exhaustively, and stating it makes cycles impossible
@@ -60,23 +70,26 @@ const DERIVES_FROM = {
 const PUBLIC = {
 	objects: [],
 	"file-server": ["url"],
-	email: [],
+	email: ["inboxUrl"],
 	database: [],
 	"database-reader": [],
 	"database-schema": [],
 	cache: [],
 	secret: [],
 	credential: [],
+	encryption: [],
 	"rest-api": ["url"],
 	queue: [],
 	topic: [],
 	oidc: ["issuer", "audience"],
+	"external-api": [],
 	function: [],
 	cron: [],
+	"mobile-app": [],
 	site: ["url"],
-	worker: []
+	worker: [],
+	telemetry: []
 };
-
 //#endregion
 //#region src/errors.ts
 /**
@@ -135,20 +148,9 @@ var IllegalDerivation = class extends Error {
 		this.allowed = allowed;
 	}
 };
-
 //#endregion
-//#region ../../node_modules/.pnpm/lodash.snakecase@4.1.1/node_modules/lodash.snakecase/index.js
-var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.snakecase@4.1.1/node_modules/lodash.snakecase/index.js"(exports, module) {
-	/**
-	* lodash (Custom Build) <https://lodash.com/>
-	* Build: `lodash modularize exports="npm" -o ./`
-	* Copyright jQuery Foundation and other contributors <https://jquery.org/>
-	* Released under MIT license <https://lodash.com/license>
-	* Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>
-	* Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
-	*/
-	/** Used as references for various `Number` constants. */
-	var INFINITY = Infinity;
+//#region src/naming.ts
+var import_lodash_snakecase = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/** `Object#toString` result references. */
 	var symbolTag = "[object Symbol]";
 	/** Used to match words composed of alphanumeric characters. */
@@ -156,15 +158,46 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.snakecase@4.1
 	/** Used to match Latin Unicode letters (excluding mathematical operators). */
 	var reLatin = /[\xc0-\xd6\xd8-\xf6\xf8-\xff\u0100-\u017f]/g;
 	/** Used to compose unicode character classes. */
-	var rsAstralRange = "\\ud800-\\udfff", rsComboMarksRange = "\\u0300-\\u036f\\ufe20-\\ufe23", rsComboSymbolsRange = "\\u20d0-\\u20f0", rsDingbatRange = "\\u2700-\\u27bf", rsLowerRange = "a-z\\xdf-\\xf6\\xf8-\\xff", rsMathOpRange = "\\xac\\xb1\\xd7\\xf7", rsNonCharRange = "\\x00-\\x2f\\x3a-\\x40\\x5b-\\x60\\x7b-\\xbf", rsPunctuationRange = "\\u2000-\\u206f", rsSpaceRange = " \\t\\x0b\\f\\xa0\\ufeff\\n\\r\\u2028\\u2029\\u1680\\u180e\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200a\\u202f\\u205f\\u3000", rsUpperRange = "A-Z\\xc0-\\xd6\\xd8-\\xde", rsVarRange = "\\ufe0e\\ufe0f", rsBreakRange = rsMathOpRange + rsNonCharRange + rsPunctuationRange + rsSpaceRange;
+	var rsAstralRange = "\\ud800-\\udfff";
+	var rsComboMarksRange = "\\u0300-\\u036f\\ufe20-\\ufe23";
+	var rsComboSymbolsRange = "\\u20d0-\\u20f0";
+	var rsDingbatRange = "\\u2700-\\u27bf";
+	var rsLowerRange = "a-z\\xdf-\\xf6\\xf8-\\xff";
+	var rsMathOpRange = "\\xac\\xb1\\xd7\\xf7";
+	var rsNonCharRange = "\\x00-\\x2f\\x3a-\\x40\\x5b-\\x60\\x7b-\\xbf";
+	var rsPunctuationRange = "\\u2000-\\u206f";
+	var rsSpaceRange = " \\t\\x0b\\f\\xa0\\ufeff\\n\\r\\u2028\\u2029\\u1680\\u180e\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200a\\u202f\\u205f\\u3000";
+	var rsUpperRange = "A-Z\\xc0-\\xd6\\xd8-\\xde";
+	var rsVarRange = "\\ufe0e\\ufe0f";
+	var rsBreakRange = rsMathOpRange + rsNonCharRange + rsPunctuationRange + rsSpaceRange;
 	/** Used to compose unicode capture groups. */
-	var rsApos = "['’]", rsBreak = "[" + rsBreakRange + "]", rsCombo = "[" + rsComboMarksRange + rsComboSymbolsRange + "]", rsDigits = "\\d+", rsDingbat = "[" + rsDingbatRange + "]", rsLower = "[" + rsLowerRange + "]", rsMisc = "[^" + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + "]", rsFitz = "\\ud83c[\\udffb-\\udfff]", rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")", rsNonAstral = "[^" + rsAstralRange + "]", rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}", rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]", rsUpper = "[" + rsUpperRange + "]", rsZWJ = "\\u200d";
+	var rsApos = "['’]";
+	var rsBreak = "[" + rsBreakRange + "]";
+	var rsCombo = "[" + rsComboMarksRange + rsComboSymbolsRange + "]";
+	var rsDigits = "\\d+";
+	var rsDingbat = "[" + rsDingbatRange + "]";
+	var rsLower = "[" + rsLowerRange + "]";
+	var rsMisc = "[^" + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + "]";
+	var rsModifier = "(?:" + rsCombo + "|\\ud83c[\\udffb-\\udfff])";
+	var rsNonAstral = "[^" + rsAstralRange + "]";
+	var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
+	var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
+	var rsUpper = "[" + rsUpperRange + "]";
+	var rsZWJ = "\\u200d";
 	/** Used to compose unicode regexes. */
-	var rsLowerMisc = "(?:" + rsLower + "|" + rsMisc + ")", rsUpperMisc = "(?:" + rsUpper + "|" + rsMisc + ")", rsOptLowerContr = "(?:" + rsApos + "(?:d|ll|m|re|s|t|ve))?", rsOptUpperContr = "(?:" + rsApos + "(?:D|LL|M|RE|S|T|VE))?", reOptMod = rsModifier + "?", rsOptVar = "[" + rsVarRange + "]?", rsOptJoin = "(?:" + rsZWJ + "(?:" + [
+	var rsLowerMisc = "(?:" + rsLower + "|" + rsMisc + ")";
+	var rsUpperMisc = "(?:" + rsUpper + "|" + rsMisc + ")";
+	var rsOptLowerContr = "(?:" + rsApos + "(?:d|ll|m|re|s|t|ve))?";
+	var rsOptUpperContr = "(?:" + rsApos + "(?:D|LL|M|RE|S|T|VE))?";
+	var reOptMod = rsModifier + "?";
+	var rsOptVar = "[" + rsVarRange + "]?";
+	var rsOptJoin = "(?:" + rsZWJ + "(?:" + [
 		rsNonAstral,
 		rsRegional,
 		rsSurrPair
-	].join("|") + ")" + rsOptVar + reOptMod + ")*", rsSeq = rsOptVar + reOptMod + rsOptJoin, rsEmoji = "(?:" + [
+	].join("|") + ")" + rsOptVar + reOptMod + ")*";
+	var rsSeq = rsOptVar + reOptMod + rsOptJoin;
+	var rsEmoji = "(?:" + [
 		rsDingbat,
 		rsRegional,
 		rsSurrPair
@@ -463,18 +496,17 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.snakecase@4.1
 	function unicodeWords(string) {
 		return string.match(reUnicodeWord) || [];
 	}
-	/** Used for built-in method references. */
-	var objectProto = Object.prototype;
 	/**
 	* Used to resolve the
 	* [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
 	* of values.
 	*/
-	var objectToString = objectProto.toString;
+	var objectToString = Object.prototype.toString;
 	/** Built-in value references. */
 	var Symbol = root.Symbol;
 	/** Used to convert symbols to primitives and strings. */
-	var symbolProto = Symbol ? Symbol.prototype : void 0, symbolToString = symbolProto ? symbolProto.toString : void 0;
+	var symbolProto = Symbol ? Symbol.prototype : void 0;
+	var symbolToString = symbolProto ? symbolProto.toString : void 0;
 	/**
 	* The base implementation of `_.toString` which doesn't convert nullish
 	* values to empty strings.
@@ -487,7 +519,7 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.snakecase@4.1
 		if (typeof value == "string") return value;
 		if (isSymbol(value)) return symbolToString ? symbolToString.call(value) : "";
 		var result = value + "";
-		return result == "0" && 1 / value == -INFINITY ? "-0" : result;
+		return result == "0" && 1 / value == -Infinity ? "-0" : result;
 	}
 	/**
 	* Creates a function like `_.camelCase`.
@@ -644,11 +676,7 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.snakecase@4.1
 		return string.match(pattern) || [];
 	}
 	module.exports = snakeCase;
-} });
-
-//#endregion
-//#region src/naming.ts
-var import_lodash = __toESM(require_lodash(), 1);
+})))(), 1);
 /**
 * `UPPER_SNAKE_CASE`, with numbers kept against the word they follow.
 *
@@ -660,7 +688,7 @@ var import_lodash = __toESM(require_lodash(), 1);
 * @example environmentCase('api2')      // 'API2'  (digit joins its word)
 */
 function environmentCase(name) {
-	return (0, import_lodash.default)(name).toUpperCase().replace(/_\d+/g, (r) => r.replace("_", ""));
+	return (0, import_lodash_snakecase.default)(name).toUpperCase().replace(/_\d+/g, (r) => r.replace("_", ""));
 }
 /**
 * The env key a construct provides for one of its roles.
@@ -685,7 +713,7 @@ function provideKey(id, role) {
 * @example canonicalId('user-uploads') // 'UserUploads'
 */
 function canonicalId(input) {
-	const id = (0, import_lodash.default)(input).split("_").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+	const id = (0, import_lodash_snakecase.default)(input).split("_").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
 	if (!VALID_ID.test(id)) throw new InvalidConstructId(input, id);
 	return id;
 }
@@ -835,9 +863,10 @@ function cookieDomain(urls) {
 * cannot catch anything.
 */
 function providedKeyFor(id, kind, role) {
-	return kind === "secret" ? environmentCase(id) : provideKey(id, role);
+	if (kind === "secret") return environmentCase(id);
+	if (kind === "telemetry") return "OTEL_EXPORTER_OTLP_ENDPOINT";
+	return provideKey(id, role);
 }
-
 //#endregion
 //#region src/derive.ts
 /** Whether a declaration names a parent. */
@@ -899,10 +928,15 @@ function dependenciesOf(declaration) {
 	const own = "dependencies" in declaration ? declaration.dependencies ?? [] : [];
 	const calls = "calls" in declaration ? declaration.calls ?? [] : [];
 	const nested = declaration.kind === "rest-api" ? declaration.endpoints.flatMap((endpoint) => endpoint.dependencies) : [];
+	const telemetry = "telemetry" in declaration && typeof declaration.telemetry === "string" ? [{
+		target: declaration.telemetry,
+		kind: "telemetry"
+	}] : [];
 	return [
 		...own,
 		...calls,
-		...nested
+		...nested,
+		...telemetry
 	];
 }
 /**
@@ -936,11 +970,13 @@ function dependentsOf(manifest, id) {
 const PUBLIC_PREFIX = {
 	static: "VITE_",
 	tanstack: "VITE_",
-	next: "NEXT_PUBLIC_"
+	next: "NEXT_PUBLIC_",
+	expo: "EXPO_PUBLIC_"
 };
 /**
 * The keys a site's bundle needs, mapped to the key each value comes from —
-* `{ VITE_API_URL: 'API_URL' }`.
+* `{ VITE_API_URL: 'API_URL' }` — its edges' public values, and a site's own
+* address (`{ VITE_WEB_URL: 'WEB_URL' }`).
 *
 * A rename, not a second derivation: `API_URL` is resolved once, by whatever
 * resolved it for the server, and the site reads the same value under the name
@@ -959,6 +995,10 @@ const PUBLIC_PREFIX = {
 function publicEnvFor(declaration, manifest) {
 	const prefix = PUBLIC_PREFIX[declaration.variant];
 	const keys = {};
+	if (declaration.kind === "site") {
+		const own = provideKey(declaration.id, "url");
+		keys[`${prefix}${own}`] = own;
+	}
 	for (const edge of declaration.dependencies) {
 		const target = manifest[edge.target];
 		if (!target) continue;
@@ -969,38 +1009,269 @@ function publicEnvFor(declaration, manifest) {
 	}
 	return keys;
 }
-
 //#endregion
-//#region src/index.ts
-/** Flatten a manifest field (array or partitioned) into a plain array. */
-function flattenManifestField(field) {
-	if (!field) return [];
-	return Array.isArray(field) ? [...field] : Object.values(field).flat();
+//#region src/encryption.ts
+/**
+* The `kms://` URL an `Encryption` construct reads on AWS.
+*
+* Here because two packages meet on it: `@geekmidas/cloud` composes it from
+* the keys it provisioned, and `@geekmidas/constructs` parses it to reach
+* them. One function, so the two cannot disagree about a parameter's name.
+*/
+const KMS_SCHEME = "kms:";
+/**
+* `kms://<region>?key=<key arn>&index=<hmac key arn>[&endpoint=<url>]`
+*
+* `endpoint` reaches an emulator instead of AWS — floci, locally and in tests —
+* the same parameter an `sns://` connection string carries for the same reason.
+*/
+function kmsUrl(input) {
+	const query = new URLSearchParams({
+		key: input.key,
+		index: input.index,
+		...input.endpoint ? { endpoint: input.endpoint } : {}
+	});
+	return `${KMS_SCHEME}//${input.region}?${query}`;
+}
+//#endregion
+//#region src/external.ts
+/** The key in a by-stage `url` that answers for every stage not listed. */
+const DEFAULT_STAGE_URL = "default";
+/**
+* Where an external API answers on a deployed stage.
+*
+* One URL answers every stage; a record answers by stage name, falling back
+* to `default`. Read at build and deploy, so a stage nobody gave a URL fails
+* there — with the stage named — rather than at the first request.
+*
+* @throws {NoUrlForStage} when a record names neither the stage nor a default.
+*/
+function externalApiUrl(declaration, stage) {
+	const { url } = declaration;
+	if (typeof url === "string") return url;
+	const resolved = url[stage] ?? url["default"];
+	if (!resolved) throw new NoUrlForStage(declaration.id, stage, Object.keys(url));
+	return resolved;
+}
+/** An external API's `url` record has nothing for the stage being deployed. */
+var NoUrlForStage = class extends Error {
+	id;
+	stage;
+	stages;
+	constructor(id, stage, stages) {
+		super(`'${id}' has no URL for the stage '${stage}': its url names ${stages.length ? stages.map((s) => `'${s}'`).join(", ") : "no stages"}. Add '${stage}', or a '${DEFAULT_STAGE_URL}' for every stage not listed.`);
+		this.id = id;
+		this.stage = stage;
+		this.stages = stages;
+		this.name = "NoUrlForStage";
+	}
+};
+//#endregion
+//#region src/headers.ts
+/**
+* Headers gkm reserves for its own services' calls to each other.
+*
+* Shared by `@geekmidas/constructs`, which sends and reads them, and
+* `@geekmidas/cli`, whose edges strip them from every request that arrives
+* from outside — so the two cannot name them differently.
+*/
+/**
+* The address of the client a service-to-service call is made on behalf of.
+*
+* An API asking its auth server for a session sends the client's address in
+* this rather than `X-Forwarded-For`: a forwarding header marks a request as
+* outside traffic, which would start the auth server's span in a new trace,
+* and the address is still needed — Better Auth rate-limits per client.
+*
+* Reserved: the stack's edge (Caddy, Traefik, the `gkm dev` edge) removes it
+* from incoming requests, and the auth server ignores it on any request that
+* is not an internal caller's, so it cannot be spoofed from outside.
+*/
+const CLIENT_IP_HEADER = "x-gkm-client-ip";
+//#endregion
+//#region src/migrations.ts
+/** Where every construct's folder lives, from the project root. */
+const MIGRATIONS_ROOT = "db";
+/** The two folders a construct's folder holds, and nothing else. */
+const DATABASE_FOLDERS = ["migrations", "seeds"];
+/**
+* The constructs that take migrations, parents before the tenants inside them.
+*
+* A database and each schema tenant: every one has an owner role and a schema
+* of its own, and so a history of its own. A reader has neither — it reads its
+* parent's schema — and a cache's table is created by provisioning, not by a
+* migration anyone writes.
+*/
+function migrationTargets(manifest) {
+	return provisionOrder(manifest).flatMap((id) => {
+		const declaration = manifest[id];
+		if (!declaration) return [];
+		if (declaration.kind === "database") return [target(id)];
+		if (declaration.kind === "database-schema") return [{
+			...target(id),
+			of: declaration.of
+		}];
+		return [];
+	});
+}
+/**
+* A construct's folder, relative to the project root.
+*
+* Named by the construct — `AuthDatabase` is `db/auth-database` — in the case
+* every other name outside TypeScript takes. Lowercase, because a folder that
+* differs from another only in case is two folders on Linux and one on a Mac;
+* and `canonicalId` reads it back to the construct exactly, which is how a
+* folder naming nothing is caught rather than skipped.
+*/
+function databaseFolder(id) {
+	return `db/${kebabCase(id)}`;
+}
+/** Where a construct's migrations live: `db/auth-database/migrations`. */
+function migrationFolder(id) {
+	return `${databaseFolder(id)}/migrations`;
+}
+/**
+* Where a construct's seeds live: `db/auth-database/seeds`.
+*
+* Reference data the app needs to run — a permission catalogue, roles, lookup
+* tables. Seeds are upserts run on every pass, after the migrations, so a
+* changed seed is applied by running it again. Sample data is factories'.
+*/
+function seedFolder(id) {
+	return `${databaseFolder(id)}/seeds`;
+}
+function target(id) {
+	return {
+		id,
+		folder: databaseFolder(id),
+		migrations: migrationFolder(id),
+		seeds: seedFolder(id)
+	};
+}
+//#endregion
+//#region src/mobile.ts
+/**
+* How a mobile app is reached: its URL scheme, and the origins a surface trusts
+* for it.
+*
+* Stated once, here, because three targets ask — the local one (`gkm dev`,
+* `gkm test`), Dokploy and AWS — and a scheme one of them derived differently
+* would be an app whose sign-in callback the auth server refuses on exactly one
+* of them.
+*/
+/**
+* An app's scheme: the one given, or the project's name made a valid scheme.
+*
+* One for every stage. A development build and the store build register the
+* same scheme, so the auth server of whichever stage a build talks to trusts
+* it, and nothing about the app differs between stages but its URLs.
+*
+* A scheme is a letter followed by letters, digits, `+`, `-` or `.` — so
+* `Corner Shop` becomes `corner-shop`, and a name that starts with a digit gets a
+* leading `app`.
+*/
+function schemeBase(project, given) {
+	const raw = (given ?? project).toLowerCase().replace(/[^a-z0-9+.-]+/g, "-").replace(/^-+|-+$/g, "");
+	if (!raw) return "app";
+	return /^[a-z]/.test(raw) ? raw : `app${raw}`;
+}
+/**
+* The origins a surface trusts for a mobile caller.
+*
+* Better Auth's Expo plugin sends the app's scheme as its origin
+* (`shop://`), and a link can carry a path after it (`shop://*`).
+* In development, Expo Go sends `exp://<host>:<port>` instead — so a local
+* stage adds the hosts a device actually reaches Metro on, and Metro's port
+* when the target placed it: a whole subnet is not trusted because one phone
+* is on it.
+*/
+function mobileOrigins(scheme, metro) {
+	return [
+		`${scheme}://`,
+		`${scheme}://*`,
+		...(metro?.hosts ?? []).flatMap((host) => [`exp://${host}:${metro?.port ?? "*"}`, `exp://${host}:${metro?.port ?? "*"}/**`])
+	];
+}
+/** Whether an origin is a web one — what a cookie domain is derived from. */
+function isWebOrigin(origin) {
+	return origin.startsWith("http://") || origin.startsWith("https://");
 }
-
 //#endregion
+//#region src/secret.ts
+/**
+* What a generated secret looks like, and the one way every stage draws it.
+*
+* A server deploy draws from `crypto`, `gkm dev` and `gkm test` from a hash of
+* the project, stage and id, and an AWS deploy asks Pulumi for the same
+* alphabet. Sharing this is what keeps a password that passes a third party's
+* rules on one stage from failing them on the next.
+*/
+/** 43 characters from 64 is 256 bits — as much as anything here needs. */
+const SECRET_LENGTH = 43;
+/**
+* Two symbols nothing has to escape — not a URL, a connection string, a shell
+* or a `.env` file — which with letters and digits is base64url's alphabet.
+*/
+const SECRET_SYMBOLS = "-_";
+const LETTERS_AND_DIGITS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+/**
+* A secret in `format`, each character chosen by `pick(n)` — an integer in
+* `[0, n)` from whatever source the caller trusts.
+*
+* When there are symbols, one is guaranteed: a rule that demands a symbol is
+* the reason anyone names them, and leaving it to chance fails it often —
+* about one draw in seven at 24 characters.
+*/
+function drawSecret(pick, format = {}) {
+	const length = format.length ?? 43;
+	const symbols = [...new Set(format.symbols ?? "-_")].join("");
+	const alphabet = LETTERS_AND_DIGITS + symbols;
+	const chars = Array.from({ length }, () => alphabet[pick(alphabet.length)]);
+	if (symbols && !chars.some((char) => symbols.includes(char))) chars[pick(length)] = symbols[pick(symbols.length)];
+	return chars.join("");
+}
+//#endregion
+exports.CLIENT_IP_HEADER = CLIENT_IP_HEADER;
+exports.DATABASE_FOLDERS = DATABASE_FOLDERS;
 exports.DEFAULT_POSTGRES_VERSION = DEFAULT_POSTGRES_VERSION;
+exports.DEFAULT_STAGE_URL = DEFAULT_STAGE_URL;
 exports.DERIVES_FROM = DERIVES_FROM;
 exports.IllegalDerivation = IllegalDerivation;
 exports.InvalidConstructId = InvalidConstructId;
+exports.KMS_SCHEME = KMS_SCHEME;
+exports.MIGRATIONS_ROOT = MIGRATIONS_ROOT;
+exports.NoUrlForStage = NoUrlForStage;
 exports.PUBLIC = PUBLIC;
 exports.PUBLIC_PREFIX = PUBLIC_PREFIX;
+exports.SECRET_LENGTH = SECRET_LENGTH;
+exports.SECRET_SYMBOLS = SECRET_SYMBOLS;
+exports.TELEMETRY_KEYS = TELEMETRY_KEYS;
 exports.UnknownParent = UnknownParent;
 exports.assertDerivations = assertDerivations;
 exports.cacheTable = cacheTable;
 exports.canonicalId = canonicalId;
 exports.cloudName = cloudName;
 exports.cookieDomain = cookieDomain;
+exports.databaseFolder = databaseFolder;
 exports.dependenciesOf = dependenciesOf;
 exports.dependentsOf = dependentsOf;
+exports.drawSecret = drawSecret;
 exports.environmentCase = environmentCase;
-exports.flattenManifestField = flattenManifestField;
+exports.externalApiUrl = externalApiUrl;
 exports.isDerived = isDerived;
+exports.isWebOrigin = isWebOrigin;
 exports.kebabCase = kebabCase;
+exports.kmsUrl = kmsUrl;
+exports.migrationFolder = migrationFolder;
+exports.migrationTargets = migrationTargets;
+exports.mobileOrigins = mobileOrigins;
 exports.provideKey = provideKey;
 exports.providedKeyFor = providedKeyFor;
 exports.provisionOrder = provisionOrder;
 exports.publicEnvFor = publicEnvFor;
+exports.schemeBase = schemeBase;
 exports.scopedName = scopedName;
+exports.seedFolder = seedFolder;
 exports.serviceKey = serviceKey;
+
 //# sourceMappingURL=index.cjs.map