@geekmidas/manifest 10.0.0-alpha.99 → 10.0.0

package/dist/index.cjs

@@ -1,1235 +1,11 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-//#endregion
-//#region src/declaration.ts
-/**
-* The version used when a database names none.
-*
-* The point is not which number this is but that there is only one of them.
-* Local ran 18 while Aurora provisioned its own default of 17.7, and nothing in
-* any declaration recorded the difference — a stage could behave differently
-* from a developer's machine for a reason neither could see. Both now read
-* this.
-*/
-const DEFAULT_POSTGRES_VERSION = 18;
-/**
-* What a `Telemetry` node provides to each process with an edge to it.
-*
-* `OTEL_SERVICE_NAME` is resolved per process — the app's name — so it is
-* listed here but composed by whichever target hands it over.
-*/
-const TELEMETRY_KEYS = [
-	"OTEL_EXPORTER_OTLP_ENDPOINT",
-	"OTEL_EXPORTER_OTLP_HEADERS",
-	"OTEL_SERVICE_NAME",
-	"OTEL_TRACES_SAMPLER",
-	"OTEL_TRACES_SAMPLER_ARG"
-];
-/**
-* What each kind may derive from.
-*
-* Small enough to state exhaustively, and stating it makes cycles impossible
-* without a graph walk: readers are terminal, so no chain can return to its
-* start. There is no `writer` — the database *is* the writer, which is what
-* keeps a replica from being reached by accident.
-*/
-const DERIVES_FROM = {
-	"database-reader": ["database", "database-schema"],
-	"database-schema": ["database"],
-	"file-server": ["objects"],
-	cache: ["database", "database-schema"]
-};
-/**
-* Which provided values may be shipped to a browser.
-*
-* Drives client-side prefixing (`VITE_`, `NEXT_PUBLIC_`) and nothing else — it
-* is not a restriction on what may be depended on, since a server-side consumer
-* can legitimately use any of them. A bucket's `url` presigns and stays private.
-*/
-const PUBLIC = {
-	objects: [],
-	"file-server": ["url"],
-	email: ["inboxUrl"],
-	database: [],
-	"database-reader": [],
-	"database-schema": [],
-	cache: [],
-	secret: [],
-	credential: [],
-	encryption: [],
-	"rest-api": ["url"],
-	queue: [],
-	topic: [],
-	oidc: ["issuer", "audience"],
-	"external-api": [],
-	function: [],
-	cron: [],
-	"mobile-app": [],
-	site: ["url"],
-	worker: [],
-	telemetry: []
-};
-//#endregion
-//#region src/errors.ts
-/**
-* Manifest errors.
-*
-* Messages state the rule, which is constant; the offending value is a field.
-* An interpolated message cannot be matched on, reads differently every time it
-* is thrown, and carries user input into every log line that touches it.
-*/
-/** A construct id that cannot survive the names derived from it. */
-var InvalidConstructId = class extends Error {
-	/** What was passed in. */
-	input;
-	/** What canonicalising it produced, which is what failed the rule. */
-	canonical;
-	constructor(input, canonical) {
-		super("A construct id must start with a letter and contain only letters and digits");
-		this.name = "InvalidConstructId";
-		this.input = input;
-		this.canonical = canonical;
-	}
-};
-/** A derived construct naming a parent the manifest does not contain. */
-var UnknownParent = class extends Error {
-	/** The derived construct. */
-	id;
-	/** The parent it named. */
-	of;
-	/** Ids the manifest does contain, for the caller to match against. */
-	available;
-	constructor(id, of, available) {
-		super("A derived construct must name a parent present in the manifest");
-		this.name = "UnknownParent";
-		this.id = id;
-		this.of = of;
-		this.available = available;
-	}
-};
-/**
-* A derived construct naming a parent that may not vend it — a reader of a
-* reader, a schema of a schema.
-*/
-var IllegalDerivation = class extends Error {
-	id;
-	kind;
-	/** The kind of the parent it named. */
-	parentKind;
-	/** The parent kinds that may vend this one. */
-	allowed;
-	constructor(id, kind, parentKind, allowed) {
-		super("A derived construct must name a parent whose kind may vend it");
-		this.name = "IllegalDerivation";
-		this.id = id;
-		this.kind = kind;
-		this.parentKind = parentKind;
-		this.allowed = allowed;
-	}
-};
-//#endregion
-//#region src/naming.ts
-var import_lodash_snakecase = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
-	/** `Object#toString` result references. */
-	var symbolTag = "[object Symbol]";
-	/** Used to match words composed of alphanumeric characters. */
-	var reAsciiWord = /[^\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f]+/g;
-	/** Used to match Latin Unicode letters (excluding mathematical operators). */
-	var reLatin = /[\xc0-\xd6\xd8-\xf6\xf8-\xff\u0100-\u017f]/g;
-	/** Used to compose unicode character classes. */
-	var rsAstralRange = "\\ud800-\\udfff";
-	var rsComboMarksRange = "\\u0300-\\u036f\\ufe20-\\ufe23";
-	var rsComboSymbolsRange = "\\u20d0-\\u20f0";
-	var rsDingbatRange = "\\u2700-\\u27bf";
-	var rsLowerRange = "a-z\\xdf-\\xf6\\xf8-\\xff";
-	var rsMathOpRange = "\\xac\\xb1\\xd7\\xf7";
-	var rsNonCharRange = "\\x00-\\x2f\\x3a-\\x40\\x5b-\\x60\\x7b-\\xbf";
-	var rsPunctuationRange = "\\u2000-\\u206f";
-	var rsSpaceRange = " \\t\\x0b\\f\\xa0\\ufeff\\n\\r\\u2028\\u2029\\u1680\\u180e\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200a\\u202f\\u205f\\u3000";
-	var rsUpperRange = "A-Z\\xc0-\\xd6\\xd8-\\xde";
-	var rsVarRange = "\\ufe0e\\ufe0f";
-	var rsBreakRange = rsMathOpRange + rsNonCharRange + rsPunctuationRange + rsSpaceRange;
-	/** Used to compose unicode capture groups. */
-	var rsApos = "['’]";
-	var rsBreak = "[" + rsBreakRange + "]";
-	var rsCombo = "[" + rsComboMarksRange + rsComboSymbolsRange + "]";
-	var rsDigits = "\\d+";
-	var rsDingbat = "[" + rsDingbatRange + "]";
-	var rsLower = "[" + rsLowerRange + "]";
-	var rsMisc = "[^" + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + "]";
-	var rsModifier = "(?:" + rsCombo + "|\\ud83c[\\udffb-\\udfff])";
-	var rsNonAstral = "[^" + rsAstralRange + "]";
-	var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
-	var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
-	var rsUpper = "[" + rsUpperRange + "]";
-	var rsZWJ = "\\u200d";
-	/** Used to compose unicode regexes. */
-	var rsLowerMisc = "(?:" + rsLower + "|" + rsMisc + ")";
-	var rsUpperMisc = "(?:" + rsUpper + "|" + rsMisc + ")";
-	var rsOptLowerContr = "(?:" + rsApos + "(?:d|ll|m|re|s|t|ve))?";
-	var rsOptUpperContr = "(?:" + rsApos + "(?:D|LL|M|RE|S|T|VE))?";
-	var reOptMod = rsModifier + "?";
-	var rsOptVar = "[" + rsVarRange + "]?";
-	var rsOptJoin = "(?:" + rsZWJ + "(?:" + [
-		rsNonAstral,
-		rsRegional,
-		rsSurrPair
-	].join("|") + ")" + rsOptVar + reOptMod + ")*";
-	var rsSeq = rsOptVar + reOptMod + rsOptJoin;
-	var rsEmoji = "(?:" + [
-		rsDingbat,
-		rsRegional,
-		rsSurrPair
-	].join("|") + ")" + rsSeq;
-	/** Used to match apostrophes. */
-	var reApos = RegExp(rsApos, "g");
-	/**
-	* Used to match [combining diacritical marks](https://en.wikipedia.org/wiki/Combining_Diacritical_Marks) and
-	* [combining diacritical marks for symbols](https://en.wikipedia.org/wiki/Combining_Diacritical_Marks_for_Symbols).
-	*/
-	var reComboMark = RegExp(rsCombo, "g");
-	/** Used to match complex or compound words. */
-	var reUnicodeWord = RegExp([
-		rsUpper + "?" + rsLower + "+" + rsOptLowerContr + "(?=" + [
-			rsBreak,
-			rsUpper,
-			"$"
-		].join("|") + ")",
-		rsUpperMisc + "+" + rsOptUpperContr + "(?=" + [
-			rsBreak,
-			rsUpper + rsLowerMisc,
-			"$"
-		].join("|") + ")",
-		rsUpper + "?" + rsLowerMisc + "+" + rsOptLowerContr,
-		rsUpper + "+" + rsOptUpperContr,
-		rsDigits,
-		rsEmoji
-	].join("|"), "g");
-	/** Used to detect strings that need a more robust regexp to match words. */
-	var reHasUnicodeWord = /[a-z][A-Z]|[A-Z]{2,}[a-z]|[0-9][a-zA-Z]|[a-zA-Z][0-9]|[^a-zA-Z0-9 ]/;
-	/** Used to map Latin Unicode letters to basic Latin letters. */
-	var deburredLetters = {
-		"À": "A",
-		"Á": "A",
-		"Â": "A",
-		"Ã": "A",
-		"Ä": "A",
-		"Å": "A",
-		"à": "a",
-		"á": "a",
-		"â": "a",
-		"ã": "a",
-		"ä": "a",
-		"å": "a",
-		"Ç": "C",
-		"ç": "c",
-		"Ð": "D",
-		"ð": "d",
-		"È": "E",
-		"É": "E",
-		"Ê": "E",
-		"Ë": "E",
-		"è": "e",
-		"é": "e",
-		"ê": "e",
-		"ë": "e",
-		"Ì": "I",
-		"Í": "I",
-		"Î": "I",
-		"Ï": "I",
-		"ì": "i",
-		"í": "i",
-		"î": "i",
-		"ï": "i",
-		"Ñ": "N",
-		"ñ": "n",
-		"Ò": "O",
-		"Ó": "O",
-		"Ô": "O",
-		"Õ": "O",
-		"Ö": "O",
-		"Ø": "O",
-		"ò": "o",
-		"ó": "o",
-		"ô": "o",
-		"õ": "o",
-		"ö": "o",
-		"ø": "o",
-		"Ù": "U",
-		"Ú": "U",
-		"Û": "U",
-		"Ü": "U",
-		"ù": "u",
-		"ú": "u",
-		"û": "u",
-		"ü": "u",
-		"Ý": "Y",
-		"ý": "y",
-		"ÿ": "y",
-		"Æ": "Ae",
-		"æ": "ae",
-		"Þ": "Th",
-		"þ": "th",
-		"ß": "ss",
-		"Ā": "A",
-		"Ă": "A",
-		"Ą": "A",
-		"ā": "a",
-		"ă": "a",
-		"ą": "a",
-		"Ć": "C",
-		"Ĉ": "C",
-		"Ċ": "C",
-		"Č": "C",
-		"ć": "c",
-		"ĉ": "c",
-		"ċ": "c",
-		"č": "c",
-		"Ď": "D",
-		"Đ": "D",
-		"ď": "d",
-		"đ": "d",
-		"Ē": "E",
-		"Ĕ": "E",
-		"Ė": "E",
-		"Ę": "E",
-		"Ě": "E",
-		"ē": "e",
-		"ĕ": "e",
-		"ė": "e",
-		"ę": "e",
-		"ě": "e",
-		"Ĝ": "G",
-		"Ğ": "G",
-		"Ġ": "G",
-		"Ģ": "G",
-		"ĝ": "g",
-		"ğ": "g",
-		"ġ": "g",
-		"ģ": "g",
-		"Ĥ": "H",
-		"Ħ": "H",
-		"ĥ": "h",
-		"ħ": "h",
-		"Ĩ": "I",
-		"Ī": "I",
-		"Ĭ": "I",
-		"Į": "I",
-		"İ": "I",
-		"ĩ": "i",
-		"ī": "i",
-		"ĭ": "i",
-		"į": "i",
-		"ı": "i",
-		"Ĵ": "J",
-		"ĵ": "j",
-		"Ķ": "K",
-		"ķ": "k",
-		"ĸ": "k",
-		"Ĺ": "L",
-		"Ļ": "L",
-		"Ľ": "L",
-		"Ŀ": "L",
-		"Ł": "L",
-		"ĺ": "l",
-		"ļ": "l",
-		"ľ": "l",
-		"ŀ": "l",
-		"ł": "l",
-		"Ń": "N",
-		"Ņ": "N",
-		"Ň": "N",
-		"Ŋ": "N",
-		"ń": "n",
-		"ņ": "n",
-		"ň": "n",
-		"ŋ": "n",
-		"Ō": "O",
-		"Ŏ": "O",
-		"Ő": "O",
-		"ō": "o",
-		"ŏ": "o",
-		"ő": "o",
-		"Ŕ": "R",
-		"Ŗ": "R",
-		"Ř": "R",
-		"ŕ": "r",
-		"ŗ": "r",
-		"ř": "r",
-		"Ś": "S",
-		"Ŝ": "S",
-		"Ş": "S",
-		"Š": "S",
-		"ś": "s",
-		"ŝ": "s",
-		"ş": "s",
-		"š": "s",
-		"Ţ": "T",
-		"Ť": "T",
-		"Ŧ": "T",
-		"ţ": "t",
-		"ť": "t",
-		"ŧ": "t",
-		"Ũ": "U",
-		"Ū": "U",
-		"Ŭ": "U",
-		"Ů": "U",
-		"Ű": "U",
-		"Ų": "U",
-		"ũ": "u",
-		"ū": "u",
-		"ŭ": "u",
-		"ů": "u",
-		"ű": "u",
-		"ų": "u",
-		"Ŵ": "W",
-		"ŵ": "w",
-		"Ŷ": "Y",
-		"ŷ": "y",
-		"Ÿ": "Y",
-		"Ź": "Z",
-		"Ż": "Z",
-		"Ž": "Z",
-		"ź": "z",
-		"ż": "z",
-		"ž": "z",
-		"IJ": "IJ",
-		"ij": "ij",
-		"Œ": "Oe",
-		"œ": "oe",
-		"ʼn": "'n",
-		"ſ": "ss"
-	};
-	/** Detect free variable `global` from Node.js. */
-	var freeGlobal = typeof global == "object" && global && global.Object === Object && global;
-	/** Detect free variable `self`. */
-	var freeSelf = typeof self == "object" && self && self.Object === Object && self;
-	/** Used as a reference to the global object. */
-	var root = freeGlobal || freeSelf || Function("return this")();
-	/**
-	* A specialized version of `_.reduce` for arrays without support for
-	* iteratee shorthands.
-	*
-	* @private
-	* @param {Array} [array] The array to iterate over.
-	* @param {Function} iteratee The function invoked per iteration.
-	* @param {*} [accumulator] The initial value.
-	* @param {boolean} [initAccum] Specify using the first element of `array` as
-	*  the initial value.
-	* @returns {*} Returns the accumulated value.
-	*/
-	function arrayReduce(array, iteratee, accumulator, initAccum) {
-		var index = -1, length = array ? array.length : 0;
-		if (initAccum && length) accumulator = array[++index];
-		while (++index < length) accumulator = iteratee(accumulator, array[index], index, array);
-		return accumulator;
-	}
-	/**
-	* Splits an ASCII `string` into an array of its words.
-	*
-	* @private
-	* @param {string} The string to inspect.
-	* @returns {Array} Returns the words of `string`.
-	*/
-	function asciiWords(string) {
-		return string.match(reAsciiWord) || [];
-	}
-	/**
-	* The base implementation of `_.propertyOf` without support for deep paths.
-	*
-	* @private
-	* @param {Object} object The object to query.
-	* @returns {Function} Returns the new accessor function.
-	*/
-	function basePropertyOf(object) {
-		return function(key) {
-			return object == null ? void 0 : object[key];
-		};
-	}
-	/**
-	* Used by `_.deburr` to convert Latin-1 Supplement and Latin Extended-A
-	* letters to basic Latin letters.
-	*
-	* @private
-	* @param {string} letter The matched letter to deburr.
-	* @returns {string} Returns the deburred letter.
-	*/
-	var deburrLetter = basePropertyOf(deburredLetters);
-	/**
-	* Checks if `string` contains a word composed of Unicode symbols.
-	*
-	* @private
-	* @param {string} string The string to inspect.
-	* @returns {boolean} Returns `true` if a word is found, else `false`.
-	*/
-	function hasUnicodeWord(string) {
-		return reHasUnicodeWord.test(string);
-	}
-	/**
-	* Splits a Unicode `string` into an array of its words.
-	*
-	* @private
-	* @param {string} The string to inspect.
-	* @returns {Array} Returns the words of `string`.
-	*/
-	function unicodeWords(string) {
-		return string.match(reUnicodeWord) || [];
-	}
-	/**
-	* Used to resolve the
-	* [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
-	* of values.
-	*/
-	var objectToString = Object.prototype.toString;
-	/** Built-in value references. */
-	var Symbol = root.Symbol;
-	/** Used to convert symbols to primitives and strings. */
-	var symbolProto = Symbol ? Symbol.prototype : void 0;
-	var symbolToString = symbolProto ? symbolProto.toString : void 0;
-	/**
-	* The base implementation of `_.toString` which doesn't convert nullish
-	* values to empty strings.
-	*
-	* @private
-	* @param {*} value The value to process.
-	* @returns {string} Returns the string.
-	*/
-	function baseToString(value) {
-		if (typeof value == "string") return value;
-		if (isSymbol(value)) return symbolToString ? symbolToString.call(value) : "";
-		var result = value + "";
-		return result == "0" && 1 / value == -Infinity ? "-0" : result;
-	}
-	/**
-	* Creates a function like `_.camelCase`.
-	*
-	* @private
-	* @param {Function} callback The function to combine each word.
-	* @returns {Function} Returns the new compounder function.
-	*/
-	function createCompounder(callback) {
-		return function(string) {
-			return arrayReduce(words(deburr(string).replace(reApos, "")), callback, "");
-		};
-	}
-	/**
-	* Checks if `value` is object-like. A value is object-like if it's not `null`
-	* and has a `typeof` result of "object".
-	*
-	* @static
-	* @memberOf _
-	* @since 4.0.0
-	* @category Lang
-	* @param {*} value The value to check.
-	* @returns {boolean} Returns `true` if `value` is object-like, else `false`.
-	* @example
-	*
-	* _.isObjectLike({});
-	* // => true
-	*
-	* _.isObjectLike([1, 2, 3]);
-	* // => true
-	*
-	* _.isObjectLike(_.noop);
-	* // => false
-	*
-	* _.isObjectLike(null);
-	* // => false
-	*/
-	function isObjectLike(value) {
-		return !!value && typeof value == "object";
-	}
-	/**
-	* Checks if `value` is classified as a `Symbol` primitive or object.
-	*
-	* @static
-	* @memberOf _
-	* @since 4.0.0
-	* @category Lang
-	* @param {*} value The value to check.
-	* @returns {boolean} Returns `true` if `value` is a symbol, else `false`.
-	* @example
-	*
-	* _.isSymbol(Symbol.iterator);
-	* // => true
-	*
-	* _.isSymbol('abc');
-	* // => false
-	*/
-	function isSymbol(value) {
-		return typeof value == "symbol" || isObjectLike(value) && objectToString.call(value) == symbolTag;
-	}
-	/**
-	* Converts `value` to a string. An empty string is returned for `null`
-	* and `undefined` values. The sign of `-0` is preserved.
-	*
-	* @static
-	* @memberOf _
-	* @since 4.0.0
-	* @category Lang
-	* @param {*} value The value to process.
-	* @returns {string} Returns the string.
-	* @example
-	*
-	* _.toString(null);
-	* // => ''
-	*
-	* _.toString(-0);
-	* // => '-0'
-	*
-	* _.toString([1, 2, 3]);
-	* // => '1,2,3'
-	*/
-	function toString(value) {
-		return value == null ? "" : baseToString(value);
-	}
-	/**
-	* Deburrs `string` by converting
-	* [Latin-1 Supplement](https://en.wikipedia.org/wiki/Latin-1_Supplement_(Unicode_block)#Character_table)
-	* and [Latin Extended-A](https://en.wikipedia.org/wiki/Latin_Extended-A)
-	* letters to basic Latin letters and removing
-	* [combining diacritical marks](https://en.wikipedia.org/wiki/Combining_Diacritical_Marks).
-	*
-	* @static
-	* @memberOf _
-	* @since 3.0.0
-	* @category String
-	* @param {string} [string=''] The string to deburr.
-	* @returns {string} Returns the deburred string.
-	* @example
-	*
-	* _.deburr('déjà vu');
-	* // => 'deja vu'
-	*/
-	function deburr(string) {
-		string = toString(string);
-		return string && string.replace(reLatin, deburrLetter).replace(reComboMark, "");
-	}
-	/**
-	* Converts `string` to
-	* [snake case](https://en.wikipedia.org/wiki/Snake_case).
-	*
-	* @static
-	* @memberOf _
-	* @since 3.0.0
-	* @category String
-	* @param {string} [string=''] The string to convert.
-	* @returns {string} Returns the snake cased string.
-	* @example
-	*
-	* _.snakeCase('Foo Bar');
-	* // => 'foo_bar'
-	*
-	* _.snakeCase('fooBar');
-	* // => 'foo_bar'
-	*
-	* _.snakeCase('--FOO-BAR--');
-	* // => 'foo_bar'
-	*/
-	var snakeCase = createCompounder(function(result, word, index) {
-		return result + (index ? "_" : "") + word.toLowerCase();
-	});
-	/**
-	* Splits `string` into an array of its words.
-	*
-	* @static
-	* @memberOf _
-	* @since 3.0.0
-	* @category String
-	* @param {string} [string=''] The string to inspect.
-	* @param {RegExp|string} [pattern] The pattern to match words.
-	* @param- {Object} [guard] Enables use as an iteratee for methods like `_.map`.
-	* @returns {Array} Returns the words of `string`.
-	* @example
-	*
-	* _.words('fred, barney, & pebbles');
-	* // => ['fred', 'barney', 'pebbles']
-	*
-	* _.words('fred, barney, & pebbles', /[^, ]+/g);
-	* // => ['fred', 'barney', '&', 'pebbles']
-	*/
-	function words(string, pattern, guard) {
-		string = toString(string);
-		pattern = guard ? void 0 : pattern;
-		if (pattern === void 0) return hasUnicodeWord(string) ? unicodeWords(string) : asciiWords(string);
-		return string.match(pattern) || [];
-	}
-	module.exports = snakeCase;
-})))(), 1);
-/**
-* `UPPER_SNAKE_CASE`, with numbers kept against the word they follow.
-*
-* Matches `environmentCase` in `@geekmidas/envkit`, which reads the values these
-* names key. The two must agree exactly, so this is the implementation and that
-* one should defer to it.
-*
-* @example environmentCase('sendEmail') // 'SEND_EMAIL'
-* @example environmentCase('api2')      // 'API2'  (digit joins its word)
-*/
-function environmentCase(name) {
-	return (0, import_lodash_snakecase.default)(name).toUpperCase().replace(/_\d+/g, (r) => r.replace("_", ""));
-}
-/**
-* The env key a construct provides for one of its roles.
-*
-* @example provideKey('Uploads', 'url')      // 'UPLOADS_URL'
-* @example provideKey('Uploads', 'cdnUrl')   // 'UPLOADS_CDN_URL'
-*/
-function provideKey(id, role) {
-	return environmentCase(`${id}_${role}`);
-}
-/**
-* A construct's canonical id — PascalCase.
-*
-* `uploads`, `Uploads`, `user_uploads`, and `user-uploads` all canonicalise to
-* the same id, so declaring two of them is a duplicate rather than a collision
-* to detect.
-*
-* Runtime only. Writing the id in PascalCase is what keeps the *type* usable:
-* the service key is `Uncapitalize<TName>`, a TypeScript intrinsic, so no
-* type-level transform is needed and none has to be kept in step with this one.
-*
-* @example canonicalId('user-uploads') // 'UserUploads'
-*/
-function canonicalId(input) {
-	const id = (0, import_lodash_snakecase.default)(input).split("_").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
-	if (!VALID_ID.test(id)) throw new InvalidConstructId(input, id);
-	return id;
-}
-/**
-* A canonical id: PascalCase, letters and digits only.
-*
-* Narrower than a JavaScript identifier — `_id` and `$ref` are legal JavaScript
-* and rejected here — because the id also has to survive `environmentCase` into
-* an env key and `cloudName` into a DNS-safe resource name.
-*/
-const VALID_ID = /^[A-Z][A-Za-z0-9]*$/;
-/**
-* The key a construct is reached under in the service record.
-*
-* The runtime twin of `Uncapitalize<TName>`, which types it — they must agree,
-* so they live next to each other rather than being re-derived by each
-* construct.
-*
-* @example serviceKey('UserUploads') // 'userUploads' → services.userUploads
-*/
-function serviceKey(id) {
-	return id.charAt(0).toLowerCase() + id.slice(1);
-}
-/**
-* The table a cache keeps its entries in, when nobody named one.
-*
-* Derived from the cache's own id rather than fixed at `cache`, because a
-* database may hold more than one and two caches sharing a table share a
-* keyspace — `orders.cache('Sessions')` and `orders.cache('Rates')` would
-* silently read each other's entries and evict each other's keys.
-*
-* Prefixed rather than suffixed so every cache sorts together in `\dt`, and
-* prefixed at all so a cache named for a thing the application also stores —
-* `orders.cache('Users')` — cannot collide with the table holding that thing.
-*
-* Read by whoever composes the URL and by whoever creates the table, so both
-* default the same way.
-*
-* @example cacheTable('Sessions') // 'cache_sessions'
-*/
-function cacheTable(id) {
-	return `cache_${id.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase()}`;
-}
-/**
-* Kebab-cases an identifier, acronym- and digit-aware.
-*
-* `userName` → `user-name`, `APIKey` → `api-key`, `S3Bucket` → `s3-bucket`.
-*
-* The last of those is why this is here rather than `snakecase(id)` with the
-* underscores swapped: lodash splits a digit from the letter beside it, so
-* `S3Bucket` became `s-3-bucket` on one provider and `s3-bucket` on the other.
-* Two implementations of one rule, agreeing on every id anybody had tried.
-*
-* `environmentCase` already corrected for the same thing in the other
-* direction — `api2` keeps its digit — so the two spellings of "kebab this id"
-* in this file did not even agree with each other.
-*/
-function kebabCase(value) {
-	return value.replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[\s_]+/g, "-").toLowerCase();
-}
-/**
-* The physical name a target provisions a construct under — lowercase kebab,
-* scoped so two stages or apps sharing an account cannot collide.
-*
-* **One rule, every provider.** A construct is named the same thing on AWS and
-* on Dokploy, which is what lets a name be read across them: `Database` in the
-* `production` stage of `kitchen-sink` is `production-kitchen-sink-database`
-* wherever it lands. The SST target's `prefixedName` is this function under
-* another signature and defers to it.
-*
-* Idempotent in its prefix: an id that already carries the scope is not given a
-* second one, so composing names cannot double up.
-*
-* @example cloudName({ stage: 'prod', app: 'myapp' }, 'UserUploads')
-* //        'prod-myapp-user-uploads'
-*/
-function cloudName(scope, id) {
-	return scopedName([scope.stage, scope.app], id);
-}
-/**
-* {@link cloudName} for a caller that holds its scope as a list.
-*
-* The SST target's stacks add a segment of their own, so the prefix is not
-* always two parts — which is the only reason this signature exists.
-*/
-function scopedName(scope, id) {
-	const prefix = scope.join("-").toLowerCase();
-	const name = kebabCase(id);
-	return name.startsWith(prefix) ? name : `${prefix}-${name}`;
-}
-/**
-* The domain a cookie must be scoped to so a surface and its callers share it.
-*
-* Derived from the addresses rather than configured, for the same reason the
-* origins are: the set of things that talk to a surface is already in the graph,
-* and the domain they have in common is a fact about that set. Returned with the
-* leading dot a `Domain` attribute wants.
-*
-* Returns `undefined` when there is nothing to scope, which is the common case
-* and not a failure:
-*
-* - **One host.** Locally everything is `localhost` on different ports, and
-*   cookies ignore the port — so a `Domain` would add nothing and `.localhost`
-*   is not a domain a browser will accept.
-* - **Nothing in common.** Unrelated hosts cannot share a cookie at all, and
-*   emitting the longest common suffix anyway would be a value that silently
-*   fails to set.
-*
-* **The public-suffix limit, stated rather than discovered.** Two apps on
-* `a.vercel.app` and `b.vercel.app` share `.vercel.app`, which every browser
-* rejects because it is a registrable suffix rather than a registrable domain.
-* Resolving that correctly needs the Public Suffix List, which is a downloaded,
-* expiring dataset — so this requires at least two labels and otherwise trusts
-* the addresses, and the value stays overridable for the case it gets wrong.
-*/
-function cookieDomain(urls) {
-	const hosts = /* @__PURE__ */ new Set();
-	for (const url of urls) try {
-		const { hostname } = new URL(url);
-		if (/^\d+(\.\d+){3}$/.test(hostname) || hostname.includes(":")) return;
-		hosts.add(hostname.toLowerCase());
-	} catch {
-		return;
-	}
-	if (hosts.size === 0) return;
-	if (hosts.size === 1) return;
-	const [first = [], ...rest] = [...hosts].map((host) => host.split(".").reverse());
-	const shared = [];
-	for (const [index, label] of first.entries()) {
-		if (!rest.every((labels) => labels[index] === label)) break;
-		shared.push(label);
-	}
-	if (shared.length < 2) return;
-	return `.${shared.reverse().join(".")}`;
-}
-/**
-* The env key a construct's provided role actually becomes.
-*
-* Almost always `provideKey(id, role)` — and `secret` is the exception, because
-* a secret's *name* is its key: `Auth` signs with `AUTH_SECRET`, which is also
-* what better-auth's own tooling looks for, and qualifying it by role would
-* produce `AUTH_SECRET_VALUE`.
-*
-* It lives here rather than in each target because two targets deriving the
-* same key separately is exactly the drift the app/infra contract check exists
-* to catch — and a check deriving the key differently from the thing it checks
-* cannot catch anything.
-*/
-function providedKeyFor(id, kind, role) {
-	if (kind === "secret") return environmentCase(id);
-	if (kind === "telemetry") return "OTEL_EXPORTER_OTLP_ENDPOINT";
-	return provideKey(id, role);
-}
-//#endregion
-//#region src/derive.ts
-/** Whether a declaration names a parent. */
-function isDerived(declaration) {
-	return declaration.kind in DERIVES_FROM && "of" in declaration && typeof declaration.of === "string";
-}
-/**
-* Check every derived construct against its parent.
-*
-* Two rules: the parent exists, and its kind may vend this one. Together they
-* make cycles unreachable — a reader is terminal, so no chain of `of` can
-* return to where it started, and no walk is needed to prove it.
-*/
-function assertDerivations(manifest) {
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (!isDerived(declaration)) continue;
-		const parent = manifest[declaration.of];
-		if (!parent) throw new UnknownParent(id, declaration.of, Object.keys(manifest));
-		const allowed = DERIVES_FROM[declaration.kind];
-		if (!allowed.includes(parent.kind)) throw new IllegalDerivation(id, declaration.kind, parent.kind, allowed);
-	}
-}
-/**
-* The order constructs must be provisioned in: every parent before its children.
-*
-* Resources are leaves and so come first in any order; only derived nodes
-* constrain the sequence, and they form a shallow forest rather than a general
-* graph. This walks each node's ancestors on demand instead of running a full
-* topological sort, which is the same result at this depth and reads as what it
-* is.
-*
-* Assumes {@link assertDerivations} has passed — a missing parent would
-* otherwise be a silent omission here rather than an error.
-*/
-function provisionOrder(manifest) {
-	const ordered = [];
-	const placed = /* @__PURE__ */ new Set();
-	const place = (id) => {
-		if (placed.has(id)) return;
-		const declaration = manifest[id];
-		if (!declaration) return;
-		placed.add(id);
-		if (isDerived(declaration)) place(declaration.of);
-		ordered.push(id);
-	};
-	for (const id of Object.keys(manifest)) place(id);
-	return ordered;
-}
-/**
-* Every edge a declaration carries, wherever the kind happens to keep them.
-*
-* Dependencies live in two places by design: on a node when the whole construct
-* is the consumer (a site), and on each nested handler when the construct is a
-* surface (a `rest-api`, whose routes each depend on their own things and
-* nothing more). Flattening that difference here is what lets every consumer of
-* the graph — reverse lookups, filtering, reference checks — ask one question.
-*/
-function dependenciesOf(declaration) {
-	const own = "dependencies" in declaration ? declaration.dependencies ?? [] : [];
-	const calls = "calls" in declaration ? declaration.calls ?? [] : [];
-	const nested = declaration.kind === "rest-api" ? declaration.endpoints.flatMap((endpoint) => endpoint.dependencies) : [];
-	const telemetry = "telemetry" in declaration && typeof declaration.telemetry === "string" ? [{
-		target: declaration.telemetry,
-		kind: "telemetry"
-	}] : [];
-	return [
-		...own,
-		...calls,
-		...nested,
-		...telemetry
-	];
-}
-/**
-* The ids that depend on one construct — the graph read backwards.
-*
-* This is the whole mechanism behind CORS origins and trusted origins. Both are
-* lists of *callers*, and a caller is exactly an inbound edge, so neither is
-* ever written down: a surface that listed its own callers would have to be
-* edited every time something new called it, which is the hand-maintained list
-* this replaces.
-*
-* Sorted, because it feeds a comma-separated env value that would otherwise
-* change whenever the manifest's key order did — and a value that churns is a
-* container that redeploys for no reason.
-*/
-function dependentsOf(manifest, id) {
-	const callers = [];
-	for (const [callerId, declaration] of Object.entries(manifest)) {
-		if (callerId === id) continue;
-		if (dependenciesOf(declaration).some((edge) => edge.target === id)) callers.push(callerId);
-	}
-	return callers.sort();
-}
-/**
-* How each site variant names a value it ships to the browser.
-*
-* The prefix *is* the framework's contract — `VITE_`, `NEXT_PUBLIC_` and
-* `EXPO_PUBLIC_` all mean "inline this into the bundle" — so it is the one thing
-* a variant changes, and it changes nothing else.
-*/
-const PUBLIC_PREFIX = {
-	static: "VITE_",
-	tanstack: "VITE_",
-	next: "NEXT_PUBLIC_",
-	expo: "EXPO_PUBLIC_"
-};
-/**
-* The keys a site's bundle needs, mapped to the key each value comes from —
-* `{ VITE_API_URL: 'API_URL' }`.
-*
-* A rename, not a second derivation: `API_URL` is resolved once, by whatever
-* resolved it for the server, and the site reads the same value under the name
-* its bundler will inline. That is what keeps a site and its API from coming to
-* disagree about where the API is.
-*
-* Filtered by `PUBLIC` rather than by what the site asked for. A site may
-* legitimately depend on anything — its server half, where it has one, reads env
-* exactly as a function does — so this is not a restriction on edges. It decides
-* one thing: which values may be prefixed into a bundle, which is what keeps
-* `ORDERS_URL` and its password out of a JavaScript file served to the public.
-*
-* Shared by every target for the same reason `providedKeyFor` is: a site built
-* locally and the same site built by a deploy must inline the same names.
-*/
-function publicEnvFor(declaration, manifest) {
-	const prefix = PUBLIC_PREFIX[declaration.variant];
-	const keys = {};
-	for (const edge of declaration.dependencies) {
-		const target = manifest[edge.target];
-		if (!target) continue;
-		for (const role of PUBLIC[target.kind] ?? []) {
-			const key = provideKey(edge.target, role);
-			keys[`${prefix}${key}`] = key;
-		}
-	}
-	return keys;
-}
-//#endregion
-//#region src/encryption.ts
-/**
-* The `kms://` URL an `Encryption` construct reads on AWS.
-*
-* Here because two packages meet on it: `@geekmidas/cloud` composes it from
-* the keys it provisioned, and `@geekmidas/constructs` parses it to reach
-* them. One function, so the two cannot disagree about a parameter's name.
-*/
-const KMS_SCHEME = "kms:";
-/**
-* `kms://<region>?key=<key arn>&index=<hmac key arn>[&endpoint=<url>]`
-*
-* `endpoint` reaches an emulator instead of AWS — floci, locally and in tests —
-* the same parameter an `sns://` connection string carries for the same reason.
-*/
-function kmsUrl(input) {
-	const query = new URLSearchParams({
-		key: input.key,
-		index: input.index,
-		...input.endpoint ? { endpoint: input.endpoint } : {}
-	});
-	return `${KMS_SCHEME}//${input.region}?${query}`;
-}
-//#endregion
-//#region src/external.ts
-/** The key in a by-stage `url` that answers for every stage not listed. */
-const DEFAULT_STAGE_URL = "default";
-/**
-* Where an external API answers on a deployed stage.
-*
-* One URL answers every stage; a record answers by stage name, falling back
-* to `default`. Read at build and deploy, so a stage nobody gave a URL fails
-* there — with the stage named — rather than at the first request.
-*
-* @throws {NoUrlForStage} when a record names neither the stage nor a default.
-*/
-function externalApiUrl(declaration, stage) {
-	const { url } = declaration;
-	if (typeof url === "string") return url;
-	const resolved = url[stage] ?? url["default"];
-	if (!resolved) throw new NoUrlForStage(declaration.id, stage, Object.keys(url));
-	return resolved;
-}
-/** An external API's `url` record has nothing for the stage being deployed. */
-var NoUrlForStage = class extends Error {
-	id;
-	stage;
-	stages;
-	constructor(id, stage, stages) {
-		super(`'${id}' has no URL for the stage '${stage}': its url names ${stages.length ? stages.map((s) => `'${s}'`).join(", ") : "no stages"}. Add '${stage}', or a '${DEFAULT_STAGE_URL}' for every stage not listed.`);
-		this.id = id;
-		this.stage = stage;
-		this.stages = stages;
-		this.name = "NoUrlForStage";
-	}
-};
-//#endregion
-//#region src/headers.ts
-/**
-* Headers gkm reserves for its own services' calls to each other.
-*
-* Shared by `@geekmidas/constructs`, which sends and reads them, and
-* `@geekmidas/cli`, whose edges strip them from every request that arrives
-* from outside — so the two cannot name them differently.
-*/
-/**
-* The address of the client a service-to-service call is made on behalf of.
-*
-* An API asking its auth server for a session sends the client's address in
-* this rather than `X-Forwarded-For`: a forwarding header marks a request as
-* outside traffic, which would start the auth server's span in a new trace,
-* and the address is still needed — Better Auth rate-limits per client.
-*
-* Reserved: the stack's edge (Caddy, Traefik, the `gkm dev` edge) removes it
-* from incoming requests, and the auth server ignores it on any request that
-* is not an internal caller's, so it cannot be spoofed from outside.
-*/
-const CLIENT_IP_HEADER = "x-gkm-client-ip";
-//#endregion
-//#region src/migrations.ts
-/** Where every construct's folder lives, from the project root. */
-const MIGRATIONS_ROOT = "db";
-/** The two folders a construct's folder holds, and nothing else. */
-const DATABASE_FOLDERS = ["migrations", "seeds"];
-/**
-* The constructs that take migrations, parents before the tenants inside them.
-*
-* A database and each schema tenant: every one has an owner role and a schema
-* of its own, and so a history of its own. A reader has neither — it reads its
-* parent's schema — and a cache's table is created by provisioning, not by a
-* migration anyone writes.
-*/
-function migrationTargets(manifest) {
-	return provisionOrder(manifest).flatMap((id) => {
-		const declaration = manifest[id];
-		if (!declaration) return [];
-		if (declaration.kind === "database") return [target(id)];
-		if (declaration.kind === "database-schema") return [{
-			...target(id),
-			of: declaration.of
-		}];
-		return [];
-	});
-}
-/**
-* A construct's folder, relative to the project root.
-*
-* Named by the construct — `AuthDatabase` is `db/auth-database` — in the case
-* every other name outside TypeScript takes. Lowercase, because a folder that
-* differs from another only in case is two folders on Linux and one on a Mac;
-* and `canonicalId` reads it back to the construct exactly, which is how a
-* folder naming nothing is caught rather than skipped.
-*/
-function databaseFolder(id) {
-	return `db/${kebabCase(id)}`;
-}
-/** Where a construct's migrations live: `db/auth-database/migrations`. */
-function migrationFolder(id) {
-	return `${databaseFolder(id)}/migrations`;
-}
-/**
-* Where a construct's seeds live: `db/auth-database/seeds`.
-*
-* Reference data the app needs to run — a permission catalogue, roles, lookup
-* tables. Seeds are upserts run on every pass, after the migrations, so a
-* changed seed is applied by running it again. Sample data is factories'.
-*/
-function seedFolder(id) {
-	return `${databaseFolder(id)}/seeds`;
-}
-function target(id) {
-	return {
-		id,
-		folder: databaseFolder(id),
-		migrations: migrationFolder(id),
-		seeds: seedFolder(id)
-	};
-}
-//#endregion
-//#region src/mobile.ts
-/**
-* How a mobile app is reached: its URL scheme, and the origins a surface trusts
-* for it.
-*
-* Stated once, here, because three targets ask — the local one (`gkm dev`,
-* `gkm test`), Dokploy and AWS — and a scheme one of them derived differently
-* would be an app whose sign-in callback the auth server refuses on exactly one
-* of them.
-*/
-/**
-* An app's scheme: the one given, or the project's name made a valid scheme.
-*
-* One for every stage. A development build and the store build register the
-* same scheme, so the auth server of whichever stage a build talks to trusts
-* it, and nothing about the app differs between stages but its URLs.
-*
-* A scheme is a letter followed by letters, digits, `+`, `-` or `.` — so
-* `Corner Shop` becomes `corner-shop`, and a name that starts with a digit gets a
-* leading `app`.
-*/
-function schemeBase(project, given) {
-	const raw = (given ?? project).toLowerCase().replace(/[^a-z0-9+.-]+/g, "-").replace(/^-+|-+$/g, "");
-	if (!raw) return "app";
-	return /^[a-z]/.test(raw) ? raw : `app${raw}`;
-}
-/**
-* The origins a surface trusts for a mobile caller.
-*
-* Better Auth's Expo plugin sends the app's scheme as its origin
-* (`shop://`), and a link can carry a path after it (`shop://*`).
-* In development, Expo Go sends `exp://<host>:<port>` instead — so a local
-* stage adds the hosts a device actually reaches Metro on, and Metro's port
-* when the target placed it: a whole subnet is not trusted because one phone
-* is on it.
-*/
-function mobileOrigins(scheme, metro) {
-	return [
-		`${scheme}://`,
-		`${scheme}://*`,
-		...(metro?.hosts ?? []).flatMap((host) => [`exp://${host}:${metro?.port ?? "*"}`, `exp://${host}:${metro?.port ?? "*"}/**`])
-	];
-}
-/** Whether an origin is a web one — what a cookie domain is derived from. */
-function isWebOrigin(origin) {
-	return origin.startsWith("http://") || origin.startsWith("https://");
+
+//#region src/index.ts
+/** Flatten a manifest field (array or partitioned) into a plain array. */
+function flattenManifestField(field) {
+	if (!field) return [];
+	return Array.isArray(field) ? [...field] : Object.values(field).flat();
 }
-//#endregion
-exports.CLIENT_IP_HEADER = CLIENT_IP_HEADER;
-exports.DATABASE_FOLDERS = DATABASE_FOLDERS;
-exports.DEFAULT_POSTGRES_VERSION = DEFAULT_POSTGRES_VERSION;
-exports.DEFAULT_STAGE_URL = DEFAULT_STAGE_URL;
-exports.DERIVES_FROM = DERIVES_FROM;
-exports.IllegalDerivation = IllegalDerivation;
-exports.InvalidConstructId = InvalidConstructId;
-exports.KMS_SCHEME = KMS_SCHEME;
-exports.MIGRATIONS_ROOT = MIGRATIONS_ROOT;
-exports.NoUrlForStage = NoUrlForStage;
-exports.PUBLIC = PUBLIC;
-exports.PUBLIC_PREFIX = PUBLIC_PREFIX;
-exports.TELEMETRY_KEYS = TELEMETRY_KEYS;
-exports.UnknownParent = UnknownParent;
-exports.assertDerivations = assertDerivations;
-exports.cacheTable = cacheTable;
-exports.canonicalId = canonicalId;
-exports.cloudName = cloudName;
-exports.cookieDomain = cookieDomain;
-exports.databaseFolder = databaseFolder;
-exports.dependenciesOf = dependenciesOf;
-exports.dependentsOf = dependentsOf;
-exports.environmentCase = environmentCase;
-exports.externalApiUrl = externalApiUrl;
-exports.isDerived = isDerived;
-exports.isWebOrigin = isWebOrigin;
-exports.kebabCase = kebabCase;
-exports.kmsUrl = kmsUrl;
-exports.migrationFolder = migrationFolder;
-exports.migrationTargets = migrationTargets;
-exports.mobileOrigins = mobileOrigins;
-exports.provideKey = provideKey;
-exports.providedKeyFor = providedKeyFor;
-exports.provisionOrder = provisionOrder;
-exports.publicEnvFor = publicEnvFor;
-exports.schemeBase = schemeBase;
-exports.scopedName = scopedName;
-exports.seedFolder = seedFolder;
-exports.serviceKey = serviceKey;
 
+//#endregion
+exports.flattenManifestField = flattenManifestField;
 //# sourceMappingURL=index.cjs.map