@geekmidas/manifest 9.0.2 → 10.0.0-alpha.1

package/dist/index.mjs

@@ -1,3 +1,1000 @@
+//#region rolldown:runtime
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function() {
+	return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
+//#region src/declaration.ts
+/**
+* The version used when a database names none.
+*
+* The point is not which number this is but that there is only one of them.
+* Local ran 18 while Aurora provisioned its own default of 17.7, and nothing in
+* any declaration recorded the difference — a stage could behave differently
+* from a developer's machine for a reason neither could see. Both now read
+* this.
+*/
+const DEFAULT_POSTGRES_VERSION = 18;
+/**
+* How the process serving a declaration is built and run.
+*
+* The half of an application that a graph genuinely cannot derive. *What*
+* exists — a surface, a site, the edges between them — is declared and read
+* back from the manifest. *Where its source lives and which globs find its
+* code* is not derivable from anything: it is a fact about a directory.
+*
+* It lives on the declaration rather than in a config `apps` block because the
+* two were the same list written twice, and the copy in config was the one that
+* could disagree. A site declared `path: 'apps/web'` and an app entry declared
+* `path: 'apps/web'`, and nothing checked them against each other; a surface
+* that config had no entry for simply never deployed.
+*
+* Only the declaration that *is* an app carries one. Two surfaces in one
+* process means one of them has the spec and the other collapses onto it —
+* which is the same rule that decides deploy units, now stated once.
+*/
+/**
+* Where an app's code lives when nobody says otherwise.
+*
+* One glob, every kind — the same rule the `constructs` glob follows. A handler
+* in one of these directories is found; anywhere else needs a `code` glob, and
+* saying so is the whole reason the field still exists.
+*/
+const DEFAULT_APP_CODE = "./{endpoints,functions,crons,queues,topics,subscribers}/**/*.ts";
+/**
+* What each kind may derive from.
+*
+* Small enough to state exhaustively, and stating it makes cycles impossible
+* without a graph walk: readers are terminal, so no chain can return to its
+* start. There is no `writer` — the database *is* the writer, which is what
+* keeps a replica from being reached by accident.
+*/
+const DERIVES_FROM = {
+	"database-reader": ["database", "database-schema"],
+	"database-schema": ["database"],
+	"file-server": ["objects"],
+	cache: ["database", "database-schema"]
+};
+/**
+* Which provided values may be shipped to a browser.
+*
+* Drives client-side prefixing (`VITE_`, `NEXT_PUBLIC_`) and nothing else — it
+* is not a restriction on what may be depended on, since a server-side consumer
+* can legitimately use any of them. A bucket's `url` presigns and stays private.
+*/
+const PUBLIC = {
+	objects: [],
+	"file-server": ["url"],
+	email: [],
+	database: [],
+	"database-reader": [],
+	"database-schema": [],
+	cache: [],
+	secret: [],
+	credential: [],
+	"rest-api": ["url"],
+	queue: [],
+	topic: [],
+	oidc: ["issuer", "audience"],
+	function: [],
+	cron: [],
+	site: ["url"]
+};
+
+//#endregion
+//#region src/errors.ts
+/**
+* Manifest errors.
+*
+* Messages state the rule, which is constant; the offending value is a field.
+* An interpolated message cannot be matched on, reads differently every time it
+* is thrown, and carries user input into every log line that touches it.
+*/
+/** A construct id that cannot survive the names derived from it. */
+var InvalidConstructId = class extends Error {
+	/** What was passed in. */
+	input;
+	/** What canonicalising it produced, which is what failed the rule. */
+	canonical;
+	constructor(input, canonical) {
+		super("A construct id must start with a letter and contain only letters and digits");
+		this.name = "InvalidConstructId";
+		this.input = input;
+		this.canonical = canonical;
+	}
+};
+/** A derived construct naming a parent the manifest does not contain. */
+var UnknownParent = class extends Error {
+	/** The derived construct. */
+	id;
+	/** The parent it named. */
+	of;
+	/** Ids the manifest does contain, for the caller to match against. */
+	available;
+	constructor(id, of, available) {
+		super("A derived construct must name a parent present in the manifest");
+		this.name = "UnknownParent";
+		this.id = id;
+		this.of = of;
+		this.available = available;
+	}
+};
+/**
+* A derived construct naming a parent that may not vend it — a reader of a
+* reader, a schema of a schema.
+*/
+var IllegalDerivation = class extends Error {
+	id;
+	kind;
+	/** The kind of the parent it named. */
+	parentKind;
+	/** The parent kinds that may vend this one. */
+	allowed;
+	constructor(id, kind, parentKind, allowed) {
+		super("A derived construct must name a parent whose kind may vend it");
+		this.name = "IllegalDerivation";
+		this.id = id;
+		this.kind = kind;
+		this.parentKind = parentKind;
+		this.allowed = allowed;
+	}
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/lodash.snakecase@4.1.1/node_modules/lodash.snakecase/index.js
+var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.snakecase@4.1.1/node_modules/lodash.snakecase/index.js"(exports, module) {
+	/**
+	* lodash (Custom Build) <https://lodash.com/>
+	* Build: `lodash modularize exports="npm" -o ./`
+	* Copyright jQuery Foundation and other contributors <https://jquery.org/>
+	* Released under MIT license <https://lodash.com/license>
+	* Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>
+	* Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
+	*/
+	/** Used as references for various `Number` constants. */
+	var INFINITY = Infinity;
+	/** `Object#toString` result references. */
+	var symbolTag = "[object Symbol]";
+	/** Used to match words composed of alphanumeric characters. */
+	var reAsciiWord = /[^\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f]+/g;
+	/** Used to match Latin Unicode letters (excluding mathematical operators). */
+	var reLatin = /[\xc0-\xd6\xd8-\xf6\xf8-\xff\u0100-\u017f]/g;
+	/** Used to compose unicode character classes. */
+	var rsAstralRange = "\\ud800-\\udfff", rsComboMarksRange = "\\u0300-\\u036f\\ufe20-\\ufe23", rsComboSymbolsRange = "\\u20d0-\\u20f0", rsDingbatRange = "\\u2700-\\u27bf", rsLowerRange = "a-z\\xdf-\\xf6\\xf8-\\xff", rsMathOpRange = "\\xac\\xb1\\xd7\\xf7", rsNonCharRange = "\\x00-\\x2f\\x3a-\\x40\\x5b-\\x60\\x7b-\\xbf", rsPunctuationRange = "\\u2000-\\u206f", rsSpaceRange = " \\t\\x0b\\f\\xa0\\ufeff\\n\\r\\u2028\\u2029\\u1680\\u180e\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200a\\u202f\\u205f\\u3000", rsUpperRange = "A-Z\\xc0-\\xd6\\xd8-\\xde", rsVarRange = "\\ufe0e\\ufe0f", rsBreakRange = rsMathOpRange + rsNonCharRange + rsPunctuationRange + rsSpaceRange;
+	/** Used to compose unicode capture groups. */
+	var rsApos = "['’]", rsBreak = "[" + rsBreakRange + "]", rsCombo = "[" + rsComboMarksRange + rsComboSymbolsRange + "]", rsDigits = "\\d+", rsDingbat = "[" + rsDingbatRange + "]", rsLower = "[" + rsLowerRange + "]", rsMisc = "[^" + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + "]", rsFitz = "\\ud83c[\\udffb-\\udfff]", rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")", rsNonAstral = "[^" + rsAstralRange + "]", rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}", rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]", rsUpper = "[" + rsUpperRange + "]", rsZWJ = "\\u200d";
+	/** Used to compose unicode regexes. */
+	var rsLowerMisc = "(?:" + rsLower + "|" + rsMisc + ")", rsUpperMisc = "(?:" + rsUpper + "|" + rsMisc + ")", rsOptLowerContr = "(?:" + rsApos + "(?:d|ll|m|re|s|t|ve))?", rsOptUpperContr = "(?:" + rsApos + "(?:D|LL|M|RE|S|T|VE))?", reOptMod = rsModifier + "?", rsOptVar = "[" + rsVarRange + "]?", rsOptJoin = "(?:" + rsZWJ + "(?:" + [
+		rsNonAstral,
+		rsRegional,
+		rsSurrPair
+	].join("|") + ")" + rsOptVar + reOptMod + ")*", rsSeq = rsOptVar + reOptMod + rsOptJoin, rsEmoji = "(?:" + [
+		rsDingbat,
+		rsRegional,
+		rsSurrPair
+	].join("|") + ")" + rsSeq;
+	/** Used to match apostrophes. */
+	var reApos = RegExp(rsApos, "g");
+	/**
+	* Used to match [combining diacritical marks](https://en.wikipedia.org/wiki/Combining_Diacritical_Marks) and
+	* [combining diacritical marks for symbols](https://en.wikipedia.org/wiki/Combining_Diacritical_Marks_for_Symbols).
+	*/
+	var reComboMark = RegExp(rsCombo, "g");
+	/** Used to match complex or compound words. */
+	var reUnicodeWord = RegExp([
+		rsUpper + "?" + rsLower + "+" + rsOptLowerContr + "(?=" + [
+			rsBreak,
+			rsUpper,
+			"$"
+		].join("|") + ")",
+		rsUpperMisc + "+" + rsOptUpperContr + "(?=" + [
+			rsBreak,
+			rsUpper + rsLowerMisc,
+			"$"
+		].join("|") + ")",
+		rsUpper + "?" + rsLowerMisc + "+" + rsOptLowerContr,
+		rsUpper + "+" + rsOptUpperContr,
+		rsDigits,
+		rsEmoji
+	].join("|"), "g");
+	/** Used to detect strings that need a more robust regexp to match words. */
+	var reHasUnicodeWord = /[a-z][A-Z]|[A-Z]{2,}[a-z]|[0-9][a-zA-Z]|[a-zA-Z][0-9]|[^a-zA-Z0-9 ]/;
+	/** Used to map Latin Unicode letters to basic Latin letters. */
+	var deburredLetters = {
+		"À": "A",
+		"Á": "A",
+		"Â": "A",
+		"Ã": "A",
+		"Ä": "A",
+		"Å": "A",
+		"à": "a",
+		"á": "a",
+		"â": "a",
+		"ã": "a",
+		"ä": "a",
+		"å": "a",
+		"Ç": "C",
+		"ç": "c",
+		"Ð": "D",
+		"ð": "d",
+		"È": "E",
+		"É": "E",
+		"Ê": "E",
+		"Ë": "E",
+		"è": "e",
+		"é": "e",
+		"ê": "e",
+		"ë": "e",
+		"Ì": "I",
+		"Í": "I",
+		"Î": "I",
+		"Ï": "I",
+		"ì": "i",
+		"í": "i",
+		"î": "i",
+		"ï": "i",
+		"Ñ": "N",
+		"ñ": "n",
+		"Ò": "O",
+		"Ó": "O",
+		"Ô": "O",
+		"Õ": "O",
+		"Ö": "O",
+		"Ø": "O",
+		"ò": "o",
+		"ó": "o",
+		"ô": "o",
+		"õ": "o",
+		"ö": "o",
+		"ø": "o",
+		"Ù": "U",
+		"Ú": "U",
+		"Û": "U",
+		"Ü": "U",
+		"ù": "u",
+		"ú": "u",
+		"û": "u",
+		"ü": "u",
+		"Ý": "Y",
+		"ý": "y",
+		"ÿ": "y",
+		"Æ": "Ae",
+		"æ": "ae",
+		"Þ": "Th",
+		"þ": "th",
+		"ß": "ss",
+		"Ā": "A",
+		"Ă": "A",
+		"Ą": "A",
+		"ā": "a",
+		"ă": "a",
+		"ą": "a",
+		"Ć": "C",
+		"Ĉ": "C",
+		"Ċ": "C",
+		"Č": "C",
+		"ć": "c",
+		"ĉ": "c",
+		"ċ": "c",
+		"č": "c",
+		"Ď": "D",
+		"Đ": "D",
+		"ď": "d",
+		"đ": "d",
+		"Ē": "E",
+		"Ĕ": "E",
+		"Ė": "E",
+		"Ę": "E",
+		"Ě": "E",
+		"ē": "e",
+		"ĕ": "e",
+		"ė": "e",
+		"ę": "e",
+		"ě": "e",
+		"Ĝ": "G",
+		"Ğ": "G",
+		"Ġ": "G",
+		"Ģ": "G",
+		"ĝ": "g",
+		"ğ": "g",
+		"ġ": "g",
+		"ģ": "g",
+		"Ĥ": "H",
+		"Ħ": "H",
+		"ĥ": "h",
+		"ħ": "h",
+		"Ĩ": "I",
+		"Ī": "I",
+		"Ĭ": "I",
+		"Į": "I",
+		"İ": "I",
+		"ĩ": "i",
+		"ī": "i",
+		"ĭ": "i",
+		"į": "i",
+		"ı": "i",
+		"Ĵ": "J",
+		"ĵ": "j",
+		"Ķ": "K",
+		"ķ": "k",
+		"ĸ": "k",
+		"Ĺ": "L",
+		"Ļ": "L",
+		"Ľ": "L",
+		"Ŀ": "L",
+		"Ł": "L",
+		"ĺ": "l",
+		"ļ": "l",
+		"ľ": "l",
+		"ŀ": "l",
+		"ł": "l",
+		"Ń": "N",
+		"Ņ": "N",
+		"Ň": "N",
+		"Ŋ": "N",
+		"ń": "n",
+		"ņ": "n",
+		"ň": "n",
+		"ŋ": "n",
+		"Ō": "O",
+		"Ŏ": "O",
+		"Ő": "O",
+		"ō": "o",
+		"ŏ": "o",
+		"ő": "o",
+		"Ŕ": "R",
+		"Ŗ": "R",
+		"Ř": "R",
+		"ŕ": "r",
+		"ŗ": "r",
+		"ř": "r",
+		"Ś": "S",
+		"Ŝ": "S",
+		"Ş": "S",
+		"Š": "S",
+		"ś": "s",
+		"ŝ": "s",
+		"ş": "s",
+		"š": "s",
+		"Ţ": "T",
+		"Ť": "T",
+		"Ŧ": "T",
+		"ţ": "t",
+		"ť": "t",
+		"ŧ": "t",
+		"Ũ": "U",
+		"Ū": "U",
+		"Ŭ": "U",
+		"Ů": "U",
+		"Ű": "U",
+		"Ų": "U",
+		"ũ": "u",
+		"ū": "u",
+		"ŭ": "u",
+		"ů": "u",
+		"ű": "u",
+		"ų": "u",
+		"Ŵ": "W",
+		"ŵ": "w",
+		"Ŷ": "Y",
+		"ŷ": "y",
+		"Ÿ": "Y",
+		"Ź": "Z",
+		"Ż": "Z",
+		"Ž": "Z",
+		"ź": "z",
+		"ż": "z",
+		"ž": "z",
+		"IJ": "IJ",
+		"ij": "ij",
+		"Œ": "Oe",
+		"œ": "oe",
+		"ʼn": "'n",
+		"ſ": "ss"
+	};
+	/** Detect free variable `global` from Node.js. */
+	var freeGlobal = typeof global == "object" && global && global.Object === Object && global;
+	/** Detect free variable `self`. */
+	var freeSelf = typeof self == "object" && self && self.Object === Object && self;
+	/** Used as a reference to the global object. */
+	var root = freeGlobal || freeSelf || Function("return this")();
+	/**
+	* A specialized version of `_.reduce` for arrays without support for
+	* iteratee shorthands.
+	*
+	* @private
+	* @param {Array} [array] The array to iterate over.
+	* @param {Function} iteratee The function invoked per iteration.
+	* @param {*} [accumulator] The initial value.
+	* @param {boolean} [initAccum] Specify using the first element of `array` as
+	*  the initial value.
+	* @returns {*} Returns the accumulated value.
+	*/
+	function arrayReduce(array, iteratee, accumulator, initAccum) {
+		var index = -1, length = array ? array.length : 0;
+		if (initAccum && length) accumulator = array[++index];
+		while (++index < length) accumulator = iteratee(accumulator, array[index], index, array);
+		return accumulator;
+	}
+	/**
+	* Splits an ASCII `string` into an array of its words.
+	*
+	* @private
+	* @param {string} The string to inspect.
+	* @returns {Array} Returns the words of `string`.
+	*/
+	function asciiWords(string) {
+		return string.match(reAsciiWord) || [];
+	}
+	/**
+	* The base implementation of `_.propertyOf` without support for deep paths.
+	*
+	* @private
+	* @param {Object} object The object to query.
+	* @returns {Function} Returns the new accessor function.
+	*/
+	function basePropertyOf(object) {
+		return function(key) {
+			return object == null ? void 0 : object[key];
+		};
+	}
+	/**
+	* Used by `_.deburr` to convert Latin-1 Supplement and Latin Extended-A
+	* letters to basic Latin letters.
+	*
+	* @private
+	* @param {string} letter The matched letter to deburr.
+	* @returns {string} Returns the deburred letter.
+	*/
+	var deburrLetter = basePropertyOf(deburredLetters);
+	/**
+	* Checks if `string` contains a word composed of Unicode symbols.
+	*
+	* @private
+	* @param {string} string The string to inspect.
+	* @returns {boolean} Returns `true` if a word is found, else `false`.
+	*/
+	function hasUnicodeWord(string) {
+		return reHasUnicodeWord.test(string);
+	}
+	/**
+	* Splits a Unicode `string` into an array of its words.
+	*
+	* @private
+	* @param {string} The string to inspect.
+	* @returns {Array} Returns the words of `string`.
+	*/
+	function unicodeWords(string) {
+		return string.match(reUnicodeWord) || [];
+	}
+	/** Used for built-in method references. */
+	var objectProto = Object.prototype;
+	/**
+	* Used to resolve the
+	* [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
+	* of values.
+	*/
+	var objectToString = objectProto.toString;
+	/** Built-in value references. */
+	var Symbol = root.Symbol;
+	/** Used to convert symbols to primitives and strings. */
+	var symbolProto = Symbol ? Symbol.prototype : void 0, symbolToString = symbolProto ? symbolProto.toString : void 0;
+	/**
+	* The base implementation of `_.toString` which doesn't convert nullish
+	* values to empty strings.
+	*
+	* @private
+	* @param {*} value The value to process.
+	* @returns {string} Returns the string.
+	*/
+	function baseToString(value) {
+		if (typeof value == "string") return value;
+		if (isSymbol(value)) return symbolToString ? symbolToString.call(value) : "";
+		var result = value + "";
+		return result == "0" && 1 / value == -INFINITY ? "-0" : result;
+	}
+	/**
+	* Creates a function like `_.camelCase`.
+	*
+	* @private
+	* @param {Function} callback The function to combine each word.
+	* @returns {Function} Returns the new compounder function.
+	*/
+	function createCompounder(callback) {
+		return function(string) {
+			return arrayReduce(words(deburr(string).replace(reApos, "")), callback, "");
+		};
+	}
+	/**
+	* Checks if `value` is object-like. A value is object-like if it's not `null`
+	* and has a `typeof` result of "object".
+	*
+	* @static
+	* @memberOf _
+	* @since 4.0.0
+	* @category Lang
+	* @param {*} value The value to check.
+	* @returns {boolean} Returns `true` if `value` is object-like, else `false`.
+	* @example
+	*
+	* _.isObjectLike({});
+	* // => true
+	*
+	* _.isObjectLike([1, 2, 3]);
+	* // => true
+	*
+	* _.isObjectLike(_.noop);
+	* // => false
+	*
+	* _.isObjectLike(null);
+	* // => false
+	*/
+	function isObjectLike(value) {
+		return !!value && typeof value == "object";
+	}
+	/**
+	* Checks if `value` is classified as a `Symbol` primitive or object.
+	*
+	* @static
+	* @memberOf _
+	* @since 4.0.0
+	* @category Lang
+	* @param {*} value The value to check.
+	* @returns {boolean} Returns `true` if `value` is a symbol, else `false`.
+	* @example
+	*
+	* _.isSymbol(Symbol.iterator);
+	* // => true
+	*
+	* _.isSymbol('abc');
+	* // => false
+	*/
+	function isSymbol(value) {
+		return typeof value == "symbol" || isObjectLike(value) && objectToString.call(value) == symbolTag;
+	}
+	/**
+	* Converts `value` to a string. An empty string is returned for `null`
+	* and `undefined` values. The sign of `-0` is preserved.
+	*
+	* @static
+	* @memberOf _
+	* @since 4.0.0
+	* @category Lang
+	* @param {*} value The value to process.
+	* @returns {string} Returns the string.
+	* @example
+	*
+	* _.toString(null);
+	* // => ''
+	*
+	* _.toString(-0);
+	* // => '-0'
+	*
+	* _.toString([1, 2, 3]);
+	* // => '1,2,3'
+	*/
+	function toString(value) {
+		return value == null ? "" : baseToString(value);
+	}
+	/**
+	* Deburrs `string` by converting
+	* [Latin-1 Supplement](https://en.wikipedia.org/wiki/Latin-1_Supplement_(Unicode_block)#Character_table)
+	* and [Latin Extended-A](https://en.wikipedia.org/wiki/Latin_Extended-A)
+	* letters to basic Latin letters and removing
+	* [combining diacritical marks](https://en.wikipedia.org/wiki/Combining_Diacritical_Marks).
+	*
+	* @static
+	* @memberOf _
+	* @since 3.0.0
+	* @category String
+	* @param {string} [string=''] The string to deburr.
+	* @returns {string} Returns the deburred string.
+	* @example
+	*
+	* _.deburr('déjà vu');
+	* // => 'deja vu'
+	*/
+	function deburr(string) {
+		string = toString(string);
+		return string && string.replace(reLatin, deburrLetter).replace(reComboMark, "");
+	}
+	/**
+	* Converts `string` to
+	* [snake case](https://en.wikipedia.org/wiki/Snake_case).
+	*
+	* @static
+	* @memberOf _
+	* @since 3.0.0
+	* @category String
+	* @param {string} [string=''] The string to convert.
+	* @returns {string} Returns the snake cased string.
+	* @example
+	*
+	* _.snakeCase('Foo Bar');
+	* // => 'foo_bar'
+	*
+	* _.snakeCase('fooBar');
+	* // => 'foo_bar'
+	*
+	* _.snakeCase('--FOO-BAR--');
+	* // => 'foo_bar'
+	*/
+	var snakeCase = createCompounder(function(result, word, index) {
+		return result + (index ? "_" : "") + word.toLowerCase();
+	});
+	/**
+	* Splits `string` into an array of its words.
+	*
+	* @static
+	* @memberOf _
+	* @since 3.0.0
+	* @category String
+	* @param {string} [string=''] The string to inspect.
+	* @param {RegExp|string} [pattern] The pattern to match words.
+	* @param- {Object} [guard] Enables use as an iteratee for methods like `_.map`.
+	* @returns {Array} Returns the words of `string`.
+	* @example
+	*
+	* _.words('fred, barney, & pebbles');
+	* // => ['fred', 'barney', 'pebbles']
+	*
+	* _.words('fred, barney, & pebbles', /[^, ]+/g);
+	* // => ['fred', 'barney', '&', 'pebbles']
+	*/
+	function words(string, pattern, guard) {
+		string = toString(string);
+		pattern = guard ? void 0 : pattern;
+		if (pattern === void 0) return hasUnicodeWord(string) ? unicodeWords(string) : asciiWords(string);
+		return string.match(pattern) || [];
+	}
+	module.exports = snakeCase;
+} });
+
+//#endregion
+//#region src/naming.ts
+var import_lodash = __toESM(require_lodash(), 1);
+/**
+* `UPPER_SNAKE_CASE`, with numbers kept against the word they follow.
+*
+* Matches `environmentCase` in `@geekmidas/envkit`, which reads the values these
+* names key. The two must agree exactly, so this is the implementation and that
+* one should defer to it.
+*
+* @example environmentCase('sendEmail') // 'SEND_EMAIL'
+* @example environmentCase('api2')      // 'API2'  (digit joins its word)
+*/
+function environmentCase(name) {
+	return (0, import_lodash.default)(name).toUpperCase().replace(/_\d+/g, (r) => r.replace("_", ""));
+}
+/**
+* The env key a construct provides for one of its roles.
+*
+* @example provideKey('Uploads', 'url')      // 'UPLOADS_URL'
+* @example provideKey('Uploads', 'cdnUrl')   // 'UPLOADS_CDN_URL'
+*/
+function provideKey(id, role) {
+	return environmentCase(`${id}_${role}`);
+}
+/**
+* A construct's canonical id — PascalCase.
+*
+* `uploads`, `Uploads`, `user_uploads`, and `user-uploads` all canonicalise to
+* the same id, so declaring two of them is a duplicate rather than a collision
+* to detect.
+*
+* Runtime only. Writing the id in PascalCase is what keeps the *type* usable:
+* the service key is `Uncapitalize<TName>`, a TypeScript intrinsic, so no
+* type-level transform is needed and none has to be kept in step with this one.
+*
+* @example canonicalId('user-uploads') // 'UserUploads'
+*/
+function canonicalId(input) {
+	const id = (0, import_lodash.default)(input).split("_").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+	if (!VALID_ID.test(id)) throw new InvalidConstructId(input, id);
+	return id;
+}
+/**
+* A canonical id: PascalCase, letters and digits only.
+*
+* Narrower than a JavaScript identifier — `_id` and `$ref` are legal JavaScript
+* and rejected here — because the id also has to survive `environmentCase` into
+* an env key and `cloudName` into a DNS-safe resource name.
+*/
+const VALID_ID = /^[A-Z][A-Za-z0-9]*$/;
+/**
+* The key a construct is reached under in the service record.
+*
+* The runtime twin of `Uncapitalize<TName>`, which types it — they must agree,
+* so they live next to each other rather than being re-derived by each
+* construct.
+*
+* @example serviceKey('UserUploads') // 'userUploads' → services.userUploads
+*/
+function serviceKey(id) {
+	return id.charAt(0).toLowerCase() + id.slice(1);
+}
+/**
+* The table a cache keeps its entries in, when nobody named one.
+*
+* Derived from the cache's own id rather than fixed at `cache`, because a
+* database may hold more than one and two caches sharing a table share a
+* keyspace — `orders.cache('Sessions')` and `orders.cache('Rates')` would
+* silently read each other's entries and evict each other's keys.
+*
+* Prefixed rather than suffixed so every cache sorts together in `\dt`, and
+* prefixed at all so a cache named for a thing the application also stores —
+* `orders.cache('Users')` — cannot collide with the table holding that thing.
+*
+* Read by whoever composes the URL and by whoever creates the table, so both
+* default the same way.
+*
+* @example cacheTable('Sessions') // 'cache_sessions'
+*/
+function cacheTable(id) {
+	return `cache_${id.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase()}`;
+}
+/**
+* Kebab-cases an identifier, acronym- and digit-aware.
+*
+* `userName` → `user-name`, `APIKey` → `api-key`, `S3Bucket` → `s3-bucket`.
+*
+* The last of those is why this is here rather than `snakecase(id)` with the
+* underscores swapped: lodash splits a digit from the letter beside it, so
+* `S3Bucket` became `s-3-bucket` on one provider and `s3-bucket` on the other.
+* Two implementations of one rule, agreeing on every id anybody had tried.
+*
+* `environmentCase` already corrected for the same thing in the other
+* direction — `api2` keeps its digit — so the two spellings of "kebab this id"
+* in this file did not even agree with each other.
+*/
+function kebabCase(value) {
+	return value.replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[\s_]+/g, "-").toLowerCase();
+}
+/**
+* The physical name a target provisions a construct under — lowercase kebab,
+* scoped so two stages or apps sharing an account cannot collide.
+*
+* **One rule, every provider.** A construct is named the same thing on AWS and
+* on Dokploy, which is what lets a name be read across them: `Database` in the
+* `production` stage of `kitchen-sink` is `production-kitchen-sink-database`
+* wherever it lands. The SST target's `prefixedName` is this function under
+* another signature and defers to it.
+*
+* Idempotent in its prefix: an id that already carries the scope is not given a
+* second one, so composing names cannot double up.
+*
+* @example cloudName({ stage: 'prod', app: 'myapp' }, 'UserUploads')
+* //        'prod-myapp-user-uploads'
+*/
+function cloudName(scope, id) {
+	return scopedName([scope.stage, scope.app], id);
+}
+/**
+* {@link cloudName} for a caller that holds its scope as a list.
+*
+* The SST target's stacks add a segment of their own, so the prefix is not
+* always two parts — which is the only reason this signature exists.
+*/
+function scopedName(scope, id) {
+	const prefix = scope.join("-").toLowerCase();
+	const name = kebabCase(id);
+	return name.startsWith(prefix) ? name : `${prefix}-${name}`;
+}
+/**
+* The domain a cookie must be scoped to so a surface and its callers share it.
+*
+* Derived from the addresses rather than configured, for the same reason the
+* origins are: the set of things that talk to a surface is already in the graph,
+* and the domain they have in common is a fact about that set. Returned with the
+* leading dot a `Domain` attribute wants.
+*
+* Returns `undefined` when there is nothing to scope, which is the common case
+* and not a failure:
+*
+* - **One host.** Locally everything is `localhost` on different ports, and
+*   cookies ignore the port — so a `Domain` would add nothing and `.localhost`
+*   is not a domain a browser will accept.
+* - **Nothing in common.** Unrelated hosts cannot share a cookie at all, and
+*   emitting the longest common suffix anyway would be a value that silently
+*   fails to set.
+*
+* **The public-suffix limit, stated rather than discovered.** Two apps on
+* `a.vercel.app` and `b.vercel.app` share `.vercel.app`, which every browser
+* rejects because it is a registrable suffix rather than a registrable domain.
+* Resolving that correctly needs the Public Suffix List, which is a downloaded,
+* expiring dataset — so this requires at least two labels and otherwise trusts
+* the addresses, and the value stays overridable for the case it gets wrong.
+*/
+function cookieDomain(urls) {
+	const hosts = /* @__PURE__ */ new Set();
+	for (const url of urls) try {
+		const { hostname } = new URL(url);
+		if (/^\d+(\.\d+){3}$/.test(hostname) || hostname.includes(":")) return;
+		hosts.add(hostname.toLowerCase());
+	} catch {
+		return;
+	}
+	if (hosts.size === 0) return;
+	if (hosts.size === 1) return;
+	const [first = [], ...rest] = [...hosts].map((host) => host.split(".").reverse());
+	const shared = [];
+	for (const [index, label] of first.entries()) {
+		if (!rest.every((labels) => labels[index] === label)) break;
+		shared.push(label);
+	}
+	if (shared.length < 2) return;
+	return `.${shared.reverse().join(".")}`;
+}
+/**
+* The env key a construct's provided role actually becomes.
+*
+* Almost always `provideKey(id, role)` — and `secret` is the exception, because
+* a secret's *name* is its key: `Auth` signs with `AUTH_SECRET`, which is also
+* what better-auth's own tooling looks for, and qualifying it by role would
+* produce `AUTH_SECRET_VALUE`.
+*
+* It lives here rather than in each target because two targets deriving the
+* same key separately is exactly the drift the app/infra contract check exists
+* to catch — and a check deriving the key differently from the thing it checks
+* cannot catch anything.
+*/
+function providedKeyFor(id, kind, role) {
+	return kind === "secret" ? environmentCase(id) : provideKey(id, role);
+}
+
+//#endregion
+//#region src/derive.ts
+/** Whether a declaration names a parent. */
+function isDerived(declaration) {
+	return declaration.kind in DERIVES_FROM && "of" in declaration && typeof declaration.of === "string";
+}
+/**
+* Check every derived construct against its parent.
+*
+* Two rules: the parent exists, and its kind may vend this one. Together they
+* make cycles unreachable — a reader is terminal, so no chain of `of` can
+* return to where it started, and no walk is needed to prove it.
+*/
+function assertDerivations(manifest) {
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (!isDerived(declaration)) continue;
+		const parent = manifest[declaration.of];
+		if (!parent) throw new UnknownParent(id, declaration.of, Object.keys(manifest));
+		const allowed = DERIVES_FROM[declaration.kind];
+		if (!allowed.includes(parent.kind)) throw new IllegalDerivation(id, declaration.kind, parent.kind, allowed);
+	}
+}
+/**
+* The order constructs must be provisioned in: every parent before its children.
+*
+* Resources are leaves and so come first in any order; only derived nodes
+* constrain the sequence, and they form a shallow forest rather than a general
+* graph. This walks each node's ancestors on demand instead of running a full
+* topological sort, which is the same result at this depth and reads as what it
+* is.
+*
+* Assumes {@link assertDerivations} has passed — a missing parent would
+* otherwise be a silent omission here rather than an error.
+*/
+function provisionOrder(manifest) {
+	const ordered = [];
+	const placed = /* @__PURE__ */ new Set();
+	const place = (id) => {
+		if (placed.has(id)) return;
+		const declaration = manifest[id];
+		if (!declaration) return;
+		placed.add(id);
+		if (isDerived(declaration)) place(declaration.of);
+		ordered.push(id);
+	};
+	for (const id of Object.keys(manifest)) place(id);
+	return ordered;
+}
+/**
+* Every edge a declaration carries, wherever the kind happens to keep them.
+*
+* Dependencies live in two places by design: on a node when the whole construct
+* is the consumer (a site), and on each nested handler when the construct is a
+* surface (a `rest-api`, whose routes each depend on their own things and
+* nothing more). Flattening that difference here is what lets every consumer of
+* the graph — reverse lookups, filtering, reference checks — ask one question.
+*/
+function dependenciesOf(declaration) {
+	const own = "dependencies" in declaration ? declaration.dependencies ?? [] : [];
+	const calls = "calls" in declaration ? declaration.calls ?? [] : [];
+	const nested = declaration.kind === "rest-api" ? declaration.endpoints.flatMap((endpoint) => endpoint.dependencies) : [];
+	return [
+		...own,
+		...calls,
+		...nested
+	];
+}
+/**
+* The ids that depend on one construct — the graph read backwards.
+*
+* This is the whole mechanism behind CORS origins and trusted origins. Both are
+* lists of *callers*, and a caller is exactly an inbound edge, so neither is
+* ever written down: a surface that listed its own callers would have to be
+* edited every time something new called it, which is the hand-maintained list
+* this replaces.
+*
+* Sorted, because it feeds a comma-separated env value that would otherwise
+* change whenever the manifest's key order did — and a value that churns is a
+* container that redeploys for no reason.
+*/
+function dependentsOf(manifest, id) {
+	const callers = [];
+	for (const [callerId, declaration] of Object.entries(manifest)) {
+		if (callerId === id) continue;
+		if (dependenciesOf(declaration).some((edge) => edge.target === id)) callers.push(callerId);
+	}
+	return callers.sort();
+}
+/**
+* How each site variant names a value it ships to the browser.
+*
+* The prefix *is* the framework's contract — `VITE_`, `NEXT_PUBLIC_` and
+* `EXPO_PUBLIC_` all mean "inline this into the bundle" — so it is the one thing
+* a variant changes, and it changes nothing else.
+*/
+const PUBLIC_PREFIX = {
+	static: "VITE_",
+	tanstack: "VITE_",
+	next: "NEXT_PUBLIC_"
+};
+/**
+* The keys a site's bundle needs, mapped to the key each value comes from —
+* `{ VITE_API_URL: 'API_URL' }`.
+*
+* A rename, not a second derivation: `API_URL` is resolved once, by whatever
+* resolved it for the server, and the site reads the same value under the name
+* its bundler will inline. That is what keeps a site and its API from coming to
+* disagree about where the API is.
+*
+* Filtered by `PUBLIC` rather than by what the site asked for. A site may
+* legitimately depend on anything — its server half, where it has one, reads env
+* exactly as a function does — so this is not a restriction on edges. It decides
+* one thing: which values may be prefixed into a bundle, which is what keeps
+* `ORDERS_URL` and its password out of a JavaScript file served to the public.
+*
+* Shared by every target for the same reason `providedKeyFor` is: a site built
+* locally and the same site built by a deploy must inline the same names.
+*/
+function publicEnvFor(declaration, manifest) {
+	const prefix = PUBLIC_PREFIX[declaration.variant];
+	const keys = {};
+	for (const edge of declaration.dependencies) {
+		const target = manifest[edge.target];
+		if (!target) continue;
+		for (const role of PUBLIC[target.kind] ?? []) {
+			const key = provideKey(edge.target, role);
+			keys[`${prefix}${key}`] = key;
+		}
+	}
+	return keys;
+}
+
+//#endregion
 //#region src/index.ts
 /** Flatten a manifest field (array or partitioned) into a plain array. */
 function flattenManifestField(field) {
@@ -6,5 +1003,5 @@ function flattenManifestField(field) {
 }
 
 //#endregion
-export { flattenManifestField };
+export { DEFAULT_APP_CODE, DEFAULT_POSTGRES_VERSION, DERIVES_FROM, IllegalDerivation, InvalidConstructId, PUBLIC, PUBLIC_PREFIX, UnknownParent, assertDerivations, cacheTable, canonicalId, cloudName, cookieDomain, dependenciesOf, dependentsOf, environmentCase, flattenManifestField, isDerived, kebabCase, provideKey, providedKeyFor, provisionOrder, publicEnvFor, scopedName, serviceKey };
 //# sourceMappingURL=index.mjs.map