cdk-turso 0.2.0 → 0.3.0

package/API.md

@@ -43,6 +43,7 @@ new TursoAuthToken(scope: Construct, id: string, props: TursoAuthTokenProps)
 | **Name** | **Description** |
 | --- | --- |
 | <code><a href="#cdk-turso.TursoAuthToken.toString">toString</a></code> | Returns a string representation of this construct. |
+| <code><a href="#cdk-turso.TursoAuthToken.with">with</a></code> | Applies one or more mixins to this construct. |
 
 ---
 
@@ -54,6 +55,27 @@ public toString(): string
 
 Returns a string representation of this construct.
 
+##### `with` <a name="with" id="cdk-turso.TursoAuthToken.with"></a>
+
+```typescript
+public with(mixins: ...IMixin[]): IConstruct
+```
+
+Applies one or more mixins to this construct.
+
+Mixins are applied in order. The list of constructs is captured at the
+start of the call, so constructs added by a mixin will not be visited.
+Use multiple `with()` calls if subsequent mixins should apply to added
+constructs.
+
+###### `mixins`<sup>Required</sup> <a name="mixins" id="cdk-turso.TursoAuthToken.with.parameter.mixins"></a>
+
+- *Type:* ...constructs.IMixin[]
+
+The mixins to apply.
+
+---
+
 #### Static Functions <a name="Static Functions" id="Static Functions"></a>
 
 | **Name** | **Description** |
@@ -62,7 +84,7 @@ Returns a string representation of this construct.
 
 ---
 
-##### ~~`isConstruct`~~ <a name="isConstruct" id="cdk-turso.TursoAuthToken.isConstruct"></a>
+##### `isConstruct` <a name="isConstruct" id="cdk-turso.TursoAuthToken.isConstruct"></a>
 
 ```typescript
 import { TursoAuthToken } from 'cdk-turso'
@@ -72,6 +94,20 @@ TursoAuthToken.isConstruct(x: any)
 
 Checks if `x` is a construct.
 
+Use this method instead of `instanceof` to properly detect `Construct`
+instances, even when the construct library is symlinked.
+
+Explanation: in JavaScript, multiple copies of the `constructs` library on
+disk are seen as independent, completely different libraries. As a
+consequence, the class `Construct` in each copy of the `constructs` library
+is seen as a different class, and an instance of one class will not test as
+`instanceof` the other class. `npm install` will not create installations
+like this, but users may manually symlink construct libraries together or
+use a monorepo tool: in those cases, multiple copies of the `constructs`
+library can be accidentally installed, and `instanceof` will behave
+unpredictably. It is safest to avoid using `instanceof`, and using
+this type-testing method instead.
+
 ###### `x`<sup>Required</sup> <a name="x" id="cdk-turso.TursoAuthToken.isConstruct.parameter.x"></a>
 
 - *Type:* any
@@ -155,6 +191,7 @@ new TursoDatabase(scope: Construct, id: string, props: TursoDatabaseProps)
 | **Name** | **Description** |
 | --- | --- |
 | <code><a href="#cdk-turso.TursoDatabase.toString">toString</a></code> | Returns a string representation of this construct. |
+| <code><a href="#cdk-turso.TursoDatabase.with">with</a></code> | Applies one or more mixins to this construct. |
 
 ---
 
@@ -166,6 +203,27 @@ public toString(): string
 
 Returns a string representation of this construct.
 
+##### `with` <a name="with" id="cdk-turso.TursoDatabase.with"></a>
+
+```typescript
+public with(mixins: ...IMixin[]): IConstruct
+```
+
+Applies one or more mixins to this construct.
+
+Mixins are applied in order. The list of constructs is captured at the
+start of the call, so constructs added by a mixin will not be visited.
+Use multiple `with()` calls if subsequent mixins should apply to added
+constructs.
+
+###### `mixins`<sup>Required</sup> <a name="mixins" id="cdk-turso.TursoDatabase.with.parameter.mixins"></a>
+
+- *Type:* ...constructs.IMixin[]
+
+The mixins to apply.
+
+---
+
 #### Static Functions <a name="Static Functions" id="Static Functions"></a>
 
 | **Name** | **Description** |
@@ -174,7 +232,7 @@ Returns a string representation of this construct.
 
 ---
 
-##### ~~`isConstruct`~~ <a name="isConstruct" id="cdk-turso.TursoDatabase.isConstruct"></a>
+##### `isConstruct` <a name="isConstruct" id="cdk-turso.TursoDatabase.isConstruct"></a>
 
 ```typescript
 import { TursoDatabase } from 'cdk-turso'
@@ -184,6 +242,20 @@ TursoDatabase.isConstruct(x: any)
 
 Checks if `x` is a construct.
 
+Use this method instead of `instanceof` to properly detect `Construct`
+instances, even when the construct library is symlinked.
+
+Explanation: in JavaScript, multiple copies of the `constructs` library on
+disk are seen as independent, completely different libraries. As a
+consequence, the class `Construct` in each copy of the `constructs` library
+is seen as a different class, and an instance of one class will not test as
+`instanceof` the other class. `npm install` will not create installations
+like this, but users may manually symlink construct libraries together or
+use a monorepo tool: in those cases, multiple copies of the `constructs`
+library can be accidentally installed, and `instanceof` will behave
+unpredictably. It is safest to avoid using `instanceof`, and using
+this type-testing method instead.
+
 ###### `x`<sup>Required</sup> <a name="x" id="cdk-turso.TursoDatabase.isConstruct.parameter.x"></a>
 
 - *Type:* any
@@ -197,11 +269,9 @@ Any object.
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
 | <code><a href="#cdk-turso.TursoDatabase.property.node">node</a></code> | <code>constructs.Node</code> | The tree node. |
-| <code><a href="#cdk-turso.TursoDatabase.property.apiToken">apiToken</a></code> | <code>aws-cdk-lib.aws_ssm.IParameter</code> | *No description.* |
 | <code><a href="#cdk-turso.TursoDatabase.property.databaseName">databaseName</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#cdk-turso.TursoDatabase.property.dbId">dbId</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#cdk-turso.TursoDatabase.property.hostname">hostname</a></code> | <code>string</code> | DNS hostname for the database (e.g., `my-db-my-org.turso.io`). Use with libSQL or HTTP connections. |
-| <code><a href="#cdk-turso.TursoDatabase.property.organizationSlug">organizationSlug</a></code> | <code>string</code> | *No description.* |
 
 ---
 
@@ -217,16 +287,6 @@ The tree node.
 
 ---
 
-##### `apiToken`<sup>Required</sup> <a name="apiToken" id="cdk-turso.TursoDatabase.property.apiToken"></a>
-
-```typescript
-public readonly apiToken: IParameter;
-```
-
-- *Type:* aws-cdk-lib.aws_ssm.IParameter
-
----
-
 ##### `databaseName`<sup>Required</sup> <a name="databaseName" id="cdk-turso.TursoDatabase.property.databaseName"></a>
 
 ```typescript
@@ -259,16 +319,175 @@ DNS hostname for the database (e.g., `my-db-my-org.turso.io`). Use with libSQL o
 
 ---
 
-##### `organizationSlug`<sup>Required</sup> <a name="organizationSlug" id="cdk-turso.TursoDatabase.property.organizationSlug"></a>
+
+### TursoProvider <a name="TursoProvider" id="cdk-turso.TursoProvider"></a>
+
+Shared Lambda + CloudFormation custom-resource provider for all Turso resources.
+
+Create one per stack and pass it to every
+`TursoDatabase`, `TursoAuthToken`, etc.
+
+#### Initializers <a name="Initializers" id="cdk-turso.TursoProvider.Initializer"></a>
 
 ```typescript
-public readonly organizationSlug: string;
+import { TursoProvider } from 'cdk-turso'
+
+new TursoProvider(scope: Construct, id: string, props: TursoProviderProps)
 ```
 
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#cdk-turso.TursoProvider.Initializer.parameter.scope">scope</a></code> | <code>constructs.Construct</code> | *No description.* |
+| <code><a href="#cdk-turso.TursoProvider.Initializer.parameter.id">id</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#cdk-turso.TursoProvider.Initializer.parameter.props">props</a></code> | <code><a href="#cdk-turso.TursoProviderProps">TursoProviderProps</a></code> | *No description.* |
+
+---
+
+##### `scope`<sup>Required</sup> <a name="scope" id="cdk-turso.TursoProvider.Initializer.parameter.scope"></a>
+
+- *Type:* constructs.Construct
+
+---
+
+##### `id`<sup>Required</sup> <a name="id" id="cdk-turso.TursoProvider.Initializer.parameter.id"></a>
+
 - *Type:* string
 
 ---
 
+##### `props`<sup>Required</sup> <a name="props" id="cdk-turso.TursoProvider.Initializer.parameter.props"></a>
+
+- *Type:* <a href="#cdk-turso.TursoProviderProps">TursoProviderProps</a>
+
+---
+
+#### Methods <a name="Methods" id="Methods"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#cdk-turso.TursoProvider.toString">toString</a></code> | Returns a string representation of this construct. |
+| <code><a href="#cdk-turso.TursoProvider.with">with</a></code> | Applies one or more mixins to this construct. |
+
+---
+
+##### `toString` <a name="toString" id="cdk-turso.TursoProvider.toString"></a>
+
+```typescript
+public toString(): string
+```
+
+Returns a string representation of this construct.
+
+##### `with` <a name="with" id="cdk-turso.TursoProvider.with"></a>
+
+```typescript
+public with(mixins: ...IMixin[]): IConstruct
+```
+
+Applies one or more mixins to this construct.
+
+Mixins are applied in order. The list of constructs is captured at the
+start of the call, so constructs added by a mixin will not be visited.
+Use multiple `with()` calls if subsequent mixins should apply to added
+constructs.
+
+###### `mixins`<sup>Required</sup> <a name="mixins" id="cdk-turso.TursoProvider.with.parameter.mixins"></a>
+
+- *Type:* ...constructs.IMixin[]
+
+The mixins to apply.
+
+---
+
+#### Static Functions <a name="Static Functions" id="Static Functions"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#cdk-turso.TursoProvider.isConstruct">isConstruct</a></code> | Checks if `x` is a construct. |
+
+---
+
+##### `isConstruct` <a name="isConstruct" id="cdk-turso.TursoProvider.isConstruct"></a>
+
+```typescript
+import { TursoProvider } from 'cdk-turso'
+
+TursoProvider.isConstruct(x: any)
+```
+
+Checks if `x` is a construct.
+
+Use this method instead of `instanceof` to properly detect `Construct`
+instances, even when the construct library is symlinked.
+
+Explanation: in JavaScript, multiple copies of the `constructs` library on
+disk are seen as independent, completely different libraries. As a
+consequence, the class `Construct` in each copy of the `constructs` library
+is seen as a different class, and an instance of one class will not test as
+`instanceof` the other class. `npm install` will not create installations
+like this, but users may manually symlink construct libraries together or
+use a monorepo tool: in those cases, multiple copies of the `constructs`
+library can be accidentally installed, and `instanceof` will behave
+unpredictably. It is safest to avoid using `instanceof`, and using
+this type-testing method instead.
+
+###### `x`<sup>Required</sup> <a name="x" id="cdk-turso.TursoProvider.isConstruct.parameter.x"></a>
+
+- *Type:* any
+
+Any object.
+
+---
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#cdk-turso.TursoProvider.property.node">node</a></code> | <code>constructs.Node</code> | The tree node. |
+| <code><a href="#cdk-turso.TursoProvider.property.handler">handler</a></code> | <code>aws-cdk-lib.aws_lambda.Function</code> | The Lambda function backing all Turso custom resources. |
+| <code><a href="#cdk-turso.TursoProvider.property.serviceToken">serviceToken</a></code> | <code>string</code> | The CDK custom-resource provider service token. |
+
+---
+
+##### `node`<sup>Required</sup> <a name="node" id="cdk-turso.TursoProvider.property.node"></a>
+
+```typescript
+public readonly node: Node;
+```
+
+- *Type:* constructs.Node
+
+The tree node.
+
+---
+
+##### `handler`<sup>Required</sup> <a name="handler" id="cdk-turso.TursoProvider.property.handler"></a>
+
+```typescript
+public readonly handler: Function;
+```
+
+- *Type:* aws-cdk-lib.aws_lambda.Function
+
+The Lambda function backing all Turso custom resources.
+
+Use this to attach additional IAM permissions when a resource
+type needs them (e.g. `ssm:PutParameter` for auth-token storage).
+
+---
+
+##### `serviceToken`<sup>Required</sup> <a name="serviceToken" id="cdk-turso.TursoProvider.property.serviceToken"></a>
+
+```typescript
+public readonly serviceToken: string;
+```
+
+- *Type:* string
+
+The CDK custom-resource provider service token.
+
+---
+
 
 ## Structs <a name="Structs" id="Structs"></a>
 
@@ -286,22 +505,36 @@ const tursoAuthTokenProps: TursoAuthTokenProps = { ... }
 
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
-| <code><a href="#cdk-turso.TursoAuthTokenProps.property.database">database</a></code> | <code><a href="#cdk-turso.TursoDatabase">TursoDatabase</a></code> | The Turso database to create an auth token for. |
+| <code><a href="#cdk-turso.TursoAuthTokenProps.property.databaseName">databaseName</a></code> | <code>string</code> | The name of the Turso database to create an auth token for. |
+| <code><a href="#cdk-turso.TursoAuthTokenProps.property.organizationSlug">organizationSlug</a></code> | <code>string</code> | The Turso organization slug that owns the database. |
 | <code><a href="#cdk-turso.TursoAuthTokenProps.property.parameterName">parameterName</a></code> | <code>string</code> | The SSM parameter name where the generated JWT will be stored as a SecureString. |
+| <code><a href="#cdk-turso.TursoAuthTokenProps.property.provider">provider</a></code> | <code><a href="#cdk-turso.TursoProvider">TursoProvider</a></code> | *No description.* |
 | <code><a href="#cdk-turso.TursoAuthTokenProps.property.authorization">authorization</a></code> | <code>string</code> | Authorization level for the token. |
 | <code><a href="#cdk-turso.TursoAuthTokenProps.property.expiration">expiration</a></code> | <code>string</code> | Expiration time for the token (e.g., `"2w"`, `"1d30m"`). |
 
 ---
 
-##### `database`<sup>Required</sup> <a name="database" id="cdk-turso.TursoAuthTokenProps.property.database"></a>
+##### `databaseName`<sup>Required</sup> <a name="databaseName" id="cdk-turso.TursoAuthTokenProps.property.databaseName"></a>
+
+```typescript
+public readonly databaseName: string;
+```
+
+- *Type:* string
+
+The name of the Turso database to create an auth token for.
+
+---
+
+##### `organizationSlug`<sup>Required</sup> <a name="organizationSlug" id="cdk-turso.TursoAuthTokenProps.property.organizationSlug"></a>
 
 ```typescript
-public readonly database: TursoDatabase;
+public readonly organizationSlug: string;
 ```
 
-- *Type:* <a href="#cdk-turso.TursoDatabase">TursoDatabase</a>
+- *Type:* string
 
-The Turso database to create an auth token for.
+The Turso organization slug that owns the database.
 
 ---
 
@@ -317,6 +550,16 @@ The SSM parameter name where the generated JWT will be stored as a SecureString.
 
 ---
 
+##### `provider`<sup>Required</sup> <a name="provider" id="cdk-turso.TursoAuthTokenProps.property.provider"></a>
+
+```typescript
+public readonly provider: TursoProvider;
+```
+
+- *Type:* <a href="#cdk-turso.TursoProvider">TursoProvider</a>
+
+---
+
 ##### `authorization`<sup>Optional</sup> <a name="authorization" id="cdk-turso.TursoAuthTokenProps.property.authorization"></a>
 
 ```typescript
@@ -396,26 +639,16 @@ const tursoDatabaseProps: TursoDatabaseProps = { ... }
 
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
-| <code><a href="#cdk-turso.TursoDatabaseProps.property.apiToken">apiToken</a></code> | <code>aws-cdk-lib.aws_ssm.IParameter</code> | *No description.* |
 | <code><a href="#cdk-turso.TursoDatabaseProps.property.databaseName">databaseName</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#cdk-turso.TursoDatabaseProps.property.group">group</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#cdk-turso.TursoDatabaseProps.property.organizationSlug">organizationSlug</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#cdk-turso.TursoDatabaseProps.property.provider">provider</a></code> | <code><a href="#cdk-turso.TursoProvider">TursoProvider</a></code> | *No description.* |
 | <code><a href="#cdk-turso.TursoDatabaseProps.property.encryption">encryption</a></code> | <code><a href="#cdk-turso.TursoDatabaseEncryption">TursoDatabaseEncryption</a></code> | *No description.* |
 | <code><a href="#cdk-turso.TursoDatabaseProps.property.seed">seed</a></code> | <code><a href="#cdk-turso.TursoDatabaseSeed">TursoDatabaseSeed</a></code> | *No description.* |
 | <code><a href="#cdk-turso.TursoDatabaseProps.property.sizeLimit">sizeLimit</a></code> | <code>string</code> | *No description.* |
 
 ---
 
-##### `apiToken`<sup>Required</sup> <a name="apiToken" id="cdk-turso.TursoDatabaseProps.property.apiToken"></a>
-
-```typescript
-public readonly apiToken: IParameter;
-```
-
-- *Type:* aws-cdk-lib.aws_ssm.IParameter
-
----
-
 ##### `databaseName`<sup>Required</sup> <a name="databaseName" id="cdk-turso.TursoDatabaseProps.property.databaseName"></a>
 
 ```typescript
@@ -446,6 +679,16 @@ public readonly organizationSlug: string;
 
 ---
 
+##### `provider`<sup>Required</sup> <a name="provider" id="cdk-turso.TursoDatabaseProps.property.provider"></a>
+
+```typescript
+public readonly provider: TursoProvider;
+```
+
+- *Type:* <a href="#cdk-turso.TursoProvider">TursoProvider</a>
+
+---
+
 ##### `encryption`<sup>Optional</sup> <a name="encryption" id="cdk-turso.TursoDatabaseProps.property.encryption"></a>
 
 ```typescript
@@ -526,5 +769,50 @@ public readonly timestamp: string;
 
 ---
 
+### TursoProviderProps <a name="TursoProviderProps" id="cdk-turso.TursoProviderProps"></a>
+
+#### Initializer <a name="Initializer" id="cdk-turso.TursoProviderProps.Initializer"></a>
+
+```typescript
+import { TursoProviderProps } from 'cdk-turso'
+
+const tursoProviderProps: TursoProviderProps = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#cdk-turso.TursoProviderProps.property.apiToken">apiToken</a></code> | <code>aws-cdk-lib.aws_ssm.IParameter</code> | SSM parameter that holds the Turso platform API token (stored as SecureString). |
+| <code><a href="#cdk-turso.TursoProviderProps.property.logGroup">logGroup</a></code> | <code>aws-cdk-lib.aws_logs.ILogGroup</code> | Optional log group for the Lambda function. |
+
+---
+
+##### `apiToken`<sup>Required</sup> <a name="apiToken" id="cdk-turso.TursoProviderProps.property.apiToken"></a>
+
+```typescript
+public readonly apiToken: IParameter;
+```
+
+- *Type:* aws-cdk-lib.aws_ssm.IParameter
+
+SSM parameter that holds the Turso platform API token (stored as SecureString).
+
+---
+
+##### `logGroup`<sup>Optional</sup> <a name="logGroup" id="cdk-turso.TursoProviderProps.property.logGroup"></a>
+
+```typescript
+public readonly logGroup: ILogGroup;
+```
+
+- *Type:* aws-cdk-lib.aws_logs.ILogGroup
+
+Optional log group for the Lambda function.
+
+If not provided, a log group will be automatically created.
+
+---
+
 
 

package/lib/handler/index.d.ts

@@ -3,31 +3,14 @@ export interface CloudFormationCustomResourceEvent {
     PhysicalResourceId?: string;
     ResourceProperties: {
         ServiceToken: string;
-        DatabaseName: string;
-        Group: string;
-        OrganizationSlug: string;
-        SizeLimit?: string;
-        Seed?: {
-            type: string;
-            name: string;
-            timestamp?: string;
-        };
-        Encryption?: {
-            encryptionKey: string;
-            encryptionCipher: string;
-        };
+        ResourceType: "Database" | "AuthToken";
+        [key: string]: unknown;
     };
     OldResourceProperties?: {
-        DatabaseName: string;
-        Group: string;
-        OrganizationSlug: string;
+        [key: string]: unknown;
     };
 }
 export declare function handler(event: CloudFormationCustomResourceEvent): Promise<{
     PhysicalResourceId: string;
-    Data?: {
-        DbId: string;
-        Hostname: string;
-        Name: string;
-    };
+    Data?: Record<string, string>;
 }>;

package/lib/handler/index.js

@@ -591,7 +591,7 @@ var retryOptions = {
   numOfAttempts: 4,
   jitter: "none"
 };
-async function fetchWithRetry(url, options, errorMessage, allow404) {
+async function fetchWithRetry(url, options, errorMessage, allow404 = false) {
   return (0, import_exponential_backoff.backOff)(async () => {
     const response = await fetch(url, options);
     if (!response.ok && !(allow404 && response.status === 404)) {
@@ -612,20 +612,8 @@ async function getApiToken(parameterName) {
   }
   return response.Parameter.Value;
 }
-async function handler(event) {
-  const {
-    RequestType,
-    PhysicalResourceId,
-    ResourceProperties,
-    OldResourceProperties
-  } = event;
-  const parameterName = process.env.TURSO_API_TOKEN_PARAMETER_NAME;
-  if (!parameterName) {
-    throw new Error(
-      "TURSO_API_TOKEN_PARAMETER_NAME environment variable not set"
-    );
-  }
-  const apiToken = await getApiToken(parameterName);
+async function handleDatabase(event, apiToken) {
+  const { RequestType, PhysicalResourceId, ResourceProperties } = event;
   const orgSlug = encodeURIComponent(ResourceProperties.OrganizationSlug);
   const baseUrl = "https://api.turso.tech/v1";
   if (RequestType === "Create") {
@@ -653,8 +641,7 @@ async function handler(event) {
         },
         body: JSON.stringify(body)
       },
-      "Failed to create database",
-      false
+      "Failed to create database"
     );
     const data = await response.json();
     return {
@@ -667,7 +654,7 @@ async function handler(event) {
     };
   }
   if (RequestType === "Update") {
-    const oldDbName = OldResourceProperties?.DatabaseName;
+    const oldDbName = event.OldResourceProperties?.DatabaseName;
     const newDbName = ResourceProperties.DatabaseName;
     if (oldDbName && oldDbName !== newDbName) {
       const body = {
@@ -684,8 +671,7 @@ async function handler(event) {
           },
           body: JSON.stringify(body)
         },
-        "Failed to create database",
-        false
+        "Failed to create database"
       );
       const data = await response.json();
       return {
@@ -724,6 +710,107 @@ async function handler(event) {
   }
   throw new Error(`Unknown request type: ${RequestType}`);
 }
+async function createToken(baseUrl, orgSlug, dbName, apiToken, expiration, authorization) {
+  const params = new URLSearchParams();
+  params.set("expiration", expiration);
+  params.set("authorization", authorization);
+  const response = await fetchWithRetry(
+    `${baseUrl}/organizations/${orgSlug}/databases/${dbName}/auth/tokens?${params.toString()}`,
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiToken}`
+      }
+    },
+    "Failed to create auth token"
+  );
+  const data = await response.json();
+  return data.jwt;
+}
+async function storeToken(parameterName, token) {
+  const command = new import_client_ssm.PutParameterCommand({
+    Name: parameterName,
+    Value: token,
+    Type: "SecureString",
+    Overwrite: true
+  });
+  await ssmClient.send(command);
+}
+async function deleteParameter(parameterName) {
+  try {
+    const command = new import_client_ssm.DeleteParameterCommand({
+      Name: parameterName
+    });
+    await ssmClient.send(command);
+  } catch (error) {
+    if (error instanceof Error && error.name === "ParameterNotFound") {
+      return;
+    }
+    throw error;
+  }
+}
+async function handleAuthToken(event, apiToken) {
+  const { RequestType, PhysicalResourceId, ResourceProperties } = event;
+  const orgSlug = encodeURIComponent(ResourceProperties.OrganizationSlug);
+  const dbName = encodeURIComponent(ResourceProperties.DatabaseName);
+  const baseUrl = "https://api.turso.tech/v1";
+  const parameterName = ResourceProperties.ParameterName;
+  const expiration = ResourceProperties.Expiration || "never";
+  const authorization = ResourceProperties.Authorization || "full-access";
+  if (RequestType === "Create") {
+    const jwt = await createToken(
+      baseUrl,
+      orgSlug,
+      dbName,
+      apiToken,
+      expiration,
+      authorization
+    );
+    await storeToken(parameterName, jwt);
+    return { PhysicalResourceId: parameterName };
+  }
+  if (RequestType === "Update") {
+    const jwt = await createToken(
+      baseUrl,
+      orgSlug,
+      dbName,
+      apiToken,
+      expiration,
+      authorization
+    );
+    await storeToken(parameterName, jwt);
+    return { PhysicalResourceId: parameterName };
+  }
+  if (RequestType === "Delete") {
+    if (!PhysicalResourceId) {
+      return { PhysicalResourceId: "unknown" };
+    }
+    if (PhysicalResourceId === "unknown" || PhysicalResourceId.startsWith("failed-")) {
+      return { PhysicalResourceId };
+    }
+    await deleteParameter(PhysicalResourceId);
+    return { PhysicalResourceId };
+  }
+  throw new Error(`Unknown request type: ${RequestType}`);
+}
+async function handler(event) {
+  const parameterName = process.env.TURSO_API_TOKEN_PARAMETER_NAME;
+  if (!parameterName) {
+    throw new Error(
+      "TURSO_API_TOKEN_PARAMETER_NAME environment variable not set"
+    );
+  }
+  const apiToken = await getApiToken(parameterName);
+  const resourceType = event.ResourceProperties.ResourceType;
+  switch (resourceType) {
+    case "Database":
+      return handleDatabase(event, apiToken);
+    case "AuthToken":
+      return handleAuthToken(event, apiToken);
+    default:
+      throw new Error(`Unknown resource type: ${resourceType}`);
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   handler