@prisma/composer-prisma-cloud 0.1.0-dev.1 → 0.1.0-dev.2

package/dist/control.d.mts

@@ -1,3 +1,4 @@
+import { t as ProviderParamEntry } from "./serializer-Cx5slrV4-xJfH6EWS.mjs";
 import * as Layer from "effect/Layer";
 import { createManagementApiClient } from "@prisma/management-api-sdk";
 import "effect/Context";
@@ -9,6 +10,7 @@ import { Resource, StackServices } from "alchemy";
 import "effect/Schedule";
 import postgres from "postgres";
 import { State, StateStoreError } from "alchemy/State";
+import * as Output from "alchemy/Output";
 import { ExtensionDescriptor } from "@prisma/composer/config";
 //#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute/index.d.mts
 /** Every region Prisma Compute serves — the runtime source of truth; `ComputeRegion` is derived from it so the two can never drift. */
@@ -39,6 +41,33 @@ type ComputeRegion = (typeof COMPUTE_REGIONS)[number];
 declare const prismaState: () => Layer.Layer<State, never, StackServices>;
 //#endregion
 //#region ../../1-prisma-cloud/1-extensions/target/dist/control.d.mts
+//#region src/descriptors/shared.d.ts
+/**
+ * The provider-side reserved param for one brand's minted values (ADR-0031:
+ * "the provisioner owns mint, size, **aggregation**, stability, and
+ * rotation", and ADR-0019: the physical encoding is the target's). `value`
+ * is deploy-side: given every inbound edge's minted ref for one provider
+ * (possibly empty), it returns the typed value to store, or `undefined` to
+ * write no row. The returned value is encoded through the serializer's
+ * normal service-own literal path (JSON) — the same path any declared param
+ * takes — never a brand-invented wire format.
+ *
+ * This is the seam that keeps `descriptors/compute.ts` brand-blind: a
+ * `ProviderParam` is registered beside its brand's provisioner in
+ * `control.ts`; the descriptor asks every registered entry about every
+ * exposing service and writes whatever comes back.
+ */
+interface ProviderParam extends ProviderParamEntry {
+  /**
+   * Every inbound edge's minted ref for this provider — POSSIBLY EMPTY. A
+   * provider with no wired consumers is still asked, because "no edges" and
+   * "no var" mean different things at boot: an absent var reads as "never
+   * provisioned" (local dev, tests). What an empty set means is this param's
+   * own call — deny everything, or emit nothing and let its reader fail closed.
+   */
+  readonly value: (refs: readonly unknown[]) => Output.Output<unknown> | unknown | undefined;
+}
+//#endregion
 //#region src/control.d.ts
 interface PrismaCloudOptions {
   /** Defaults to the PRISMA_WORKSPACE_ID environment variable. */
@@ -46,8 +75,19 @@ interface PrismaCloudOptions {
   /** Defaults to the PRISMA_REGION environment variable when set. */
   region?: ComputeRegion;
 }
+/**
+ * Builds the deploy-side registry from the boot-side list, keyed by brand —
+ * throws if a boot-side entry has no registered deploy-side `value(refs)`, so
+ * `RESERVED_PROVIDER_PARAMS` stays the single source of which reserved
+ * provider params exist: deploy can no longer write a row boot never
+ * stashes. Exported (rather than inlined into `PROVIDER_PARAMS` below) so
+ * `__tests__/provider-params.test.ts` can drive it directly with a
+ * deliberately incomplete value map and watch it throw.
+ */
+declare function buildProviderParams(entries: readonly ProviderParamEntry[], values: ReadonlyMap<symbol, ProviderParam['value']>): ReadonlyMap<symbol, ProviderParam>;
+declare const PROVIDER_PARAMS: ReadonlyMap<symbol, ProviderParam>;
 /** The Prisma Cloud extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */
 declare const prismaCloud: (opts?: PrismaCloudOptions) => ExtensionDescriptor;
 //#endregion
-export { PrismaCloudOptions, prismaCloud, prismaState };
+export { PROVIDER_PARAMS, PrismaCloudOptions, buildProviderParams, prismaCloud, prismaState };
 //# sourceMappingURL=control.d.mts.map

package/dist/control.mjs

@@ -1,5 +1,5 @@
-import { a as encodeParamPointer, c as secretName, i as encode, l as secretPointerRows, s as paramEntries, t as configKey } from "./serializer-DAEWRfnm-D3GW9dOZ.mjs";
-import { a as serviceKeyEdges, i as paramName, n as isEnvParamSource, o as serviceKeyEnvName, r as paramBindingFor } from "./param-DB0B8m15-IvzNq9BM.mjs";
+import { a as encodeParamPointer, c as secretName, i as encode, l as secretPointerRows, s as paramEntries, t as configKey } from "./serializer-CX4VYdf_-KKGoAxfx.mjs";
+import { a as isEnvParamSource, c as provisionedEdges, n as STREAMS_API_KEY, o as paramBindingFor, s as paramName, t as RESERVED_PROVIDER_PARAMS } from "./provisioned-edges-Bb7WiV49-DeSPi3Ax.mjs";
 import { a as normalizeSslMode, n as isPnPostgresResourceNode, o as withConnectionRetry } from "./prisma-next-COrwlg3N.mjs";
 import { isParamSource, paramManifest, provisionManifest } from "@prisma/composer";
 import { blindCast } from "@prisma/composer/casts";
@@ -1293,16 +1293,31 @@ function computeDescriptor(o) {
 				...branch
 			}));
 			if (svc.expose !== void 0 && Object.keys(svc.expose).length > 0) {
-				const keyOuts = serviceKeyEdges(graph).filter((e) => e.providerAddress === address).map((e) => ctx.provisioned.get(e.edgeId)).filter((value) => value !== void 0).map((value) => blindCast(value));
-				const acceptedJson = keyOuts.length > 0 ? Output.map(Output.all(...keyOuts), (vals) => JSON.stringify(vals)) : JSON.stringify([]);
-				const key = serviceKeyEnvName(address);
-				records.push(yield* EnvironmentVariable(`${key}-var`, {
-					projectId,
-					key,
-					value: acceptedJson,
-					class: cls,
-					...branch
-				}));
+				const refsByBrand = /* @__PURE__ */ new Map();
+				for (const edge of provisionedEdges(graph)) {
+					if (edge.providerAddress !== address) continue;
+					const ref = ctx.provisioned.get(edge.edgeId);
+					if (ref === void 0) continue;
+					const refs = refsByBrand.get(edge.brand) ?? [];
+					refs.push(ref);
+					refsByBrand.set(edge.brand, refs);
+				}
+				for (const [brand, entry] of o.providerParams) {
+					const raw = entry.value(refsByBrand.get(brand) ?? []);
+					if (raw === void 0) continue;
+					const key = configKey(address, {
+						owner: "service",
+						name: entry.name
+					});
+					const value = Output.isOutput(raw) ? Output.map(raw, (v) => encode("service", v)) : encode("service", raw);
+					records.push(yield* EnvironmentVariable(`${key}-var`, {
+						projectId,
+						key,
+						value,
+						class: cls,
+						...branch
+					}));
+				}
 			}
 			return {
 				environment: records,
@@ -1957,6 +1972,63 @@ async function runTeardown(input, deps) {
 const serviceKeyProvisioner = { provision: (edge) => Effect.gen(function* () {
 	return (yield* ServiceKey(`servicekey-${edge.edgeId}`, {})).value;
 }) };
+/**
+* `ctx.provisioned`'s refs are typed `unknown` — core forwards a provisioner's
+* ref without inspecting it. Each provider param below is the sole reader of
+* its own provisioner's output, so the shape is asserted here, once, rather
+* than checked.
+*/
+const asKeyOutputs = (refs) => refs.map((ref) => blindCast(ref));
+/**
+* RPC's deploy-side `value(refs)` (ADR-0030): the provider stores a SET — one
+* key per inbound edge — into the accepted-keys var `serve()` reads. Paired
+* with the provisioner above: mint per edge, aggregate every edge.
+*
+* Zero consumers still emits, and that is the whole point of #100: an ABSENT
+* var means "never provisioned" and passes every caller through, so a deployed
+* provider nobody wired must say "[]" — deny everything — rather than say
+* nothing. Written as a literal because `Output.all()` with no arguments has
+* nothing to resolve.
+*/
+const rpcAcceptedKeysValue = (refs) => refs.length > 0 ? Output.all(...asKeyOutputs(refs)) : [];
+/**
+* ADR-0031's registered provisioner for STREAMS_API_KEY — the same `ServiceKey`
+* mint, keyed PER PROVIDER instead of per edge: the resource id is the
+* provider's address, so every consumer edge of one streams module resolves to
+* the same resource and therefore the same stable value. That is what
+* `@prisma/streams-server` requires (it authenticates a single `API_KEY`), and
+* cardinality is exactly what ADR-0031 leaves to the provisioner. Making it
+* per-edge later is this id's shape plus an accepted-set provider param — no
+* new resource, no core change.
+*/
+const streamsApiKeyProvisioner = { provision: (edge) => Effect.gen(function* () {
+	return (yield* ServiceKey(`streamskey-${edge.providerAddress}`, {})).value;
+}) };
+/**
+* Streams' deploy-side `value(refs)`: ONE value, not a set —
+* `@prisma/streams-server` authenticates a single `API_KEY`, which is why the
+* provisioner above mints per provider. That pairing is the invariant this
+* param depends on, so it asserts rather than trusts it: a future per-edge
+* flip without a paired accepted-set param here would otherwise ship
+* whichever key came first and leave every other consumer 401ing, silently.
+* The refs are lazy Outputs (not comparable at serialize time); inside
+* `Output.map` they are resolved strings, the same seam RPC's set aggregates
+* on.
+*
+* Zero consumers emits NOTHING — the streams counterpart to RPC's "[]".
+* `@prisma/streams-server` has no deny-all mode: it either authenticates a key
+* or runs --no-auth, so there is no value here that means "refuse everyone".
+* Writing no key is what fails closed — the entrypoint refuses to boot with
+* a named error rather than serve unauthenticated.
+*/
+const streamsApiKeyValue = (refs) => {
+	if (refs.length === 0) return void 0;
+	return Output.map(Output.all(...asKeyOutputs(refs)), (vals) => {
+		const distinct = [...new Set(vals)];
+		if (distinct.length > 1) throw new Error(`a streams provider was provisioned ${distinct.length} distinct keys across its ${refs.length} inbound bindings, but it can only be given one (@prisma/streams-server authenticates a single API_KEY). Its provisioner must mint per provider, not per edge — or this param must store an accepted-key set, once the server accepts one.`);
+		return distinct[0] ?? "";
+	});
+};
 const KNOWN_REGION_SET = new Set(COMPUTE_REGIONS);
 function isComputeRegion(value) {
 	return KNOWN_REGION_SET.has(value);
@@ -1966,6 +2038,51 @@ function asProvidersLayer(layer) {
 	return layer;
 }
 /**
+* This extension's brands, each with the two halves ADR-0031 splits: the
+* PROVISIONER core resolves a mint through, and the reserved PROVIDER PARAM
+* that stores the minted values on the provider. So this file stays the only
+* place a brand is named — `descriptors/compute.ts` just looks a provider
+* param up by brand.
+*
+* `__tests__/provider-params.test.ts` asserts this map's brands are exactly
+* `PROVIDER_PARAMS`'s brands: a brand minted here with no provider param
+* below would leave the value it mints written to consumers while no
+* provider ever stores an accepted-keys row for it — `serve()` (or the
+* equivalent runtime reader) then sees an absent var and passes every caller
+* through.
+*/
+const PROVISIONERS = /* @__PURE__ */ new Map([[RPC_PEER_KEY, serviceKeyProvisioner], [STREAMS_API_KEY, streamsApiKeyProvisioner]]);
+/**
+* Every brand's deploy-side `value(refs)` — the only per-brand thing this
+* file still holds directly. `PROVIDER_PARAMS` below is built by mapping
+* `RESERVED_PROVIDER_PARAMS` (`provider-params.ts`, the boot-side list) onto
+* this map, so a param can exist on the deploy side only if it already
+* exists on the boot side: `RESERVED_PROVIDER_PARAMS` is the single source of
+* which reserved provider params exist at all, closing the drift the old
+* name-comparison test only detected after the fact.
+*/
+const PROVIDER_PARAM_VALUES = /* @__PURE__ */ new Map([[RPC_PEER_KEY, rpcAcceptedKeysValue], [STREAMS_API_KEY, streamsApiKeyValue]]);
+/**
+* Builds the deploy-side registry from the boot-side list, keyed by brand —
+* throws if a boot-side entry has no registered deploy-side `value(refs)`, so
+* `RESERVED_PROVIDER_PARAMS` stays the single source of which reserved
+* provider params exist: deploy can no longer write a row boot never
+* stashes. Exported (rather than inlined into `PROVIDER_PARAMS` below) so
+* `__tests__/provider-params.test.ts` can drive it directly with a
+* deliberately incomplete value map and watch it throw.
+*/
+function buildProviderParams(entries, values) {
+	return new Map(entries.map((entry) => {
+		const value = values.get(entry.brand);
+		if (value === void 0) throw new Error(`prisma-cloud: reserved provider param "${entry.name}" (provider-params.ts) has no registered deploy-side value() in control.ts's PROVIDER_PARAM_VALUES — every param in RESERVED_PROVIDER_PARAMS must have one.`);
+		return [entry.brand, {
+			...entry,
+			value
+		}];
+	}));
+}
+const PROVIDER_PARAMS = buildProviderParams(RESERVED_PROVIDER_PARAMS, PROVIDER_PARAM_VALUES);
+/**
 * Resolves the factory's env-or-option inputs, failing fast with the exact
 * variable name. `projectId`/`branchId` aren't required here — `prismaCloud()`
 * also runs in the CLI parent, before they're set; the required check lives in `application.provision`.
@@ -1979,20 +2096,23 @@ function resolveOptions(opts) {
 		workspaceId,
 		region: opts.region,
 		projectId,
-		branchId
+		branchId,
+		providerParams: PROVIDER_PARAMS
 	};
 	const region = process.env["PRISMA_REGION"];
 	if (region === void 0 || region.length === 0) return {
 		workspaceId,
 		projectId,
-		branchId
+		branchId,
+		providerParams: PROVIDER_PARAMS
 	};
 	if (!isComputeRegion(region)) throw new Error(`prismaCloud(): environment variable PRISMA_REGION="${region}" is not a known region (expected one of: ${COMPUTE_REGIONS.join(", ")}).`);
 	return {
 		workspaceId,
 		region,
 		projectId,
-		branchId
+		branchId,
+		providerParams: PROVIDER_PARAMS
 	};
 }
 /** The Prisma Cloud extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */
@@ -2015,7 +2135,7 @@ const prismaCloud = (opts = {}) => {
 			});
 			return { projectId };
 		}) },
-		provisions: /* @__PURE__ */ new Map([[RPC_PEER_KEY, serviceKeyProvisioner]]),
+		provisions: PROVISIONERS,
 		nodes: {
 			postgres: postgresDescriptor(o),
 			"prisma-next": prismaNextDescriptor(o),
@@ -2026,6 +2146,6 @@ const prismaCloud = (opts = {}) => {
 	};
 };
 //#endregion
-export { prismaCloud, prismaState };
+export { PROVIDER_PARAMS, buildProviderParams, prismaCloud, prismaState };
 
 //# sourceMappingURL=control.mjs.map