@prisma/composer-prisma-cloud 0.1.0-dev.1 → 0.1.0-dev.2

package/dist/cron/index.mjs

@@ -1,4 +1,4 @@
-import { contract, rpc, serve } from "@prisma/composer/rpc";
+import { RPC_PEER_KEY, contract, rpc, serve } from "@prisma/composer/rpc";
 import { type } from "arktype";
 import { hydrateSecrets, hydrateSync, module, number, param, service } from "@prisma/composer";
 import node from "@prisma/composer/node";
@@ -165,6 +165,32 @@ const stashSecrets = (node, address) => {
 		process.env[secretKey("", slot)] = name;
 	}
 };
+/**
+* Boot: for each reserved provider param, read its address-scoped row through
+* the same `coerce` a declared param uses (JSON-decode, schema-validate), and
+* re-emit it address-free — `stash`'s counterpart for this separate
+* declaration space. A param is declared optional here unconditionally: an
+* absent row means "never provisioned" (local dev, tests, a provider with no
+* registered value for this deploy), never a boot failure, so nothing is
+* stashed and the runtime reader that owns this slot falls back to its own
+* pass-through behavior.
+*/
+function stashProviderParams(entries, address) {
+	for (const entry of entries) {
+		const d = {
+			owner: "service",
+			name: entry.name,
+			param: {
+				schema: entry.schema,
+				optional: true
+			}
+		};
+		const key = configKey(address, d);
+		const value = coerce(process.env[key], d, key);
+		if (value === void 0) continue;
+		process.env[configKey("", d)] = encode("service", value);
+	}
+}
 /** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */
 function standardValidateSync(schema, value) {
 	const result = schema["~standard"].validate(value);
@@ -173,12 +199,52 @@ function standardValidateSync(schema, value) {
 	return result.value;
 }
 //#endregion
-//#region ../../1-prisma-cloud/1-extensions/target/dist/param-DB0B8m15.mjs
-/** The reserved accepted-keys env var: COMPOSER_<addr>_RPC_ACCEPTED_KEYS ("" ↦ @internal/rpc's RPC_ACCEPTED_KEYS_ENV). */
-const serviceKeyEnvName = (address) => configKey(address, {
+//#region ../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-Bb7WiV49.mjs
+/**
+* RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —
+* name + schema + brand — for the accepted-keys set a provider stores, shared
+* by `control.ts` (which registers the deploy-side `value(refs)` that mints
+* and aggregates it — see its `rpcAcceptedKeysValue`) and `compute.ts` (which
+* validates and stashes it at boot), so writer and reader cannot drift.
+* Finding the edges themselves is `provisioned-edges.ts`'s generic,
+* brand-blind scan — RPC is not special-cased anywhere in this target.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side `value(refs)` lives in control.ts, the
+* control-plane-only entry).
+*/
+/**
+* The reserved provider param for RPC's accepted-keys set: the var name is
+* `RPC_ACCEPTED_KEYS`, derived through `configKey` at both ends
+* (`configKey(address, …)` at deploy, `configKey('', …)` at boot — the
+* address-free form is `@internal/rpc`'s `RPC_ACCEPTED_KEYS_ENV`). `brand` is
+* `RPC_PEER_KEY`, the same brand `perBindingToken()`'s need carries — control.ts
+* looks its `value(refs)` up by this field.
+*/
+const RPC_ACCEPTED_KEYS_PARAM = {
+	name: "RPC_ACCEPTED_KEYS",
+	schema: type("string[]"),
+	brand: RPC_PEER_KEY
+};
+/** ADR-0031's need brand for the streams module's bearer key — control.ts registers the provisioner under this. */
+const STREAMS_API_KEY = Symbol.for("prisma:streams/api-key");
+/**
+* The reserved provider param for the streams bearer key: the var name is
+* `STREAMS_API_KEY`. `brand` is `STREAMS_API_KEY` itself (the same symbol
+* `streamsApiKeyNeed()`'s need carries) — control.ts looks its `value(refs)`
+* up by this field.
+*/
+const STREAMS_API_KEY_PARAM = {
+	name: "STREAMS_API_KEY",
+	schema: type("string"),
+	brand: STREAMS_API_KEY
+};
+configKey("", {
 	owner: "service",
-	name: "RPC_ACCEPTED_KEYS"
+	name: STREAMS_API_KEY_PARAM.name
 });
+const RESERVED_PROVIDER_PARAMS = [RPC_ACCEPTED_KEYS_PARAM, STREAMS_API_KEY_PARAM];
 blindCast(Symbol.for("prisma:prisma-cloud-param-source"));
 //#endregion
 //#region ../../1-prisma-cloud/1-extensions/target/dist/index.mjs
@@ -235,9 +301,8 @@ const compute = (def) => {
 		async run(address, boot) {
 			const config = deserialize(node, address);
 			stash(node, config);
+			stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
 			stashSecrets(node, address);
-			const accepted = process.env[serviceKeyEnvName(address)];
-			if (accepted !== void 0) process.env[serviceKeyEnvName("")] = accepted;
 			const port = config.service["port"];
 			if (typeof port === "number") process.env["PORT"] = String(port);
 			return boot();

package/dist/cron/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../1-prisma-cloud/1-extensions/target/dist/serializer-DAEWRfnm.mjs","../../../../1-prisma-cloud/1-extensions/target/dist/param-DB0B8m15.mjs","../../../../1-prisma-cloud/1-extensions/target/dist/index.mjs","../../../../1-prisma-cloud/2-shared-modules/cron/dist/scheduler-iL9rl3YY.mjs","../../../../1-prisma-cloud/2-shared-modules/cron/dist/index.mjs"],"sourcesContent":["import { secretSource } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/secret.ts\n/**\n* Brands the payload `envSecret` builds. Core's `secretSource()` is a public\n* SPI, so a user could bypass `envSecret` and bind a raw `secretSource('x')`;\n* the brand lets `secretName` reject such a source (or another target's) with a\n* clear error instead of reading an absent `.name`.\n*/\nconst PRISMA_CLOUD_SECRET_SOURCE = blindCast(Symbol.for(\"prisma:prisma-cloud-secret-source\"));\nconst RESERVED_SECRET_PREFIX = \"COMPOSER_\";\nconst POISONED_SECRET_NAMES = /* @__PURE__ */ new Set([\"DATABASE_URL\", \"DATABASE_URL_POOLED\"]);\n/**\n* Binds a secret slot to a named Prisma Cloud platform env var (ADR-0029). The\n* value is provisioned out-of-band; only the name is carried. The name may not\n* use the framework's reserved `COMPOSER_` prefix or the poisoned\n* `DATABASE_URL(_POOLED)` keys.\n*/\nfunction envSecret(name) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(\"envSecret() requires a non-empty platform env-var name, e.g. envSecret('STRIPE_SECRET_KEY').\");\n\tif (name.startsWith(RESERVED_SECRET_PREFIX)) throw new Error(`envSecret name \"${name}\" may not start with \"${RESERVED_SECRET_PREFIX}\" — that prefix is reserved for the framework's own generated config keys.`);\n\tif (POISONED_SECRET_NAMES.has(name)) throw new Error(`envSecret name \"${name}\" is reserved — ${[...POISONED_SECRET_NAMES].join(\" and \")} are poisoned at project provision and cannot back a secret.`);\n\treturn secretSource({\n\t\t[PRISMA_CLOUD_SECRET_SOURCE]: true,\n\t\tname\n\t});\n}\n/** True only for a payload that `envSecret` built — i.e. one carrying the brand. */\nfunction isEnvSecretPayload(payload) {\n\treturn typeof payload === \"object\" && payload !== null && blindCast(payload)[PRISMA_CLOUD_SECRET_SOURCE] === true;\n}\n/**\n* Reads the Prisma Cloud env-var name back out of a secret binding's opaque\n* source. A source not built by `envSecret` (a raw `secretSource(...)` or\n* another target's source) carries no name — reject it here. `secretName` runs\n* in preflight before any provisioning, so a foreign source fails early and\n* clearly rather than producing a broken deploy with an undefined name.\n*/\nfunction secretName(binding) {\n\tconst payload = binding.source.payload;\n\tif (!isEnvSecretPayload(payload)) throw new Error(`secret slot \"${binding.slot}\" of service \"${binding.serviceAddress}\" is bound to a source not created by envSecret() — bind secrets with envSecret('NAME') from @prisma/composer-prisma-cloud.`);\n\treturn payload.name;\n}\n//#endregion\n//#region src/serializer.ts\n/**\n* Walks a node's own params, then each dependency input's connection params —\n* the same enumeration order `configOf` uses, but carrying the raw\n* `ConfigParam` (with its `serialize`/`deserialize`) instead of a pure-data\n* projection.\n*/\nfunction paramEntries(node) {\n\tconst entries = [];\n\tfor (const [input, value] of Object.entries(node.inputs)) {\n\t\tif (typeof value !== \"object\" || value === null) continue;\n\t\tconst params = blindCast(value).connection.params;\n\t\tfor (const [name, param] of Object.entries(params)) entries.push({\n\t\t\towner: { input },\n\t\t\tname,\n\t\t\tparam\n\t\t});\n\t}\n\tfor (const [name, param] of Object.entries(node.params)) entries.push({\n\t\towner: \"service\",\n\t\tname,\n\t\tparam\n\t});\n\treturn entries;\n}\nconst configKey = (address, d) => {\n\tconst segments = address.split(\".\").filter((s) => s.length > 0);\n\tconst owner = d.owner === \"service\" ? [] : [d.owner.input];\n\treturn [\n\t\t\"COMPOSER\",\n\t\t...segments,\n\t\t...owner,\n\t\td.name\n\t].join(\"_\").toUpperCase();\n};\n/**\n* Typed value → its stored string. Service-own literals are JSON-encoded; a\n* dependency-input value is a provisioning ref at deploy (and a resolved\n* string at boot) and passes through untouched — LANDMINE: JSON-encoding it\n* would break the ordering edge Alchemy resolves through it.\n*/\nfunction encode(owner, value) {\n\treturn owner === \"service\" ? JSON.stringify(value) : blindCast(value);\n}\n/** Reverses `encode`: JSON-parse a service-own value, take a dependency-input value raw. */\nfunction decode(owner, raw) {\n\treturn owner === \"service\" ? JSON.parse(raw) : raw;\n}\nconst PARAM_POINTER_PREFIX = \"@composer-param-pointer:\";\n/** True iff `raw` is a param pointer row (as opposed to a JSON-encoded literal). */\nconst isParamPointerRow = (raw) => raw.startsWith(PARAM_POINTER_PREFIX);\n/** Builds a param pointer row's stored value from the platform var NAME it points to. */\nconst encodeParamPointer = (name) => `${PARAM_POINTER_PREFIX}${name}`;\n/** Reverses `encodeParamPointer`: the platform var NAME a pointer row points to. */\nconst decodeParamPointer = (raw) => raw.slice(24);\nfunction coerce(raw, d, key) {\n\tif (!(raw !== void 0 && raw !== \"\")) {\n\t\tif (d.param.default !== void 0) return d.param.default;\n\t\tif (d.param.optional === true) return void 0;\n\t\tthrow new Error(`missing required config param \"${d.name}\" (env ${key})`);\n\t}\n\tif (d.owner === \"service\" && isParamPointerRow(raw)) return coerceEnvSourcedParam(raw, d, key);\n\ttry {\n\t\treturn standardValidateSync(d.param.schema, decode(d.owner, raw));\n\t} catch (cause) {\n\t\tconst message = cause instanceof Error ? cause.message : String(cause);\n\t\tthrow new Error(`invalid value for config param \"${d.name}\" (env ${key}): ${message}`);\n\t}\n}\n/**\n* Boot resolution for an env-sourced param: double-lookup (pointer → platform\n* var), then the param's own schema on the raw string — no JSON decode, and\n* no redaction (it's config, not a secret). An UNSET platform var is a loud\n* boot failure naming both the param and the platform var; an EMPTY string is\n* not special-cased here — it reaches the schema like any other value, so it\n* passes iff the schema accepts it (deliberately unlike a literal param's own\n* \"\"-means-absent rule, and unlike a secret's non-empty requirement).\n*/\nfunction coerceEnvSourcedParam(raw, d, key) {\n\tconst platformVar = decodeParamPointer(raw);\n\tconst value = process.env[platformVar];\n\tif (value === void 0) throw new Error(`env-sourced config param \"${d.name}\" (env ${key} → ${platformVar}) is unset: the platform variable \"${platformVar}\" was not injected — the deploy did not provision it.`);\n\ttry {\n\t\treturn standardValidateSync(d.param.schema, value);\n\t} catch (cause) {\n\t\tconst message = cause instanceof Error ? cause.message : String(cause);\n\t\tthrow new Error(`invalid value for env-sourced config param \"${d.name}\" (env ${key} → ${platformVar}): ${message}`);\n\t}\n}\n/**\n* Boot: read each declared param from env by its key, reverse the param's own\n* serialization (missing/invalid fails loudly), assemble the typed Config.\n* Secrets ride a separate channel (deserializeSecrets), not this one.\n*/\nconst deserialize = (node, address) => {\n\tconst service = {};\n\tconst inputs = {};\n\tfor (const d of paramEntries(node)) {\n\t\tconst key = configKey(address, d);\n\t\tconst value = coerce(process.env[key], d, key);\n\t\tif (d.owner === \"service\") service[d.name] = value;\n\t\telse {\n\t\t\tlet bucket = inputs[d.owner.input];\n\t\t\tif (bucket === void 0) {\n\t\t\t\tbucket = {};\n\t\t\t\tinputs[d.owner.input] = bucket;\n\t\t\t}\n\t\t\tbucket[d.name] = value;\n\t\t}\n\t}\n\treturn {\n\t\tservice,\n\t\tinputs\n\t};\n};\n/**\n* run()'s setup step: write the resolved config to the environment under\n* address-free keys (configKey(\"\", d) + each serialize suffix), which load()\n* reads back with no address. Uses env, not a module variable, because a\n* framework may fork worker processes that inherit env but not memory.\n* Writes only these keys; nothing else is touched.\n*/\nconst stash = (node, config) => {\n\tfor (const d of paramEntries(node)) {\n\t\tconst value = d.owner === \"service\" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];\n\t\tif (value === void 0) continue;\n\t\tprocess.env[configKey(\"\", d)] = encode(d.owner, value);\n\t}\n};\n/** The pointer-row key for a secret slot: COMPOSER_<addr>_<slot> (secrets are service-level). */\nconst secretKey = (address, slot) => configKey(address, {\n\towner: \"service\",\n\tname: slot\n});\n/**\n* Deploy: the pointer rows for a node's secret slots — each slot's key mapped to\n* the platform NAME the root bound it to (looked up in `graph.secrets`). Never a\n* value. A declared slot with no binding is a Load-invariant violation (Load\n* binds every slot), surfaced loudly here rather than written as a blank row.\n*/\nfunction secretPointerRows(node, address, bindings) {\n\tconst rows = [];\n\tfor (const slot of Object.keys(node.secretSlots)) {\n\t\tconst binding = bindings.find((b) => b.serviceAddress === address && b.slot === slot);\n\t\tif (binding === void 0) throw new Error(`secret slot \"${slot}\" of \"${address}\" has no bound platform name — Load should have bound it (ADR-0029).`);\n\t\trows.push({\n\t\t\tkey: secretKey(address, slot),\n\t\t\tname: secretName(binding)\n\t\t});\n\t}\n\treturn rows;\n}\n/**\n* Boot: resolve every secret slot to its value by double-lookup — read the\n* pointer key (the platform NAME), then read that platform var. A missing\n* pointer or a missing/empty platform value is a loud failure naming both keys.\n* Returns a plain Record for core's `hydrateSecrets` to box.\n*/\nconst deserializeSecrets = (node, address) => {\n\tconst values = {};\n\tfor (const slot of Object.keys(node.secretSlots)) {\n\t\tconst key = secretKey(address, slot);\n\t\tconst name = process.env[key];\n\t\tif (name === void 0 || name === \"\") throw new Error(`missing secret pointer for slot \"${slot}\" (env ${key}) — the deploy did not write it.`);\n\t\tconst value = process.env[name];\n\t\tif (value === void 0 || value === \"\") throw new Error(`secret \"${slot}\" is not provisioned (env ${key} → ${name}): the platform var \"${name}\" is unset or empty.`);\n\t\tvalues[slot] = value;\n\t}\n\treturn values;\n};\n/**\n* run()'s setup step for secrets: re-emit each slot's pointer NAME under its\n* address-free key, so the address-free `deserializeSecrets` double-looks-up\n* identically. Never the value — the value stays only in the platform var.\n*/\nconst stashSecrets = (node, address) => {\n\tfor (const slot of Object.keys(node.secretSlots)) {\n\t\tconst name = process.env[secretKey(address, slot)];\n\t\tif (name === void 0) continue;\n\t\tprocess.env[secretKey(\"\", slot)] = name;\n\t}\n};\n/** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */\nfunction standardValidateSync(schema, value) {\n\tconst result = schema[\"~standard\"].validate(value);\n\tif (result instanceof Promise) throw new Error(\"config param schema validation must be synchronous — async Standard Schema validators are not supported for config params\");\n\tif (result.issues !== void 0) throw new Error(`config param validation failed: ${result.issues.map((issue) => issue.message).join(\"; \")}`);\n\treturn result.value;\n}\n//#endregion\nexport { encodeParamPointer as a, stash as c, secretName as d, encode as i, stashSecrets as l, deserialize as n, paramEntries as o, deserializeSecrets as r, secretPointerRows as s, configKey as t, envSecret as u };\n\n//# sourceMappingURL=serializer-DAEWRfnm.mjs.map","import { t as configKey } from \"./serializer-DAEWRfnm.mjs\";\nimport { isParamSource, paramSource } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\nimport { RPC_PEER_KEY } from \"@internal/rpc\";\n//#region src/service-keys.ts\n/** Every faceted RPC edge in the graph — scans each dependency edge's consumer-side input for the need. */\nfunction serviceKeyEdges(graph) {\n\tconst edges = [];\n\tfor (const edge of graph.edges) {\n\t\tif (edge.kind !== \"dependency\") continue;\n\t\tconst consumer = graph.nodes.find((n) => n.id === edge.to)?.node;\n\t\tif (consumer === void 0 || consumer.kind !== \"service\") continue;\n\t\tconst slot = consumer.inputs[edge.input];\n\t\tif (slot === void 0) continue;\n\t\tif (slot.connection.params[\"serviceKey\"]?.provision?.brand !== RPC_PEER_KEY) continue;\n\t\tedges.push({\n\t\t\tedgeId: `${edge.to}.${edge.input}`,\n\t\t\tconsumerAddress: edge.to,\n\t\t\tinput: edge.input,\n\t\t\tproviderAddress: edge.from\n\t\t});\n\t}\n\treturn edges;\n}\n/** The reserved accepted-keys env var: COMPOSER_<addr>_RPC_ACCEPTED_KEYS (\"\" ↦ @internal/rpc's RPC_ACCEPTED_KEYS_ENV). */\nconst serviceKeyEnvName = (address) => configKey(address, {\n\towner: \"service\",\n\tname: \"RPC_ACCEPTED_KEYS\"\n});\n//#endregion\n//#region src/param.ts\n/**\n* Brands the payload `envParam` builds. Core's `paramSource()` is a public\n* SPI, so a user could bypass `envParam` and bind a raw `paramSource('x')`;\n* the brand lets `paramName` reject such a source (or another target's) with\n* a clear error instead of reading an absent `.name`.\n*/\nconst PRISMA_CLOUD_PARAM_SOURCE = blindCast(Symbol.for(\"prisma:prisma-cloud-param-source\"));\nconst RESERVED_PARAM_PREFIX = \"COMPOSER_\";\nconst POISONED_PARAM_NAMES = /* @__PURE__ */ new Set([\"DATABASE_URL\", \"DATABASE_URL_POOLED\"]);\n/**\n* Binds a param slot to a named Prisma Cloud platform env var — the non-secret\n* sibling of `envSecret` (spec: env-sourced config params). The platform\n* injects the value into the running instance per stage; the param's own\n* schema validates it at boot, unredacted. The name may not use the\n* framework's reserved `COMPOSER_` prefix or the poisoned\n* `DATABASE_URL(_POOLED)` keys — same parity as `envSecret`.\n*/\nfunction envParam(name) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(\"envParam() requires a non-empty platform env-var name, e.g. envParam('APP_ORIGIN').\");\n\tif (name.startsWith(RESERVED_PARAM_PREFIX)) throw new Error(`envParam name \"${name}\" may not start with \"${RESERVED_PARAM_PREFIX}\" — that prefix is reserved for the framework's own generated config keys.`);\n\tif (POISONED_PARAM_NAMES.has(name)) throw new Error(`envParam name \"${name}\" is reserved — ${[...POISONED_PARAM_NAMES].join(\" and \")} are poisoned at project provision and cannot back a param.`);\n\treturn paramSource({\n\t\t[PRISMA_CLOUD_PARAM_SOURCE]: true,\n\t\tname\n\t});\n}\n/** True only for a payload that `envParam` built — i.e. one carrying the brand. */\nfunction isEnvParamPayload(payload) {\n\treturn typeof payload === \"object\" && payload !== null && blindCast(payload)[PRISMA_CLOUD_PARAM_SOURCE] === true;\n}\n/** True iff a resolved param value is an env-sourced pointer this target built (as opposed to a literal, or a foreign/raw `ParamSource`). */\nfunction isEnvParamSource(value) {\n\treturn isParamSource(value) && isEnvParamPayload(value.payload);\n}\n/**\n* Reads the Prisma Cloud env-var name back out of a param binding's opaque\n* source. A source not built by `envParam` (a raw `paramSource(...)` or\n* another target's source) carries no name — reject it here. `paramName` runs\n* in preflight and at serialize before any value ever crosses the wire, so a\n* foreign source fails early and clearly rather than producing a broken\n* deploy with an undefined name.\n*/\nfunction paramName(binding) {\n\tconst { binding: bound } = binding;\n\tif (!isEnvParamSource(bound)) throw new Error(`param slot \"${binding.slot}\" of service \"${binding.serviceAddress}\" is bound to a source not created by envParam() — bind env-sourced params with envParam('NAME') from @prisma/composer-prisma-cloud.`);\n\treturn bound.payload.name;\n}\n/**\n* Finds the manifest entry for one service param slot. `serialize` calls this\n* only after confirming `buildConfig` resolved the slot to a `ParamSource`\n* (`isParamSource(value)`), so a miss here means `graph.params` and the\n* resolved `Config` have drifted — a Load invariant violation, surfaced\n* loudly rather than producing a pointer row with an undefined name.\n*/\nfunction paramBindingFor(bindings, serviceAddress, slot) {\n\tconst binding = bindings.find((b) => b.serviceAddress === serviceAddress && b.slot === slot);\n\tif (binding === void 0) throw new Error(`param slot \"${slot}\" of \"${serviceAddress}\" resolved to a source but has no bound entry in the manifest — Load should have recorded it.`);\n\treturn binding;\n}\n//#endregion\nexport { serviceKeyEdges as a, paramName as i, isEnvParamSource as n, serviceKeyEnvName as o, paramBindingFor as r, envParam as t };\n\n//# sourceMappingURL=param-DB0B8m15.mjs.map","import { c as stash, d as secretName, l as stashSecrets, n as deserialize, r as deserializeSecrets, t as configKey, u as envSecret } from \"./serializer-DAEWRfnm.mjs\";\nimport { i as paramName, o as serviceKeyEnvName, t as envParam } from \"./param-DB0B8m15.mjs\";\nimport { dependency, hydrateSecrets, hydrateSync, number, resource, service, string } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/compute.ts\nconst reservedParams = { port: number({ default: 3e3 }) };\n/**\n* A Prisma Compute service — declarations only (deps + params + build + the\n* ports it exposes), no descriptor. `params` merges with the reserved\n* `ReservedParams` (`port`); a user param whose name collides with a reserved\n* one fails at authoring, the same way a colliding dependency name does.\n* Returns the extension's runnable/loadable node:\n*   · run(address, boot) — the process controller: deserialize the platform\n*     environment (keyed off `address`, the extension's ONE env read) into a\n*     typed Config, re-emit it under address-free process-local stash keys,\n*     then call boot() to start the app's entry.\n*   · load() / config() — called from inside the app's entry: read the stash;\n*     load() hydrates + memoizes the deps, config() returns the typed params.\n*     Separate accessors so a dep and a param never share a namespace (ADR-0021).\n*\n* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —\n* the control-plane registry key `prisma-composer deploy` resolves through the\n* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at\n* deploy time; nodes are pure data.\n*/\nconst compute = (def) => {\n\tconst userParams = def.params ?? blindCast({});\n\tfor (const reserved of Object.keys(reservedParams)) {\n\t\tif (reserved in def.deps) throw new Error(`compute(): dependency \"${reserved}\" collides with the reserved service param of the same name — rename the dependency.`);\n\t\tif (reserved in userParams) throw new Error(`compute(): param \"${reserved}\" collides with the reserved service param of the same name — rename the param.`);\n\t}\n\tconst params = blindCast({\n\t\t...userParams,\n\t\t...reservedParams\n\t});\n\tconst node = service({\n\t\tname: def.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\ttype: \"compute\",\n\t\tinputs: def.deps,\n\t\tparams,\n\t\t...def.secrets !== void 0 ? { secrets: def.secrets } : {},\n\t\tbuild: def.build,\n\t\t...def.expose !== void 0 ? { expose: def.expose } : {}\n\t});\n\tlet resolved;\n\tlet loadedDeps;\n\tlet loadedParams;\n\tlet loadedSecrets;\n\tfunction processConfig() {\n\t\tif (resolved === void 0) resolved = deserialize(node, \"\");\n\t\treturn resolved;\n\t}\n\tconst runnable = {\n\t\t...node,\n\t\tasync run(address, boot) {\n\t\t\tconst config = deserialize(node, address);\n\t\t\tstash(node, config);\n\t\t\tstashSecrets(node, address);\n\t\t\tconst accepted = process.env[serviceKeyEnvName(address)];\n\t\t\tif (accepted !== void 0) process.env[serviceKeyEnvName(\"\")] = accepted;\n\t\t\tconst port = config.service[\"port\"];\n\t\t\tif (typeof port === \"number\") process.env[\"PORT\"] = String(port);\n\t\t\treturn boot();\n\t\t},\n\t\tload() {\n\t\t\tif (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));\n\t\t\treturn loadedDeps;\n\t\t},\n\t\tconfig() {\n\t\t\tif (loadedParams === void 0) loadedParams = blindCast(processConfig().service);\n\t\t\treturn loadedParams;\n\t\t},\n\t\tsecrets() {\n\t\t\tif (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, \"\")));\n\t\t\treturn loadedSecrets;\n\t\t}\n\t};\n\treturn Object.freeze(blindCast(runnable));\n};\n//#endregion\n//#region src/http.ts\nconst defaultHttpClient = (cfg) => ({\n\turl: cfg.url,\n\tfetch: (path, init) => fetch(new URL(path, cfg.url), init)\n});\n/**\n* A service-to-service dependency. Its binding (what `load()` returns) is a\n* derived HttpClient — a thin URL-anchored fetch wrapper (fetch is standard\n* across runtimes — no driver, no runtime coupling). http() is a\n* protocol-owned kind: the framework owns the transport, so the client is\n* kind-canonical and derived from the contract, with no user client in the\n* declaration (ADR-0015). The typed generated client arrives with the\n* interface primitive (a later extension point).\n*/\nconst http = (opts) => dependency({\n\tname: opts.name,\n\ttype: \"http\",\n\tconnection: {\n\t\tparams: { url: string() },\n\t\thydrate: (v) => defaultHttpClient({ url: v.url })\n\t}\n});\n//#endregion\n//#region src/postgres.ts\n/**\n* The contract a Postgres provides — and the contract its consumers require.\n* `satisfies` compares KIND, not identity: an extension module can be duplicated\n* across a workspace (same rationale as the Symbol.for node brand), and every\n* duplicate's contract must still satisfy. `__cmp` is the connection config a\n* postgres offers; core never inspects it.\n*/\nconst postgresContract = Object.freeze({\n\tkind: \"postgres\",\n\t__cmp: { url: \"\" },\n\tsatisfies: (required) => required.kind === \"postgres\"\n});\nfunction postgres(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: postgresContract\n\t});\n\treturn dependency({\n\t\ttype: \"postgres\",\n\t\tconnection: {\n\t\t\tparams: { url: string() },\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: postgresContract\n\t});\n}\n//#endregion\n//#region src/s3-credentials.ts\n/**\n* The contract the `s3-credentials` resource provides — a minted SigV4 key\n* pair. `satisfies` compares KIND only (mirrors `postgresContract`); `__cmp` is\n* the config the resource offers, which core never inspects.\n*/\nconst credentialsContract = Object.freeze({\n\tkind: \"credentials\",\n\t__cmp: {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\"\n\t},\n\tsatisfies: (required) => required.kind === \"credentials\"\n});\nfunction s3Credentials(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: credentialsContract\n\t});\n\treturn dependency({\n\t\ttype: \"credentials\",\n\t\tconnection: {\n\t\t\tparams: {\n\t\t\t\taccessKeyId: string(),\n\t\t\t\tsecretAccessKey: string()\n\t\t\t},\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: credentialsContract\n\t});\n}\n//#endregion\n//#region src/s3-store.ts\n/**\n* The storage service authoring factory — a `compute` service routed to the\n* `s3-store` lowering instead of `compute`'s. It is exactly `compute`'s\n* runnable (run/load/config, deps, params, build, expose) with the routing\n* `type` overridden to `'s3-store'`: nothing at runtime keys off `type` (the\n* serializer keys off the deployment address and each param's owner/name, and\n* `load`/`config` off deps/params), so only the deploy-time descriptor lookup\n* sees the override and routes to the extended-output lowering (§ 5). The\n* return type is compute's exactly (including the reserved `port` param). The\n* storage module (D4b) calls this with its `db`/`credentials` deps, a `bucket`\n* param, and `expose: { store: s3Contract }`.\n*/\nfunction s3StoreService(def) {\n\tconst node = compute(def);\n\treturn Object.freeze(blindCast({\n\t\t...node,\n\t\ttype: \"s3-store\"\n\t}));\n}\n//#endregion\nexport { compute, configKey, credentialsContract, envParam, envSecret, http, paramName, postgres, postgresContract, s3Credentials, s3StoreService, secretName };\n\n//# sourceMappingURL=index.mjs.map","import { contract, rpc } from \"@internal/rpc\";\nimport { type } from \"arktype\";\nimport { param } from \"@internal/core\";\nimport node from \"@internal/node\";\nimport { compute } from \"@internal/prisma-cloud\";\n//#region src/contract.ts\n/**\n* The one call edge between the scheduler and the app's runner: `trigger(jobId)`.\n* The scheduler depends on it (`rpc(triggerContract)`); the runner exposes it\n* (`expose: { trigger: triggerContract }`). `jobId` travels as data through this\n* single method — adding a job never adds a method, service, or port.\n*/\nconst triggerContract = contract({ trigger: rpc({\n\tinput: type({ jobId: \"string\" }),\n\toutput: type({ ok: \"boolean\" })\n}) });\n//#endregion\n//#region src/schedule.ts\n/**\n* `defineSchedule({ tick: '60s', mrr: '24h' })` →\n* `{ jobs: [{ jobId: 'tick', every: '60s' }, { jobId: 'mrr', every: '24h' }] }`,\n* preserving key order.\n*/\nfunction defineSchedule(spec) {\n\treturn { jobs: Object.entries(spec).map(([jobId, every]) => ({\n\t\tjobId,\n\t\tevery\n\t})) };\n}\n/**\n* Parses the `every` grammar `<integer><unit>`, unit one of `s`/`m`/`h`/`d`\n* (e.g. `30s`, `24h`), returning milliseconds. Throws on a malformed value —\n* empty, missing/unknown unit, non-integer, or non-positive.\n*/\nfunction parseEvery(s) {\n\tconst match = /^(\\d+)([smhd])$/.exec(s);\n\tif (match === null) throw new Error(`parseEvery(): \"${s}\" is not a valid interval — expected \"<integer><unit>\" with unit one of s/m/h/d (e.g. \"30s\", \"24h\").`);\n\tconst [, digits = \"\", unit = \"\"] = match;\n\tconst value = Number(digits);\n\tif (!Number.isInteger(value) || value <= 0) throw new Error(`parseEvery(): \"${s}\" must have a positive integer value.`);\n\tswitch (unit) {\n\t\tcase \"s\": return value * 1e3;\n\t\tcase \"m\": return value * 6e4;\n\t\tcase \"h\": return value * 36e5;\n\t\tcase \"d\": return value * 864e5;\n\t\tdefault: throw new Error(`parseEvery(): \"${s}\" has an unknown unit \"${unit}\" — expected one of s/m/h/d.`);\n\t}\n}\n//#endregion\n//#region src/scheduler.ts\n/**\n* The reusable scheduler node and its firing logic. `cronScheduler` builds a\n* `compute()` whose `jobs` param default is the app's schedule and whose only\n* dependency is `trigger(jobId)`; nothing else about it varies per app.\n* `runScheduler` is the pure, injectable firing loop the entrypoint (and its\n* tests) drive.\n*/\nconst scheduleSchema = type({\n\tjobId: \"string\",\n\tevery: \"string\"\n}).array();\n/**\n* The always-on scheduler service. `schedule` sets only the `jobs` param's\n* default — the value the deploy serializes into config; the scheduler\n* itself is job-agnostic.\n*/\nfunction cronScheduler(schedule) {\n\treturn compute({\n\t\tname: \"scheduler\",\n\t\tdeps: { trigger: rpc(triggerContract) },\n\t\tparams: { jobs: param(scheduleSchema, { default: [...schedule.jobs] }) },\n\t\tbuild: node({\n\t\t\tmodule: new URL(\"./scheduler-service.mjs\", import.meta.url).href,\n\t\t\tentry: \"./scheduler-entrypoint.mjs\"\n\t\t})\n\t});\n}\n/**\n* Fires `call(jobId)` on each job's `every` interval. A rejected `call` is\n* logged, never thrown — a missed tick is healed by an idempotent target, not\n* by scheduler state. `setTimer` defaults to `setInterval`; tests inject a\n* fake to drive time.\n*/\nfunction runScheduler(opts) {\n\tconst setTimer = opts.setTimer ?? ((fn, ms) => setInterval(fn, ms));\n\tfor (const job of opts.jobs) setTimer(() => {\n\t\topts.call(job.jobId).catch((err) => {\n\t\t\tconsole.error(`cron: job \"${job.jobId}\" failed`, err);\n\t\t});\n\t}, parseEvery(job.every));\n}\n//#endregion\nexport { triggerContract as i, runScheduler as n, defineSchedule as r, cronScheduler as t };\n\n//# sourceMappingURL=scheduler-iL9rl3YY.mjs.map","import { i as triggerContract, n as runScheduler, r as defineSchedule, t as cronScheduler } from \"./scheduler-iL9rl3YY.mjs\";\nimport { serve } from \"@internal/rpc\";\nimport { module } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/module.ts\n/**\n* `opts.runner` is a service exposing `{ trigger }`; the returned module\n* provisions it alongside the scheduler that fires `opts.schedule` at it. The\n* module's boundary deps mirror the runner's own deps, so the parent wires the\n* real work target through them, e.g.\n* `provision(cron({ schedule, runner }), { worker: worker.rpc })`. `opts.name`\n* sets the module name (default `'cron'`). Exposes nothing.\n*/\nfunction cron(opts) {\n\treturn module(opts.name ?? \"cron\", { deps: opts.runner.inputs }, ({ inputs, provision }) => {\n\t\tconst runner = provision(opts.runner, {\n\t\t\tid: \"runner\",\n\t\t\tdeps: inputs\n\t\t});\n\t\tprovision(cronScheduler(opts.schedule), {\n\t\t\tid: \"scheduler\",\n\t\t\tdeps: { trigger: runner.trigger }\n\t\t});\n\t\treturn {};\n\t});\n}\n//#endregion\n//#region src/serve-schedule.ts\nfunction serveSchedule(service, _schedule, handlers) {\n\tconst byId = blindCast(handlers);\n\tconst triggerHandler = async (input, deps) => {\n\t\tconst handler = byId[input.jobId];\n\t\tif (handler === void 0) throw new Error(`serveSchedule(): no handler for job id \"${input.jobId}\" — not in the schedule.`);\n\t\tawait handler(deps);\n\t\treturn { ok: true };\n\t};\n\treturn serve(service, blindCast({ trigger: { trigger: triggerHandler } }));\n}\n//#endregion\nexport { cron, cronScheduler, defineSchedule, runScheduler, serveSchedule, triggerContract };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;AASmC,UAAU,OAAO,IAAI,mCAAmC,CAAC;;;;;;;AA0C5F,SAAS,aAAa,MAAM;CAC3B,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;EACjD,MAAM,SAAS,UAAU,KAAK,CAAC,CAAC,WAAW;EAC3C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAAG,QAAQ,KAAK;GAChE,OAAO,EAAE,MAAM;GACf;GACA;EACD,CAAC;CACF;CACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG,QAAQ,KAAK;EACrE,OAAO;EACP;EACA;CACD,CAAC;CACD,OAAO;AACR;AACA,MAAM,aAAa,SAAS,MAAM;CACjC,MAAM,WAAW,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,EAAE,SAAS,CAAC;CAC9D,MAAM,QAAQ,EAAE,UAAU,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK;CACzD,OAAO;EACN;EACA,GAAG;EACH,GAAG;EACH,EAAE;CACH,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,YAAY;AACzB;;;;;;;AAOA,SAAS,OAAO,OAAO,OAAO;CAC7B,OAAO,UAAU,YAAY,KAAK,UAAU,KAAK,IAAI,UAAU,KAAK;AACrE;;AAEA,SAAS,OAAO,OAAO,KAAK;CAC3B,OAAO,UAAU,YAAY,KAAK,MAAM,GAAG,IAAI;AAChD;AACA,MAAM,uBAAuB;;AAE7B,MAAM,qBAAqB,QAAQ,IAAI,WAAW,oBAAoB;;AAItE,MAAM,sBAAsB,QAAQ,IAAI,MAAM,EAAE;AAChD,SAAS,OAAO,KAAK,GAAG,KAAK;CAC5B,IAAI,EAAE,QAAQ,KAAK,KAAK,QAAQ,KAAK;EACpC,IAAI,EAAE,MAAM,YAAY,KAAK,GAAG,OAAO,EAAE,MAAM;EAC/C,IAAI,EAAE,MAAM,aAAa,MAAM,OAAO,KAAK;EAC3C,MAAM,IAAI,MAAM,kCAAkC,EAAE,KAAK,SAAS,IAAI,EAAE;CACzE;CACA,IAAI,EAAE,UAAU,aAAa,kBAAkB,GAAG,GAAG,OAAO,sBAAsB,KAAK,GAAG,GAAG;CAC7F,IAAI;EACH,OAAO,qBAAqB,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;CACjE,SAAS,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,MAAM,IAAI,MAAM,mCAAmC,EAAE,KAAK,SAAS,IAAI,KAAK,SAAS;CACtF;AACD;;;;;;;;;;AAUA,SAAS,sBAAsB,KAAK,GAAG,KAAK;CAC3C,MAAM,cAAc,mBAAmB,GAAG;CAC1C,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,MAAM,6BAA6B,EAAE,KAAK,SAAS,IAAI,KAAK,YAAY,qCAAqC,YAAY,sDAAsD;CAC/M,IAAI;EACH,OAAO,qBAAqB,EAAE,MAAM,QAAQ,KAAK;CAClD,SAAS,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,MAAM,IAAI,MAAM,+CAA+C,EAAE,KAAK,SAAS,IAAI,KAAK,YAAY,KAAK,SAAS;CACnH;AACD;;;;;;AAMA,MAAM,eAAe,MAAM,YAAY;CACtC,MAAM,UAAU,CAAC;CACjB,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,KAAK,aAAa,IAAI,GAAG;EACnC,MAAM,MAAM,UAAU,SAAS,CAAC;EAChC,MAAM,QAAQ,OAAO,QAAQ,IAAI,MAAM,GAAG,GAAG;EAC7C,IAAI,EAAE,UAAU,WAAW,QAAQ,EAAE,QAAQ;OACxC;GACJ,IAAI,SAAS,OAAO,EAAE,MAAM;GAC5B,IAAI,WAAW,KAAK,GAAG;IACtB,SAAS,CAAC;IACV,OAAO,EAAE,MAAM,SAAS;GACzB;GACA,OAAO,EAAE,QAAQ;EAClB;CACD;CACA,OAAO;EACN;EACA;CACD;AACD;;;;;;;;AAQA,MAAM,SAAS,MAAM,WAAW;CAC/B,KAAK,MAAM,KAAK,aAAa,IAAI,GAAG;EACnC,MAAM,QAAQ,EAAE,UAAU,YAAY,OAAO,QAAQ,EAAE,QAAQ,OAAO,OAAO,EAAE,MAAM,MAAM,GAAG,EAAE;EAChG,IAAI,UAAU,KAAK,GAAG;EACtB,QAAQ,IAAI,UAAU,IAAI,CAAC,KAAK,OAAO,EAAE,OAAO,KAAK;CACtD;AACD;;AAEA,MAAM,aAAa,SAAS,SAAS,UAAU,SAAS;CACvD,OAAO;CACP,MAAM;AACP,CAAC;;;;;;;AAyBD,MAAM,sBAAsB,MAAM,YAAY;CAC7C,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,WAAW,GAAG;EACjD,MAAM,MAAM,UAAU,SAAS,IAAI;EACnC,MAAM,OAAO,QAAQ,IAAI;EACzB,IAAI,SAAS,KAAK,KAAK,SAAS,IAAI,MAAM,IAAI,MAAM,oCAAoC,KAAK,SAAS,IAAI,iCAAiC;EAC3I,MAAM,QAAQ,QAAQ,IAAI;EAC1B,IAAI,UAAU,KAAK,KAAK,UAAU,IAAI,MAAM,IAAI,MAAM,WAAW,KAAK,4BAA4B,IAAI,KAAK,KAAK,uBAAuB,KAAK,qBAAqB;EACjK,OAAO,QAAQ;CAChB;CACA,OAAO;AACR;;;;;;AAMA,MAAM,gBAAgB,MAAM,YAAY;CACvC,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,WAAW,GAAG;EACjD,MAAM,OAAO,QAAQ,IAAI,UAAU,SAAS,IAAI;EAChD,IAAI,SAAS,KAAK,GAAG;EACrB,QAAQ,IAAI,UAAU,IAAI,IAAI,KAAK;CACpC;AACD;;AAEA,SAAS,qBAAqB,QAAQ,OAAO;CAC5C,MAAM,SAAS,OAAO,YAAY,CAAC,SAAS,KAAK;CACjD,IAAI,kBAAkB,SAAS,MAAM,IAAI,MAAM,2HAA2H;CAC1K,IAAI,OAAO,WAAW,KAAK,GAAG,MAAM,IAAI,MAAM,mCAAmC,OAAO,OAAO,KAAK,UAAU,MAAM,OAAO,CAAC,CAAC,KAAK,IAAI,GAAG;CACzI,OAAO,OAAO;AACf;;;;AC/MA,MAAM,qBAAqB,YAAY,UAAU,SAAS;CACzD,OAAO;CACP,MAAM;AACP,CAAC;AASiC,UAAU,OAAO,IAAI,kCAAkC,CAAC;;;AChC1F,MAAM,iBAAiB,EAAE,MAAM,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;AAoBxD,MAAM,WAAW,QAAQ;CACxB,MAAM,aAAa,IAAI,UAAU,UAAU,CAAC,CAAC;CAC7C,KAAK,MAAM,YAAY,OAAO,KAAK,cAAc,GAAG;EACnD,IAAI,YAAY,IAAI,MAAM,MAAM,IAAI,MAAM,0BAA0B,SAAS,qFAAqF;EAClK,IAAI,YAAY,YAAY,MAAM,IAAI,MAAM,qBAAqB,SAAS,gFAAgF;CAC3J;CACA,MAAM,SAAS,UAAU;EACxB,GAAG;EACH,GAAG;CACJ,CAAC;CACD,MAAM,OAAO,QAAQ;EACpB,MAAM,IAAI;EACV,WAAW;EACX,MAAM;EACN,QAAQ,IAAI;EACZ;EACA,GAAG,IAAI,YAAY,KAAK,IAAI,EAAE,SAAS,IAAI,QAAQ,IAAI,CAAC;EACxD,OAAO,IAAI;EACX,GAAG,IAAI,WAAW,KAAK,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;CACtD,CAAC;CACD,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,SAAS,gBAAgB;EACxB,IAAI,aAAa,KAAK,GAAG,WAAW,YAAY,MAAM,EAAE;EACxD,OAAO;CACR;CACA,MAAM,WAAW;EAChB,GAAG;EACH,MAAM,IAAI,SAAS,MAAM;GACxB,MAAM,SAAS,YAAY,MAAM,OAAO;GACxC,MAAM,MAAM,MAAM;GAClB,aAAa,MAAM,OAAO;GAC1B,MAAM,WAAW,QAAQ,IAAI,kBAAkB,OAAO;GACtD,IAAI,aAAa,KAAK,GAAG,QAAQ,IAAI,kBAAkB,EAAE,KAAK;GAC9D,MAAM,OAAO,OAAO,QAAQ;GAC5B,IAAI,OAAO,SAAS,UAAU,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC/D,OAAO,KAAK;EACb;EACA,OAAO;GACN,IAAI,eAAe,KAAK,GAAG,aAAa,UAAU,YAAY,MAAM,cAAc,CAAC,CAAC;GACpF,OAAO;EACR;EACA,SAAS;GACR,IAAI,iBAAiB,KAAK,GAAG,eAAe,UAAU,cAAc,CAAC,CAAC,OAAO;GAC7E,OAAO;EACR;EACA,UAAU;GACT,IAAI,kBAAkB,KAAK,GAAG,gBAAgB,UAAU,eAAe,MAAM,mBAAmB,MAAM,EAAE,CAAC,CAAC;GAC1G,OAAO;EACR;CACD;CACA,OAAO,OAAO,OAAO,UAAU,QAAQ,CAAC;AACzC;AAiCyB,OAAO,OAAO;CACtC,MAAM;CACN,OAAO,EAAE,KAAK,GAAG;CACjB,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;AAuB2B,OAAO,OAAO;CACzC,MAAM;CACN,OAAO;EACN,aAAa;EACb,iBAAiB;CAClB;CACA,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;;;;;;;;;ACtID,MAAM,kBAAkB,SAAS,EAAE,SAAS,IAAI;CAC/C,OAAO,KAAK,EAAE,OAAO,SAAS,CAAC;CAC/B,QAAQ,KAAK,EAAE,IAAI,UAAU,CAAC;AAC/B,CAAC,EAAE,CAAC;;;;;;AAQJ,SAAS,eAAe,MAAM;CAC7B,OAAO,EAAE,MAAM,OAAO,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY;EAC5D;EACA;CACD,EAAE,EAAE;AACL;;;;;;AAMA,SAAS,WAAW,GAAG;CACtB,MAAM,QAAQ,kBAAkB,KAAK,CAAC;CACtC,IAAI,UAAU,MAAM,MAAM,IAAI,MAAM,kBAAkB,EAAE,qGAAqG;CAC7J,MAAM,GAAG,SAAS,IAAI,OAAO,MAAM;CACnC,MAAM,QAAQ,OAAO,MAAM;CAC3B,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG,MAAM,IAAI,MAAM,kBAAkB,EAAE,sCAAsC;CACtH,QAAQ,MAAR;EACC,KAAK,KAAK,OAAO,QAAQ;EACzB,KAAK,KAAK,OAAO,QAAQ;EACzB,KAAK,KAAK,OAAO,QAAQ;EACzB,KAAK,KAAK,OAAO,QAAQ;EACzB,SAAS,MAAM,IAAI,MAAM,kBAAkB,EAAE,yBAAyB,KAAK,6BAA6B;CACzG;AACD;;;;;;;;AAUA,MAAM,iBAAiB,KAAK;CAC3B,OAAO;CACP,OAAO;AACR,CAAC,CAAC,CAAC,MAAM;;;;;;AAMT,SAAS,cAAc,UAAU;CAChC,OAAO,QAAQ;EACd,MAAM;EACN,MAAM,EAAE,SAAS,IAAI,eAAe,EAAE;EACtC,QAAQ,EAAE,MAAM,MAAM,gBAAgB,EAAE,SAAS,CAAC,GAAG,SAAS,IAAI,EAAE,CAAC,EAAE;EACvE,OAAO,KAAK;GACX,QAAQ,IAAI,IAAI,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;GAC5D,OAAO;EACR,CAAC;CACF,CAAC;AACF;;;;;;;AAOA,SAAS,aAAa,MAAM;CAC3B,MAAM,WAAW,KAAK,cAAc,IAAI,OAAO,YAAY,IAAI,EAAE;CACjE,KAAK,MAAM,OAAO,KAAK,MAAM,eAAe;EAC3C,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,OAAO,QAAQ;GACnC,QAAQ,MAAM,cAAc,IAAI,MAAM,WAAW,GAAG;EACrD,CAAC;CACF,GAAG,WAAW,IAAI,KAAK,CAAC;AACzB;;;;;;;;;;;AC7EA,SAAS,KAAK,MAAM;CACnB,OAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,MAAM,KAAK,OAAO,OAAO,IAAI,EAAE,QAAQ,gBAAgB;EAC3F,MAAM,SAAS,UAAU,KAAK,QAAQ;GACrC,IAAI;GACJ,MAAM;EACP,CAAC;EACD,UAAU,cAAc,KAAK,QAAQ,GAAG;GACvC,IAAI;GACJ,MAAM,EAAE,SAAS,OAAO,QAAQ;EACjC,CAAC;EACD,OAAO,CAAC;CACT,CAAC;AACF;AAGA,SAAS,cAAc,SAAS,WAAW,UAAU;CACpD,MAAM,OAAO,UAAU,QAAQ;CAC/B,MAAM,iBAAiB,OAAO,OAAO,SAAS;EAC7C,MAAM,UAAU,KAAK,MAAM;EAC3B,IAAI,YAAY,KAAK,GAAG,MAAM,IAAI,MAAM,2CAA2C,MAAM,MAAM,yBAAyB;EACxH,MAAM,QAAQ,IAAI;EAClB,OAAO,EAAE,IAAI,KAAK;CACnB;CACA,OAAO,MAAM,SAAS,UAAU,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC,CAAC;AAC1E"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../1-prisma-cloud/1-extensions/target/dist/serializer-CX4VYdf_.mjs","../../../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-Bb7WiV49.mjs","../../../../1-prisma-cloud/1-extensions/target/dist/index.mjs","../../../../1-prisma-cloud/2-shared-modules/cron/dist/scheduler-iL9rl3YY.mjs","../../../../1-prisma-cloud/2-shared-modules/cron/dist/index.mjs"],"sourcesContent":["import { secretSource } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/secret.ts\n/**\n* Brands the payload `envSecret` builds. Core's `secretSource()` is a public\n* SPI, so a user could bypass `envSecret` and bind a raw `secretSource('x')`;\n* the brand lets `secretName` reject such a source (or another target's) with a\n* clear error instead of reading an absent `.name`.\n*/\nconst PRISMA_CLOUD_SECRET_SOURCE = blindCast(Symbol.for(\"prisma:prisma-cloud-secret-source\"));\nconst RESERVED_SECRET_PREFIX = \"COMPOSER_\";\nconst POISONED_SECRET_NAMES = /* @__PURE__ */ new Set([\"DATABASE_URL\", \"DATABASE_URL_POOLED\"]);\n/**\n* Binds a secret slot to a named Prisma Cloud platform env var (ADR-0029). The\n* value is provisioned out-of-band; only the name is carried. The name may not\n* use the framework's reserved `COMPOSER_` prefix or the poisoned\n* `DATABASE_URL(_POOLED)` keys.\n*/\nfunction envSecret(name) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(\"envSecret() requires a non-empty platform env-var name, e.g. envSecret('STRIPE_SECRET_KEY').\");\n\tif (name.startsWith(RESERVED_SECRET_PREFIX)) throw new Error(`envSecret name \"${name}\" may not start with \"${RESERVED_SECRET_PREFIX}\" — that prefix is reserved for the framework's own generated config keys.`);\n\tif (POISONED_SECRET_NAMES.has(name)) throw new Error(`envSecret name \"${name}\" is reserved — ${[...POISONED_SECRET_NAMES].join(\" and \")} are poisoned at project provision and cannot back a secret.`);\n\treturn secretSource({\n\t\t[PRISMA_CLOUD_SECRET_SOURCE]: true,\n\t\tname\n\t});\n}\n/** True only for a payload that `envSecret` built — i.e. one carrying the brand. */\nfunction isEnvSecretPayload(payload) {\n\treturn typeof payload === \"object\" && payload !== null && blindCast(payload)[PRISMA_CLOUD_SECRET_SOURCE] === true;\n}\n/**\n* Reads the Prisma Cloud env-var name back out of a secret binding's opaque\n* source. A source not built by `envSecret` (a raw `secretSource(...)` or\n* another target's source) carries no name — reject it here. `secretName` runs\n* in preflight before any provisioning, so a foreign source fails early and\n* clearly rather than producing a broken deploy with an undefined name.\n*/\nfunction secretName(binding) {\n\tconst payload = binding.source.payload;\n\tif (!isEnvSecretPayload(payload)) throw new Error(`secret slot \"${binding.slot}\" of service \"${binding.serviceAddress}\" is bound to a source not created by envSecret() — bind secrets with envSecret('NAME') from @prisma/composer-prisma-cloud.`);\n\treturn payload.name;\n}\n//#endregion\n//#region src/serializer.ts\n/**\n* Walks a node's own params, then each dependency input's connection params —\n* the same enumeration order `configOf` uses, but carrying the raw\n* `ConfigParam` (with its `serialize`/`deserialize`) instead of a pure-data\n* projection.\n*/\nfunction paramEntries(node) {\n\tconst entries = [];\n\tfor (const [input, value] of Object.entries(node.inputs)) {\n\t\tif (typeof value !== \"object\" || value === null) continue;\n\t\tconst params = blindCast(value).connection.params;\n\t\tfor (const [name, param] of Object.entries(params)) entries.push({\n\t\t\towner: { input },\n\t\t\tname,\n\t\t\tparam\n\t\t});\n\t}\n\tfor (const [name, param] of Object.entries(node.params)) entries.push({\n\t\towner: \"service\",\n\t\tname,\n\t\tparam\n\t});\n\treturn entries;\n}\nconst configKey = (address, d) => {\n\tconst segments = address.split(\".\").filter((s) => s.length > 0);\n\tconst owner = d.owner === \"service\" ? [] : [d.owner.input];\n\treturn [\n\t\t\"COMPOSER\",\n\t\t...segments,\n\t\t...owner,\n\t\td.name\n\t].join(\"_\").toUpperCase();\n};\n/**\n* Typed value → its stored string. Service-own literals are JSON-encoded; a\n* dependency-input value is a provisioning ref at deploy (and a resolved\n* string at boot) and passes through untouched — LANDMINE: JSON-encoding it\n* would break the ordering edge Alchemy resolves through it.\n*/\nfunction encode(owner, value) {\n\treturn owner === \"service\" ? JSON.stringify(value) : blindCast(value);\n}\n/** Reverses `encode`: JSON-parse a service-own value, take a dependency-input value raw. */\nfunction decode(owner, raw) {\n\treturn owner === \"service\" ? JSON.parse(raw) : raw;\n}\nconst PARAM_POINTER_PREFIX = \"@composer-param-pointer:\";\n/** True iff `raw` is a param pointer row (as opposed to a JSON-encoded literal). */\nconst isParamPointerRow = (raw) => raw.startsWith(PARAM_POINTER_PREFIX);\n/** Builds a param pointer row's stored value from the platform var NAME it points to. */\nconst encodeParamPointer = (name) => `${PARAM_POINTER_PREFIX}${name}`;\n/** Reverses `encodeParamPointer`: the platform var NAME a pointer row points to. */\nconst decodeParamPointer = (raw) => raw.slice(24);\nfunction coerce(raw, d, key) {\n\tif (!(raw !== void 0 && raw !== \"\")) {\n\t\tif (d.param.default !== void 0) return d.param.default;\n\t\tif (d.param.optional === true) return void 0;\n\t\tthrow new Error(`missing required config param \"${d.name}\" (env ${key})`);\n\t}\n\tif (d.owner === \"service\" && isParamPointerRow(raw)) return coerceEnvSourcedParam(raw, d, key);\n\ttry {\n\t\treturn standardValidateSync(d.param.schema, decode(d.owner, raw));\n\t} catch (cause) {\n\t\tconst message = cause instanceof Error ? cause.message : String(cause);\n\t\tthrow new Error(`invalid value for config param \"${d.name}\" (env ${key}): ${message}`);\n\t}\n}\n/**\n* Boot resolution for an env-sourced param: double-lookup (pointer → platform\n* var), then the param's own schema on the raw string — no JSON decode, and\n* no redaction (it's config, not a secret). An UNSET platform var is a loud\n* boot failure naming both the param and the platform var; an EMPTY string is\n* not special-cased here — it reaches the schema like any other value, so it\n* passes iff the schema accepts it (deliberately unlike a literal param's own\n* \"\"-means-absent rule, and unlike a secret's non-empty requirement).\n*/\nfunction coerceEnvSourcedParam(raw, d, key) {\n\tconst platformVar = decodeParamPointer(raw);\n\tconst value = process.env[platformVar];\n\tif (value === void 0) throw new Error(`env-sourced config param \"${d.name}\" (env ${key} → ${platformVar}) is unset: the platform variable \"${platformVar}\" was not injected — the deploy did not provision it.`);\n\ttry {\n\t\treturn standardValidateSync(d.param.schema, value);\n\t} catch (cause) {\n\t\tconst message = cause instanceof Error ? cause.message : String(cause);\n\t\tthrow new Error(`invalid value for env-sourced config param \"${d.name}\" (env ${key} → ${platformVar}): ${message}`);\n\t}\n}\n/**\n* Boot: read each declared param from env by its key, reverse the param's own\n* serialization (missing/invalid fails loudly), assemble the typed Config.\n* Secrets ride a separate channel (deserializeSecrets), not this one.\n*/\nconst deserialize = (node, address) => {\n\tconst service = {};\n\tconst inputs = {};\n\tfor (const d of paramEntries(node)) {\n\t\tconst key = configKey(address, d);\n\t\tconst value = coerce(process.env[key], d, key);\n\t\tif (d.owner === \"service\") service[d.name] = value;\n\t\telse {\n\t\t\tlet bucket = inputs[d.owner.input];\n\t\t\tif (bucket === void 0) {\n\t\t\t\tbucket = {};\n\t\t\t\tinputs[d.owner.input] = bucket;\n\t\t\t}\n\t\t\tbucket[d.name] = value;\n\t\t}\n\t}\n\treturn {\n\t\tservice,\n\t\tinputs\n\t};\n};\n/**\n* run()'s setup step: write the resolved config to the environment under\n* address-free keys (configKey(\"\", d) + each serialize suffix), which load()\n* reads back with no address. Uses env, not a module variable, because a\n* framework may fork worker processes that inherit env but not memory.\n* Writes only these keys; nothing else is touched.\n*/\nconst stash = (node, config) => {\n\tfor (const d of paramEntries(node)) {\n\t\tconst value = d.owner === \"service\" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];\n\t\tif (value === void 0) continue;\n\t\tprocess.env[configKey(\"\", d)] = encode(d.owner, value);\n\t}\n};\n/** The pointer-row key for a secret slot: COMPOSER_<addr>_<slot> (secrets are service-level). */\nconst secretKey = (address, slot) => configKey(address, {\n\towner: \"service\",\n\tname: slot\n});\n/**\n* Deploy: the pointer rows for a node's secret slots — each slot's key mapped to\n* the platform NAME the root bound it to (looked up in `graph.secrets`). Never a\n* value. A declared slot with no binding is a Load-invariant violation (Load\n* binds every slot), surfaced loudly here rather than written as a blank row.\n*/\nfunction secretPointerRows(node, address, bindings) {\n\tconst rows = [];\n\tfor (const slot of Object.keys(node.secretSlots)) {\n\t\tconst binding = bindings.find((b) => b.serviceAddress === address && b.slot === slot);\n\t\tif (binding === void 0) throw new Error(`secret slot \"${slot}\" of \"${address}\" has no bound platform name — Load should have bound it (ADR-0029).`);\n\t\trows.push({\n\t\t\tkey: secretKey(address, slot),\n\t\t\tname: secretName(binding)\n\t\t});\n\t}\n\treturn rows;\n}\n/**\n* Boot: resolve every secret slot to its value by double-lookup — read the\n* pointer key (the platform NAME), then read that platform var. A missing\n* pointer or a missing/empty platform value is a loud failure naming both keys.\n* Returns a plain Record for core's `hydrateSecrets` to box.\n*/\nconst deserializeSecrets = (node, address) => {\n\tconst values = {};\n\tfor (const slot of Object.keys(node.secretSlots)) {\n\t\tconst key = secretKey(address, slot);\n\t\tconst name = process.env[key];\n\t\tif (name === void 0 || name === \"\") throw new Error(`missing secret pointer for slot \"${slot}\" (env ${key}) — the deploy did not write it.`);\n\t\tconst value = process.env[name];\n\t\tif (value === void 0 || value === \"\") throw new Error(`secret \"${slot}\" is not provisioned (env ${key} → ${name}): the platform var \"${name}\" is unset or empty.`);\n\t\tvalues[slot] = value;\n\t}\n\treturn values;\n};\n/**\n* run()'s setup step for secrets: re-emit each slot's pointer NAME under its\n* address-free key, so the address-free `deserializeSecrets` double-looks-up\n* identically. Never the value — the value stays only in the platform var.\n*/\nconst stashSecrets = (node, address) => {\n\tfor (const slot of Object.keys(node.secretSlots)) {\n\t\tconst name = process.env[secretKey(address, slot)];\n\t\tif (name === void 0) continue;\n\t\tprocess.env[secretKey(\"\", slot)] = name;\n\t}\n};\n/**\n* Boot: for each reserved provider param, read its address-scoped row through\n* the same `coerce` a declared param uses (JSON-decode, schema-validate), and\n* re-emit it address-free — `stash`'s counterpart for this separate\n* declaration space. A param is declared optional here unconditionally: an\n* absent row means \"never provisioned\" (local dev, tests, a provider with no\n* registered value for this deploy), never a boot failure, so nothing is\n* stashed and the runtime reader that owns this slot falls back to its own\n* pass-through behavior.\n*/\nfunction stashProviderParams(entries, address) {\n\tfor (const entry of entries) {\n\t\tconst d = {\n\t\t\towner: \"service\",\n\t\t\tname: entry.name,\n\t\t\tparam: {\n\t\t\t\tschema: entry.schema,\n\t\t\t\toptional: true\n\t\t\t}\n\t\t};\n\t\tconst key = configKey(address, d);\n\t\tconst value = coerce(process.env[key], d, key);\n\t\tif (value === void 0) continue;\n\t\tprocess.env[configKey(\"\", d)] = encode(\"service\", value);\n\t}\n}\n/** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */\nfunction standardValidateSync(schema, value) {\n\tconst result = schema[\"~standard\"].validate(value);\n\tif (result instanceof Promise) throw new Error(\"config param schema validation must be synchronous — async Standard Schema validators are not supported for config params\");\n\tif (result.issues !== void 0) throw new Error(`config param validation failed: ${result.issues.map((issue) => issue.message).join(\"; \")}`);\n\treturn result.value;\n}\n//#endregion\nexport { encodeParamPointer as a, stash as c, envSecret as d, secretName as f, encode as i, stashProviderParams as l, deserialize as n, paramEntries as o, deserializeSecrets as r, secretPointerRows as s, configKey as t, stashSecrets as u };\n\n//# sourceMappingURL=serializer-CX4VYdf_.mjs.map","import { t as configKey } from \"./serializer-CX4VYdf_.mjs\";\nimport { isParamSource, paramSource, provisionNeed } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\nimport { RPC_PEER_KEY } from \"@internal/rpc\";\nimport { type } from \"arktype\";\n//#region src/service-keys.ts\n/**\n* RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —\n* name + schema + brand — for the accepted-keys set a provider stores, shared\n* by `control.ts` (which registers the deploy-side `value(refs)` that mints\n* and aggregates it — see its `rpcAcceptedKeysValue`) and `compute.ts` (which\n* validates and stashes it at boot), so writer and reader cannot drift.\n* Finding the edges themselves is `provisioned-edges.ts`'s generic,\n* brand-blind scan — RPC is not special-cased anywhere in this target.\n*\n* This module is reachable from the RUNTIME/authoring side — it must never\n* import `@internal/lowering` or `effect`, or those tokens leak into a user\n* service's bundle (the deploy-side `value(refs)` lives in control.ts, the\n* control-plane-only entry).\n*/\n/**\n* The reserved provider param for RPC's accepted-keys set: the var name is\n* `RPC_ACCEPTED_KEYS`, derived through `configKey` at both ends\n* (`configKey(address, …)` at deploy, `configKey('', …)` at boot — the\n* address-free form is `@internal/rpc`'s `RPC_ACCEPTED_KEYS_ENV`). `brand` is\n* `RPC_PEER_KEY`, the same brand `perBindingToken()`'s need carries — control.ts\n* looks its `value(refs)` up by this field.\n*/\nconst RPC_ACCEPTED_KEYS_PARAM = {\n\tname: \"RPC_ACCEPTED_KEYS\",\n\tschema: type(\"string[]\"),\n\tbrand: RPC_PEER_KEY\n};\n//#endregion\n//#region src/streams-keys.ts\n/** ADR-0031's need brand for the streams module's bearer key — control.ts registers the provisioner under this. */\nconst STREAMS_API_KEY = Symbol.for(\"prisma:streams/api-key\");\n/**\n* The provisioning need `durableStreams()`'s `apiKey` param declares: an\n* unguessable value the target mints ONCE PER PROVIDER (not per edge) —\n* `@prisma/streams-server` authenticates a single `API_KEY`, so every\n* consumer of one streams module must present the same value. Per-provider\n* cardinality is provisioner policy (ADR-0031), invisible to core.\n*/\nconst streamsApiKeyNeed = () => provisionNeed(STREAMS_API_KEY);\n/**\n* The reserved provider param for the streams bearer key: the var name is\n* `STREAMS_API_KEY`. `brand` is `STREAMS_API_KEY` itself (the same symbol\n* `streamsApiKeyNeed()`'s need carries) — control.ts looks its `value(refs)`\n* up by this field.\n*/\nconst STREAMS_API_KEY_PARAM = {\n\tname: \"STREAMS_API_KEY\",\n\tschema: type(\"string\"),\n\tbrand: STREAMS_API_KEY\n};\n/** The address-free name compute.ts re-stashes to and the streams entrypoint reads. */\nconst STREAMS_API_KEY_ENV = configKey(\"\", {\n\towner: \"service\",\n\tname: STREAMS_API_KEY_PARAM.name\n});\n//#endregion\n//#region src/provider-params.ts\nconst RESERVED_PROVIDER_PARAMS = [RPC_ACCEPTED_KEYS_PARAM, STREAMS_API_KEY_PARAM];\n//#endregion\n//#region src/param.ts\n/**\n* Brands the payload `envParam` builds. Core's `paramSource()` is a public\n* SPI, so a user could bypass `envParam` and bind a raw `paramSource('x')`;\n* the brand lets `paramName` reject such a source (or another target's) with\n* a clear error instead of reading an absent `.name`.\n*/\nconst PRISMA_CLOUD_PARAM_SOURCE = blindCast(Symbol.for(\"prisma:prisma-cloud-param-source\"));\nconst RESERVED_PARAM_PREFIX = \"COMPOSER_\";\nconst POISONED_PARAM_NAMES = /* @__PURE__ */ new Set([\"DATABASE_URL\", \"DATABASE_URL_POOLED\"]);\n/**\n* Binds a param slot to a named Prisma Cloud platform env var — the non-secret\n* sibling of `envSecret` (spec: env-sourced config params). The platform\n* injects the value into the running instance per stage; the param's own\n* schema validates it at boot, unredacted. The name may not use the\n* framework's reserved `COMPOSER_` prefix or the poisoned\n* `DATABASE_URL(_POOLED)` keys — same parity as `envSecret`.\n*/\nfunction envParam(name) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(\"envParam() requires a non-empty platform env-var name, e.g. envParam('APP_ORIGIN').\");\n\tif (name.startsWith(RESERVED_PARAM_PREFIX)) throw new Error(`envParam name \"${name}\" may not start with \"${RESERVED_PARAM_PREFIX}\" — that prefix is reserved for the framework's own generated config keys.`);\n\tif (POISONED_PARAM_NAMES.has(name)) throw new Error(`envParam name \"${name}\" is reserved — ${[...POISONED_PARAM_NAMES].join(\" and \")} are poisoned at project provision and cannot back a param.`);\n\treturn paramSource({\n\t\t[PRISMA_CLOUD_PARAM_SOURCE]: true,\n\t\tname\n\t});\n}\n/** True only for a payload that `envParam` built — i.e. one carrying the brand. */\nfunction isEnvParamPayload(payload) {\n\treturn typeof payload === \"object\" && payload !== null && blindCast(payload)[PRISMA_CLOUD_PARAM_SOURCE] === true;\n}\n/** True iff a resolved param value is an env-sourced pointer this target built (as opposed to a literal, or a foreign/raw `ParamSource`). */\nfunction isEnvParamSource(value) {\n\treturn isParamSource(value) && isEnvParamPayload(value.payload);\n}\n/**\n* Reads the Prisma Cloud env-var name back out of a param binding's opaque\n* source. A source not built by `envParam` (a raw `paramSource(...)` or\n* another target's source) carries no name — reject it here. `paramName` runs\n* in preflight and at serialize before any value ever crosses the wire, so a\n* foreign source fails early and clearly rather than producing a broken\n* deploy with an undefined name.\n*/\nfunction paramName(binding) {\n\tconst { binding: bound } = binding;\n\tif (!isEnvParamSource(bound)) throw new Error(`param slot \"${binding.slot}\" of service \"${binding.serviceAddress}\" is bound to a source not created by envParam() — bind env-sourced params with envParam('NAME') from @prisma/composer-prisma-cloud.`);\n\treturn bound.payload.name;\n}\n/**\n* Finds the manifest entry for one service param slot. `serialize` calls this\n* only after confirming `buildConfig` resolved the slot to a `ParamSource`\n* (`isParamSource(value)`), so a miss here means `graph.params` and the\n* resolved `Config` have drifted — a Load invariant violation, surfaced\n* loudly rather than producing a pointer row with an undefined name.\n*/\nfunction paramBindingFor(bindings, serviceAddress, slot) {\n\tconst binding = bindings.find((b) => b.serviceAddress === serviceAddress && b.slot === slot);\n\tif (binding === void 0) throw new Error(`param slot \"${slot}\" of \"${serviceAddress}\" resolved to a source but has no bound entry in the manifest — Load should have recorded it.`);\n\treturn binding;\n}\n//#endregion\n//#region src/provisioned-edges.ts\n/**\n* Every provisioned edge in the graph. Core resolves and mints these (one\n* value per edge, keyed by `edgeId`); this scan is how the target finds them\n* again when it gathers a provider's inbound values.\n*/\nfunction provisionedEdges(graph) {\n\tconst edges = [];\n\tfor (const edge of graph.edges) {\n\t\tif (edge.kind !== \"dependency\") continue;\n\t\tconst consumer = graph.nodes.find((n) => n.id === edge.to)?.node;\n\t\tif (consumer === void 0 || consumer.kind !== \"service\") continue;\n\t\tconst slot = consumer.inputs[edge.input];\n\t\tif (slot === void 0) continue;\n\t\tfor (const param of Object.values(slot.connection.params)) {\n\t\t\tconst brand = param.provision?.brand;\n\t\t\tif (brand === void 0) continue;\n\t\t\tedges.push({\n\t\t\t\tedgeId: `${edge.to}.${edge.input}`,\n\t\t\t\tconsumerAddress: edge.to,\n\t\t\t\tinput: edge.input,\n\t\t\t\tproviderAddress: edge.from,\n\t\t\t\tbrand\n\t\t\t});\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn edges;\n}\n//#endregion\nexport { paramName as a, STREAMS_API_KEY_ENV as c, paramBindingFor as i, streamsApiKeyNeed as l, envParam as n, RESERVED_PROVIDER_PARAMS as o, isEnvParamSource as r, STREAMS_API_KEY as s, provisionedEdges as t };\n\n//# sourceMappingURL=provisioned-edges-Bb7WiV49.mjs.map","import { a as paramName, c as STREAMS_API_KEY_ENV, l as streamsApiKeyNeed, n as envParam, o as RESERVED_PROVIDER_PARAMS, s as STREAMS_API_KEY, t as provisionedEdges } from \"./provisioned-edges-Bb7WiV49.mjs\";\nimport { c as stash, d as envSecret, f as secretName, l as stashProviderParams, n as deserialize, r as deserializeSecrets, t as configKey, u as stashSecrets } from \"./serializer-CX4VYdf_.mjs\";\nimport { dependency, hydrateSecrets, hydrateSync, number, resource, service, string } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/compute.ts\nconst reservedParams = { port: number({ default: 3e3 }) };\n/**\n* A Prisma Compute service — declarations only (deps + params + build + the\n* ports it exposes), no descriptor. `params` merges with the reserved\n* `ReservedParams` (`port`); a user param whose name collides with a reserved\n* one fails at authoring, the same way a colliding dependency name does.\n* Returns the extension's runnable/loadable node:\n*   · run(address, boot) — the process controller: deserialize the platform\n*     environment (keyed off `address`, the extension's ONE env read) into a\n*     typed Config, re-emit it under address-free process-local stash keys,\n*     then call boot() to start the app's entry.\n*   · load() / config() — called from inside the app's entry: read the stash;\n*     load() hydrates + memoizes the deps, config() returns the typed params.\n*     Separate accessors so a dep and a param never share a namespace (ADR-0021).\n*\n* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —\n* the control-plane registry key `prisma-composer deploy` resolves through the\n* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at\n* deploy time; nodes are pure data.\n*/\nconst compute = (def) => {\n\tconst userParams = def.params ?? blindCast({});\n\tfor (const reserved of Object.keys(reservedParams)) {\n\t\tif (reserved in def.deps) throw new Error(`compute(): dependency \"${reserved}\" collides with the reserved service param of the same name — rename the dependency.`);\n\t\tif (reserved in userParams) throw new Error(`compute(): param \"${reserved}\" collides with the reserved service param of the same name — rename the param.`);\n\t}\n\tconst params = blindCast({\n\t\t...userParams,\n\t\t...reservedParams\n\t});\n\tconst node = service({\n\t\tname: def.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\ttype: \"compute\",\n\t\tinputs: def.deps,\n\t\tparams,\n\t\t...def.secrets !== void 0 ? { secrets: def.secrets } : {},\n\t\tbuild: def.build,\n\t\t...def.expose !== void 0 ? { expose: def.expose } : {}\n\t});\n\tlet resolved;\n\tlet loadedDeps;\n\tlet loadedParams;\n\tlet loadedSecrets;\n\tfunction processConfig() {\n\t\tif (resolved === void 0) resolved = deserialize(node, \"\");\n\t\treturn resolved;\n\t}\n\tconst runnable = {\n\t\t...node,\n\t\tasync run(address, boot) {\n\t\t\tconst config = deserialize(node, address);\n\t\t\tstash(node, config);\n\t\t\tstashProviderParams(RESERVED_PROVIDER_PARAMS, address);\n\t\t\tstashSecrets(node, address);\n\t\t\tconst port = config.service[\"port\"];\n\t\t\tif (typeof port === \"number\") process.env[\"PORT\"] = String(port);\n\t\t\treturn boot();\n\t\t},\n\t\tload() {\n\t\t\tif (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));\n\t\t\treturn loadedDeps;\n\t\t},\n\t\tconfig() {\n\t\t\tif (loadedParams === void 0) loadedParams = blindCast(processConfig().service);\n\t\t\treturn loadedParams;\n\t\t},\n\t\tsecrets() {\n\t\t\tif (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, \"\")));\n\t\t\treturn loadedSecrets;\n\t\t}\n\t};\n\treturn Object.freeze(blindCast(runnable));\n};\n//#endregion\n//#region src/http.ts\nconst defaultHttpClient = (cfg) => ({\n\turl: cfg.url,\n\tfetch: (path, init) => fetch(new URL(path, cfg.url), init)\n});\n/**\n* A service-to-service dependency. Its binding (what `load()` returns) is a\n* derived HttpClient — a thin URL-anchored fetch wrapper (fetch is standard\n* across runtimes — no driver, no runtime coupling). http() is a\n* protocol-owned kind: the framework owns the transport, so the client is\n* kind-canonical and derived from the contract, with no user client in the\n* declaration (ADR-0015). The typed generated client arrives with the\n* interface primitive (a later extension point).\n*/\nconst http = (opts) => dependency({\n\tname: opts.name,\n\ttype: \"http\",\n\tconnection: {\n\t\tparams: { url: string() },\n\t\thydrate: (v) => defaultHttpClient({ url: v.url })\n\t}\n});\n//#endregion\n//#region src/postgres.ts\n/**\n* The contract a Postgres provides — and the contract its consumers require.\n* `satisfies` compares KIND, not identity: an extension module can be duplicated\n* across a workspace (same rationale as the Symbol.for node brand), and every\n* duplicate's contract must still satisfy. `__cmp` is the connection config a\n* postgres offers; core never inspects it.\n*/\nconst postgresContract = Object.freeze({\n\tkind: \"postgres\",\n\t__cmp: { url: \"\" },\n\tsatisfies: (required) => required.kind === \"postgres\"\n});\nfunction postgres(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: postgresContract\n\t});\n\treturn dependency({\n\t\ttype: \"postgres\",\n\t\tconnection: {\n\t\t\tparams: { url: string() },\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: postgresContract\n\t});\n}\n//#endregion\n//#region src/s3-credentials.ts\n/**\n* The contract the `s3-credentials` resource provides — a minted SigV4 key\n* pair. `satisfies` compares KIND only (mirrors `postgresContract`); `__cmp` is\n* the config the resource offers, which core never inspects.\n*/\nconst credentialsContract = Object.freeze({\n\tkind: \"credentials\",\n\t__cmp: {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\"\n\t},\n\tsatisfies: (required) => required.kind === \"credentials\"\n});\nfunction s3Credentials(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: credentialsContract\n\t});\n\treturn dependency({\n\t\ttype: \"credentials\",\n\t\tconnection: {\n\t\t\tparams: {\n\t\t\t\taccessKeyId: string(),\n\t\t\t\tsecretAccessKey: string()\n\t\t\t},\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: credentialsContract\n\t});\n}\n//#endregion\n//#region src/s3-store.ts\n/**\n* The storage service authoring factory — a `compute` service routed to the\n* `s3-store` lowering instead of `compute`'s. It is exactly `compute`'s\n* runnable (run/load/config, deps, params, build, expose) with the routing\n* `type` overridden to `'s3-store'`: nothing at runtime keys off `type` (the\n* serializer keys off the deployment address and each param's owner/name, and\n* `load`/`config` off deps/params), so only the deploy-time descriptor lookup\n* sees the override and routes to the extended-output lowering (§ 5). The\n* return type is compute's exactly (including the reserved `port` param). The\n* storage module (D4b) calls this with its `db`/`credentials` deps, a `bucket`\n* param, and `expose: { store: s3Contract }`.\n*/\nfunction s3StoreService(def) {\n\tconst node = compute(def);\n\treturn Object.freeze(blindCast({\n\t\t...node,\n\t\ttype: \"s3-store\"\n\t}));\n}\n//#endregion\nexport { STREAMS_API_KEY, STREAMS_API_KEY_ENV, compute, configKey, credentialsContract, envParam, envSecret, http, paramName, postgres, postgresContract, provisionedEdges, s3Credentials, s3StoreService, secretName, streamsApiKeyNeed };\n\n//# sourceMappingURL=index.mjs.map","import { contract, rpc } from \"@internal/rpc\";\nimport { type } from \"arktype\";\nimport { param } from \"@internal/core\";\nimport node from \"@internal/node\";\nimport { compute } from \"@internal/prisma-cloud\";\n//#region src/contract.ts\n/**\n* The one call edge between the scheduler and the app's runner: `trigger(jobId)`.\n* The scheduler depends on it (`rpc(triggerContract)`); the runner exposes it\n* (`expose: { trigger: triggerContract }`). `jobId` travels as data through this\n* single method — adding a job never adds a method, service, or port.\n*/\nconst triggerContract = contract({ trigger: rpc({\n\tinput: type({ jobId: \"string\" }),\n\toutput: type({ ok: \"boolean\" })\n}) });\n//#endregion\n//#region src/schedule.ts\n/**\n* `defineSchedule({ tick: '60s', mrr: '24h' })` →\n* `{ jobs: [{ jobId: 'tick', every: '60s' }, { jobId: 'mrr', every: '24h' }] }`,\n* preserving key order.\n*/\nfunction defineSchedule(spec) {\n\treturn { jobs: Object.entries(spec).map(([jobId, every]) => ({\n\t\tjobId,\n\t\tevery\n\t})) };\n}\n/**\n* Parses the `every` grammar `<integer><unit>`, unit one of `s`/`m`/`h`/`d`\n* (e.g. `30s`, `24h`), returning milliseconds. Throws on a malformed value —\n* empty, missing/unknown unit, non-integer, or non-positive.\n*/\nfunction parseEvery(s) {\n\tconst match = /^(\\d+)([smhd])$/.exec(s);\n\tif (match === null) throw new Error(`parseEvery(): \"${s}\" is not a valid interval — expected \"<integer><unit>\" with unit one of s/m/h/d (e.g. \"30s\", \"24h\").`);\n\tconst [, digits = \"\", unit = \"\"] = match;\n\tconst value = Number(digits);\n\tif (!Number.isInteger(value) || value <= 0) throw new Error(`parseEvery(): \"${s}\" must have a positive integer value.`);\n\tswitch (unit) {\n\t\tcase \"s\": return value * 1e3;\n\t\tcase \"m\": return value * 6e4;\n\t\tcase \"h\": return value * 36e5;\n\t\tcase \"d\": return value * 864e5;\n\t\tdefault: throw new Error(`parseEvery(): \"${s}\" has an unknown unit \"${unit}\" — expected one of s/m/h/d.`);\n\t}\n}\n//#endregion\n//#region src/scheduler.ts\n/**\n* The reusable scheduler node and its firing logic. `cronScheduler` builds a\n* `compute()` whose `jobs` param default is the app's schedule and whose only\n* dependency is `trigger(jobId)`; nothing else about it varies per app.\n* `runScheduler` is the pure, injectable firing loop the entrypoint (and its\n* tests) drive.\n*/\nconst scheduleSchema = type({\n\tjobId: \"string\",\n\tevery: \"string\"\n}).array();\n/**\n* The always-on scheduler service. `schedule` sets only the `jobs` param's\n* default — the value the deploy serializes into config; the scheduler\n* itself is job-agnostic.\n*/\nfunction cronScheduler(schedule) {\n\treturn compute({\n\t\tname: \"scheduler\",\n\t\tdeps: { trigger: rpc(triggerContract) },\n\t\tparams: { jobs: param(scheduleSchema, { default: [...schedule.jobs] }) },\n\t\tbuild: node({\n\t\t\tmodule: new URL(\"./scheduler-service.mjs\", import.meta.url).href,\n\t\t\tentry: \"./scheduler-entrypoint.mjs\"\n\t\t})\n\t});\n}\n/**\n* Fires `call(jobId)` on each job's `every` interval. A rejected `call` is\n* logged, never thrown — a missed tick is healed by an idempotent target, not\n* by scheduler state. `setTimer` defaults to `setInterval`; tests inject a\n* fake to drive time.\n*/\nfunction runScheduler(opts) {\n\tconst setTimer = opts.setTimer ?? ((fn, ms) => setInterval(fn, ms));\n\tfor (const job of opts.jobs) setTimer(() => {\n\t\topts.call(job.jobId).catch((err) => {\n\t\t\tconsole.error(`cron: job \"${job.jobId}\" failed`, err);\n\t\t});\n\t}, parseEvery(job.every));\n}\n//#endregion\nexport { triggerContract as i, runScheduler as n, defineSchedule as r, cronScheduler as t };\n\n//# sourceMappingURL=scheduler-iL9rl3YY.mjs.map","import { i as triggerContract, n as runScheduler, r as defineSchedule, t as cronScheduler } from \"./scheduler-iL9rl3YY.mjs\";\nimport { serve } from \"@internal/rpc\";\nimport { module } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/module.ts\n/**\n* `opts.runner` is a service exposing `{ trigger }`; the returned module\n* provisions it alongside the scheduler that fires `opts.schedule` at it. The\n* module's boundary deps mirror the runner's own deps, so the parent wires the\n* real work target through them, e.g.\n* `provision(cron({ schedule, runner }), { worker: worker.rpc })`. `opts.name`\n* sets the module name (default `'cron'`). Exposes nothing.\n*/\nfunction cron(opts) {\n\treturn module(opts.name ?? \"cron\", { deps: opts.runner.inputs }, ({ inputs, provision }) => {\n\t\tconst runner = provision(opts.runner, {\n\t\t\tid: \"runner\",\n\t\t\tdeps: inputs\n\t\t});\n\t\tprovision(cronScheduler(opts.schedule), {\n\t\t\tid: \"scheduler\",\n\t\t\tdeps: { trigger: runner.trigger }\n\t\t});\n\t\treturn {};\n\t});\n}\n//#endregion\n//#region src/serve-schedule.ts\nfunction serveSchedule(service, _schedule, handlers) {\n\tconst byId = blindCast(handlers);\n\tconst triggerHandler = async (input, deps) => {\n\t\tconst handler = byId[input.jobId];\n\t\tif (handler === void 0) throw new Error(`serveSchedule(): no handler for job id \"${input.jobId}\" — not in the schedule.`);\n\t\tawait handler(deps);\n\t\treturn { ok: true };\n\t};\n\treturn serve(service, blindCast({ trigger: { trigger: triggerHandler } }));\n}\n//#endregion\nexport { cron, cronScheduler, defineSchedule, runScheduler, serveSchedule, triggerContract };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;AASmC,UAAU,OAAO,IAAI,mCAAmC,CAAC;;;;;;;AA0C5F,SAAS,aAAa,MAAM;CAC3B,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;EACjD,MAAM,SAAS,UAAU,KAAK,CAAC,CAAC,WAAW;EAC3C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAAG,QAAQ,KAAK;GAChE,OAAO,EAAE,MAAM;GACf;GACA;EACD,CAAC;CACF;CACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG,QAAQ,KAAK;EACrE,OAAO;EACP;EACA;CACD,CAAC;CACD,OAAO;AACR;AACA,MAAM,aAAa,SAAS,MAAM;CACjC,MAAM,WAAW,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,EAAE,SAAS,CAAC;CAC9D,MAAM,QAAQ,EAAE,UAAU,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK;CACzD,OAAO;EACN;EACA,GAAG;EACH,GAAG;EACH,EAAE;CACH,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,YAAY;AACzB;;;;;;;AAOA,SAAS,OAAO,OAAO,OAAO;CAC7B,OAAO,UAAU,YAAY,KAAK,UAAU,KAAK,IAAI,UAAU,KAAK;AACrE;;AAEA,SAAS,OAAO,OAAO,KAAK;CAC3B,OAAO,UAAU,YAAY,KAAK,MAAM,GAAG,IAAI;AAChD;AACA,MAAM,uBAAuB;;AAE7B,MAAM,qBAAqB,QAAQ,IAAI,WAAW,oBAAoB;;AAItE,MAAM,sBAAsB,QAAQ,IAAI,MAAM,EAAE;AAChD,SAAS,OAAO,KAAK,GAAG,KAAK;CAC5B,IAAI,EAAE,QAAQ,KAAK,KAAK,QAAQ,KAAK;EACpC,IAAI,EAAE,MAAM,YAAY,KAAK,GAAG,OAAO,EAAE,MAAM;EAC/C,IAAI,EAAE,MAAM,aAAa,MAAM,OAAO,KAAK;EAC3C,MAAM,IAAI,MAAM,kCAAkC,EAAE,KAAK,SAAS,IAAI,EAAE;CACzE;CACA,IAAI,EAAE,UAAU,aAAa,kBAAkB,GAAG,GAAG,OAAO,sBAAsB,KAAK,GAAG,GAAG;CAC7F,IAAI;EACH,OAAO,qBAAqB,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;CACjE,SAAS,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,MAAM,IAAI,MAAM,mCAAmC,EAAE,KAAK,SAAS,IAAI,KAAK,SAAS;CACtF;AACD;;;;;;;;;;AAUA,SAAS,sBAAsB,KAAK,GAAG,KAAK;CAC3C,MAAM,cAAc,mBAAmB,GAAG;CAC1C,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,MAAM,6BAA6B,EAAE,KAAK,SAAS,IAAI,KAAK,YAAY,qCAAqC,YAAY,sDAAsD;CAC/M,IAAI;EACH,OAAO,qBAAqB,EAAE,MAAM,QAAQ,KAAK;CAClD,SAAS,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,MAAM,IAAI,MAAM,+CAA+C,EAAE,KAAK,SAAS,IAAI,KAAK,YAAY,KAAK,SAAS;CACnH;AACD;;;;;;AAMA,MAAM,eAAe,MAAM,YAAY;CACtC,MAAM,UAAU,CAAC;CACjB,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,KAAK,aAAa,IAAI,GAAG;EACnC,MAAM,MAAM,UAAU,SAAS,CAAC;EAChC,MAAM,QAAQ,OAAO,QAAQ,IAAI,MAAM,GAAG,GAAG;EAC7C,IAAI,EAAE,UAAU,WAAW,QAAQ,EAAE,QAAQ;OACxC;GACJ,IAAI,SAAS,OAAO,EAAE,MAAM;GAC5B,IAAI,WAAW,KAAK,GAAG;IACtB,SAAS,CAAC;IACV,OAAO,EAAE,MAAM,SAAS;GACzB;GACA,OAAO,EAAE,QAAQ;EAClB;CACD;CACA,OAAO;EACN;EACA;CACD;AACD;;;;;;;;AAQA,MAAM,SAAS,MAAM,WAAW;CAC/B,KAAK,MAAM,KAAK,aAAa,IAAI,GAAG;EACnC,MAAM,QAAQ,EAAE,UAAU,YAAY,OAAO,QAAQ,EAAE,QAAQ,OAAO,OAAO,EAAE,MAAM,MAAM,GAAG,EAAE;EAChG,IAAI,UAAU,KAAK,GAAG;EACtB,QAAQ,IAAI,UAAU,IAAI,CAAC,KAAK,OAAO,EAAE,OAAO,KAAK;CACtD;AACD;;AAEA,MAAM,aAAa,SAAS,SAAS,UAAU,SAAS;CACvD,OAAO;CACP,MAAM;AACP,CAAC;;;;;;;AAyBD,MAAM,sBAAsB,MAAM,YAAY;CAC7C,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,WAAW,GAAG;EACjD,MAAM,MAAM,UAAU,SAAS,IAAI;EACnC,MAAM,OAAO,QAAQ,IAAI;EACzB,IAAI,SAAS,KAAK,KAAK,SAAS,IAAI,MAAM,IAAI,MAAM,oCAAoC,KAAK,SAAS,IAAI,iCAAiC;EAC3I,MAAM,QAAQ,QAAQ,IAAI;EAC1B,IAAI,UAAU,KAAK,KAAK,UAAU,IAAI,MAAM,IAAI,MAAM,WAAW,KAAK,4BAA4B,IAAI,KAAK,KAAK,uBAAuB,KAAK,qBAAqB;EACjK,OAAO,QAAQ;CAChB;CACA,OAAO;AACR;;;;;;AAMA,MAAM,gBAAgB,MAAM,YAAY;CACvC,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,WAAW,GAAG;EACjD,MAAM,OAAO,QAAQ,IAAI,UAAU,SAAS,IAAI;EAChD,IAAI,SAAS,KAAK,GAAG;EACrB,QAAQ,IAAI,UAAU,IAAI,IAAI,KAAK;CACpC;AACD;;;;;;;;;;;AAWA,SAAS,oBAAoB,SAAS,SAAS;CAC9C,KAAK,MAAM,SAAS,SAAS;EAC5B,MAAM,IAAI;GACT,OAAO;GACP,MAAM,MAAM;GACZ,OAAO;IACN,QAAQ,MAAM;IACd,UAAU;GACX;EACD;EACA,MAAM,MAAM,UAAU,SAAS,CAAC;EAChC,MAAM,QAAQ,OAAO,QAAQ,IAAI,MAAM,GAAG,GAAG;EAC7C,IAAI,UAAU,KAAK,GAAG;EACtB,QAAQ,IAAI,UAAU,IAAI,CAAC,KAAK,OAAO,WAAW,KAAK;CACxD;AACD;;AAEA,SAAS,qBAAqB,QAAQ,OAAO;CAC5C,MAAM,SAAS,OAAO,YAAY,CAAC,SAAS,KAAK;CACjD,IAAI,kBAAkB,SAAS,MAAM,IAAI,MAAM,2HAA2H;CAC1K,IAAI,OAAO,WAAW,KAAK,GAAG,MAAM,IAAI,MAAM,mCAAmC,OAAO,OAAO,KAAK,UAAU,MAAM,OAAO,CAAC,CAAC,KAAK,IAAI,GAAG;CACzI,OAAO,OAAO;AACf;;;;;;;;;;;;;;;;;;;;;;;;;ACtOA,MAAM,0BAA0B;CAC/B,MAAM;CACN,QAAQ,KAAK,UAAU;CACvB,OAAO;AACR;;AAIA,MAAM,kBAAkB,OAAO,IAAI,wBAAwB;;;;;;;AAe3D,MAAM,wBAAwB;CAC7B,MAAM;CACN,QAAQ,KAAK,QAAQ;CACrB,OAAO;AACR;AAE4B,UAAU,IAAI;CACzC,OAAO;CACP,MAAM,sBAAsB;AAC7B,CAAC;AAGD,MAAM,2BAA2B,CAAC,yBAAyB,qBAAqB;AAS9C,UAAU,OAAO,IAAI,kCAAkC,CAAC;;;ACnE1F,MAAM,iBAAiB,EAAE,MAAM,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;AAoBxD,MAAM,WAAW,QAAQ;CACxB,MAAM,aAAa,IAAI,UAAU,UAAU,CAAC,CAAC;CAC7C,KAAK,MAAM,YAAY,OAAO,KAAK,cAAc,GAAG;EACnD,IAAI,YAAY,IAAI,MAAM,MAAM,IAAI,MAAM,0BAA0B,SAAS,qFAAqF;EAClK,IAAI,YAAY,YAAY,MAAM,IAAI,MAAM,qBAAqB,SAAS,gFAAgF;CAC3J;CACA,MAAM,SAAS,UAAU;EACxB,GAAG;EACH,GAAG;CACJ,CAAC;CACD,MAAM,OAAO,QAAQ;EACpB,MAAM,IAAI;EACV,WAAW;EACX,MAAM;EACN,QAAQ,IAAI;EACZ;EACA,GAAG,IAAI,YAAY,KAAK,IAAI,EAAE,SAAS,IAAI,QAAQ,IAAI,CAAC;EACxD,OAAO,IAAI;EACX,GAAG,IAAI,WAAW,KAAK,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;CACtD,CAAC;CACD,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,SAAS,gBAAgB;EACxB,IAAI,aAAa,KAAK,GAAG,WAAW,YAAY,MAAM,EAAE;EACxD,OAAO;CACR;CACA,MAAM,WAAW;EAChB,GAAG;EACH,MAAM,IAAI,SAAS,MAAM;GACxB,MAAM,SAAS,YAAY,MAAM,OAAO;GACxC,MAAM,MAAM,MAAM;GAClB,oBAAoB,0BAA0B,OAAO;GACrD,aAAa,MAAM,OAAO;GAC1B,MAAM,OAAO,OAAO,QAAQ;GAC5B,IAAI,OAAO,SAAS,UAAU,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC/D,OAAO,KAAK;EACb;EACA,OAAO;GACN,IAAI,eAAe,KAAK,GAAG,aAAa,UAAU,YAAY,MAAM,cAAc,CAAC,CAAC;GACpF,OAAO;EACR;EACA,SAAS;GACR,IAAI,iBAAiB,KAAK,GAAG,eAAe,UAAU,cAAc,CAAC,CAAC,OAAO;GAC7E,OAAO;EACR;EACA,UAAU;GACT,IAAI,kBAAkB,KAAK,GAAG,gBAAgB,UAAU,eAAe,MAAM,mBAAmB,MAAM,EAAE,CAAC,CAAC;GAC1G,OAAO;EACR;CACD;CACA,OAAO,OAAO,OAAO,UAAU,QAAQ,CAAC;AACzC;AAiCyB,OAAO,OAAO;CACtC,MAAM;CACN,OAAO,EAAE,KAAK,GAAG;CACjB,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;AAuB2B,OAAO,OAAO;CACzC,MAAM;CACN,OAAO;EACN,aAAa;EACb,iBAAiB;CAClB;CACA,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;;;;;;;;;ACrID,MAAM,kBAAkB,SAAS,EAAE,SAAS,IAAI;CAC/C,OAAO,KAAK,EAAE,OAAO,SAAS,CAAC;CAC/B,QAAQ,KAAK,EAAE,IAAI,UAAU,CAAC;AAC/B,CAAC,EAAE,CAAC;;;;;;AAQJ,SAAS,eAAe,MAAM;CAC7B,OAAO,EAAE,MAAM,OAAO,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY;EAC5D;EACA;CACD,EAAE,EAAE;AACL;;;;;;AAMA,SAAS,WAAW,GAAG;CACtB,MAAM,QAAQ,kBAAkB,KAAK,CAAC;CACtC,IAAI,UAAU,MAAM,MAAM,IAAI,MAAM,kBAAkB,EAAE,qGAAqG;CAC7J,MAAM,GAAG,SAAS,IAAI,OAAO,MAAM;CACnC,MAAM,QAAQ,OAAO,MAAM;CAC3B,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG,MAAM,IAAI,MAAM,kBAAkB,EAAE,sCAAsC;CACtH,QAAQ,MAAR;EACC,KAAK,KAAK,OAAO,QAAQ;EACzB,KAAK,KAAK,OAAO,QAAQ;EACzB,KAAK,KAAK,OAAO,QAAQ;EACzB,KAAK,KAAK,OAAO,QAAQ;EACzB,SAAS,MAAM,IAAI,MAAM,kBAAkB,EAAE,yBAAyB,KAAK,6BAA6B;CACzG;AACD;;;;;;;;AAUA,MAAM,iBAAiB,KAAK;CAC3B,OAAO;CACP,OAAO;AACR,CAAC,CAAC,CAAC,MAAM;;;;;;AAMT,SAAS,cAAc,UAAU;CAChC,OAAO,QAAQ;EACd,MAAM;EACN,MAAM,EAAE,SAAS,IAAI,eAAe,EAAE;EACtC,QAAQ,EAAE,MAAM,MAAM,gBAAgB,EAAE,SAAS,CAAC,GAAG,SAAS,IAAI,EAAE,CAAC,EAAE;EACvE,OAAO,KAAK;GACX,QAAQ,IAAI,IAAI,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;GAC5D,OAAO;EACR,CAAC;CACF,CAAC;AACF;;;;;;;AAOA,SAAS,aAAa,MAAM;CAC3B,MAAM,WAAW,KAAK,cAAc,IAAI,OAAO,YAAY,IAAI,EAAE;CACjE,KAAK,MAAM,OAAO,KAAK,MAAM,eAAe;EAC3C,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,OAAO,QAAQ;GACnC,QAAQ,MAAM,cAAc,IAAI,MAAM,WAAW,GAAG;EACrD,CAAC;CACF,GAAG,WAAW,IAAI,KAAK,CAAC;AACzB;;;;;;;;;;;AC7EA,SAAS,KAAK,MAAM;CACnB,OAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,MAAM,KAAK,OAAO,OAAO,IAAI,EAAE,QAAQ,gBAAgB;EAC3F,MAAM,SAAS,UAAU,KAAK,QAAQ;GACrC,IAAI;GACJ,MAAM;EACP,CAAC;EACD,UAAU,cAAc,KAAK,QAAQ,GAAG;GACvC,IAAI;GACJ,MAAM,EAAE,SAAS,OAAO,QAAQ;EACjC,CAAC;EACD,OAAO,CAAC;CACT,CAAC;AACF;AAGA,SAAS,cAAc,SAAS,WAAW,UAAU;CACpD,MAAM,OAAO,UAAU,QAAQ;CAC/B,MAAM,iBAAiB,OAAO,OAAO,SAAS;EAC7C,MAAM,UAAU,KAAK,MAAM;EAC3B,IAAI,YAAY,KAAK,GAAG,MAAM,IAAI,MAAM,2CAA2C,MAAM,MAAM,yBAAyB;EACxH,MAAM,QAAQ,IAAI;EAClB,OAAO,EAAE,IAAI,KAAK;CACnB;CACA,OAAO,MAAM,SAAS,UAAU,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC,CAAC;AAC1E"}

package/dist/cron/scheduler-entrypoint.mjs

@@ -398,6 +398,32 @@ const stashSecrets = (node, address) => {
 		process.env[secretKey("", slot)] = name;
 	}
 };
+/**
+* Boot: for each reserved provider param, read its address-scoped row through
+* the same `coerce` a declared param uses (JSON-decode, schema-validate), and
+* re-emit it address-free — `stash`'s counterpart for this separate
+* declaration space. A param is declared optional here unconditionally: an
+* absent row means "never provisioned" (local dev, tests, a provider with no
+* registered value for this deploy), never a boot failure, so nothing is
+* stashed and the runtime reader that owns this slot falls back to its own
+* pass-through behavior.
+*/
+function stashProviderParams(entries, address) {
+	for (const entry of entries) {
+		const d = {
+			owner: "service",
+			name: entry.name,
+			param: {
+				schema: entry.schema,
+				optional: true
+			}
+		};
+		const key = configKey(address, d);
+		const value = coerce(process.env[key], d, key);
+		if (value === void 0) continue;
+		process.env[configKey("", d)] = encode("service", value);
+	}
+}
 /** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */
 function standardValidateSync(schema, value) {
 	const result = schema["~standard"].validate(value);
@@ -475,99 +501,6 @@ function rpc(arg) {
 function isRpcContract(value) {
 	return typeof value === "object" && value !== null && "kind" in value && value.kind === "rpc" && "__cmp" in value && "satisfies" in value;
 }
-/** The reserved accepted-keys env var: COMPOSER_<addr>_RPC_ACCEPTED_KEYS ("" ↦ @internal/rpc's RPC_ACCEPTED_KEYS_ENV). */
-const serviceKeyEnvName = (address) => configKey(address, {
-	owner: "service",
-	name: "RPC_ACCEPTED_KEYS"
-});
-const reservedParams = { port: number$1({ default: 3e3 }) };
-/**
-* A Prisma Compute service — declarations only (deps + params + build + the
-* ports it exposes), no descriptor. `params` merges with the reserved
-* `ReservedParams` (`port`); a user param whose name collides with a reserved
-* one fails at authoring, the same way a colliding dependency name does.
-* Returns the extension's runnable/loadable node:
-*   · run(address, boot) — the process controller: deserialize the platform
-*     environment (keyed off `address`, the extension's ONE env read) into a
-*     typed Config, re-emit it under address-free process-local stash keys,
-*     then call boot() to start the app's entry.
-*   · load() / config() — called from inside the app's entry: read the stash;
-*     load() hydrates + memoizes the deps, config() returns the typed params.
-*     Separate accessors so a dep and a param never share a namespace (ADR-0021).
-*
-* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
-* the control-plane registry key `prisma-composer deploy` resolves through the
-* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
-* deploy time; nodes are pure data.
-*/
-const compute = (def) => {
-	const userParams = def.params ?? blindCast({});
-	for (const reserved of Object.keys(reservedParams)) {
-		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
-		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
-	}
-	const params = blindCast({
-		...userParams,
-		...reservedParams
-	});
-	const node = service$1({
-		name: def.name,
-		extension: "@prisma/composer-prisma-cloud",
-		type: "compute",
-		inputs: def.deps,
-		params,
-		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
-		build: def.build,
-		...def.expose !== void 0 ? { expose: def.expose } : {}
-	});
-	let resolved;
-	let loadedDeps;
-	let loadedParams;
-	let loadedSecrets;
-	function processConfig() {
-		if (resolved === void 0) resolved = deserialize(node, "");
-		return resolved;
-	}
-	const runnable = {
-		...node,
-		async run(address, boot) {
-			const config = deserialize(node, address);
-			stash(node, config);
-			stashSecrets(node, address);
-			const accepted = process.env[serviceKeyEnvName(address)];
-			if (accepted !== void 0) process.env[serviceKeyEnvName("")] = accepted;
-			const port = config.service["port"];
-			if (typeof port === "number") process.env["PORT"] = String(port);
-			return boot();
-		},
-		load() {
-			if (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));
-			return loadedDeps;
-		},
-		config() {
-			if (loadedParams === void 0) loadedParams = blindCast(processConfig().service);
-			return loadedParams;
-		},
-		secrets() {
-			if (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, "")));
-			return loadedSecrets;
-		}
-	};
-	return Object.freeze(blindCast(runnable));
-};
-Object.freeze({
-	kind: "postgres",
-	__cmp: { url: "" },
-	satisfies: (required) => required.kind === "postgres"
-});
-Object.freeze({
-	kind: "credentials",
-	__cmp: {
-		accessKeyId: "",
-		secretAccessKey: ""
-	},
-	satisfies: (required) => required.kind === "credentials"
-});
 const liftArray = (data) => Array.isArray(data) ? data : [data];
 /**
 * Splits an array into two arrays based on the result of a predicate
@@ -7687,6 +7620,138 @@ ark.schema;
 ark.define;
 ark.declare;
 /**
+* RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —
+* name + schema + brand — for the accepted-keys set a provider stores, shared
+* by `control.ts` (which registers the deploy-side `value(refs)` that mints
+* and aggregates it — see its `rpcAcceptedKeysValue`) and `compute.ts` (which
+* validates and stashes it at boot), so writer and reader cannot drift.
+* Finding the edges themselves is `provisioned-edges.ts`'s generic,
+* brand-blind scan — RPC is not special-cased anywhere in this target.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side `value(refs)` lives in control.ts, the
+* control-plane-only entry).
+*/
+/**
+* The reserved provider param for RPC's accepted-keys set: the var name is
+* `RPC_ACCEPTED_KEYS`, derived through `configKey` at both ends
+* (`configKey(address, …)` at deploy, `configKey('', …)` at boot — the
+* address-free form is `@internal/rpc`'s `RPC_ACCEPTED_KEYS_ENV`). `brand` is
+* `RPC_PEER_KEY`, the same brand `perBindingToken()`'s need carries — control.ts
+* looks its `value(refs)` up by this field.
+*/
+const RPC_ACCEPTED_KEYS_PARAM = {
+	name: "RPC_ACCEPTED_KEYS",
+	schema: type("string[]"),
+	brand: RPC_PEER_KEY
+};
+/** ADR-0031's need brand for the streams module's bearer key — control.ts registers the provisioner under this. */
+const STREAMS_API_KEY = Symbol.for("prisma:streams/api-key");
+/**
+* The reserved provider param for the streams bearer key: the var name is
+* `STREAMS_API_KEY`. `brand` is `STREAMS_API_KEY` itself (the same symbol
+* `streamsApiKeyNeed()`'s need carries) — control.ts looks its `value(refs)`
+* up by this field.
+*/
+const STREAMS_API_KEY_PARAM = {
+	name: "STREAMS_API_KEY",
+	schema: type("string"),
+	brand: STREAMS_API_KEY
+};
+configKey("", {
+	owner: "service",
+	name: STREAMS_API_KEY_PARAM.name
+});
+const RESERVED_PROVIDER_PARAMS = [RPC_ACCEPTED_KEYS_PARAM, STREAMS_API_KEY_PARAM];
+const reservedParams = { port: number$1({ default: 3e3 }) };
+/**
+* A Prisma Compute service — declarations only (deps + params + build + the
+* ports it exposes), no descriptor. `params` merges with the reserved
+* `ReservedParams` (`port`); a user param whose name collides with a reserved
+* one fails at authoring, the same way a colliding dependency name does.
+* Returns the extension's runnable/loadable node:
+*   · run(address, boot) — the process controller: deserialize the platform
+*     environment (keyed off `address`, the extension's ONE env read) into a
+*     typed Config, re-emit it under address-free process-local stash keys,
+*     then call boot() to start the app's entry.
+*   · load() / config() — called from inside the app's entry: read the stash;
+*     load() hydrates + memoizes the deps, config() returns the typed params.
+*     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+*
+* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
+* the control-plane registry key `prisma-composer deploy` resolves through the
+* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
+* deploy time; nodes are pure data.
+*/
+const compute = (def) => {
+	const userParams = def.params ?? blindCast({});
+	for (const reserved of Object.keys(reservedParams)) {
+		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
+		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
+	}
+	const params = blindCast({
+		...userParams,
+		...reservedParams
+	});
+	const node = service$1({
+		name: def.name,
+		extension: "@prisma/composer-prisma-cloud",
+		type: "compute",
+		inputs: def.deps,
+		params,
+		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
+		build: def.build,
+		...def.expose !== void 0 ? { expose: def.expose } : {}
+	});
+	let resolved;
+	let loadedDeps;
+	let loadedParams;
+	let loadedSecrets;
+	function processConfig() {
+		if (resolved === void 0) resolved = deserialize(node, "");
+		return resolved;
+	}
+	const runnable = {
+		...node,
+		async run(address, boot) {
+			const config = deserialize(node, address);
+			stash(node, config);
+			stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
+			stashSecrets(node, address);
+			const port = config.service["port"];
+			if (typeof port === "number") process.env["PORT"] = String(port);
+			return boot();
+		},
+		load() {
+			if (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));
+			return loadedDeps;
+		},
+		config() {
+			if (loadedParams === void 0) loadedParams = blindCast(processConfig().service);
+			return loadedParams;
+		},
+		secrets() {
+			if (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, "")));
+			return loadedSecrets;
+		}
+	};
+	return Object.freeze(blindCast(runnable));
+};
+Object.freeze({
+	kind: "postgres",
+	__cmp: { url: "" },
+	satisfies: (required) => required.kind === "postgres"
+});
+Object.freeze({
+	kind: "credentials",
+	__cmp: {
+		accessKeyId: "",
+		secretAccessKey: ""
+	},
+	satisfies: (required) => required.kind === "credentials"
+});
+/**
 * The one call edge between the scheduler and the app's runner: `trigger(jobId)`.
 * The scheduler depends on it (`rpc(triggerContract)`); the runner exposes it
 * (`expose: { trigger: triggerContract }`). `jobId` travels as data through this