@prisma/composer-prisma-cloud 0.1.0-dev.11 → 0.1.0-dev.13

package/dist/control.d.mts

@@ -1,8 +1,8 @@
 import { t as ProviderParamEntry } from "./serializer-Cx5slrV4-xJfH6EWS.mjs";
 import * as Layer from "effect/Layer";
+import "effect/Effect";
 import { createManagementApiClient } from "@prisma/management-api-sdk";
 import "effect/Context";
-import "effect/Effect";
 import "effect/Redacted";
 import "effect/Config";
 import "alchemy/Provider";

package/dist/control.mjs

@@ -6,9 +6,9 @@ import { blindCast } from "@prisma/composer/casts";
 import { RPC_PEER_KEY } from "@prisma/composer/service-rpc";
 import pg from "pg";
 import * as Layer from "effect/Layer";
+import * as Effect from "effect/Effect";
 import { createManagementApiClient } from "@prisma/management-api-sdk";
 import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import * as Config$1 from "effect/Config";
 import * as Data from "effect/Data";
@@ -28,7 +28,7 @@ import { resolve } from "pathe";
 import { readRef } from "@prisma-next/migration-tools/refs";
 import { APP_SPACE_ID, readContractSpaceHeadRef, spaceMigrationDirectory, spaceRefsDirectory } from "@prisma-next/migration-tools/spaces";
 import { createPostgresControlClient } from "@prisma-next/postgres/control";
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CxGdfSAP.mjs
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-BWHVlSzh.mjs
 /**
 * The Prisma service token used to authenticate Management API calls. Kept
 * as a Redacted value so it never lands in logs or error output.
@@ -68,6 +68,84 @@ const callOptional = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.s
 /** Fire-and-forget a call, tolerating a 404 (already deleted). */
 const callVoid = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
 //#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/buckets.mjs
+/** A Prisma **Object Store bucket** inside a project. */
+const Bucket = Resource("Prisma.Bucket");
+const BucketProvider = () => Provider.effect(Bucket, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } })) : void 0;
+			if (observed) return {
+				id: observed.data.id,
+				name: observed.data.name
+			};
+			const created = yield* call(() => client.POST("/v1/buckets", { body: {
+				projectId: news.projectId,
+				name: news.name,
+				...news.branchId !== void 0 ? { branchId: news.branchId } : {}
+			} }));
+			return {
+				id: created.data.id,
+				name: created.data.name
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const b = yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
+			return b ? {
+				id: b.data.id,
+				name: b.data.name
+			} : void 0;
+		})
+	};
+}));
+/** A **bucket access key** for a Prisma Object Store bucket — yields the S3 credentials. */
+const BucketKey = Resource("Prisma.BucketKey");
+const BucketKeyProvider = () => Provider.effect(BucketKey, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: [
+			"id",
+			"bucketId",
+			"secretAccessKey",
+			"accessKeyId",
+			"endpoint",
+			"bucketName"
+		],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			if (output?.id) return output;
+			const created = yield* call(() => client.POST("/v1/buckets/{bucketId}/keys", {
+				params: { path: { bucketId: news.bucketId } },
+				body: {
+					name: news.name,
+					role: news.role
+				}
+			}));
+			return {
+				id: created.data.id,
+				bucketId: news.bucketId,
+				accessKeyId: created.data.accessKeyId,
+				secretAccessKey: Redacted.make(created.data.secretAccessKey),
+				endpoint: created.data.endpoint,
+				bucketName: created.data.bucketName
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}/keys/{keyId}", { params: { path: {
+				bucketId: output.bucketId,
+				keyId: output.id
+			} } }));
+		})
+	};
+}));
+//#endregion
 //#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute.mjs
 /**
 * Stopping a deployment before the app that owns it can be
@@ -558,8 +636,10 @@ const providers = () => Layer.effect(Providers, Provider.collection([
 	Connection,
 	ComputeService,
 	Deployment,
-	EnvironmentVariable
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
+	EnvironmentVariable,
+	Bucket,
+	BucketKey
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider(), BucketProvider(), BucketKeyProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
 //#endregion
 //#region ../../1-prisma-cloud/0-lowering/lowering/dist/state.mjs
 /** The framework-owned database a stage's deploy state lives in — a child of that stage's Branch (ADR-0034). */
@@ -1240,6 +1320,42 @@ function projectIdOf(application) {
 	if (!isCloudApplication(application)) throw new Error("prisma-cloud: ctx.application is not this extension's application product — the prismaCloud() application hook must run before any node lowers.");
 	return application.projectId;
 }
+/**
+* One Bucket per module-provisioned bucket resource — `id` is the module
+* provision id, so a resource shared by several consumers is created exactly
+* once. A BucketKey is minted for the bucket: it is the reveal-once credential
+* carrier, and its attributes (endpoint, bucketName, accessKeyId,
+* secretAccessKey) become the four S3Config outputs consumers resolve by name.
+*/
+function bucketDescriptor(o) {
+	const lowering = ({ id, application }) => Effect.gen(function* () {
+		validateName(id, "resource name (from provision id)");
+		const bkt = yield* Bucket(`${id}-bucket`, {
+			projectId: projectIdOf(application),
+			name: id,
+			...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+		});
+		const key = yield* BucketKey(`${id}-key`, {
+			bucketId: bkt.id,
+			name: id,
+			role: "read_write"
+		});
+		const secretAccessKey = Output.map(key.secretAccessKey, (v) => Redacted.value(v));
+		return {
+			outputs: {
+				url: key.endpoint,
+				bucket: key.bucketName,
+				accessKeyId: key.accessKeyId,
+				secretAccessKey
+			},
+			entities: [{
+				kind: "bucket",
+				id: bkt.id
+			}]
+		};
+	});
+	return Object.assign(lowering, { kind: "resource" });
+}
 /** The `compute` node kind's descriptor: the four service hooks — provision, serialize, package, deploy. */
 /**
 * Returns the PRECISE descriptor type, not the erased `NodeDescriptor`: the
@@ -2139,7 +2255,8 @@ const prismaCloud = (opts = {}) => {
 			"prisma-next": prismaNextDescriptor(o),
 			compute: computeDescriptor(o),
 			credentials: s3CredentialsDescriptor(o),
-			"s3-store": s3StoreDescriptor(o)
+			"s3-store": s3StoreDescriptor(o),
+			s3: bucketDescriptor(o)
 		}
 	};
 };