@prisma/composer-prisma-cloud 0.1.0 → 0.2.0-dev.1

package/dist/cron/index.d.mts

@@ -1,5 +1,56 @@
-import { Deps, HydratedDeps, ModuleNode, Params, RunnableServiceNode, ServiceNode } from "@prisma/composer";
-
+import { BuildAdapter, Deps, Expose, HydratedDeps, ModuleNode, NODE, Params, RunnableServiceNode, SecretValues, Secrets, ServiceNode, Values } from "@prisma/composer";
+import "@standard-schema/spec";
+//#region ../../1-prisma-cloud/1-extensions/target/dist/index.d.mts
+//#endregion
+//#region src/compute.d.ts
+declare const reservedParams: {
+  readonly port: import("@prisma/composer").ConfigParam<import("@standard-schema/spec").StandardSchemaV1<number, number>>;
+};
+type ReservedParams = typeof reservedParams;
+/**
+ * A Prisma Compute service — declarations only (deps + params + build + the
+ * ports it exposes), no descriptor. `params` merges with the reserved
+ * `ReservedParams` (`port`); a user param whose name collides with a reserved
+ * one fails at authoring, the same way a colliding dependency name does.
+ *
+ *   · run(address, boot) — the process controller: deserialize the platform
+ *     environment (keyed off `address`, the extension's ONE env read) into a
+ *     typed Config, re-emit it under address-free process-local stash keys,
+ *     then call boot() to start the app's entry.
+ *   · load() / config() — called from inside the app's entry: read the stash;
+ *     load() hydrates + memoizes the deps, config() returns the typed params.
+ *     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+ *   · origin() — this service's platform-assigned public origin, read from the
+ *     stash `run()` populates; memoized per process.
+ *
+ * The underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
+ * the control-plane registry key `prisma-composer deploy` resolves through the
+ * app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
+ * deploy time; nodes are pure data until run() or load() is called.
+ */
+declare class ComputeService<D extends Deps, P extends Params, E extends Expose, S extends Secrets> implements RunnableServiceNode<D, P & ReservedParams, E, S> {
+  #private;
+  readonly [NODE]: true;
+  readonly kind: 'service';
+  readonly name: string;
+  readonly extension: string;
+  readonly type: string;
+  readonly inputs: D;
+  readonly params: P & ReservedParams;
+  readonly secretSlots: S;
+  readonly build: BuildAdapter;
+  readonly expose: E | undefined;
+  constructor(node: ServiceNode<D, P & ReservedParams, E, S>);
+  run(address: string, boot: () => Promise<unknown>): Promise<unknown>;
+  load(): HydratedDeps<D>;
+  config(): Values<P & ReservedParams>;
+  secrets(): SecretValues<S>;
+  /** This service's platform-assigned public origin — read from the stash
+   *  run() populates and memoized per process. Throws if called before run()
+   *  has stashed it (readOrigin's pinned message). */
+  origin(): string;
+}
+//#endregion
 //#region ../../1-prisma-cloud/2-shared-modules/cron/dist/index.d.mts
 //#region src/contract.d.ts
 declare const triggerContract: import("@prisma/composer").Contract<"rpc", {
@@ -9,7 +60,8 @@ declare const triggerContract: import("@prisma/composer").Contract<"rpc", {
     ok: boolean;
   }>;
 }>;
-type TriggerContract = typeof triggerContract; //#endregion
+type TriggerContract = typeof triggerContract;
+//#endregion
 //#region src/schedule.d.ts
 /**
  * A job-id → interval map, turned into the structured `jobs` list the
@@ -27,7 +79,8 @@ interface Schedule<Ids extends string> {
  * `{ jobs: [{ jobId: 'tick', every: '60s' }, { jobId: 'mrr', every: '24h' }] }`,
  * preserving key order.
  */
-declare function defineSchedule<const S extends Record<string, string>>(spec: S): Schedule<keyof S & string>; //#endregion
+declare function defineSchedule<const S extends Record<string, string>>(spec: S): Schedule<keyof S & string>;
+//#endregion
 //#region src/module.d.ts
 /**
  * `opts.runner` is a service exposing `{ trigger }`; the returned module
@@ -43,14 +96,15 @@ declare function cron<RD extends Deps, RP extends Params, Ids extends string>(op
     trigger: TriggerContract;
   }>;
   name?: string;
-}): ModuleNode<RD, Record<never, never>>; //#endregion
+}): ModuleNode<RD, Record<never, never>>;
+//#endregion
 //#region src/scheduler.d.ts
 /**
  * The always-on scheduler service. `schedule` sets only the `jobs` param's
  * default — the value the deploy serializes into config; the scheduler
  * itself is job-agnostic.
  */
-declare function cronScheduler<Ids extends string>(schedule: Schedule<Ids>): import("@prisma/composer").RunnableServiceNode<{
+declare function cronScheduler<Ids extends string>(schedule: Schedule<Ids>): ComputeService<{
   trigger: import("@prisma/composer").DependencyEnd<{
     trigger: (input: {
       jobId: string;
@@ -69,8 +123,6 @@ declare function cronScheduler<Ids extends string>(schedule: Schedule<Ids>): imp
     jobId: string;
     every: string;
   }[], {}>>;
-} & {
-  readonly port: import("@prisma/composer").ConfigParam<import("@standard-schema/spec").StandardSchemaV1<number, number>>;
 }, Record<never, never>, Record<never, never>>;
 /**
  * Fires `call(jobId)` on each job's `every` interval. A rejected `call` is
@@ -85,12 +137,13 @@ declare function runScheduler(opts: {
   }>;
   call: (jobId: string) => Promise<unknown>;
   setTimer?: (fn: () => void, ms: number) => void;
-}): void; //#endregion
+}): void;
+//#endregion
 //#region src/serve-schedule.d.ts
 type ScheduleHandler<D> = (deps: D) => Promise<unknown>;
 declare function serveSchedule<D extends Deps, P extends Params, Ids extends string>(service: RunnableServiceNode<D, P, {
   trigger: TriggerContract;
-}>, _schedule: Schedule<Ids>, handlers: { [Id in Ids]: ScheduleHandler<HydratedDeps<D>> }): (req: Request) => Promise<Response>; //#endregion
+}>, _schedule: Schedule<Ids>, handlers: { [Id in Ids]: ScheduleHandler<HydratedDeps<D>>; }): (req: Request) => Promise<Response>;
 //#endregion
 export { type Schedule, type TriggerContract, cron, cronScheduler, defineSchedule, runScheduler, serveSchedule, triggerContract };
 //# sourceMappingURL=index.d.mts.map

package/dist/cron/index.mjs

@@ -1,4 +1,4 @@
-import { contract, rpc, serve } from "@prisma/composer/rpc";
+import { RPC_PEER_KEY, contract, rpc, serve } from "@prisma/composer/service-rpc";
 import { type } from "arktype";
 import { hydrateSecrets, hydrateSync, module, number, param, service } from "@prisma/composer";
 import node from "@prisma/composer/node";
@@ -32,7 +32,7 @@ const configKey = (address, d) => {
 	const segments = address.split(".").filter((s) => s.length > 0);
 	const owner = d.owner === "service" ? [] : [d.owner.input];
 	return [
-		"COMPOSE",
+		"COMPOSER",
 		...segments,
 		...owner,
 		d.name
@@ -51,12 +51,18 @@ function encode(owner, value) {
 function decode(owner, raw) {
 	return owner === "service" ? JSON.parse(raw) : raw;
 }
+const PARAM_POINTER_PREFIX = "@composer-param-pointer:";
+/** True iff `raw` is a param pointer row (as opposed to a JSON-encoded literal). */
+const isParamPointerRow = (raw) => raw.startsWith(PARAM_POINTER_PREFIX);
+/** Reverses `encodeParamPointer`: the platform var NAME a pointer row points to. */
+const decodeParamPointer = (raw) => raw.slice(24);
 function coerce(raw, d, key) {
 	if (!(raw !== void 0 && raw !== "")) {
 		if (d.param.default !== void 0) return d.param.default;
 		if (d.param.optional === true) return void 0;
 		throw new Error(`missing required config param "${d.name}" (env ${key})`);
 	}
+	if (d.owner === "service" && isParamPointerRow(raw)) return coerceEnvSourcedParam(raw, d, key);
 	try {
 		return standardValidateSync(d.param.schema, decode(d.owner, raw));
 	} catch (cause) {
@@ -65,6 +71,26 @@ function coerce(raw, d, key) {
 	}
 }
 /**
+* Boot resolution for an env-sourced param: double-lookup (pointer → platform
+* var), then the param's own schema on the raw string — no JSON decode, and
+* no redaction (it's config, not a secret). An UNSET platform var is a loud
+* boot failure naming both the param and the platform var; an EMPTY string is
+* not special-cased here — it reaches the schema like any other value, so it
+* passes iff the schema accepts it (deliberately unlike a literal param's own
+* ""-means-absent rule, and unlike a secret's non-empty requirement).
+*/
+function coerceEnvSourcedParam(raw, d, key) {
+	const platformVar = decodeParamPointer(raw);
+	const value = process.env[platformVar];
+	if (value === void 0) throw new Error(`env-sourced config param "${d.name}" (env ${key} → ${platformVar}) is unset: the platform variable "${platformVar}" was not injected — the deploy did not provision it.`);
+	try {
+		return standardValidateSync(d.param.schema, value);
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`invalid value for env-sourced config param "${d.name}" (env ${key} → ${platformVar}): ${message}`);
+	}
+}
+/**
 * Boot: read each declared param from env by its key, reverse the param's own
 * serialization (missing/invalid fails loudly), assemble the typed Config.
 * Secrets ride a separate channel (deserializeSecrets), not this one.
@@ -104,7 +130,7 @@ const stash = (node, config) => {
 		process.env[configKey("", d)] = encode(d.owner, value);
 	}
 };
-/** The pointer-row key for a secret slot: COMPOSE_<addr>_<slot> (secrets are service-level). */
+/** The pointer-row key for a secret slot: COMPOSER_<addr>_<slot> (secrets are service-level). */
 const secretKey = (address, slot) => configKey(address, {
 	owner: "service",
 	name: slot
@@ -139,6 +165,61 @@ const stashSecrets = (node, address) => {
 		process.env[secretKey("", slot)] = name;
 	}
 };
+/**
+* Boot: for each reserved provider param, read its address-scoped row through
+* the same `coerce` a declared param uses (JSON-decode, schema-validate), and
+* re-emit it address-free — `stash`'s counterpart for this separate
+* declaration space. A param is declared optional here unconditionally: an
+* absent row means "never provisioned" (local dev, tests, a provider with no
+* registered value for this deploy), never a boot failure, so nothing is
+* stashed and the runtime reader that owns this slot falls back to its own
+* pass-through behavior.
+*/
+function stashProviderParams(entries, address) {
+	for (const entry of entries) {
+		const d = {
+			owner: "service",
+			name: entry.name,
+			param: {
+				schema: entry.schema,
+				optional: true
+			}
+		};
+		const key = configKey(address, d);
+		const value = coerce(process.env[key], d, key);
+		if (value === void 0) continue;
+		process.env[configKey("", d)] = encode("service", value);
+	}
+}
+/** The framework-resolved origin row: COMPOSER_<addr>_ORIGIN. Written per
+*  compute service at serialize — the service's own provisioned endpoint URL,
+*  riding the reserved-provider-param machinery (`origin-key.ts`'s
+*  `ORIGIN_PARAM`); never a declared param, never in config(). A harness with
+*  no deploy behind it supplies it by setting `COMPOSER_ORIGIN` to the
+*  JSON-encoded origin URL — exactly how the existing entrypoint tests supply
+*  their other `COMPOSER_*` rows. */
+const ORIGIN_KEY_NAME = "ORIGIN";
+/**
+* Reads this service's origin back out of the address-free stash
+* `stashProviderParams` wrote for the ORIGIN entry. `COMPOSER_ORIGIN` unset is
+* a loud failure — a deployed environment always writes it, so an unset row
+* means either a local harness that hasn't supplied it or a boot() called
+* before run().
+*/
+function readOrigin() {
+	const d = {
+		owner: "service",
+		name: ORIGIN_KEY_NAME,
+		param: {
+			schema: type("string"),
+			optional: true
+		}
+	};
+	const key = configKey("", d);
+	const value = coerce(process.env[key], d, key);
+	if (value === void 0) throw new Error("this service's origin is not available (env COMPOSER_ORIGIN is unset) — a deployed environment writes it automatically; a local harness must supply it like any other config value (set COMPOSER_ORIGIN to the JSON-encoded origin URL).");
+	return blindCast(value);
+}
 /** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */
 function standardValidateSync(schema, value) {
 	const result = schema["~standard"].validate(value);
@@ -147,14 +228,130 @@ function standardValidateSync(schema, value) {
 	return result.value;
 }
 //#endregion
-//#region ../../1-prisma-cloud/1-extensions/target/dist/index.mjs
+//#region ../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-B_XS1Mz-.mjs
+/**
+* The service's own origin as a reserved provider param (ADR-0031): the ONE
+* brand and the ONE entry — shared by control.ts (which registers the
+* deploy-side value function that resolves the provisioned service's
+* `endpointDomain` — see its `selfOriginValue`) and compute.ts (which
+* validates and stashes the row at boot through the generic
+* `stashProviderParams` loop), so writer and reader cannot drift.
+*
+* Unlike the key-minting brands (`service-keys.ts`, `streams-keys.ts`) this
+* brand has no provisioner and no consumer edges: the value derives from the
+* service's OWN provisioned attributes, so control.ts registers it as a
+* service-derived provider param (`descriptors/shared.ts`'s
+* `ServiceProviderParam`) and the descriptor writes it for EVERY compute
+* service, exposing or not.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side value function lives in control.ts, the
+* control-plane-only entry).
+*/
+/** ADR-0031's brand for the service's own origin — control.ts registers the deploy-side value function under this. */
+const SELF_ORIGIN = Symbol.for("prisma:self-origin");
+/**
+* The reserved provider param for the origin row: the var name is `ORIGIN`,
+* derived through `configKey` at both ends (`configKey(address, …)` at
+* deploy, `configKey('', …)` — `COMPOSER_ORIGIN` — at boot, where
+* `readOrigin` reads it back). `brand` is `SELF_ORIGIN` — control.ts looks
+* its deploy-side value function up by this field.
+*/
+const ORIGIN_PARAM = {
+	name: ORIGIN_KEY_NAME,
+	schema: type("string"),
+	brand: SELF_ORIGIN
+};
+/**
+* RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —
+* name + schema + brand — for the accepted-keys set a provider stores, shared
+* by `control.ts` (which registers the deploy-side `value(refs)` that mints
+* and aggregates it — see its `rpcAcceptedKeysValue`) and `compute.ts` (which
+* validates and stashes it at boot), so writer and reader cannot drift.
+* Finding the edges themselves is `provisioned-edges.ts`'s generic,
+* brand-blind scan — RPC is not special-cased anywhere in this target.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side `value(refs)` lives in control.ts, the
+* control-plane-only entry).
+*/
+/**
+* The reserved provider param for RPC's accepted-keys set: the var name is
+* `RPC_ACCEPTED_KEYS`, derived through `configKey` at both ends
+* (`configKey(address, …)` at deploy, `configKey('', …)` at boot — the
+* address-free form is `@internal/service-rpc`'s `RPC_ACCEPTED_KEYS_ENV`). `brand` is
+* `RPC_PEER_KEY`, the same brand `perBindingToken()`'s need carries — control.ts
+* looks its `value(refs)` up by this field.
+*/
+const RPC_ACCEPTED_KEYS_PARAM = {
+	name: "RPC_ACCEPTED_KEYS",
+	schema: type("string[]"),
+	brand: RPC_PEER_KEY
+};
+/** ADR-0031's need brand for the streams module's bearer key — control.ts registers the provisioner under this. */
+const STREAMS_API_KEY = Symbol.for("prisma:streams/api-key");
+/**
+* The reserved provider param for the streams bearer key: the var name is
+* `STREAMS_API_KEY`. `brand` is `STREAMS_API_KEY` itself (the same symbol
+* `streamsApiKeyNeed()`'s need carries) — control.ts looks its `value(refs)`
+* up by this field.
+*/
+const STREAMS_API_KEY_PARAM = {
+	name: "STREAMS_API_KEY",
+	schema: type("string"),
+	brand: STREAMS_API_KEY
+};
+configKey("", {
+	owner: "service",
+	name: STREAMS_API_KEY_PARAM.name
+});
+/**
+* The list of provider-side reserved params the boot path validates and
+* stashes (ADR-0031): every brand's `{name, schema, brand}` declaration,
+* collected from that brand's own module (`service-keys.ts`,
+* `streams-keys.ts`, `origin-key.ts`) so `compute.ts` names no brand itself.
+*
+* This list exists separately from `control.ts`'s deploy-side registry
+* (`PROVIDER_PARAMS`) because `control.ts` is deploy-only code — it imports
+* `@internal/lowering` and `effect` to mint values — and a booted service
+* must never import it. This module is reachable from a user service's
+* bundle through `compute.ts`, so it must never import `@internal/lowering`,
+* `effect`, `alchemy`, or `control.ts`.
+*
+* This is the single source of which reserved provider params exist:
+* control.ts builds `PROVIDER_PARAMS` by mapping over this list and looking
+* up each entry's deploy-side value function (edge-derived `value(refs)` or
+* service-derived `valueForService(provisioned, address)`) by its `brand`,
+* throwing at module load if one is missing. Adding a brand means adding its
+* entry here, plus its deploy-side value function in control.ts — a brand
+* registered for deploy but absent here is no longer expressible, because
+* deploy no longer names its own param set independently.
+*/
+const RESERVED_PROVIDER_PARAMS = [
+	RPC_ACCEPTED_KEYS_PARAM,
+	STREAMS_API_KEY_PARAM,
+	ORIGIN_PARAM
+];
+blindCast(Symbol.for("prisma:prisma-cloud-param-source"));
+Object.freeze({
+	kind: "s3",
+	__cmp: {
+		url: "",
+		bucket: "",
+		accessKeyId: "",
+		secretAccessKey: ""
+	},
+	satisfies: (required) => required.kind === "s3"
+});
 const reservedParams = { port: number({ default: 3e3 }) };
 /**
 * A Prisma Compute service — declarations only (deps + params + build + the
 * ports it exposes), no descriptor. `params` merges with the reserved
 * `ReservedParams` (`port`); a user param whose name collides with a reserved
 * one fails at authoring, the same way a colliding dependency name does.
-* Returns the extension's runnable/loadable node:
+*
 *   · run(address, boot) — the process controller: deserialize the platform
 *     environment (keyed off `address`, the extension's ONE env read) into a
 *     typed Config, re-emit it under address-free process-local stash keys,
@@ -162,23 +359,69 @@ const reservedParams = { port: number({ default: 3e3 }) };
 *   · load() / config() — called from inside the app's entry: read the stash;
 *     load() hydrates + memoizes the deps, config() returns the typed params.
 *     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+*   · origin() — this service's platform-assigned public origin, read from the
+*     stash `run()` populates; memoized per process.
 *
-* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
+* The underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
 * the control-plane registry key `prisma-composer deploy` resolves through the
 * app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
-* deploy time; nodes are pure data.
+* deploy time; nodes are pure data until run() or load() is called.
 */
+var ComputeService = class {
+	#resolved;
+	#loadedDeps;
+	#loadedParams;
+	#loadedSecrets;
+	#origin;
+	constructor(node) {
+		Object.assign(this, node);
+	}
+	#processConfig() {
+		if (this.#resolved === void 0) this.#resolved = deserialize(this, "");
+		return this.#resolved;
+	}
+	async run(address, boot) {
+		const config = deserialize(this, address);
+		stash(this, config);
+		stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
+		stashSecrets(this, address);
+		const port = config.service["port"];
+		if (typeof port === "number") process.env["PORT"] = String(port);
+		return boot();
+	}
+	load() {
+		if (this.#loadedDeps === void 0) this.#loadedDeps = blindCast(hydrateSync(this, this.#processConfig()));
+		return this.#loadedDeps;
+	}
+	config() {
+		if (this.#loadedParams === void 0) this.#loadedParams = blindCast(this.#processConfig().service);
+		return this.#loadedParams;
+	}
+	secrets() {
+		if (this.#loadedSecrets === void 0) this.#loadedSecrets = blindCast(hydrateSecrets(this, deserializeSecrets(this, "")));
+		return this.#loadedSecrets;
+	}
+	/** This service's platform-assigned public origin — read from the stash
+	*  run() populates and memoized per process. Throws if called before run()
+	*  has stashed it (readOrigin's pinned message). */
+	origin() {
+		this.#origin ??= readOrigin();
+		return this.#origin;
+	}
+};
 const compute = (def) => {
 	const userParams = def.params ?? blindCast({});
 	for (const reserved of Object.keys(reservedParams)) {
 		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
 		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
 	}
+	for (const name of Object.keys(userParams)) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): param "${name}" collides with the framework-written origin row — rename the param.`);
+	for (const name of Object.keys(def.secrets ?? {})) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): secret "${name}" collides with the framework-written origin row — rename the secret.`);
 	const params = blindCast({
 		...userParams,
 		...reservedParams
 	});
-	const node = service({
+	const instance = new ComputeService(service({
 		name: def.name,
 		extension: "@prisma/composer-prisma-cloud",
 		type: "compute",
@@ -187,39 +430,9 @@ const compute = (def) => {
 		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
 		build: def.build,
 		...def.expose !== void 0 ? { expose: def.expose } : {}
-	});
-	let resolved;
-	let loadedDeps;
-	let loadedParams;
-	let loadedSecrets;
-	function processConfig() {
-		if (resolved === void 0) resolved = deserialize(node, "");
-		return resolved;
-	}
-	const runnable = {
-		...node,
-		async run(address, boot) {
-			const config = deserialize(node, address);
-			stash(node, config);
-			stashSecrets(node, address);
-			const port = config.service["port"];
-			if (typeof port === "number") process.env["PORT"] = String(port);
-			return boot();
-		},
-		load() {
-			if (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));
-			return loadedDeps;
-		},
-		config() {
-			if (loadedParams === void 0) loadedParams = blindCast(processConfig().service);
-			return loadedParams;
-		},
-		secrets() {
-			if (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, "")));
-			return loadedSecrets;
-		}
-	};
-	return Object.freeze(blindCast(runnable));
+	}));
+	Object.freeze(instance);
+	return instance;
 };
 Object.freeze({
 	kind: "postgres",
@@ -235,7 +448,7 @@ Object.freeze({
 	satisfies: (required) => required.kind === "credentials"
 });
 //#endregion
-//#region ../../1-prisma-cloud/2-shared-modules/cron/dist/scheduler-iL9rl3YY.mjs
+//#region ../../1-prisma-cloud/2-shared-modules/cron/dist/scheduler-DhziPSWE.mjs
 /**
 * The one call edge between the scheduler and the app's runner: `trigger(jobId)`.
 * The scheduler depends on it (`rpc(triggerContract)`); the runner exposes it