@prisma/composer-prisma-cloud 0.1.0 → 0.2.0-dev.10

package/dist/index.mjs

@@ -1,14 +1,55 @@
-import { a as envSecret, l as stash, n as deserialize, r as deserializeSecrets, s as secretName, t as configKey, u as stashSecrets } from "./serializer-C2CsA7xm-29Eg2Tjl.mjs";
+import { f as stash, i as deserializeSecrets, l as readOrigin, m as stashSecrets, n as configKey, p as stashProviderParams, r as deserialize, s as envSecret, u as secretName } from "./serializer-D8_84XWO-DA2B6YbX.mjs";
+import { a as envParam, c as paramName, i as STREAMS_API_KEY_ENV, l as provisionedEdges, r as STREAMS_API_KEY, t as RESERVED_PROVIDER_PARAMS, u as streamsApiKeyNeed } from "./provisioned-edges-B_XS1Mz--NFJgcXK7.mjs";
 import { dependency, hydrateSecrets, hydrateSync, number, resource, service, string } from "@prisma/composer";
 import { blindCast } from "@prisma/composer/casts";
 //#region ../../1-prisma-cloud/1-extensions/target/dist/index.mjs
+/**
+* The contract a provisioned Bucket provides — deliberately kind-equal to the
+* storage module's `s3Contract` (`kind: 's3'`). `satisfies` compares KIND,
+* not identity (mirrors `postgresContract`): a real bucket and the emulator
+* are interchangeable at every `s3()` dependency slot. Cross-layer import of
+* the storage module's contract is not allowed (layering: 2-shared-modules
+* depends on 1-extensions, not the reverse), which is exactly the design
+* rationale for kind-equality — the two contracts cooperate through their
+* shared kind string, not through object identity.
+*/
+const bucketContract = Object.freeze({
+	kind: "s3",
+	__cmp: {
+		url: "",
+		bucket: "",
+		accessKeyId: "",
+		secretAccessKey: ""
+	},
+	satisfies: (required) => required.kind === "s3"
+});
+function bucket(opts) {
+	if (opts?.name !== void 0) return resource({
+		name: opts.name,
+		extension: "@prisma/composer-prisma-cloud",
+		provides: bucketContract
+	});
+	return dependency({
+		type: "s3",
+		connection: {
+			params: {
+				url: string(),
+				bucket: string(),
+				accessKeyId: string(),
+				secretAccessKey: string()
+			},
+			hydrate: (v) => v
+		},
+		required: bucketContract
+	});
+}
 const reservedParams = { port: number({ default: 3e3 }) };
 /**
 * A Prisma Compute service — declarations only (deps + params + build + the
 * ports it exposes), no descriptor. `params` merges with the reserved
 * `ReservedParams` (`port`); a user param whose name collides with a reserved
 * one fails at authoring, the same way a colliding dependency name does.
-* Returns the extension's runnable/loadable node:
+*
 *   · run(address, boot) — the process controller: deserialize the platform
 *     environment (keyed off `address`, the extension's ONE env read) into a
 *     typed Config, re-emit it under address-free process-local stash keys,
@@ -16,23 +57,69 @@ const reservedParams = { port: number({ default: 3e3 }) };
 *   · load() / config() — called from inside the app's entry: read the stash;
 *     load() hydrates + memoizes the deps, config() returns the typed params.
 *     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+*   · origin() — this service's platform-assigned public origin, read from the
+*     stash `run()` populates; memoized per process.
 *
-* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
+* The underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
 * the control-plane registry key `prisma-composer deploy` resolves through the
 * app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
-* deploy time; nodes are pure data.
+* deploy time; nodes are pure data until run() or load() is called.
 */
+var ComputeService = class {
+	#resolved;
+	#loadedDeps;
+	#loadedParams;
+	#loadedSecrets;
+	#origin;
+	constructor(node) {
+		Object.assign(this, node);
+	}
+	#processConfig() {
+		if (this.#resolved === void 0) this.#resolved = deserialize(this, "");
+		return this.#resolved;
+	}
+	async run(address, boot) {
+		const config = deserialize(this, address);
+		stash(this, config);
+		stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
+		stashSecrets(this, address);
+		const port = config.service["port"];
+		if (typeof port === "number") process.env["PORT"] = String(port);
+		return boot();
+	}
+	load() {
+		if (this.#loadedDeps === void 0) this.#loadedDeps = blindCast(hydrateSync(this, this.#processConfig()));
+		return this.#loadedDeps;
+	}
+	config() {
+		if (this.#loadedParams === void 0) this.#loadedParams = blindCast(this.#processConfig().service);
+		return this.#loadedParams;
+	}
+	secrets() {
+		if (this.#loadedSecrets === void 0) this.#loadedSecrets = blindCast(hydrateSecrets(this, deserializeSecrets(this, "")));
+		return this.#loadedSecrets;
+	}
+	/** This service's platform-assigned public origin — read from the stash
+	*  run() populates and memoized per process. Throws if called before run()
+	*  has stashed it (readOrigin's pinned message). */
+	origin() {
+		this.#origin ??= readOrigin();
+		return this.#origin;
+	}
+};
 const compute = (def) => {
 	const userParams = def.params ?? blindCast({});
 	for (const reserved of Object.keys(reservedParams)) {
 		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
 		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
 	}
+	for (const name of Object.keys(userParams)) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): param "${name}" collides with the framework-written origin row — rename the param.`);
+	for (const name of Object.keys(def.secrets ?? {})) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): secret "${name}" collides with the framework-written origin row — rename the secret.`);
 	const params = blindCast({
 		...userParams,
 		...reservedParams
 	});
-	const node = service({
+	const instance = new ComputeService(service({
 		name: def.name,
 		extension: "@prisma/composer-prisma-cloud",
 		type: "compute",
@@ -41,39 +128,9 @@ const compute = (def) => {
 		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
 		build: def.build,
 		...def.expose !== void 0 ? { expose: def.expose } : {}
-	});
-	let resolved;
-	let loadedDeps;
-	let loadedParams;
-	let loadedSecrets;
-	function processConfig() {
-		if (resolved === void 0) resolved = deserialize(node, "");
-		return resolved;
-	}
-	const runnable = {
-		...node,
-		async run(address, boot) {
-			const config = deserialize(node, address);
-			stash(node, config);
-			stashSecrets(node, address);
-			const port = config.service["port"];
-			if (typeof port === "number") process.env["PORT"] = String(port);
-			return boot();
-		},
-		load() {
-			if (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));
-			return loadedDeps;
-		},
-		config() {
-			if (loadedParams === void 0) loadedParams = blindCast(processConfig().service);
-			return loadedParams;
-		},
-		secrets() {
-			if (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, "")));
-			return loadedSecrets;
-		}
-	};
-	return Object.freeze(blindCast(runnable));
+	}));
+	Object.freeze(instance);
+	return instance;
 };
 const defaultHttpClient = (cfg) => ({
 	url: cfg.url,
@@ -165,15 +222,23 @@ function s3Credentials(opts) {
 * return type is compute's exactly (including the reserved `port` param). The
 * storage module (D4b) calls this with its `db`/`credentials` deps, a `bucket`
 * param, and `expose: { store: s3Contract }`.
+*
+* `compute()`'s result is a `ComputeService` instance — its run/load/config/
+* secrets/origin methods live on the class prototype, not as the instance's
+* own properties, so a plain object spread (`{ ...node }`) would silently
+* drop them. Building a fresh `ComputeService` from the same data fields
+* (which `{ ...node }` DOES copy — they're the node's own enumerable
+* properties) with `type` overridden keeps every method intact.
 */
 function s3StoreService(def) {
-	const node = compute(def);
-	return Object.freeze(blindCast({
-		...node,
+	const instance = new ComputeService({
+		...compute(def),
 		type: "s3-store"
-	}));
+	});
+	Object.freeze(instance);
+	return instance;
 }
 //#endregion
-export { compute, configKey, credentialsContract, envSecret, http, postgres, postgresContract, s3Credentials, s3StoreService, secretName };
+export { ComputeService, STREAMS_API_KEY, STREAMS_API_KEY_ENV, bucket, bucketContract, compute, configKey, credentialsContract, envParam, envSecret, http, paramName, postgres, postgresContract, provisionedEdges, s3Credentials, s3StoreService, secretName, streamsApiKeyNeed };
 
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../1-prisma-cloud/1-extensions/target/dist/index.mjs"],"sourcesContent":["import { c as stashSecrets, l as envSecret, n as deserialize, r as deserializeSecrets, s as stash, t as configKey, u as secretName } from \"./serializer-C2CsA7xm.mjs\";\nimport { dependency, hydrateSecrets, hydrateSync, number, resource, service, string } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/compute.ts\nconst reservedParams = { port: number({ default: 3e3 }) };\n/**\n* A Prisma Compute service — declarations only (deps + params + build + the\n* ports it exposes), no descriptor. `params` merges with the reserved\n* `ReservedParams` (`port`); a user param whose name collides with a reserved\n* one fails at authoring, the same way a colliding dependency name does.\n* Returns the extension's runnable/loadable node:\n*   · run(address, boot) — the process controller: deserialize the platform\n*     environment (keyed off `address`, the extension's ONE env read) into a\n*     typed Config, re-emit it under address-free process-local stash keys,\n*     then call boot() to start the app's entry.\n*   · load() / config() — called from inside the app's entry: read the stash;\n*     load() hydrates + memoizes the deps, config() returns the typed params.\n*     Separate accessors so a dep and a param never share a namespace (ADR-0021).\n*\n* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —\n* the control-plane registry key `prisma-composer deploy` resolves through the\n* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at\n* deploy time; nodes are pure data.\n*/\nconst compute = (def) => {\n\tconst userParams = def.params ?? blindCast({});\n\tfor (const reserved of Object.keys(reservedParams)) {\n\t\tif (reserved in def.deps) throw new Error(`compute(): dependency \"${reserved}\" collides with the reserved service param of the same name — rename the dependency.`);\n\t\tif (reserved in userParams) throw new Error(`compute(): param \"${reserved}\" collides with the reserved service param of the same name — rename the param.`);\n\t}\n\tconst params = blindCast({\n\t\t...userParams,\n\t\t...reservedParams\n\t});\n\tconst node = service({\n\t\tname: def.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\ttype: \"compute\",\n\t\tinputs: def.deps,\n\t\tparams,\n\t\t...def.secrets !== void 0 ? { secrets: def.secrets } : {},\n\t\tbuild: def.build,\n\t\t...def.expose !== void 0 ? { expose: def.expose } : {}\n\t});\n\tlet resolved;\n\tlet loadedDeps;\n\tlet loadedParams;\n\tlet loadedSecrets;\n\tfunction processConfig() {\n\t\tif (resolved === void 0) resolved = deserialize(node, \"\");\n\t\treturn resolved;\n\t}\n\tconst runnable = {\n\t\t...node,\n\t\tasync run(address, boot) {\n\t\t\tconst config = deserialize(node, address);\n\t\t\tstash(node, config);\n\t\t\tstashSecrets(node, address);\n\t\t\tconst port = config.service[\"port\"];\n\t\t\tif (typeof port === \"number\") process.env[\"PORT\"] = String(port);\n\t\t\treturn boot();\n\t\t},\n\t\tload() {\n\t\t\tif (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));\n\t\t\treturn loadedDeps;\n\t\t},\n\t\tconfig() {\n\t\t\tif (loadedParams === void 0) loadedParams = blindCast(processConfig().service);\n\t\t\treturn loadedParams;\n\t\t},\n\t\tsecrets() {\n\t\t\tif (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, \"\")));\n\t\t\treturn loadedSecrets;\n\t\t}\n\t};\n\treturn Object.freeze(blindCast(runnable));\n};\n//#endregion\n//#region src/http.ts\nconst defaultHttpClient = (cfg) => ({\n\turl: cfg.url,\n\tfetch: (path, init) => fetch(new URL(path, cfg.url), init)\n});\n/**\n* A service-to-service dependency. Its binding (what `load()` returns) is a\n* derived HttpClient — a thin URL-anchored fetch wrapper (fetch is standard\n* across runtimes — no driver, no runtime coupling). http() is a\n* protocol-owned kind: the framework owns the transport, so the client is\n* kind-canonical and derived from the contract, with no user client in the\n* declaration (ADR-0015). The typed generated client arrives with the\n* interface primitive (a later extension point).\n*/\nconst http = (opts) => dependency({\n\tname: opts.name,\n\ttype: \"http\",\n\tconnection: {\n\t\tparams: { url: string() },\n\t\thydrate: (v) => defaultHttpClient({ url: v.url })\n\t}\n});\n//#endregion\n//#region src/postgres.ts\n/**\n* The contract a Postgres provides — and the contract its consumers require.\n* `satisfies` compares KIND, not identity: an extension module can be duplicated\n* across a workspace (same rationale as the Symbol.for node brand), and every\n* duplicate's contract must still satisfy. `__cmp` is the connection config a\n* postgres offers; core never inspects it.\n*/\nconst postgresContract = Object.freeze({\n\tkind: \"postgres\",\n\t__cmp: { url: \"\" },\n\tsatisfies: (required) => required.kind === \"postgres\"\n});\nfunction postgres(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: postgresContract\n\t});\n\treturn dependency({\n\t\ttype: \"postgres\",\n\t\tconnection: {\n\t\t\tparams: { url: string() },\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: postgresContract\n\t});\n}\n//#endregion\n//#region src/s3-credentials.ts\n/**\n* The contract the `s3-credentials` resource provides — a minted SigV4 key\n* pair. `satisfies` compares KIND only (mirrors `postgresContract`); `__cmp` is\n* the config the resource offers, which core never inspects.\n*/\nconst credentialsContract = Object.freeze({\n\tkind: \"credentials\",\n\t__cmp: {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\"\n\t},\n\tsatisfies: (required) => required.kind === \"credentials\"\n});\nfunction s3Credentials(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: credentialsContract\n\t});\n\treturn dependency({\n\t\ttype: \"credentials\",\n\t\tconnection: {\n\t\t\tparams: {\n\t\t\t\taccessKeyId: string(),\n\t\t\t\tsecretAccessKey: string()\n\t\t\t},\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: credentialsContract\n\t});\n}\n//#endregion\n//#region src/s3-store.ts\n/**\n* The storage service authoring factory — a `compute` service routed to the\n* `s3-store` lowering instead of `compute`'s. It is exactly `compute`'s\n* runnable (run/load/config, deps, params, build, expose) with the routing\n* `type` overridden to `'s3-store'`: nothing at runtime keys off `type` (the\n* serializer keys off the deployment address and each param's owner/name, and\n* `load`/`config` off deps/params), so only the deploy-time descriptor lookup\n* sees the override and routes to the extended-output lowering (§ 5). The\n* return type is compute's exactly (including the reserved `port` param). The\n* storage module (D4b) calls this with its `db`/`credentials` deps, a `bucket`\n* param, and `expose: { store: s3Contract }`.\n*/\nfunction s3StoreService(def) {\n\tconst node = compute(def);\n\treturn Object.freeze(blindCast({\n\t\t...node,\n\t\ttype: \"s3-store\"\n\t}));\n}\n//#endregion\nexport { compute, configKey, credentialsContract, envSecret, http, postgres, postgresContract, s3Credentials, s3StoreService, secretName };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;AAIA,MAAM,iBAAiB,EAAE,MAAM,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;AAoBxD,MAAM,WAAW,QAAQ;CACxB,MAAM,aAAa,IAAI,UAAU,UAAU,CAAC,CAAC;CAC7C,KAAK,MAAM,YAAY,OAAO,KAAK,cAAc,GAAG;EACnD,IAAI,YAAY,IAAI,MAAM,MAAM,IAAI,MAAM,0BAA0B,SAAS,qFAAqF;EAClK,IAAI,YAAY,YAAY,MAAM,IAAI,MAAM,qBAAqB,SAAS,gFAAgF;CAC3J;CACA,MAAM,SAAS,UAAU;EACxB,GAAG;EACH,GAAG;CACJ,CAAC;CACD,MAAM,OAAO,QAAQ;EACpB,MAAM,IAAI;EACV,WAAW;EACX,MAAM;EACN,QAAQ,IAAI;EACZ;EACA,GAAG,IAAI,YAAY,KAAK,IAAI,EAAE,SAAS,IAAI,QAAQ,IAAI,CAAC;EACxD,OAAO,IAAI;EACX,GAAG,IAAI,WAAW,KAAK,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;CACtD,CAAC;CACD,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,SAAS,gBAAgB;EACxB,IAAI,aAAa,KAAK,GAAG,WAAW,YAAY,MAAM,EAAE;EACxD,OAAO;CACR;CACA,MAAM,WAAW;EAChB,GAAG;EACH,MAAM,IAAI,SAAS,MAAM;GACxB,MAAM,SAAS,YAAY,MAAM,OAAO;GACxC,MAAM,MAAM,MAAM;GAClB,aAAa,MAAM,OAAO;GAC1B,MAAM,OAAO,OAAO,QAAQ;GAC5B,IAAI,OAAO,SAAS,UAAU,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC/D,OAAO,KAAK;EACb;EACA,OAAO;GACN,IAAI,eAAe,KAAK,GAAG,aAAa,UAAU,YAAY,MAAM,cAAc,CAAC,CAAC;GACpF,OAAO;EACR;EACA,SAAS;GACR,IAAI,iBAAiB,KAAK,GAAG,eAAe,UAAU,cAAc,CAAC,CAAC,OAAO;GAC7E,OAAO;EACR;EACA,UAAU;GACT,IAAI,kBAAkB,KAAK,GAAG,gBAAgB,UAAU,eAAe,MAAM,mBAAmB,MAAM,EAAE,CAAC,CAAC;GAC1G,OAAO;EACR;CACD;CACA,OAAO,OAAO,OAAO,UAAU,QAAQ,CAAC;AACzC;AAGA,MAAM,qBAAqB,SAAS;CACnC,KAAK,IAAI;CACT,QAAQ,MAAM,SAAS,MAAM,IAAI,IAAI,MAAM,IAAI,GAAG,GAAG,IAAI;AAC1D;;;;;;;;;;AAUA,MAAM,QAAQ,SAAS,WAAW;CACjC,MAAM,KAAK;CACX,MAAM;CACN,YAAY;EACX,QAAQ,EAAE,KAAK,OAAO,EAAE;EACxB,UAAU,MAAM,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC;CACjD;AACD,CAAC;;;;;;;;AAUD,MAAM,mBAAmB,OAAO,OAAO;CACtC,MAAM;CACN,OAAO,EAAE,KAAK,GAAG;CACjB,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;AACD,SAAS,SAAS,MAAM;CACvB,IAAI,MAAM,SAAS,KAAK,GAAG,OAAO,SAAS;EAC1C,MAAM,KAAK;EACX,WAAW;EACX,UAAU;CACX,CAAC;CACD,OAAO,WAAW;EACjB,MAAM;EACN,YAAY;GACX,QAAQ,EAAE,KAAK,OAAO,EAAE;GACxB,UAAU,MAAM;EACjB;EACA,UAAU;CACX,CAAC;AACF;;;;;;AAQA,MAAM,sBAAsB,OAAO,OAAO;CACzC,MAAM;CACN,OAAO;EACN,aAAa;EACb,iBAAiB;CAClB;CACA,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;AACD,SAAS,cAAc,MAAM;CAC5B,IAAI,MAAM,SAAS,KAAK,GAAG,OAAO,SAAS;EAC1C,MAAM,KAAK;EACX,WAAW;EACX,UAAU;CACX,CAAC;CACD,OAAO,WAAW;EACjB,MAAM;EACN,YAAY;GACX,QAAQ;IACP,aAAa,OAAO;IACpB,iBAAiB,OAAO;GACzB;GACA,UAAU,MAAM;EACjB;EACA,UAAU;CACX,CAAC;AACF;;;;;;;;;;;;;AAeA,SAAS,eAAe,KAAK;CAC5B,MAAM,OAAO,QAAQ,GAAG;CACxB,OAAO,OAAO,OAAO,UAAU;EAC9B,GAAG;EACH,MAAM;CACP,CAAC,CAAC;AACH"}
+{"version":3,"file":"index.mjs","names":["#resolved","#loadedDeps","#processConfig","#loadedParams","#loadedSecrets","#origin"],"sources":["../../../1-prisma-cloud/1-extensions/target/dist/index.mjs"],"sourcesContent":["import { c as readOrigin, d as stashProviderParams, f as stashSecrets, i as deserializeSecrets, m as secretName, n as configKey, p as envSecret, r as deserialize, u as stash } from \"./serializer-D8_84XWO.mjs\";\nimport { a as paramName, c as STREAMS_API_KEY_ENV, l as streamsApiKeyNeed, n as envParam, o as RESERVED_PROVIDER_PARAMS, s as STREAMS_API_KEY, t as provisionedEdges } from \"./provisioned-edges-B_XS1Mz-.mjs\";\nimport { dependency, hydrateSecrets, hydrateSync, number, resource, service, string } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/bucket.ts\n/**\n* The contract a provisioned Bucket provides — deliberately kind-equal to the\n* storage module's `s3Contract` (`kind: 's3'`). `satisfies` compares KIND,\n* not identity (mirrors `postgresContract`): a real bucket and the emulator\n* are interchangeable at every `s3()` dependency slot. Cross-layer import of\n* the storage module's contract is not allowed (layering: 2-shared-modules\n* depends on 1-extensions, not the reverse), which is exactly the design\n* rationale for kind-equality — the two contracts cooperate through their\n* shared kind string, not through object identity.\n*/\nconst bucketContract = Object.freeze({\n\tkind: \"s3\",\n\t__cmp: {\n\t\turl: \"\",\n\t\tbucket: \"\",\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\"\n\t},\n\tsatisfies: (required) => required.kind === \"s3\"\n});\nfunction bucket(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: bucketContract\n\t});\n\treturn dependency({\n\t\ttype: \"s3\",\n\t\tconnection: {\n\t\t\tparams: {\n\t\t\t\turl: string(),\n\t\t\t\tbucket: string(),\n\t\t\t\taccessKeyId: string(),\n\t\t\t\tsecretAccessKey: string()\n\t\t\t},\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: bucketContract\n\t});\n}\n//#endregion\n//#region src/compute.ts\nconst reservedParams = { port: number({ default: 3e3 }) };\n/**\n* A Prisma Compute service — declarations only (deps + params + build + the\n* ports it exposes), no descriptor. `params` merges with the reserved\n* `ReservedParams` (`port`); a user param whose name collides with a reserved\n* one fails at authoring, the same way a colliding dependency name does.\n*\n*   · run(address, boot) — the process controller: deserialize the platform\n*     environment (keyed off `address`, the extension's ONE env read) into a\n*     typed Config, re-emit it under address-free process-local stash keys,\n*     then call boot() to start the app's entry.\n*   · load() / config() — called from inside the app's entry: read the stash;\n*     load() hydrates + memoizes the deps, config() returns the typed params.\n*     Separate accessors so a dep and a param never share a namespace (ADR-0021).\n*   · origin() — this service's platform-assigned public origin, read from the\n*     stash `run()` populates; memoized per process.\n*\n* The underlying node carries `extension: '@prisma/composer-prisma-cloud'` —\n* the control-plane registry key `prisma-composer deploy` resolves through the\n* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at\n* deploy time; nodes are pure data until run() or load() is called.\n*/\nvar ComputeService = class {\n\t#resolved;\n\t#loadedDeps;\n\t#loadedParams;\n\t#loadedSecrets;\n\t#origin;\n\tconstructor(node) {\n\t\tObject.assign(this, node);\n\t}\n\t#processConfig() {\n\t\tif (this.#resolved === void 0) this.#resolved = deserialize(this, \"\");\n\t\treturn this.#resolved;\n\t}\n\tasync run(address, boot) {\n\t\tconst config = deserialize(this, address);\n\t\tstash(this, config);\n\t\tstashProviderParams(RESERVED_PROVIDER_PARAMS, address);\n\t\tstashSecrets(this, address);\n\t\tconst port = config.service[\"port\"];\n\t\tif (typeof port === \"number\") process.env[\"PORT\"] = String(port);\n\t\treturn boot();\n\t}\n\tload() {\n\t\tif (this.#loadedDeps === void 0) this.#loadedDeps = blindCast(hydrateSync(this, this.#processConfig()));\n\t\treturn this.#loadedDeps;\n\t}\n\tconfig() {\n\t\tif (this.#loadedParams === void 0) this.#loadedParams = blindCast(this.#processConfig().service);\n\t\treturn this.#loadedParams;\n\t}\n\tsecrets() {\n\t\tif (this.#loadedSecrets === void 0) this.#loadedSecrets = blindCast(hydrateSecrets(this, deserializeSecrets(this, \"\")));\n\t\treturn this.#loadedSecrets;\n\t}\n\t/** This service's platform-assigned public origin — read from the stash\n\t*  run() populates and memoized per process. Throws if called before run()\n\t*  has stashed it (readOrigin's pinned message). */\n\torigin() {\n\t\tthis.#origin ??= readOrigin();\n\t\treturn this.#origin;\n\t}\n};\nconst compute = (def) => {\n\tconst userParams = def.params ?? blindCast({});\n\tfor (const reserved of Object.keys(reservedParams)) {\n\t\tif (reserved in def.deps) throw new Error(`compute(): dependency \"${reserved}\" collides with the reserved service param of the same name — rename the dependency.`);\n\t\tif (reserved in userParams) throw new Error(`compute(): param \"${reserved}\" collides with the reserved service param of the same name — rename the param.`);\n\t}\n\tfor (const name of Object.keys(userParams)) if (name.toUpperCase() === \"ORIGIN\") throw new Error(`compute(): param \"${name}\" collides with the framework-written origin row — rename the param.`);\n\tfor (const name of Object.keys(def.secrets ?? {})) if (name.toUpperCase() === \"ORIGIN\") throw new Error(`compute(): secret \"${name}\" collides with the framework-written origin row — rename the secret.`);\n\tconst params = blindCast({\n\t\t...userParams,\n\t\t...reservedParams\n\t});\n\tconst instance = new ComputeService(service({\n\t\tname: def.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\ttype: \"compute\",\n\t\tinputs: def.deps,\n\t\tparams,\n\t\t...def.secrets !== void 0 ? { secrets: def.secrets } : {},\n\t\tbuild: def.build,\n\t\t...def.expose !== void 0 ? { expose: def.expose } : {}\n\t}));\n\tObject.freeze(instance);\n\treturn instance;\n};\n//#endregion\n//#region src/http.ts\nconst defaultHttpClient = (cfg) => ({\n\turl: cfg.url,\n\tfetch: (path, init) => fetch(new URL(path, cfg.url), init)\n});\n/**\n* A service-to-service dependency. Its binding (what `load()` returns) is a\n* derived HttpClient — a thin URL-anchored fetch wrapper (fetch is standard\n* across runtimes — no driver, no runtime coupling). http() is a\n* protocol-owned kind: the framework owns the transport, so the client is\n* kind-canonical and derived from the contract, with no user client in the\n* declaration (ADR-0015). The typed generated client arrives with the\n* interface primitive (a later extension point).\n*/\nconst http = (opts) => dependency({\n\tname: opts.name,\n\ttype: \"http\",\n\tconnection: {\n\t\tparams: { url: string() },\n\t\thydrate: (v) => defaultHttpClient({ url: v.url })\n\t}\n});\n//#endregion\n//#region src/postgres.ts\n/**\n* The contract a Postgres provides — and the contract its consumers require.\n* `satisfies` compares KIND, not identity: an extension module can be duplicated\n* across a workspace (same rationale as the Symbol.for node brand), and every\n* duplicate's contract must still satisfy. `__cmp` is the connection config a\n* postgres offers; core never inspects it.\n*/\nconst postgresContract = Object.freeze({\n\tkind: \"postgres\",\n\t__cmp: { url: \"\" },\n\tsatisfies: (required) => required.kind === \"postgres\"\n});\nfunction postgres(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: postgresContract\n\t});\n\treturn dependency({\n\t\ttype: \"postgres\",\n\t\tconnection: {\n\t\t\tparams: { url: string() },\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: postgresContract\n\t});\n}\n//#endregion\n//#region src/s3-credentials.ts\n/**\n* The contract the `s3-credentials` resource provides — a minted SigV4 key\n* pair. `satisfies` compares KIND only (mirrors `postgresContract`); `__cmp` is\n* the config the resource offers, which core never inspects.\n*/\nconst credentialsContract = Object.freeze({\n\tkind: \"credentials\",\n\t__cmp: {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\"\n\t},\n\tsatisfies: (required) => required.kind === \"credentials\"\n});\nfunction s3Credentials(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: credentialsContract\n\t});\n\treturn dependency({\n\t\ttype: \"credentials\",\n\t\tconnection: {\n\t\t\tparams: {\n\t\t\t\taccessKeyId: string(),\n\t\t\t\tsecretAccessKey: string()\n\t\t\t},\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: credentialsContract\n\t});\n}\n//#endregion\n//#region src/s3-store.ts\n/**\n* The storage service authoring factory — a `compute` service routed to the\n* `s3-store` lowering instead of `compute`'s. It is exactly `compute`'s\n* runnable (run/load/config, deps, params, build, expose) with the routing\n* `type` overridden to `'s3-store'`: nothing at runtime keys off `type` (the\n* serializer keys off the deployment address and each param's owner/name, and\n* `load`/`config` off deps/params), so only the deploy-time descriptor lookup\n* sees the override and routes to the extended-output lowering (§ 5). The\n* return type is compute's exactly (including the reserved `port` param). The\n* storage module (D4b) calls this with its `db`/`credentials` deps, a `bucket`\n* param, and `expose: { store: s3Contract }`.\n*\n* `compute()`'s result is a `ComputeService` instance — its run/load/config/\n* secrets/origin methods live on the class prototype, not as the instance's\n* own properties, so a plain object spread (`{ ...node }`) would silently\n* drop them. Building a fresh `ComputeService` from the same data fields\n* (which `{ ...node }` DOES copy — they're the node's own enumerable\n* properties) with `type` overridden keeps every method intact.\n*/\nfunction s3StoreService(def) {\n\tconst instance = new ComputeService({\n\t\t...compute(def),\n\t\ttype: \"s3-store\"\n\t});\n\tObject.freeze(instance);\n\treturn instance;\n}\n//#endregion\nexport { ComputeService, STREAMS_API_KEY, STREAMS_API_KEY_ENV, bucket, bucketContract, compute, configKey, credentialsContract, envParam, envSecret, http, paramName, postgres, postgresContract, provisionedEdges, s3Credentials, s3StoreService, secretName, streamsApiKeyNeed };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;;;;;;;;;;;AAeA,MAAM,iBAAiB,OAAO,OAAO;CACpC,MAAM;CACN,OAAO;EACN,KAAK;EACL,QAAQ;EACR,aAAa;EACb,iBAAiB;CAClB;CACA,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;AACD,SAAS,OAAO,MAAM;CACrB,IAAI,MAAM,SAAS,KAAK,GAAG,OAAO,SAAS;EAC1C,MAAM,KAAK;EACX,WAAW;EACX,UAAU;CACX,CAAC;CACD,OAAO,WAAW;EACjB,MAAM;EACN,YAAY;GACX,QAAQ;IACP,KAAK,OAAO;IACZ,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,iBAAiB,OAAO;GACzB;GACA,UAAU,MAAM;EACjB;EACA,UAAU;CACX,CAAC;AACF;AAGA,MAAM,iBAAiB,EAAE,MAAM,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;AAsBxD,IAAI,iBAAiB,MAAM;CAC1B;CACA;CACA;CACA;CACA;CACA,YAAY,MAAM;EACjB,OAAO,OAAO,MAAM,IAAI;CACzB;CACA,iBAAiB;EAChB,IAAI,KAAKA,cAAc,KAAK,GAAG,KAAKA,YAAY,YAAY,MAAM,EAAE;EACpE,OAAO,KAAKA;CACb;CACA,MAAM,IAAI,SAAS,MAAM;EACxB,MAAM,SAAS,YAAY,MAAM,OAAO;EACxC,MAAM,MAAM,MAAM;EAClB,oBAAoB,0BAA0B,OAAO;EACrD,aAAa,MAAM,OAAO;EAC1B,MAAM,OAAO,OAAO,QAAQ;EAC5B,IAAI,OAAO,SAAS,UAAU,QAAQ,IAAI,UAAU,OAAO,IAAI;EAC/D,OAAO,KAAK;CACb;CACA,OAAO;EACN,IAAI,KAAKC,gBAAgB,KAAK,GAAG,KAAKA,cAAc,UAAU,YAAY,MAAM,KAAKC,eAAe,CAAC,CAAC;EACtG,OAAO,KAAKD;CACb;CACA,SAAS;EACR,IAAI,KAAKE,kBAAkB,KAAK,GAAG,KAAKA,gBAAgB,UAAU,KAAKD,eAAe,CAAC,CAAC,OAAO;EAC/F,OAAO,KAAKC;CACb;CACA,UAAU;EACT,IAAI,KAAKC,mBAAmB,KAAK,GAAG,KAAKA,iBAAiB,UAAU,eAAe,MAAM,mBAAmB,MAAM,EAAE,CAAC,CAAC;EACtH,OAAO,KAAKA;CACb;;;;CAIA,SAAS;EACR,KAAKC,YAAY,WAAW;EAC5B,OAAO,KAAKA;CACb;AACD;AACA,MAAM,WAAW,QAAQ;CACxB,MAAM,aAAa,IAAI,UAAU,UAAU,CAAC,CAAC;CAC7C,KAAK,MAAM,YAAY,OAAO,KAAK,cAAc,GAAG;EACnD,IAAI,YAAY,IAAI,MAAM,MAAM,IAAI,MAAM,0BAA0B,SAAS,qFAAqF;EAClK,IAAI,YAAY,YAAY,MAAM,IAAI,MAAM,qBAAqB,SAAS,gFAAgF;CAC3J;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,UAAU,GAAG,IAAI,KAAK,YAAY,MAAM,UAAU,MAAM,IAAI,MAAM,qBAAqB,KAAK,qEAAqE;CAChM,KAAK,MAAM,QAAQ,OAAO,KAAK,IAAI,WAAW,CAAC,CAAC,GAAG,IAAI,KAAK,YAAY,MAAM,UAAU,MAAM,IAAI,MAAM,sBAAsB,KAAK,sEAAsE;CACzM,MAAM,SAAS,UAAU;EACxB,GAAG;EACH,GAAG;CACJ,CAAC;CACD,MAAM,WAAW,IAAI,eAAe,QAAQ;EAC3C,MAAM,IAAI;EACV,WAAW;EACX,MAAM;EACN,QAAQ,IAAI;EACZ;EACA,GAAG,IAAI,YAAY,KAAK,IAAI,EAAE,SAAS,IAAI,QAAQ,IAAI,CAAC;EACxD,OAAO,IAAI;EACX,GAAG,IAAI,WAAW,KAAK,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;CACtD,CAAC,CAAC;CACF,OAAO,OAAO,QAAQ;CACtB,OAAO;AACR;AAGA,MAAM,qBAAqB,SAAS;CACnC,KAAK,IAAI;CACT,QAAQ,MAAM,SAAS,MAAM,IAAI,IAAI,MAAM,IAAI,GAAG,GAAG,IAAI;AAC1D;;;;;;;;;;AAUA,MAAM,QAAQ,SAAS,WAAW;CACjC,MAAM,KAAK;CACX,MAAM;CACN,YAAY;EACX,QAAQ,EAAE,KAAK,OAAO,EAAE;EACxB,UAAU,MAAM,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC;CACjD;AACD,CAAC;;;;;;;;AAUD,MAAM,mBAAmB,OAAO,OAAO;CACtC,MAAM;CACN,OAAO,EAAE,KAAK,GAAG;CACjB,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;AACD,SAAS,SAAS,MAAM;CACvB,IAAI,MAAM,SAAS,KAAK,GAAG,OAAO,SAAS;EAC1C,MAAM,KAAK;EACX,WAAW;EACX,UAAU;CACX,CAAC;CACD,OAAO,WAAW;EACjB,MAAM;EACN,YAAY;GACX,QAAQ,EAAE,KAAK,OAAO,EAAE;GACxB,UAAU,MAAM;EACjB;EACA,UAAU;CACX,CAAC;AACF;;;;;;AAQA,MAAM,sBAAsB,OAAO,OAAO;CACzC,MAAM;CACN,OAAO;EACN,aAAa;EACb,iBAAiB;CAClB;CACA,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;AACD,SAAS,cAAc,MAAM;CAC5B,IAAI,MAAM,SAAS,KAAK,GAAG,OAAO,SAAS;EAC1C,MAAM,KAAK;EACX,WAAW;EACX,UAAU;CACX,CAAC;CACD,OAAO,WAAW;EACjB,MAAM;EACN,YAAY;GACX,QAAQ;IACP,aAAa,OAAO;IACpB,iBAAiB,OAAO;GACzB;GACA,UAAU,MAAM;EACjB;EACA,UAAU;CACX,CAAC;AACF;;;;;;;;;;;;;;;;;;;;AAsBA,SAAS,eAAe,KAAK;CAC5B,MAAM,WAAW,IAAI,eAAe;EACnC,GAAG,QAAQ,GAAG;EACd,MAAM;CACP,CAAC;CACD,OAAO,OAAO,QAAQ;CACtB,OAAO;AACR"}

package/dist/{prisma-next-COrwlg3N.mjs → prisma-next-BvBwGCIt-CSauMX4l.mjs}

@@ -2,7 +2,7 @@ import { ResourceNodeBase, dependency, freezeNode, string } from "@prisma/compos
 import { blindCast } from "@prisma/composer/casts";
 import pg from "pg";
 import pnPostgresRuntime from "@prisma-next/postgres/runtime";
-//#region ../../1-prisma-cloud/1-extensions/target/dist/pg-connection.mjs
+//#region ../../1-prisma-cloud/1-extensions/target/dist/pg-connection-CadPZuEK.mjs
 /** Connection resilience helpers for Prisma Postgres cold-starts (FT-5226); no heavy imports (no `effect`/`alchemy`/`pg`), so the deploy lowerings, the pnPostgres runtime client, and bun-runnable services (the storage store, via the pure `@internal/prisma-cloud/connection` subpath) all share one implementation. */
 /** Network-level socket failures node-postgres surfaces as `err.code`. */
 const TRANSIENT_CODES = /* @__PURE__ */ new Set([
@@ -78,7 +78,7 @@ function retryTransientConnect(acquire, opts = {}) {
 	});
 }
 //#endregion
-//#region ../../1-prisma-cloud/1-extensions/target/dist/prisma-next.mjs
+//#region ../../1-prisma-cloud/1-extensions/target/dist/prisma-next-BvBwGCIt.mjs
 /**
 * The `prisma-next` resource node: a core Resource node plus `config`, the
 * `prisma-next.config.ts` path the deploy-only migration lowering loads to
@@ -119,7 +119,7 @@ function pnPostgres(arg) {
 		type: "prisma-next",
 		connection: {
 			params: { url: string() },
-			hydrate: ({ url }) => buildClient(contract, url)
+			hydrate: ({ url }) => bindLazyClient(contract, url)
 		},
 		required: contract
 	});
@@ -128,6 +128,22 @@ function isPnPostgresContract(value) {
 	return typeof value === "object" && value !== null && "kind" in value && value.kind === "prisma-next" && "__cmp" in value && "satisfies" in value;
 }
 /**
+* The hydrated binding: `url` as delivered, `client` built by `buildClient`
+* on first access. Construction stays out of hydrate because the runtime
+* validates `contractJson` eagerly — deferring it keeps a bad contract from
+* poisoning `load()` and spares URL-only consumers the cost (ADR-0040).
+*/
+function bindLazyClient(contract, url) {
+	let client;
+	return Object.freeze({
+		url,
+		get client() {
+			client ??= buildClient(contract, url);
+			return client;
+		}
+	});
+}
+/**
 * Builds the typed Prisma Next client over a connection pool that rides out
 * a transient cold-start (FT-5226). We pass our own `pg.Pool` rather than a
 * bare `url`: the runtime's bare-`url` connect is a one-shot that fails
@@ -173,4 +189,4 @@ function storageHashOf(contract) {
 //#endregion
 export { normalizeSslMode as a, pnPostgres as i, isPnPostgresResourceNode as n, withConnectionRetry as o, pnContract as r, PnPostgresResourceNode as t };
 
-//# sourceMappingURL=prisma-next-COrwlg3N.mjs.map
+//# sourceMappingURL=prisma-next-BvBwGCIt-CSauMX4l.mjs.map

package/dist/prisma-next-BvBwGCIt-CSauMX4l.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-next-BvBwGCIt-CSauMX4l.mjs","names":[],"sources":["../../../1-prisma-cloud/1-extensions/target/dist/pg-connection-CadPZuEK.mjs","../../../1-prisma-cloud/1-extensions/target/dist/prisma-next-BvBwGCIt.mjs"],"sourcesContent":["//#region src/pg-connection.ts\n/** Connection resilience helpers for Prisma Postgres cold-starts (FT-5226); no heavy imports (no `effect`/`alchemy`/`pg`), so the deploy lowerings, the pnPostgres runtime client, and bun-runnable services (the storage store, via the pure `@internal/prisma-cloud/connection` subpath) all share one implementation. */\n/** Network-level socket failures node-postgres surfaces as `err.code`. */\nconst TRANSIENT_CODES = /* @__PURE__ */ new Set([\n\t\"ECONNREFUSED\",\n\t\"ECONNRESET\",\n\t\"ETIMEDOUT\",\n\t\"EPIPE\",\n\t\"ENOTFOUND\",\n\t\"EAI_AGAIN\"\n]);\n/** Connection-establishment failure messages (no useful `err.code`). */\nconst TRANSIENT_MESSAGE_FRAGMENTS = [\n\t\"upstream database\",\n\t\"connection terminated\",\n\t\"connection refused\",\n\t\"terminating connection\",\n\t\"server closed the connection\",\n\t\"connection timeout\",\n\t\"timeout expired\"\n];\n/** Whether an error is a transient connection failure worth retrying, as opposed to a real query error that must surface at once. */\nfunction isTransientConnectionError(error) {\n\tif (typeof error !== \"object\" || error === null) return false;\n\tconst code = \"code\" in error && typeof error.code === \"string\" ? error.code : void 0;\n\tif (code !== void 0 && TRANSIENT_CODES.has(code)) return true;\n\tconst message = \"message\" in error && typeof error.message === \"string\" ? error.message.toLowerCase() : \"\";\n\treturn TRANSIENT_MESSAGE_FRAGMENTS.some((fragment) => message.includes(fragment));\n}\n/**\n* Rewrites a deprecating `sslmode` (`require`/`prefer`/`verify-ca`) to the\n* explicit `verify-full` these already mean, silencing node-postgres's\n* deprecation warning. `disable`/`no-verify`/unset are left untouched.\n*/\nfunction normalizeSslMode(url) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(url);\n\t} catch {\n\t\treturn url;\n\t}\n\tconst sslmode = parsed.searchParams.get(\"sslmode\");\n\tif (sslmode === \"require\" || sslmode === \"prefer\" || sslmode === \"verify-ca\") {\n\t\tparsed.searchParams.set(\"sslmode\", \"verify-full\");\n\t\treturn parsed.toString();\n\t}\n\treturn url;\n}\n/**\n* Retries an operation past a transient connection failure, bounded (default\n* ~1 min). `shouldRetry` decides what's transient — defaults to retrying\n* everything; the runtime client passes {@link isTransientConnectionError}.\n*/\nasync function withConnectionRetry(operation, opts = {}) {\n\tconst attempts = opts.attempts ?? 12;\n\tconst delayMs = opts.delayMs ?? 5e3;\n\tconst sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));\n\tconst shouldRetry = opts.shouldRetry ?? (() => true);\n\tlet lastError;\n\tfor (let attempt = 1; attempt <= attempts; attempt++) try {\n\t\treturn await operation();\n\t} catch (error) {\n\t\tif (!shouldRetry(error)) throw error;\n\t\tlastError = error;\n\t\tif (attempt < attempts) await sleep(delayMs);\n\t}\n\tthrow lastError;\n}\n/** Retries acquiring a connection past a transient cold-start; {@link withConnectionRetry} with {@link isTransientConnectionError} fixed as the predicate. */\nfunction retryTransientConnect(acquire, opts = {}) {\n\treturn withConnectionRetry(acquire, {\n\t\t...opts,\n\t\tshouldRetry: isTransientConnectionError\n\t});\n}\n//#endregion\nexport { withConnectionRetry as i, normalizeSslMode as n, retryTransientConnect as r, isTransientConnectionError as t };\n\n//# sourceMappingURL=pg-connection-CadPZuEK.mjs.map","import { n as normalizeSslMode, r as retryTransientConnect } from \"./pg-connection-CadPZuEK.mjs\";\nimport { ResourceNodeBase, dependency, freezeNode, string } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\nimport pg from \"pg\";\nimport pnPostgresRuntime from \"@prisma-next/postgres/runtime\";\n//#region src/prisma-next.ts\n/**\n* The `prisma-next` resource node: a core Resource node plus `config`, the\n* `prisma-next.config.ts` path the deploy-only migration lowering loads to\n* find the migrations directory — the app build never imports it.\n*/\nvar PnPostgresResourceNode = class extends ResourceNodeBase {\n\tconfig;\n\tconstructor(def) {\n\t\tsuper({\n\t\t\tname: def.name,\n\t\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\t\tprovides: def.contract\n\t\t});\n\t\tthis.config = def.config;\n\t\tif (def.targetRef !== void 0) this.targetRef = def.targetRef;\n\t\tfreezeNode(this);\n\t}\n};\n/** Narrows `ctx.node` to a `pnPostgres` resource node so the deploy lowering reads `config` without a bare cast. Structural, never `instanceof`. */\nfunction isPnPostgresResourceNode(node) {\n\treturn node.kind === \"resource\" && node.type === \"prisma-next\" && \"config\" in node && typeof node.config === \"string\";\n}\nfunction pnContract(contract) {\n\tconst value = {\n\t\tkind: \"prisma-next\",\n\t\t__cmp: { contractJson: contract },\n\t\tsatisfies: (required) => {\n\t\t\tconst requiredHash = storageHashOf(required);\n\t\t\treturn requiredHash !== void 0 && requiredHash === storageHashOf(value);\n\t\t}\n\t};\n\treturn Object.freeze(value);\n}\nfunction pnPostgres(arg) {\n\tif (!isPnPostgresContract(arg)) return new PnPostgresResourceNode(arg);\n\tconst contract = arg;\n\treturn dependency({\n\t\ttype: \"prisma-next\",\n\t\tconnection: {\n\t\t\tparams: { url: string() },\n\t\t\thydrate: ({ url }) => bindLazyClient(contract, url)\n\t\t},\n\t\trequired: contract\n\t});\n}\nfunction isPnPostgresContract(value) {\n\treturn typeof value === \"object\" && value !== null && \"kind\" in value && value.kind === \"prisma-next\" && \"__cmp\" in value && \"satisfies\" in value;\n}\n/**\n* The hydrated binding: `url` as delivered, `client` built by `buildClient`\n* on first access. Construction stays out of hydrate because the runtime\n* validates `contractJson` eagerly — deferring it keeps a bad contract from\n* poisoning `load()` and spares URL-only consumers the cost (ADR-0040).\n*/\nfunction bindLazyClient(contract, url) {\n\tlet client;\n\treturn Object.freeze({\n\t\turl,\n\t\tget client() {\n\t\t\tclient ??= buildClient(contract, url);\n\t\t\treturn client;\n\t\t}\n\t});\n}\n/**\n* Builds the typed Prisma Next client over a connection pool that rides out\n* a transient cold-start (FT-5226). We pass our own `pg.Pool` rather than a\n* bare `url`: the runtime's bare-`url` connect is a one-shot that fails\n* permanently, but a pool connects lazily on first query, so a bounded retry there suffices.\n*/\nfunction buildClient(contract, url) {\n\treturn pnPostgresRuntime({\n\t\tcontractJson: contract.__cmp.contractJson,\n\t\tbinding: {\n\t\t\tkind: \"pgPool\",\n\t\t\tpool: resilientPool(url)\n\t\t}\n\t});\n}\n/**\n* A `pg.Pool` whose connection acquisition retries a transient cold-start\n* (bounded ~1 min). Only `pool.connect()` is wrapped — a real query error\n* still surfaces at once from `client.query()`.\n*/\nfunction resilientPool(url) {\n\tconst pool = new pg.Pool({\n\t\tconnectionString: normalizeSslMode(url),\n\t\tconnectionTimeoutMillis: 2e4,\n\t\tidleTimeoutMillis: 5e3\n\t});\n\tpool.on(\"error\", (err) => console.error(\"pg pool idle client error\", err));\n\tconst acquire = pool.connect.bind(pool);\n\tpool.connect = blindCast(() => retryTransientConnect(() => acquire()));\n\treturn pool;\n}\n/** Reads `__cmp.contractJson.storage.storageHash` off a `prisma-next` Contract, defensively — `__cmp` is opaque to core, so nothing guarantees its shape without a runtime check. */\nfunction storageHashOf(contract) {\n\tif (contract === void 0) return void 0;\n\tconst cmp = contract.__cmp;\n\tif (typeof cmp !== \"object\" || cmp === null || !(\"contractJson\" in cmp)) return void 0;\n\tconst contractJson = cmp.contractJson;\n\tif (typeof contractJson !== \"object\" || contractJson === null || !(\"storage\" in contractJson)) return;\n\tconst storage = contractJson.storage;\n\tif (typeof storage !== \"object\" || storage === null || !(\"storageHash\" in storage)) return void 0;\n\tconst hash = storage.storageHash;\n\treturn typeof hash === \"string\" ? hash : void 0;\n}\n//#endregion\nexport { pnPostgres as i, isPnPostgresResourceNode as n, pnContract as r, PnPostgresResourceNode as t };\n\n//# sourceMappingURL=prisma-next-BvBwGCIt.mjs.map"],"mappings":";;;;;;;AAGA,MAAM,kCAAkC,IAAI,IAAI;CAC/C;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;;AAED,MAAM,8BAA8B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;AAEA,SAAS,2BAA2B,OAAO;CAC1C,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,OAAO,UAAU,SAAS,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,KAAK;CACnF,IAAI,SAAS,KAAK,KAAK,gBAAgB,IAAI,IAAI,GAAG,OAAO;CACzD,MAAM,UAAU,aAAa,SAAS,OAAO,MAAM,YAAY,WAAW,MAAM,QAAQ,YAAY,IAAI;CACxG,OAAO,4BAA4B,MAAM,aAAa,QAAQ,SAAS,QAAQ,CAAC;AACjF;;;;;;AAMA,SAAS,iBAAiB,KAAK;CAC9B,IAAI;CACJ,IAAI;EACH,SAAS,IAAI,IAAI,GAAG;CACrB,QAAQ;EACP,OAAO;CACR;CACA,MAAM,UAAU,OAAO,aAAa,IAAI,SAAS;CACjD,IAAI,YAAY,aAAa,YAAY,YAAY,YAAY,aAAa;EAC7E,OAAO,aAAa,IAAI,WAAW,aAAa;EAChD,OAAO,OAAO,SAAS;CACxB;CACA,OAAO;AACR;;;;;;AAMA,eAAe,oBAAoB,WAAW,OAAO,CAAC,GAAG;CACxD,MAAM,WAAW,KAAK,YAAY;CAClC,MAAM,UAAU,KAAK,WAAW;CAChC,MAAM,QAAQ,KAAK,WAAW,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;CACrF,MAAM,cAAc,KAAK,sBAAsB;CAC/C,IAAI;CACJ,KAAK,IAAI,UAAU,GAAG,WAAW,UAAU,WAAW,IAAI;EACzD,OAAO,MAAM,UAAU;CACxB,SAAS,OAAO;EACf,IAAI,CAAC,YAAY,KAAK,GAAG,MAAM;EAC/B,YAAY;EACZ,IAAI,UAAU,UAAU,MAAM,MAAM,OAAO;CAC5C;CACA,MAAM;AACP;;AAEA,SAAS,sBAAsB,SAAS,OAAO,CAAC,GAAG;CAClD,OAAO,oBAAoB,SAAS;EACnC,GAAG;EACH,aAAa;CACd,CAAC;AACF;;;;;;;;AC/DA,IAAI,yBAAyB,cAAc,iBAAiB;CAC3D;CACA,YAAY,KAAK;EAChB,MAAM;GACL,MAAM,IAAI;GACV,WAAW;GACX,UAAU,IAAI;EACf,CAAC;EACD,KAAK,SAAS,IAAI;EAClB,IAAI,IAAI,cAAc,KAAK,GAAG,KAAK,YAAY,IAAI;EACnD,WAAW,IAAI;CAChB;AACD;;AAEA,SAAS,yBAAyB,MAAM;CACvC,OAAO,KAAK,SAAS,cAAc,KAAK,SAAS,iBAAiB,YAAY,QAAQ,OAAO,KAAK,WAAW;AAC9G;AACA,SAAS,WAAW,UAAU;CAC7B,MAAM,QAAQ;EACb,MAAM;EACN,OAAO,EAAE,cAAc,SAAS;EAChC,YAAY,aAAa;GACxB,MAAM,eAAe,cAAc,QAAQ;GAC3C,OAAO,iBAAiB,KAAK,KAAK,iBAAiB,cAAc,KAAK;EACvE;CACD;CACA,OAAO,OAAO,OAAO,KAAK;AAC3B;AACA,SAAS,WAAW,KAAK;CACxB,IAAI,CAAC,qBAAqB,GAAG,GAAG,OAAO,IAAI,uBAAuB,GAAG;CACrE,MAAM,WAAW;CACjB,OAAO,WAAW;EACjB,MAAM;EACN,YAAY;GACX,QAAQ,EAAE,KAAK,OAAO,EAAE;GACxB,UAAU,EAAE,UAAU,eAAe,UAAU,GAAG;EACnD;EACA,UAAU;CACX,CAAC;AACF;AACA,SAAS,qBAAqB,OAAO;CACpC,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS,iBAAiB,WAAW,SAAS,eAAe;AAC7I;;;;;;;AAOA,SAAS,eAAe,UAAU,KAAK;CACtC,IAAI;CACJ,OAAO,OAAO,OAAO;EACpB;EACA,IAAI,SAAS;GACZ,WAAW,YAAY,UAAU,GAAG;GACpC,OAAO;EACR;CACD,CAAC;AACF;;;;;;;AAOA,SAAS,YAAY,UAAU,KAAK;CACnC,OAAO,kBAAkB;EACxB,cAAc,SAAS,MAAM;EAC7B,SAAS;GACR,MAAM;GACN,MAAM,cAAc,GAAG;EACxB;CACD,CAAC;AACF;;;;;;AAMA,SAAS,cAAc,KAAK;CAC3B,MAAM,OAAO,IAAI,GAAG,KAAK;EACxB,kBAAkB,iBAAiB,GAAG;EACtC,yBAAyB;EACzB,mBAAmB;CACpB,CAAC;CACD,KAAK,GAAG,UAAU,QAAQ,QAAQ,MAAM,6BAA6B,GAAG,CAAC;CACzE,MAAM,UAAU,KAAK,QAAQ,KAAK,IAAI;CACtC,KAAK,UAAU,gBAAgB,4BAA4B,QAAQ,CAAC,CAAC;CACrE,OAAO;AACR;;AAEA,SAAS,cAAc,UAAU;CAChC,IAAI,aAAa,KAAK,GAAG,OAAO,KAAK;CACrC,MAAM,MAAM,SAAS;CACrB,IAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,EAAE,kBAAkB,MAAM,OAAO,KAAK;CACrF,MAAM,eAAe,IAAI;CACzB,IAAI,OAAO,iBAAiB,YAAY,iBAAiB,QAAQ,EAAE,aAAa,eAAe;CAC/F,MAAM,UAAU,aAAa;CAC7B,IAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,EAAE,iBAAiB,UAAU,OAAO,KAAK;CAChG,MAAM,OAAO,QAAQ;CACrB,OAAO,OAAO,SAAS,WAAW,OAAO,KAAK;AAC/C"}

package/dist/prisma-next.d.mts

@@ -1,7 +1,6 @@
 import { Contract, DependencyEnd, ResourceNode, ResourceNodeBase, ServiceNode } from "@prisma/composer";
 import { PostgresClient } from "@prisma-next/postgres/runtime";
 import { SqlStorage } from "@prisma-next/sql-contract/types";
-
 //#region ../../1-prisma-cloud/1-extensions/target/dist/prisma-next.d.mts
 //#region src/prisma-next.d.ts
 /**
@@ -23,8 +22,17 @@ interface PnCmp<C extends AnyPnContract = AnyPnContract> {
 type PnPostgresContract<C extends AnyPnContract = AnyPnContract> = Contract<'prisma-next', PnCmp<C>>;
 /** Recovers the emitted contract type `C` a `prisma-next` Contract carries. */
 type PnContractOf<Ct> = Ct extends PnPostgresContract<infer C> ? C : never;
-/** The typed client a consumer's `pnPostgres(contract)` dependency hydrates to. */
+/** The typed Prisma Next client, reachable as `binding.client` on a `pnPostgres(contract)` dependency. */
 type Client<Ct> = PostgresClient<PnContractOf<Ct>>;
+/**
+ * The binding a consumer's `pnPostgres(contract)` dependency hydrates to
+ * (ADR-0040): the raw connection URL, plus the typed client — constructed on
+ * first access, memoized thereafter.
+ */
+interface PnPostgresBinding<Ct> {
+  readonly url: string;
+  readonly client: Client<Ct>;
+}
 /**
  * The `prisma-next` resource node: a core Resource node plus `config`, the
  * `prisma-next.config.ts` path the deploy-only migration lowering loads to
@@ -63,10 +71,10 @@ declare function pnPostgres<C extends PnPostgresContract>(opts: {
 }): PnPostgresResourceNode<C>;
 /**
  * `pnPostgres(contract)` — a service's dependency on a Prisma Next-typed
- * Postgres. Its binding is the typed Prisma Next client, constructed by the
- * framework in hydrate from the contract plus the injected connection URL.
+ * Postgres. Its binding carries the raw connection URL and the typed Prisma
+ * Next client, built lazily on first `client` access (ADR-0040).
  */
-declare function pnPostgres<C extends PnPostgresContract>(contract: C): DependencyEnd<Client<C>, C>; //#endregion
+declare function pnPostgres<C extends PnPostgresContract>(contract: C): DependencyEnd<PnPostgresBinding<C>, C>;
 //#endregion
-export { AnyPnContract, Client, PnCmp, PnContractOf, PnPostgresContract, PnPostgresResourceNode, isPnPostgresResourceNode, pnContract, pnPostgres };
+export { AnyPnContract, Client, PnCmp, PnContractOf, PnPostgresBinding, PnPostgresContract, PnPostgresResourceNode, isPnPostgresResourceNode, pnContract, pnPostgres };
 //# sourceMappingURL=prisma-next.d.mts.map

package/dist/prisma-next.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-next.d.mts","names":[],"sources":["../../../1-prisma-cloud/1-extensions/target/dist/prisma-next.d.mts"],"mappings":";;;;;;;;;;KASK,sDAAsD,SAAS;;;;;;UAM1D,MAAM,UAAU,gBAAgB;WAC/B;WACA,YAAY;;;KAGlB,mBAAmB,UAAU,gBAAgB,iBAAiB,wBAAwB,MAAM;;KAE5F,aAAa,MAAM,WAAW,yBAAyB,KAAK;;KAE5D,OAAO,MAAM,eAAe,aAAa;;;;;;UAMpC,kBAAkB;WACjB;WACA,QAAQ,OAAO;;;;;;;cAOZ,uBAAuB,UAAU,qBAAqB,4BAA4B,iBAAiB;WACtG;;WAEA;EACT,YAAY;IACV;IACA,UAAU;IACV;IACA;;;;iBAIa,yBAAyB,MAAM,cAAc,eAAe,QAAQ;;;;;;iBAMpE,iBAAiB,UAAU,eAAe,UAAU,IAAI,mBAAmB;iBAC3E,WAAW,UAAU,eAAe,wBAAwB,mBAAmB;;;;;;iBAM/E,WAAW,UAAU,oBAAoB;EACxD;EACA,UAAU;EACV;EACA;IACE,uBAAuB;;;;;;iBAMV,WAAW,UAAU,oBAAoB,UAAU,IAAI,cAAc,kBAAkB,IAAI"}

package/dist/prisma-next.mjs

@@ -1,2 +1,2 @@
-import { i as pnPostgres, n as isPnPostgresResourceNode, r as pnContract, t as PnPostgresResourceNode } from "./prisma-next-COrwlg3N.mjs";
+import { i as pnPostgres, n as isPnPostgresResourceNode, r as pnContract, t as PnPostgresResourceNode } from "./prisma-next-BvBwGCIt-CSauMX4l.mjs";
 export { PnPostgresResourceNode, isPnPostgresResourceNode, pnContract, pnPostgres };

package/dist/provisioned-edges-B_XS1Mz--NFJgcXK7.mjs

@@ -0,0 +1,211 @@
+import { n as configKey, t as ORIGIN_KEY_NAME } from "./serializer-D8_84XWO-DA2B6YbX.mjs";
+import { isParamSource, paramSource, provisionNeed } from "@prisma/composer";
+import { blindCast } from "@prisma/composer/casts";
+import { type } from "arktype";
+import { RPC_PEER_KEY } from "@prisma/composer/service-rpc";
+//#region ../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-B_XS1Mz-.mjs
+/**
+* The service's own origin as a reserved provider param (ADR-0031): the ONE
+* brand and the ONE entry — shared by control.ts (which registers the
+* deploy-side value function that resolves the provisioned service's
+* `endpointDomain` — see its `selfOriginValue`) and compute.ts (which
+* validates and stashes the row at boot through the generic
+* `stashProviderParams` loop), so writer and reader cannot drift.
+*
+* Unlike the key-minting brands (`service-keys.ts`, `streams-keys.ts`) this
+* brand has no provisioner and no consumer edges: the value derives from the
+* service's OWN provisioned attributes, so control.ts registers it as a
+* service-derived provider param (`descriptors/shared.ts`'s
+* `ServiceProviderParam`) and the descriptor writes it for EVERY compute
+* service, exposing or not.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side value function lives in control.ts, the
+* control-plane-only entry).
+*/
+/** ADR-0031's brand for the service's own origin — control.ts registers the deploy-side value function under this. */
+const SELF_ORIGIN = Symbol.for("prisma:self-origin");
+/**
+* The reserved provider param for the origin row: the var name is `ORIGIN`,
+* derived through `configKey` at both ends (`configKey(address, …)` at
+* deploy, `configKey('', …)` — `COMPOSER_ORIGIN` — at boot, where
+* `readOrigin` reads it back). `brand` is `SELF_ORIGIN` — control.ts looks
+* its deploy-side value function up by this field.
+*/
+const ORIGIN_PARAM = {
+	name: ORIGIN_KEY_NAME,
+	schema: type("string"),
+	brand: SELF_ORIGIN
+};
+/**
+* RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —
+* name + schema + brand — for the accepted-keys set a provider stores, shared
+* by `control.ts` (which registers the deploy-side `value(refs)` that mints
+* and aggregates it — see its `rpcAcceptedKeysValue`) and `compute.ts` (which
+* validates and stashes it at boot), so writer and reader cannot drift.
+* Finding the edges themselves is `provisioned-edges.ts`'s generic,
+* brand-blind scan — RPC is not special-cased anywhere in this target.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side `value(refs)` lives in control.ts, the
+* control-plane-only entry).
+*/
+/**
+* The reserved provider param for RPC's accepted-keys set: the var name is
+* `RPC_ACCEPTED_KEYS`, derived through `configKey` at both ends
+* (`configKey(address, …)` at deploy, `configKey('', …)` at boot — the
+* address-free form is `@internal/service-rpc`'s `RPC_ACCEPTED_KEYS_ENV`). `brand` is
+* `RPC_PEER_KEY`, the same brand `perBindingToken()`'s need carries — control.ts
+* looks its `value(refs)` up by this field.
+*/
+const RPC_ACCEPTED_KEYS_PARAM = {
+	name: "RPC_ACCEPTED_KEYS",
+	schema: type("string[]"),
+	brand: RPC_PEER_KEY
+};
+/** ADR-0031's need brand for the streams module's bearer key — control.ts registers the provisioner under this. */
+const STREAMS_API_KEY = Symbol.for("prisma:streams/api-key");
+/**
+* The provisioning need `durableStreams()`'s `apiKey` param declares: an
+* unguessable value the target mints ONCE PER PROVIDER (not per edge) —
+* `@prisma/streams-server` authenticates a single `API_KEY`, so every
+* consumer of one streams module must present the same value. Per-provider
+* cardinality is provisioner policy (ADR-0031), invisible to core.
+*/
+const streamsApiKeyNeed = () => provisionNeed(STREAMS_API_KEY);
+/**
+* The reserved provider param for the streams bearer key: the var name is
+* `STREAMS_API_KEY`. `brand` is `STREAMS_API_KEY` itself (the same symbol
+* `streamsApiKeyNeed()`'s need carries) — control.ts looks its `value(refs)`
+* up by this field.
+*/
+const STREAMS_API_KEY_PARAM = {
+	name: "STREAMS_API_KEY",
+	schema: type("string"),
+	brand: STREAMS_API_KEY
+};
+/** The address-free name compute.ts re-stashes to and the streams entrypoint reads. */
+const STREAMS_API_KEY_ENV = configKey("", {
+	owner: "service",
+	name: STREAMS_API_KEY_PARAM.name
+});
+/**
+* The list of provider-side reserved params the boot path validates and
+* stashes (ADR-0031): every brand's `{name, schema, brand}` declaration,
+* collected from that brand's own module (`service-keys.ts`,
+* `streams-keys.ts`, `origin-key.ts`) so `compute.ts` names no brand itself.
+*
+* This list exists separately from `control.ts`'s deploy-side registry
+* (`PROVIDER_PARAMS`) because `control.ts` is deploy-only code — it imports
+* `@internal/lowering` and `effect` to mint values — and a booted service
+* must never import it. This module is reachable from a user service's
+* bundle through `compute.ts`, so it must never import `@internal/lowering`,
+* `effect`, `alchemy`, or `control.ts`.
+*
+* This is the single source of which reserved provider params exist:
+* control.ts builds `PROVIDER_PARAMS` by mapping over this list and looking
+* up each entry's deploy-side value function (edge-derived `value(refs)` or
+* service-derived `valueForService(provisioned, address)`) by its `brand`,
+* throwing at module load if one is missing. Adding a brand means adding its
+* entry here, plus its deploy-side value function in control.ts — a brand
+* registered for deploy but absent here is no longer expressible, because
+* deploy no longer names its own param set independently.
+*/
+const RESERVED_PROVIDER_PARAMS = [
+	RPC_ACCEPTED_KEYS_PARAM,
+	STREAMS_API_KEY_PARAM,
+	ORIGIN_PARAM
+];
+/**
+* Brands the payload `envParam` builds. Core's `paramSource()` is a public
+* SPI, so a user could bypass `envParam` and bind a raw `paramSource('x')`;
+* the brand lets `paramName` reject such a source (or another target's) with
+* a clear error instead of reading an absent `.name`.
+*/
+const PRISMA_CLOUD_PARAM_SOURCE = blindCast(Symbol.for("prisma:prisma-cloud-param-source"));
+const RESERVED_PARAM_PREFIX = "COMPOSER_";
+const POISONED_PARAM_NAMES = /* @__PURE__ */ new Set(["DATABASE_URL", "DATABASE_URL_POOLED"]);
+/**
+* Binds a param slot to a named Prisma Cloud platform env var — the non-secret
+* sibling of `envSecret` (spec: env-sourced config params). The platform
+* injects the value into the running instance per stage; the param's own
+* schema validates it at boot, unredacted. The name may not use the
+* framework's reserved `COMPOSER_` prefix or the poisoned
+* `DATABASE_URL(_POOLED)` keys — same parity as `envSecret`.
+*/
+function envParam(name) {
+	if (typeof name !== "string" || name.length === 0) throw new Error("envParam() requires a non-empty platform env-var name, e.g. envParam('APP_ORIGIN').");
+	if (name.startsWith(RESERVED_PARAM_PREFIX)) throw new Error(`envParam name "${name}" may not start with "${RESERVED_PARAM_PREFIX}" — that prefix is reserved for the framework's own generated config keys.`);
+	if (POISONED_PARAM_NAMES.has(name)) throw new Error(`envParam name "${name}" is reserved — ${[...POISONED_PARAM_NAMES].join(" and ")} are poisoned at project provision and cannot back a param.`);
+	return paramSource({
+		[PRISMA_CLOUD_PARAM_SOURCE]: true,
+		name
+	});
+}
+/** True only for a payload that `envParam` built — i.e. one carrying the brand. */
+function isEnvParamPayload(payload) {
+	return typeof payload === "object" && payload !== null && blindCast(payload)[PRISMA_CLOUD_PARAM_SOURCE] === true;
+}
+/** True iff a resolved param value is an env-sourced pointer this target built (as opposed to a literal, or a foreign/raw `ParamSource`). */
+function isEnvParamSource(value) {
+	return isParamSource(value) && isEnvParamPayload(value.payload);
+}
+/**
+* Reads the Prisma Cloud env-var name back out of a param binding's opaque
+* source. A source not built by `envParam` (a raw `paramSource(...)` or
+* another target's source) carries no name — reject it here. `paramName` runs
+* in preflight and at serialize before any value ever crosses the wire, so a
+* foreign source fails early and clearly rather than producing a broken
+* deploy with an undefined name.
+*/
+function paramName(binding) {
+	const { binding: bound } = binding;
+	if (!isEnvParamSource(bound)) throw new Error(`param slot "${binding.slot}" of service "${binding.serviceAddress}" is bound to a source not created by envParam() — bind env-sourced params with envParam('NAME') from @prisma/composer-prisma-cloud.`);
+	return bound.payload.name;
+}
+/**
+* Finds the manifest entry for one service param slot. `serialize` calls this
+* only after confirming `buildConfig` resolved the slot to a `ParamSource`
+* (`isParamSource(value)`), so a miss here means `graph.params` and the
+* resolved `Config` have drifted — a Load invariant violation, surfaced
+* loudly rather than producing a pointer row with an undefined name.
+*/
+function paramBindingFor(bindings, serviceAddress, slot) {
+	const binding = bindings.find((b) => b.serviceAddress === serviceAddress && b.slot === slot);
+	if (binding === void 0) throw new Error(`param slot "${slot}" of "${serviceAddress}" resolved to a source but has no bound entry in the manifest — Load should have recorded it.`);
+	return binding;
+}
+/**
+* Every provisioned edge in the graph. Core resolves and mints these (one
+* value per edge, keyed by `edgeId`); this scan is how the target finds them
+* again when it gathers a provider's inbound values.
+*/
+function provisionedEdges(graph) {
+	const edges = [];
+	for (const edge of graph.edges) {
+		if (edge.kind !== "dependency") continue;
+		const consumer = graph.nodes.find((n) => n.id === edge.to)?.node;
+		if (consumer === void 0 || consumer.kind !== "service") continue;
+		const slot = consumer.inputs[edge.input];
+		if (slot === void 0) continue;
+		for (const param of Object.values(slot.connection.params)) {
+			const brand = param.provision?.brand;
+			if (brand === void 0) continue;
+			edges.push({
+				edgeId: `${edge.to}.${edge.input}`,
+				consumerAddress: edge.to,
+				input: edge.input,
+				providerAddress: edge.from,
+				brand
+			});
+			break;
+		}
+	}
+	return edges;
+}
+//#endregion
+export { envParam as a, paramName as c, STREAMS_API_KEY_ENV as i, provisionedEdges as l, SELF_ORIGIN as n, isEnvParamSource as o, STREAMS_API_KEY as r, paramBindingFor as s, RESERVED_PROVIDER_PARAMS as t, streamsApiKeyNeed as u };
+
+//# sourceMappingURL=provisioned-edges-B_XS1Mz--NFJgcXK7.mjs.map

package/dist/provisioned-edges-B_XS1Mz--NFJgcXK7.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioned-edges-B_XS1Mz--NFJgcXK7.mjs","names":[],"sources":["../../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-B_XS1Mz-.mjs"],"sourcesContent":["import { n as configKey, t as ORIGIN_KEY_NAME } from \"./serializer-D8_84XWO.mjs\";\nimport { isParamSource, paramSource, provisionNeed } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\nimport { type } from \"arktype\";\nimport { RPC_PEER_KEY } from \"@internal/service-rpc\";\n//#region src/origin-key.ts\n/**\n* The service's own origin as a reserved provider param (ADR-0031): the ONE\n* brand and the ONE entry — shared by control.ts (which registers the\n* deploy-side value function that resolves the provisioned service's\n* `endpointDomain` — see its `selfOriginValue`) and compute.ts (which\n* validates and stashes the row at boot through the generic\n* `stashProviderParams` loop), so writer and reader cannot drift.\n*\n* Unlike the key-minting brands (`service-keys.ts`, `streams-keys.ts`) this\n* brand has no provisioner and no consumer edges: the value derives from the\n* service's OWN provisioned attributes, so control.ts registers it as a\n* service-derived provider param (`descriptors/shared.ts`'s\n* `ServiceProviderParam`) and the descriptor writes it for EVERY compute\n* service, exposing or not.\n*\n* This module is reachable from the RUNTIME/authoring side — it must never\n* import `@internal/lowering` or `effect`, or those tokens leak into a user\n* service's bundle (the deploy-side value function lives in control.ts, the\n* control-plane-only entry).\n*/\n/** ADR-0031's brand for the service's own origin — control.ts registers the deploy-side value function under this. */\nconst SELF_ORIGIN = Symbol.for(\"prisma:self-origin\");\n/**\n* The reserved provider param for the origin row: the var name is `ORIGIN`,\n* derived through `configKey` at both ends (`configKey(address, …)` at\n* deploy, `configKey('', …)` — `COMPOSER_ORIGIN` — at boot, where\n* `readOrigin` reads it back). `brand` is `SELF_ORIGIN` — control.ts looks\n* its deploy-side value function up by this field.\n*/\nconst ORIGIN_PARAM = {\n\tname: ORIGIN_KEY_NAME,\n\tschema: type(\"string\"),\n\tbrand: SELF_ORIGIN\n};\n//#endregion\n//#region src/service-keys.ts\n/**\n* RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —\n* name + schema + brand — for the accepted-keys set a provider stores, shared\n* by `control.ts` (which registers the deploy-side `value(refs)` that mints\n* and aggregates it — see its `rpcAcceptedKeysValue`) and `compute.ts` (which\n* validates and stashes it at boot), so writer and reader cannot drift.\n* Finding the edges themselves is `provisioned-edges.ts`'s generic,\n* brand-blind scan — RPC is not special-cased anywhere in this target.\n*\n* This module is reachable from the RUNTIME/authoring side — it must never\n* import `@internal/lowering` or `effect`, or those tokens leak into a user\n* service's bundle (the deploy-side `value(refs)` lives in control.ts, the\n* control-plane-only entry).\n*/\n/**\n* The reserved provider param for RPC's accepted-keys set: the var name is\n* `RPC_ACCEPTED_KEYS`, derived through `configKey` at both ends\n* (`configKey(address, …)` at deploy, `configKey('', …)` at boot — the\n* address-free form is `@internal/service-rpc`'s `RPC_ACCEPTED_KEYS_ENV`). `brand` is\n* `RPC_PEER_KEY`, the same brand `perBindingToken()`'s need carries — control.ts\n* looks its `value(refs)` up by this field.\n*/\nconst RPC_ACCEPTED_KEYS_PARAM = {\n\tname: \"RPC_ACCEPTED_KEYS\",\n\tschema: type(\"string[]\"),\n\tbrand: RPC_PEER_KEY\n};\n//#endregion\n//#region src/streams-keys.ts\n/** ADR-0031's need brand for the streams module's bearer key — control.ts registers the provisioner under this. */\nconst STREAMS_API_KEY = Symbol.for(\"prisma:streams/api-key\");\n/**\n* The provisioning need `durableStreams()`'s `apiKey` param declares: an\n* unguessable value the target mints ONCE PER PROVIDER (not per edge) —\n* `@prisma/streams-server` authenticates a single `API_KEY`, so every\n* consumer of one streams module must present the same value. Per-provider\n* cardinality is provisioner policy (ADR-0031), invisible to core.\n*/\nconst streamsApiKeyNeed = () => provisionNeed(STREAMS_API_KEY);\n/**\n* The reserved provider param for the streams bearer key: the var name is\n* `STREAMS_API_KEY`. `brand` is `STREAMS_API_KEY` itself (the same symbol\n* `streamsApiKeyNeed()`'s need carries) — control.ts looks its `value(refs)`\n* up by this field.\n*/\nconst STREAMS_API_KEY_PARAM = {\n\tname: \"STREAMS_API_KEY\",\n\tschema: type(\"string\"),\n\tbrand: STREAMS_API_KEY\n};\n/** The address-free name compute.ts re-stashes to and the streams entrypoint reads. */\nconst STREAMS_API_KEY_ENV = configKey(\"\", {\n\towner: \"service\",\n\tname: STREAMS_API_KEY_PARAM.name\n});\n//#endregion\n//#region src/provider-params.ts\n/**\n* The list of provider-side reserved params the boot path validates and\n* stashes (ADR-0031): every brand's `{name, schema, brand}` declaration,\n* collected from that brand's own module (`service-keys.ts`,\n* `streams-keys.ts`, `origin-key.ts`) so `compute.ts` names no brand itself.\n*\n* This list exists separately from `control.ts`'s deploy-side registry\n* (`PROVIDER_PARAMS`) because `control.ts` is deploy-only code — it imports\n* `@internal/lowering` and `effect` to mint values — and a booted service\n* must never import it. This module is reachable from a user service's\n* bundle through `compute.ts`, so it must never import `@internal/lowering`,\n* `effect`, `alchemy`, or `control.ts`.\n*\n* This is the single source of which reserved provider params exist:\n* control.ts builds `PROVIDER_PARAMS` by mapping over this list and looking\n* up each entry's deploy-side value function (edge-derived `value(refs)` or\n* service-derived `valueForService(provisioned, address)`) by its `brand`,\n* throwing at module load if one is missing. Adding a brand means adding its\n* entry here, plus its deploy-side value function in control.ts — a brand\n* registered for deploy but absent here is no longer expressible, because\n* deploy no longer names its own param set independently.\n*/\nconst RESERVED_PROVIDER_PARAMS = [\n\tRPC_ACCEPTED_KEYS_PARAM,\n\tSTREAMS_API_KEY_PARAM,\n\tORIGIN_PARAM\n];\n//#endregion\n//#region src/param.ts\n/**\n* Brands the payload `envParam` builds. Core's `paramSource()` is a public\n* SPI, so a user could bypass `envParam` and bind a raw `paramSource('x')`;\n* the brand lets `paramName` reject such a source (or another target's) with\n* a clear error instead of reading an absent `.name`.\n*/\nconst PRISMA_CLOUD_PARAM_SOURCE = blindCast(Symbol.for(\"prisma:prisma-cloud-param-source\"));\nconst RESERVED_PARAM_PREFIX = \"COMPOSER_\";\nconst POISONED_PARAM_NAMES = /* @__PURE__ */ new Set([\"DATABASE_URL\", \"DATABASE_URL_POOLED\"]);\n/**\n* Binds a param slot to a named Prisma Cloud platform env var — the non-secret\n* sibling of `envSecret` (spec: env-sourced config params). The platform\n* injects the value into the running instance per stage; the param's own\n* schema validates it at boot, unredacted. The name may not use the\n* framework's reserved `COMPOSER_` prefix or the poisoned\n* `DATABASE_URL(_POOLED)` keys — same parity as `envSecret`.\n*/\nfunction envParam(name) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(\"envParam() requires a non-empty platform env-var name, e.g. envParam('APP_ORIGIN').\");\n\tif (name.startsWith(RESERVED_PARAM_PREFIX)) throw new Error(`envParam name \"${name}\" may not start with \"${RESERVED_PARAM_PREFIX}\" — that prefix is reserved for the framework's own generated config keys.`);\n\tif (POISONED_PARAM_NAMES.has(name)) throw new Error(`envParam name \"${name}\" is reserved — ${[...POISONED_PARAM_NAMES].join(\" and \")} are poisoned at project provision and cannot back a param.`);\n\treturn paramSource({\n\t\t[PRISMA_CLOUD_PARAM_SOURCE]: true,\n\t\tname\n\t});\n}\n/** True only for a payload that `envParam` built — i.e. one carrying the brand. */\nfunction isEnvParamPayload(payload) {\n\treturn typeof payload === \"object\" && payload !== null && blindCast(payload)[PRISMA_CLOUD_PARAM_SOURCE] === true;\n}\n/** True iff a resolved param value is an env-sourced pointer this target built (as opposed to a literal, or a foreign/raw `ParamSource`). */\nfunction isEnvParamSource(value) {\n\treturn isParamSource(value) && isEnvParamPayload(value.payload);\n}\n/**\n* Reads the Prisma Cloud env-var name back out of a param binding's opaque\n* source. A source not built by `envParam` (a raw `paramSource(...)` or\n* another target's source) carries no name — reject it here. `paramName` runs\n* in preflight and at serialize before any value ever crosses the wire, so a\n* foreign source fails early and clearly rather than producing a broken\n* deploy with an undefined name.\n*/\nfunction paramName(binding) {\n\tconst { binding: bound } = binding;\n\tif (!isEnvParamSource(bound)) throw new Error(`param slot \"${binding.slot}\" of service \"${binding.serviceAddress}\" is bound to a source not created by envParam() — bind env-sourced params with envParam('NAME') from @prisma/composer-prisma-cloud.`);\n\treturn bound.payload.name;\n}\n/**\n* Finds the manifest entry for one service param slot. `serialize` calls this\n* only after confirming `buildConfig` resolved the slot to a `ParamSource`\n* (`isParamSource(value)`), so a miss here means `graph.params` and the\n* resolved `Config` have drifted — a Load invariant violation, surfaced\n* loudly rather than producing a pointer row with an undefined name.\n*/\nfunction paramBindingFor(bindings, serviceAddress, slot) {\n\tconst binding = bindings.find((b) => b.serviceAddress === serviceAddress && b.slot === slot);\n\tif (binding === void 0) throw new Error(`param slot \"${slot}\" of \"${serviceAddress}\" resolved to a source but has no bound entry in the manifest — Load should have recorded it.`);\n\treturn binding;\n}\n//#endregion\n//#region src/provisioned-edges.ts\n/**\n* Every provisioned edge in the graph. Core resolves and mints these (one\n* value per edge, keyed by `edgeId`); this scan is how the target finds them\n* again when it gathers a provider's inbound values.\n*/\nfunction provisionedEdges(graph) {\n\tconst edges = [];\n\tfor (const edge of graph.edges) {\n\t\tif (edge.kind !== \"dependency\") continue;\n\t\tconst consumer = graph.nodes.find((n) => n.id === edge.to)?.node;\n\t\tif (consumer === void 0 || consumer.kind !== \"service\") continue;\n\t\tconst slot = consumer.inputs[edge.input];\n\t\tif (slot === void 0) continue;\n\t\tfor (const param of Object.values(slot.connection.params)) {\n\t\t\tconst brand = param.provision?.brand;\n\t\t\tif (brand === void 0) continue;\n\t\t\tedges.push({\n\t\t\t\tedgeId: `${edge.to}.${edge.input}`,\n\t\t\t\tconsumerAddress: edge.to,\n\t\t\t\tinput: edge.input,\n\t\t\t\tproviderAddress: edge.from,\n\t\t\t\tbrand\n\t\t\t});\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn edges;\n}\n//#endregion\nexport { paramName as a, STREAMS_API_KEY_ENV as c, paramBindingFor as i, streamsApiKeyNeed as l, envParam as n, RESERVED_PROVIDER_PARAMS as o, isEnvParamSource as r, STREAMS_API_KEY as s, provisionedEdges as t, SELF_ORIGIN as u };\n\n//# sourceMappingURL=provisioned-edges-B_XS1Mz-.mjs.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,MAAM,cAAc,OAAO,IAAI,oBAAoB;;;;;;;;AAQnD,MAAM,eAAe;CACpB,MAAM;CACN,QAAQ,KAAK,QAAQ;CACrB,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,0BAA0B;CAC/B,MAAM;CACN,QAAQ,KAAK,UAAU;CACvB,OAAO;AACR;;AAIA,MAAM,kBAAkB,OAAO,IAAI,wBAAwB;;;;;;;;AAQ3D,MAAM,0BAA0B,cAAc,eAAe;;;;;;;AAO7D,MAAM,wBAAwB;CAC7B,MAAM;CACN,QAAQ,KAAK,QAAQ;CACrB,OAAO;AACR;;AAEA,MAAM,sBAAsB,UAAU,IAAI;CACzC,OAAO;CACP,MAAM,sBAAsB;AAC7B,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAyBD,MAAM,2BAA2B;CAChC;CACA;CACA;AACD;;;;;;;AASA,MAAM,4BAA4B,UAAU,OAAO,IAAI,kCAAkC,CAAC;AAC1F,MAAM,wBAAwB;AAC9B,MAAM,uCAAuC,IAAI,IAAI,CAAC,gBAAgB,qBAAqB,CAAC;;;;;;;;;AAS5F,SAAS,SAAS,MAAM;CACvB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,qFAAqF;CACxJ,IAAI,KAAK,WAAW,qBAAqB,GAAG,MAAM,IAAI,MAAM,kBAAkB,KAAK,wBAAwB,sBAAsB,2EAA2E;CAC5M,IAAI,qBAAqB,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,kBAAkB,KAAK,kBAAkB,CAAC,GAAG,oBAAoB,CAAC,CAAC,KAAK,OAAO,EAAE,4DAA4D;CACjM,OAAO,YAAY;GACjB,4BAA4B;EAC7B;CACD,CAAC;AACF;;AAEA,SAAS,kBAAkB,SAAS;CACnC,OAAO,OAAO,YAAY,YAAY,YAAY,QAAQ,UAAU,OAAO,CAAC,CAAC,+BAA+B;AAC7G;;AAEA,SAAS,iBAAiB,OAAO;CAChC,OAAO,cAAc,KAAK,KAAK,kBAAkB,MAAM,OAAO;AAC/D;;;;;;;;;AASA,SAAS,UAAU,SAAS;CAC3B,MAAM,EAAE,SAAS,UAAU;CAC3B,IAAI,CAAC,iBAAiB,KAAK,GAAG,MAAM,IAAI,MAAM,eAAe,QAAQ,KAAK,gBAAgB,QAAQ,eAAe,qIAAqI;CACtP,OAAO,MAAM,QAAQ;AACtB;;;;;;;;AAQA,SAAS,gBAAgB,UAAU,gBAAgB,MAAM;CACxD,MAAM,UAAU,SAAS,MAAM,MAAM,EAAE,mBAAmB,kBAAkB,EAAE,SAAS,IAAI;CAC3F,IAAI,YAAY,KAAK,GAAG,MAAM,IAAI,MAAM,eAAe,KAAK,QAAQ,eAAe,8FAA8F;CACjL,OAAO;AACR;;;;;;AAQA,SAAS,iBAAiB,OAAO;CAChC,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,QAAQ,MAAM,OAAO;EAC/B,IAAI,KAAK,SAAS,cAAc;EAChC,MAAM,WAAW,MAAM,MAAM,MAAM,MAAM,EAAE,OAAO,KAAK,EAAE,CAAC,EAAE;EAC5D,IAAI,aAAa,KAAK,KAAK,SAAS,SAAS,WAAW;EACxD,MAAM,OAAO,SAAS,OAAO,KAAK;EAClC,IAAI,SAAS,KAAK,GAAG;EACrB,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,WAAW,MAAM,GAAG;GAC1D,MAAM,QAAQ,MAAM,WAAW;GAC/B,IAAI,UAAU,KAAK,GAAG;GACtB,MAAM,KAAK;IACV,QAAQ,GAAG,KAAK,GAAG,GAAG,KAAK;IAC3B,iBAAiB,KAAK;IACtB,OAAO,KAAK;IACZ,iBAAiB,KAAK;IACtB;GACD,CAAC;GACD;EACD;CACD;CACA,OAAO;AACR"}