@prisma/composer-prisma-cloud 0.1.0 → 0.2.0

package/dist/cron/scheduler-entrypoint.mjs

@@ -42,6 +42,15 @@ function blindCast(input) {
 * data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).
 */
 const NODE = Symbol.for("prisma:node");
+const PROVISION_NEED = blindCast(Symbol.for("prisma:provision-need"));
+/** Builds an opaque provisioning need — the declaring package's own brand plus whatever payload its provisioner reads back. */
+function provisionNeed(brand, payload) {
+	return blindCast(Object.freeze({
+		[PROVISION_NEED]: true,
+		brand,
+		payload
+	}));
+}
 function requireType(type, factory) {
 	if (typeof type !== "string" || type.length === 0) throw new Error(`${factory}() requires a non-empty node type.`);
 }
@@ -87,7 +96,7 @@ function service$1(def) {
 	requireNoUnderscoreNames(Object.keys(def.inputs), "input", "service");
 	requireNoUnderscoreNames(Object.keys(def.params), "param", "service");
 	requireNoUnderscoreNames(Object.keys(def.secrets ?? {}), "secret", "service");
-	for (const slot of Object.keys(def.secrets ?? {})) if (Object.hasOwn(def.params, slot)) throw new Error(`service() secret slot "${slot}" collides with a param of the same name — a secret slot and a service param derive the same config key (COMPOSE_<addr>_${slot.toUpperCase()}); rename one.`);
+	for (const slot of Object.keys(def.secrets ?? {})) if (Object.hasOwn(def.params, slot)) throw new Error(`service() secret slot "${slot}" collides with a param of the same name — a secret slot and a service param derive the same config key (COMPOSER_<addr>_${slot.toUpperCase()}); rename one.`);
 	return Object.freeze({
 		[NODE]: true,
 		kind: "service",
@@ -171,7 +180,8 @@ function withFacets(schema, opts) {
 	return {
 		schema,
 		...opts.optional !== void 0 ? { optional: opts.optional } : {},
-		...opts.default !== void 0 ? { default: opts.default } : {}
+		...opts.default !== void 0 ? { default: opts.default } : {},
+		...opts.provision !== void 0 ? { provision: opts.provision } : {}
 	};
 }
 /** A string-valued param. */
@@ -224,7 +234,8 @@ const nodeBuild = (opts) => ({
 	extension: "@prisma/composer/node",
 	type: "node",
 	module: opts.module,
-	entry: opts.entry
+	entry: opts.entry,
+	...opts.dir === void 0 ? {} : { dir: opts.dir }
 });
 /**
 * Walks a node's own params, then each dependency input's connection params —
@@ -254,7 +265,7 @@ const configKey = (address, d) => {
 	const segments = address.split(".").filter((s) => s.length > 0);
 	const owner = d.owner === "service" ? [] : [d.owner.input];
 	return [
-		"COMPOSE",
+		"COMPOSER",
 		...segments,
 		...owner,
 		d.name
@@ -273,12 +284,18 @@ function encode(owner, value) {
 function decode(owner, raw) {
 	return owner === "service" ? JSON.parse(raw) : raw;
 }
+const PARAM_POINTER_PREFIX = "@composer-param-pointer:";
+/** True iff `raw` is a param pointer row (as opposed to a JSON-encoded literal). */
+const isParamPointerRow = (raw) => raw.startsWith(PARAM_POINTER_PREFIX);
+/** Reverses `encodeParamPointer`: the platform var NAME a pointer row points to. */
+const decodeParamPointer = (raw) => raw.slice(24);
 function coerce(raw, d, key) {
 	if (!(raw !== void 0 && raw !== "")) {
 		if (d.param.default !== void 0) return d.param.default;
 		if (d.param.optional === true) return void 0;
 		throw new Error(`missing required config param "${d.name}" (env ${key})`);
 	}
+	if (d.owner === "service" && isParamPointerRow(raw)) return coerceEnvSourcedParam(raw, d, key);
 	try {
 		return standardValidateSync(d.param.schema, decode(d.owner, raw));
 	} catch (cause) {
@@ -287,6 +304,26 @@ function coerce(raw, d, key) {
 	}
 }
 /**
+* Boot resolution for an env-sourced param: double-lookup (pointer → platform
+* var), then the param's own schema on the raw string — no JSON decode, and
+* no redaction (it's config, not a secret). An UNSET platform var is a loud
+* boot failure naming both the param and the platform var; an EMPTY string is
+* not special-cased here — it reaches the schema like any other value, so it
+* passes iff the schema accepts it (deliberately unlike a literal param's own
+* ""-means-absent rule, and unlike a secret's non-empty requirement).
+*/
+function coerceEnvSourcedParam(raw, d, key) {
+	const platformVar = decodeParamPointer(raw);
+	const value = process.env[platformVar];
+	if (value === void 0) throw new Error(`env-sourced config param "${d.name}" (env ${key} → ${platformVar}) is unset: the platform variable "${platformVar}" was not injected — the deploy did not provision it.`);
+	try {
+		return standardValidateSync(d.param.schema, value);
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`invalid value for env-sourced config param "${d.name}" (env ${key} → ${platformVar}): ${message}`);
+	}
+}
+/**
 * Boot: read each declared param from env by its key, reverse the param's own
 * serialization (missing/invalid fails loudly), assemble the typed Config.
 * Secrets ride a separate channel (deserializeSecrets), not this one.
@@ -326,7 +363,7 @@ const stash = (node, config) => {
 		process.env[configKey("", d)] = encode(d.owner, value);
 	}
 };
-/** The pointer-row key for a secret slot: COMPOSE_<addr>_<slot> (secrets are service-level). */
+/** The pointer-row key for a secret slot: COMPOSER_<addr>_<slot> (secrets are service-level). */
 const secretKey = (address, slot) => configKey(address, {
 	owner: "service",
 	name: slot
@@ -361,6 +398,32 @@ const stashSecrets = (node, address) => {
 		process.env[secretKey("", slot)] = name;
 	}
 };
+/**
+* Boot: for each reserved provider param, read its address-scoped row through
+* the same `coerce` a declared param uses (JSON-decode, schema-validate), and
+* re-emit it address-free — `stash`'s counterpart for this separate
+* declaration space. A param is declared optional here unconditionally: an
+* absent row means "never provisioned" (local dev, tests, a provider with no
+* registered value for this deploy), never a boot failure, so nothing is
+* stashed and the runtime reader that owns this slot falls back to its own
+* pass-through behavior.
+*/
+function stashProviderParams(entries, address) {
+	for (const entry of entries) {
+		const d = {
+			owner: "service",
+			name: entry.name,
+			param: {
+				schema: entry.schema,
+				optional: true
+			}
+		};
+		const key = configKey(address, d);
+		const value = coerce(process.env[key], d, key);
+		if (value === void 0) continue;
+		process.env[configKey("", d)] = encode("service", value);
+	}
+}
 /** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */
 function standardValidateSync(schema, value) {
 	const result = schema["~standard"].validate(value);
@@ -368,101 +431,20 @@ function standardValidateSync(schema, value) {
 	if (result.issues !== void 0) throw new Error(`config param validation failed: ${result.issues.map((issue) => issue.message).join("; ")}`);
 	return result.value;
 }
-const reservedParams = { port: number$1({ default: 3e3 }) };
-/**
-* A Prisma Compute service — declarations only (deps + params + build + the
-* ports it exposes), no descriptor. `params` merges with the reserved
-* `ReservedParams` (`port`); a user param whose name collides with a reserved
-* one fails at authoring, the same way a colliding dependency name does.
-* Returns the extension's runnable/loadable node:
-*   · run(address, boot) — the process controller: deserialize the platform
-*     environment (keyed off `address`, the extension's ONE env read) into a
-*     typed Config, re-emit it under address-free process-local stash keys,
-*     then call boot() to start the app's entry.
-*   · load() / config() — called from inside the app's entry: read the stash;
-*     load() hydrates + memoizes the deps, config() returns the typed params.
-*     Separate accessors so a dep and a param never share a namespace (ADR-0021).
-*
-* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
-* the control-plane registry key `prisma-composer deploy` resolves through the
-* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
-* deploy time; nodes are pure data.
-*/
-const compute = (def) => {
-	const userParams = def.params ?? blindCast({});
-	for (const reserved of Object.keys(reservedParams)) {
-		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
-		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
-	}
-	const params = blindCast({
-		...userParams,
-		...reservedParams
-	});
-	const node = service$1({
-		name: def.name,
-		extension: "@prisma/composer-prisma-cloud",
-		type: "compute",
-		inputs: def.deps,
-		params,
-		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
-		build: def.build,
-		...def.expose !== void 0 ? { expose: def.expose } : {}
-	});
-	let resolved;
-	let loadedDeps;
-	let loadedParams;
-	let loadedSecrets;
-	function processConfig() {
-		if (resolved === void 0) resolved = deserialize(node, "");
-		return resolved;
-	}
-	const runnable = {
-		...node,
-		async run(address, boot) {
-			const config = deserialize(node, address);
-			stash(node, config);
-			stashSecrets(node, address);
-			const port = config.service["port"];
-			if (typeof port === "number") process.env["PORT"] = String(port);
-			return boot();
-		},
-		load() {
-			if (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));
-			return loadedDeps;
-		},
-		config() {
-			if (loadedParams === void 0) loadedParams = blindCast(processConfig().service);
-			return loadedParams;
-		},
-		secrets() {
-			if (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, "")));
-			return loadedSecrets;
-		}
-	};
-	return Object.freeze(blindCast(runnable));
-};
-Object.freeze({
-	kind: "postgres",
-	__cmp: { url: "" },
-	satisfies: (required) => required.kind === "postgres"
-});
-Object.freeze({
-	kind: "credentials",
-	__cmp: {
-		accessKeyId: "",
-		secretAccessKey: ""
-	},
-	satisfies: (required) => required.kind === "credentials"
-});
-async function standardValidate(schema, value) {
-	const result = await schema["~standard"].validate(value);
-	if (result.issues !== void 0) throw new Error(`Schema validation failed: ${result.issues.map((issue) => issue.message).join("; ")}`);
-	return result.value;
+/** Bounded jittered backoff for retrying a dropped call. `maxRetries` is retries after the first attempt. */
+const RETRY = {
+	initialDelayMs: 250,
+	multiplier: 2,
+	maxDelayMs: 5e3,
+	maxRetries: 5
+};
+const IDEMPOTENCY_KEY_HEADER$1 = "Idempotency-Key";
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
 }
-/** `<base>/rpc/<method>`, preserving a base URL's own path (e.g. a mount point). */
-function methodUrl(base, method) {
-	const normalizedBase = base.endsWith("/") ? base : `${base}/`;
-	return new URL(`rpc/${method}`, normalizedBase).toString();
+/** Whether a non-OK response is safe to retry: 429 or any 5xx, never another 4xx. */
+function isRetryableStatus(status) {
+	return status === 429 || status >= 500;
 }
 /** The server's `{ error }` body, if the response has one — undefined otherwise. */
 async function errorDetail(res) {
@@ -473,20 +455,56 @@ async function errorDetail(res) {
 		return;
 	}
 }
+/** `<base>/rpc/<method>`, preserving a base URL's own path (e.g. a mount point). */
+function methodUrl(base, method) {
+	const normalizedBase = base.endsWith("/") ? base : `${base}/`;
+	return new URL(`rpc/${method}`, normalizedBase).toString();
+}
+/**
+* Sends one call over `send`, retrying a thrown error, 429, or 5xx with
+* full-jitter backoff. `buildRequest` runs per attempt but carries the same
+* idempotency key each time — only the transport call repeats, not the key.
+*/
+async function callWithRetry(send, buildRequest, method) {
+	let delay = RETRY.initialDelayMs;
+	let retries = 0;
+	for (;;) {
+		let res;
+		try {
+			res = await send(buildRequest());
+		} catch (err) {
+			if (retries >= RETRY.maxRetries) throw err;
+			retries += 1;
+			await sleep(Math.random() * delay);
+			delay = Math.min(delay * RETRY.multiplier, RETRY.maxDelayMs);
+			continue;
+		}
+		if (res.ok) return res.json();
+		if (!isRetryableStatus(res.status) || retries >= RETRY.maxRetries) {
+			const detail = await errorDetail(res);
+			throw new Error(`RPC call "${method}" failed: ${res.status} ${res.statusText}` + (detail !== void 0 ? ` — ${detail}` : ""));
+		}
+		retries += 1;
+		await sleep(Math.random() * delay);
+		delay = Math.min(delay * RETRY.multiplier, RETRY.maxDelayMs);
+	}
+}
 function makeClient(contract, url, opts) {
 	const send = opts?.fetch ?? fetch;
+	const baseHeaders = { "content-type": "application/json" };
+	if (opts?.serviceKey !== void 0) baseHeaders["Authorization"] = `Bearer ${opts.serviceKey}`;
 	const client = {};
-	for (const [method, schemas] of Object.entries(blindCast(contract.__cmp))) client[method] = async (input) => {
-		const res = await send(new Request(methodUrl(url, method), {
+	for (const method of Object.keys(contract.__cmp)) client[method] = async (input) => {
+		const idempotencyKey = crypto.randomUUID();
+		const body = JSON.stringify(input);
+		return callWithRetry(send, () => new Request(methodUrl(url, method), {
 			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify(input)
-		}));
-		if (!res.ok) {
-			const detail = await errorDetail(res);
-			throw new Error(`RPC call "${method}" failed: ${res.status} ${res.statusText}` + (detail !== void 0 ? ` — ${detail}` : ""));
-		}
-		return standardValidate(schemas.output, await res.json());
+			headers: {
+				...baseHeaders,
+				[IDEMPOTENCY_KEY_HEADER$1]: idempotencyKey
+			},
+			body
+		}), method);
 	};
 	return blindCast(client);
 }
@@ -498,13 +516,23 @@ function contract(fns) {
 	};
 	return Object.freeze(value);
 }
+/** ADR-0031's need brand for RPC's per-binding service key — the target registers a provisioner under this. */
+const RPC_PEER_KEY = Symbol.for("prisma:rpc/per-binding-key");
+/** The provisioning need `rpc()`'s `serviceKey` param declares (ADR-0030): a shared, unguessable value the target mints per consumer edge. */
+const perBindingToken = () => provisionNeed(RPC_PEER_KEY);
 function rpc(arg) {
 	if (!isRpcContract(arg)) return arg;
 	return dependency({
 		type: "rpc",
 		connection: {
-			params: { url: string$1() },
-			hydrate: ({ url }) => makeClient(arg, url)
+			params: {
+				url: string$1(),
+				serviceKey: string$1({
+					optional: true,
+					provision: perBindingToken()
+				})
+			},
+			hydrate: ({ url, serviceKey }) => makeClient(arg, url, { serviceKey })
 		},
 		required: arg
 	});
@@ -7631,6 +7659,148 @@ ark.schema;
 ark.define;
 ark.declare;
 /**
+* RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —
+* name + schema + brand — for the accepted-keys set a provider stores, shared
+* by `control.ts` (which registers the deploy-side `value(refs)` that mints
+* and aggregates it — see its `rpcAcceptedKeysValue`) and `compute.ts` (which
+* validates and stashes it at boot), so writer and reader cannot drift.
+* Finding the edges themselves is `provisioned-edges.ts`'s generic,
+* brand-blind scan — RPC is not special-cased anywhere in this target.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side `value(refs)` lives in control.ts, the
+* control-plane-only entry).
+*/
+/**
+* The reserved provider param for RPC's accepted-keys set: the var name is
+* `RPC_ACCEPTED_KEYS`, derived through `configKey` at both ends
+* (`configKey(address, …)` at deploy, `configKey('', …)` at boot — the
+* address-free form is `@internal/service-rpc`'s `RPC_ACCEPTED_KEYS_ENV`). `brand` is
+* `RPC_PEER_KEY`, the same brand `perBindingToken()`'s need carries — control.ts
+* looks its `value(refs)` up by this field.
+*/
+const RPC_ACCEPTED_KEYS_PARAM = {
+	name: "RPC_ACCEPTED_KEYS",
+	schema: type("string[]"),
+	brand: RPC_PEER_KEY
+};
+/** ADR-0031's need brand for the streams module's bearer key — control.ts registers the provisioner under this. */
+const STREAMS_API_KEY = Symbol.for("prisma:streams/api-key");
+/**
+* The reserved provider param for the streams bearer key: the var name is
+* `STREAMS_API_KEY`. `brand` is `STREAMS_API_KEY` itself (the same symbol
+* `streamsApiKeyNeed()`'s need carries) — control.ts looks its `value(refs)`
+* up by this field.
+*/
+const STREAMS_API_KEY_PARAM = {
+	name: "STREAMS_API_KEY",
+	schema: type("string"),
+	brand: STREAMS_API_KEY
+};
+configKey("", {
+	owner: "service",
+	name: STREAMS_API_KEY_PARAM.name
+});
+const RESERVED_PROVIDER_PARAMS = [RPC_ACCEPTED_KEYS_PARAM, STREAMS_API_KEY_PARAM];
+Object.freeze({
+	kind: "s3",
+	__cmp: {
+		url: "",
+		bucket: "",
+		accessKeyId: "",
+		secretAccessKey: ""
+	},
+	satisfies: (required) => required.kind === "s3"
+});
+const reservedParams = { port: number$1({ default: 3e3 }) };
+/**
+* A Prisma Compute service — declarations only (deps + params + build + the
+* ports it exposes), no descriptor. `params` merges with the reserved
+* `ReservedParams` (`port`); a user param whose name collides with a reserved
+* one fails at authoring, the same way a colliding dependency name does.
+* Returns the extension's runnable/loadable node:
+*   · run(address, boot) — the process controller: deserialize the platform
+*     environment (keyed off `address`, the extension's ONE env read) into a
+*     typed Config, re-emit it under address-free process-local stash keys,
+*     then call boot() to start the app's entry.
+*   · load() / config() — called from inside the app's entry: read the stash;
+*     load() hydrates + memoizes the deps, config() returns the typed params.
+*     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+*
+* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
+* the control-plane registry key `prisma-composer deploy` resolves through the
+* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
+* deploy time; nodes are pure data.
+*/
+const compute = (def) => {
+	const userParams = def.params ?? blindCast({});
+	for (const reserved of Object.keys(reservedParams)) {
+		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
+		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
+	}
+	const params = blindCast({
+		...userParams,
+		...reservedParams
+	});
+	const node = service$1({
+		name: def.name,
+		extension: "@prisma/composer-prisma-cloud",
+		type: "compute",
+		inputs: def.deps,
+		params,
+		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
+		build: def.build,
+		...def.expose !== void 0 ? { expose: def.expose } : {}
+	});
+	let resolved;
+	let loadedDeps;
+	let loadedParams;
+	let loadedSecrets;
+	function processConfig() {
+		if (resolved === void 0) resolved = deserialize(node, "");
+		return resolved;
+	}
+	const runnable = {
+		...node,
+		async run(address, boot) {
+			const config = deserialize(node, address);
+			stash(node, config);
+			stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
+			stashSecrets(node, address);
+			const port = config.service["port"];
+			if (typeof port === "number") process.env["PORT"] = String(port);
+			return boot();
+		},
+		load() {
+			if (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));
+			return loadedDeps;
+		},
+		config() {
+			if (loadedParams === void 0) loadedParams = blindCast(processConfig().service);
+			return loadedParams;
+		},
+		secrets() {
+			if (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, "")));
+			return loadedSecrets;
+		}
+	};
+	return Object.freeze(blindCast(runnable));
+};
+Object.freeze({
+	kind: "postgres",
+	__cmp: { url: "" },
+	satisfies: (required) => required.kind === "postgres"
+});
+Object.freeze({
+	kind: "credentials",
+	__cmp: {
+		accessKeyId: "",
+		secretAccessKey: ""
+	},
+	satisfies: (required) => required.kind === "credentials"
+});
+/**
 * The one call edge between the scheduler and the app's runner: `trigger(jobId)`.
 * The scheduler depends on it (`rpc(triggerContract)`); the runner exposes it
 * (`expose: { trigger: triggerContract }`). `jobId` travels as data through this