@prisma/composer-prisma-cloud 0.1.0

package/dist/storage/storage-entrypoint.mjs

@@ -0,0 +1,1138 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { SQL } from "bun";
+//#region ../../1-prisma-cloud/2-shared-modules/storage/dist/storage-entrypoint.mjs
+/** Connection resilience helpers for Prisma Postgres cold-starts (FT-5226); no heavy imports (no `effect`/`alchemy`/`pg`), so the deploy lowerings, the pnPostgres runtime client, and bun-runnable services (the storage store, via the pure `@internal/prisma-cloud/connection` subpath) all share one implementation. */
+/** Network-level socket failures node-postgres surfaces as `err.code`. */
+const TRANSIENT_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ETIMEDOUT",
+	"EPIPE",
+	"ENOTFOUND",
+	"EAI_AGAIN"
+]);
+/** Connection-establishment failure messages (no useful `err.code`). */
+const TRANSIENT_MESSAGE_FRAGMENTS = [
+	"upstream database",
+	"connection terminated",
+	"connection refused",
+	"terminating connection",
+	"server closed the connection",
+	"connection timeout",
+	"timeout expired"
+];
+/** Whether an error is a transient connection failure worth retrying, as opposed to a real query error that must surface at once. */
+function isTransientConnectionError(error) {
+	if (typeof error !== "object" || error === null) return false;
+	const code = "code" in error && typeof error.code === "string" ? error.code : void 0;
+	if (code !== void 0 && TRANSIENT_CODES.has(code)) return true;
+	const message = "message" in error && typeof error.message === "string" ? error.message.toLowerCase() : "";
+	return TRANSIENT_MESSAGE_FRAGMENTS.some((fragment) => message.includes(fragment));
+}
+/**
+* Retries an operation past a transient connection failure, bounded (default
+* ~1 min). `shouldRetry` decides what's transient — defaults to retrying
+* everything; the runtime client passes {@link isTransientConnectionError}.
+*/
+async function withConnectionRetry(operation, opts = {}) {
+	const attempts = opts.attempts ?? 12;
+	const delayMs = opts.delayMs ?? 5e3;
+	const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const shouldRetry = opts.shouldRetry ?? (() => true);
+	let lastError;
+	for (let attempt = 1; attempt <= attempts; attempt++) try {
+		return await operation();
+	} catch (error) {
+		if (!shouldRetry(error)) throw error;
+		lastError = error;
+		if (attempt < attempts) await sleep(delayMs);
+	}
+	throw lastError;
+}
+/** Retries acquiring a connection past a transient cold-start; {@link withConnectionRetry} with {@link isTransientConnectionError} fixed as the predicate. */
+function retryTransientConnect(acquire, opts = {}) {
+	return withConnectionRetry(acquire, {
+		...opts,
+		shouldRetry: isTransientConnectionError
+	});
+}
+/**
+* The `ObjectStore` over Postgres `bytea` (spec § 3): one `objects` table,
+* single-row-per-object. Ranged reads use SQL `substring` so a range request
+* never detoasts the whole object. The schema is applied idempotently at init
+* behind a bounded connection retry — the first connect to a freshly
+* provisioned Postgres is rejected while the upstream is cold (FT-5226).
+*
+* Runtime engine code (`bun` SQL + `node:crypto`); NOT re-exported from the
+* authoring barrel.
+*/
+const DEFAULT_MAX_KEYS$1 = 1e3;
+function etagOf(bytes) {
+	return `"${createHash("sha256").update(bytes).digest("hex")}"`;
+}
+/** bytea comes back as a Node Buffer (a Uint8Array). Fail closed on anything else rather than returning wrong bytes. */
+function toBytes(value) {
+	if (value instanceof Uint8Array) return value;
+	throw new TypeError(`expected bytea to decode as Uint8Array, got ${typeof value}`);
+}
+/** One row → GetResult (both the whole-object and ranged queries alias the payload as `bytes`; `size` is the bigint total). */
+function toGetResult(row) {
+	return {
+		bytes: toBytes(row.bytes),
+		etag: row.etag,
+		contentType: row.content_type,
+		size: Number(row.size)
+	};
+}
+var PgObjectStore = class {
+	sql;
+	constructor(sql) {
+		this.sql = sql;
+	}
+	async put(bucket, key, bytes, opts = {}) {
+		const etag = etagOf(bytes);
+		const contentType = opts.contentType ?? "application/octet-stream";
+		await this.sql`
+      insert into objects (bucket, key, bytes, size, etag, content_type)
+      values (${bucket}, ${key}, ${bytes}, ${bytes.byteLength}, ${etag}, ${contentType})
+      on conflict (bucket, key) do update set
+        bytes = excluded.bytes, size = excluded.size,
+        etag = excluded.etag, content_type = excluded.content_type`;
+		return { etag };
+	}
+	async get(bucket, key, opts = {}) {
+		const range = opts.range;
+		if (range) {
+			const from = range.start + 1;
+			const row = (range.end === void 0 ? await this.sql`select substring(bytes from ${from}) as bytes, size, etag, content_type
+                           from objects where bucket = ${bucket} and key = ${key}` : await this.sql`select substring(bytes from ${from} for ${range.end - range.start + 1}) as bytes,
+                           size, etag, content_type
+                           from objects where bucket = ${bucket} and key = ${key}`)[0];
+			return row === void 0 ? null : toGetResult(row);
+		}
+		const row = (await this.sql`select bytes, size, etag, content_type
+                                from objects where bucket = ${bucket} and key = ${key}`)[0];
+		return row === void 0 ? null : toGetResult(row);
+	}
+	async head(bucket, key) {
+		const row = (await this.sql`select size, etag, content_type
+                                from objects where bucket = ${bucket} and key = ${key}`)[0];
+		if (row === void 0) return null;
+		return {
+			etag: row.etag,
+			size: Number(row.size),
+			contentType: row.content_type
+		};
+	}
+	async delete(bucket, key) {
+		await this.sql`delete from objects where bucket = ${bucket} and key = ${key}`;
+	}
+	async list(bucket, opts = {}) {
+		const prefix = opts.prefix ?? "";
+		const maxKeys = opts.maxKeys ?? DEFAULT_MAX_KEYS$1;
+		const token = opts.continuationToken;
+		const limit = maxKeys + 1;
+		const keys = (token === void 0 ? await this.sql`select key from objects
+                         where bucket = ${bucket} and starts_with(key, ${prefix})
+                         order by key limit ${limit}` : await this.sql`select key from objects
+                         where bucket = ${bucket} and starts_with(key, ${prefix}) and key > ${token}
+                         order by key limit ${limit}`).map((r) => r.key);
+		const isTruncated = keys.length > maxKeys;
+		const page = isTruncated ? keys.slice(0, maxKeys) : keys;
+		const last = page.at(-1);
+		return {
+			keys: page,
+			isTruncated,
+			...isTruncated && last !== void 0 ? { nextContinuationToken: last } : {}
+		};
+	}
+};
+/**
+* Connect (FT-5219 posture: `max: 1`, short `idleTimeout`), apply the schema
+* idempotently behind the cold-start retry, and return the store.
+*/
+async function createPgStore(url) {
+	const sql = new SQL({
+		url,
+		max: 1,
+		idleTimeout: 10
+	});
+	await retryTransientConnect(() => sql`
+      create table if not exists objects (
+        bucket text not null,
+        key text not null,
+        bytes bytea not null,
+        size bigint not null,
+        etag text not null,
+        content_type text not null,
+        created_at timestamptz not null default now(),
+        primary key (bucket, key)
+      )`);
+	return new PgObjectStore(sql);
+}
+/**
+* AWS SigV4 verification for the S3 wire protocol (spec § 2 auth). The payload
+* hash comes from the client — `x-amz-content-sha256` (a real hash or
+* `UNSIGNED-PAYLOAD`) for header auth, `UNSIGNED-PAYLOAD` for presign — and is
+* never re-hashed; the verifier trusts what was signed, like a real S3 endpoint.
+* Runtime engine code (`node:crypto`); not re-exported from the authoring barrel.
+*/
+const ALGORITHM = "AWS4-HMAC-SHA256";
+const UNSIGNED_PAYLOAD = "UNSIGNED-PAYLOAD";
+function sha256Hex(data) {
+	return createHash("sha256").update(data).digest("hex");
+}
+function hmac(key, data) {
+	return createHmac("sha256", key).update(data).digest();
+}
+/** AWS canonical URI encoding: every byte except the unreserved set is %XX. */
+function awsUriEncode(value) {
+	return encodeURIComponent(value).replace(/[!'()*]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%7E/g, "~");
+}
+function parseCredential(credential) {
+	const parts = credential.split("/");
+	if (parts.length !== 5 || parts[4] !== "aws4_request") return null;
+	const [accessKeyId, date, region, service] = parts;
+	if (!accessKeyId || !date || !region || !service) return null;
+	return {
+		accessKeyId,
+		date,
+		region,
+		service
+	};
+}
+function signingKey(secret, scope) {
+	return hmac(hmac(hmac(hmac(`AWS4${secret}`, scope.date), scope.region), scope.service), "aws4_request");
+}
+function canonicalHeaders(url, req, signedHeaders) {
+	return signedHeaders.map((name) => {
+		return `${name}:${(name === "host" ? url.host : req.headers.get(name) ?? "").trim().replace(/\s+/g, " ")}\n`;
+	}).join("");
+}
+function canonicalQuery(url, exclude) {
+	const entries = [];
+	for (const [key, value] of url.searchParams.entries()) {
+		if (exclude !== void 0 && key === exclude) continue;
+		entries.push([awsUriEncode(key), awsUriEncode(value)]);
+	}
+	const cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+	entries.sort(([ak, av], [bk, bv]) => cmp(ak, bk) || cmp(av, bv));
+	return entries.map(([k, v]) => `${k}=${v}`).join("&");
+}
+function stringToSign(amzDate, scope, canonicalRequest) {
+	const scopeString = `${scope.date}/${scope.region}/${scope.service}/aws4_request`;
+	return [
+		ALGORITHM,
+		amzDate,
+		scopeString,
+		sha256Hex(canonicalRequest)
+	].join("\n");
+}
+function signatureMatches(expected, provided) {
+	const a = Buffer.from(expected, "hex");
+	const b = Buffer.from(provided, "hex");
+	return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
+}
+/** `YYYYMMDDTHHMMSSZ` → epoch ms, or null when malformed. */
+function parseAmzDate(amzDate) {
+	const match = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(amzDate);
+	if (!match) return null;
+	const [, y, mo, d, h, mi, s] = match;
+	return Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s));
+}
+function parseAuthorizationHeader(header) {
+	if (!header.startsWith(`${ALGORITHM} `)) return null;
+	const rest = header.slice(17);
+	const fields = /* @__PURE__ */ new Map();
+	for (const part of rest.split(",")) {
+		const eq = part.indexOf("=");
+		if (eq === -1) continue;
+		fields.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+	}
+	const credential = fields.get("Credential");
+	const signedHeaders = fields.get("SignedHeaders");
+	const signature = fields.get("Signature");
+	if (!credential || !signedHeaders || !signature) return null;
+	return {
+		credential,
+		signedHeaders: signedHeaders.split(";"),
+		signature
+	};
+}
+/** The one signing core both auth forms share: check the access key, rebuild the canonical request, derive the key, compare in constant time. */
+function verifySignature(req, url, credentials, params) {
+	if (params.scope.accessKeyId !== credentials.accessKeyId) return {
+		ok: false,
+		reason: "unknown access key"
+	};
+	const canonicalRequest = [
+		req.method,
+		url.pathname,
+		canonicalQuery(url, params.excludeQuery),
+		canonicalHeaders(url, req, params.signedHeaders),
+		params.signedHeaders.join(";"),
+		params.payloadHash
+	].join("\n");
+	return signatureMatches(hmac(signingKey(credentials.secretAccessKey, params.scope), stringToSign(params.amzDate, params.scope, canonicalRequest)).toString("hex"), params.signature) ? { ok: true } : {
+		ok: false,
+		reason: "signature mismatch"
+	};
+}
+function verifyHeader(req, url, credentials) {
+	const auth = parseAuthorizationHeader(req.headers.get("authorization") ?? "");
+	if (!auth) return {
+		ok: false,
+		reason: "malformed Authorization header"
+	};
+	const scope = parseCredential(auth.credential);
+	if (!scope) return {
+		ok: false,
+		reason: "malformed credential scope"
+	};
+	const amzDate = req.headers.get("x-amz-date");
+	if (!amzDate) return {
+		ok: false,
+		reason: "missing x-amz-date"
+	};
+	const payloadHash = req.headers.get("x-amz-content-sha256");
+	if (!payloadHash) return {
+		ok: false,
+		reason: "missing x-amz-content-sha256"
+	};
+	return verifySignature(req, url, credentials, {
+		scope,
+		amzDate,
+		signedHeaders: auth.signedHeaders,
+		payloadHash,
+		signature: auth.signature
+	});
+}
+function verifyPresigned(req, url, credentials, now) {
+	const q = url.searchParams;
+	if (q.get("X-Amz-Algorithm") !== ALGORITHM) return {
+		ok: false,
+		reason: "unsupported presign algorithm"
+	};
+	const credentialRaw = q.get("X-Amz-Credential");
+	const amzDate = q.get("X-Amz-Date");
+	const expiresRaw = q.get("X-Amz-Expires");
+	const signedHeadersRaw = q.get("X-Amz-SignedHeaders");
+	const signature = q.get("X-Amz-Signature");
+	if (!credentialRaw || !amzDate || !expiresRaw || !signedHeadersRaw || !signature) return {
+		ok: false,
+		reason: "incomplete presign parameters"
+	};
+	const scope = parseCredential(credentialRaw);
+	if (!scope) return {
+		ok: false,
+		reason: "malformed credential scope"
+	};
+	const signedAt = parseAmzDate(amzDate);
+	const expires = Number(expiresRaw);
+	if (signedAt === null || !Number.isFinite(expires)) return {
+		ok: false,
+		reason: "malformed presign date"
+	};
+	if (now.getTime() > signedAt + expires * 1e3) return {
+		ok: false,
+		reason: "presign expired"
+	};
+	return verifySignature(req, url, credentials, {
+		scope,
+		amzDate,
+		signedHeaders: signedHeadersRaw.split(";"),
+		payloadHash: UNSIGNED_PAYLOAD,
+		signature,
+		excludeQuery: "X-Amz-Signature"
+	});
+}
+/**
+* Verify a request's SigV4 signature against a single credential pair. Picks
+* the presigned form when `X-Amz-Signature` is present, otherwise the
+* `Authorization`-header form. `now` is injectable for deterministic
+* expiry tests.
+*/
+function verifyRequest(req, credentials, now = /* @__PURE__ */ new Date()) {
+	const url = new URL(req.url);
+	if (url.searchParams.has("X-Amz-Signature")) return verifyPresigned(req, url, credentials, now);
+	if (req.headers.has("authorization")) return verifyHeader(req, url, credentials);
+	return {
+		ok: false,
+		reason: "unsigned request"
+	};
+}
+const DEFAULT_CONTENT_TYPE = "application/octet-stream";
+/** Path-style: `/{bucket}/{key…}`. Each segment is percent-decoded. */
+function parseTarget(url) {
+	const segments = url.pathname.split("/").filter((s) => s.length > 0);
+	if (segments.length === 0) return null;
+	const [bucket, ...keyParts] = segments;
+	return {
+		bucket: decodeURIComponent(bucket ?? ""),
+		key: keyParts.map(decodeURIComponent).join("/")
+	};
+}
+/** `bytes=a-b` (inclusive) or `bytes=a-` (open-ended). Null when absent/malformed. */
+function parseRange(header) {
+	if (!header) return null;
+	const match = /^bytes=(\d+)-(\d*)$/.exec(header.trim());
+	if (!match) return null;
+	const start = Number(match[1]);
+	return match[2] ? {
+		start,
+		end: Number(match[2])
+	} : { start };
+}
+function xmlEscape(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function listXml(bucket, prefix, maxKeys, result) {
+	const contents = result.keys.map((k) => `<Contents><Key>${xmlEscape(k)}</Key></Contents>`).join("");
+	const next = result.isTruncated && result.nextContinuationToken !== void 0 ? `<NextContinuationToken>${xmlEscape(result.nextContinuationToken)}</NextContinuationToken>` : "";
+	return `<?xml version="1.0" encoding="UTF-8"?><ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Name>${xmlEscape(bucket)}</Name><Prefix>${xmlEscape(prefix)}</Prefix><KeyCount>${result.keys.length}</KeyCount><MaxKeys>${maxKeys}</MaxKeys><IsTruncated>${result.isTruncated}</IsTruncated>` + contents + next + "</ListBucketResult>";
+}
+const DEFAULT_MAX_KEYS = 1e3;
+async function handleList(store, bucket, url) {
+	const prefix = url.searchParams.get("prefix") ?? "";
+	const continuationToken = url.searchParams.get("continuation-token");
+	const maxKeysRaw = url.searchParams.get("max-keys");
+	const maxKeys = maxKeysRaw !== null && Number.isFinite(Number(maxKeysRaw)) ? Number(maxKeysRaw) : DEFAULT_MAX_KEYS;
+	const result = await store.list(bucket, {
+		prefix,
+		maxKeys,
+		...continuationToken !== null ? { continuationToken } : {}
+	});
+	return new Response(listXml(bucket, prefix, maxKeys, result), {
+		status: 200,
+		headers: { "content-type": "application/xml" }
+	});
+}
+/** aws-chunked / flexible-checksum PUTs frame the body as chunks + a trailer (signalled by `x-amz-content-sha256: STREAMING-…` or `content-encoding: aws-chunked`); the seed signature still verifies, so reject them (501) rather than store the raw framing as the object bytes. Decoding is out of scope. */
+function isStreamingPut(req) {
+	const contentSha = req.headers.get("x-amz-content-sha256") ?? "";
+	const contentEncoding = req.headers.get("content-encoding") ?? "";
+	return contentSha.startsWith("STREAMING-") || contentEncoding.split(",").some((e) => e.trim() === "aws-chunked");
+}
+async function handlePut(store, t, req) {
+	if (isStreamingPut(req)) return new Response("aws-chunked / flexible checksums not supported; set requestChecksumCalculation: 'WHEN_REQUIRED'", { status: 501 });
+	const body = new Uint8Array(await req.arrayBuffer());
+	const contentType = req.headers.get("content-type") ?? DEFAULT_CONTENT_TYPE;
+	const { etag } = await store.put(t.bucket, t.key, body, { contentType });
+	return new Response(null, {
+		status: 200,
+		headers: { etag }
+	});
+}
+/** The etag/content-type/content-length/accept-ranges headers GET and HEAD share — `contentLength` is the slice length for GET, the total object size for HEAD. */
+function metaHeaders(meta) {
+	return new Headers({
+		etag: meta.etag,
+		"content-type": meta.contentType,
+		"content-length": String(meta.contentLength),
+		"accept-ranges": "bytes"
+	});
+}
+async function handleGet(store, t, req) {
+	const range = parseRange(req.headers.get("range"));
+	const object = await store.get(t.bucket, t.key, range ? { range } : void 0);
+	if (!object) return new Response(null, { status: 404 });
+	const headers = metaHeaders({
+		etag: object.etag,
+		contentType: object.contentType,
+		contentLength: object.bytes.byteLength
+	});
+	if (!range) return new Response(object.bytes, {
+		status: 200,
+		headers
+	});
+	if (range.start >= object.size && object.size > 0) return new Response(null, {
+		status: 416,
+		headers: { "content-range": `bytes */${object.size}` }
+	});
+	const end = range.end === void 0 ? object.size - 1 : Math.min(range.end, object.size - 1);
+	headers.set("content-range", `bytes ${range.start}-${end}/${object.size}`);
+	return new Response(object.bytes, {
+		status: 206,
+		headers
+	});
+}
+async function handleHead(store, t) {
+	const meta = await store.head(t.bucket, t.key);
+	if (!meta) return new Response(null, { status: 404 });
+	return new Response(null, {
+		status: 200,
+		headers: metaHeaders({
+			etag: meta.etag,
+			contentType: meta.contentType,
+			contentLength: meta.size
+		})
+	});
+}
+async function handleDelete(store, t) {
+	await store.delete(t.bucket, t.key);
+	return new Response(null, { status: 204 });
+}
+function createS3Handler(opts) {
+	const { store, credentials } = opts;
+	return async (req) => {
+		if (!verifyRequest(req, credentials).ok) return new Response(null, { status: 403 });
+		const url = new URL(req.url);
+		const target = parseTarget(url);
+		if (!target) return new Response(null, { status: 400 });
+		if (req.method === "GET" && url.searchParams.get("list-type") === "2" && target.key === "") return handleList(store, target.bucket, url);
+		if (target.key === "") return new Response(null, { status: 400 });
+		switch (req.method) {
+			case "PUT": return handlePut(store, target, req);
+			case "GET": return handleGet(store, target, req);
+			case "HEAD": return handleHead(store, target);
+			case "DELETE": return handleDelete(store, target);
+			default: return new Response(null, { status: 405 });
+		}
+	};
+}
+/**
+* Boots the S3 wire protocol on `Bun.serve` — the D2 handler over any
+* `ObjectStore`. Binds all interfaces (Compute routes external HTTP to the VM,
+* so a loopback-only listener would be unreachable). Installs the FT-5219
+* process guards so an idle Bun.SQL connection close surfaces as a logged
+* error instead of crash-looping the process on scale-to-zero.
+*
+* Runtime engine code; NOT re-exported from the authoring barrel. The D4
+* entrypoint reads deps via `load()` and calls this.
+*/
+let guardsInstalled = false;
+/** FT-5219: keep the process alive when Bun.SQL surfaces an idle-close as an unawaited async error. Installed once. */
+function installProcessGuards() {
+	if (guardsInstalled) return;
+	guardsInstalled = true;
+	process.on("uncaughtException", (err) => console.error("uncaughtException", err));
+	process.on("unhandledRejection", (err) => console.error("unhandledRejection", err));
+}
+function startStorageServer(opts) {
+	installProcessGuards();
+	const handler = createS3Handler({
+		store: opts.store,
+		credentials: opts.credentials
+	});
+	const hostname = opts.hostname ?? "0.0.0.0";
+	const server = Bun.serve({
+		port: opts.port,
+		hostname,
+		fetch: (req) => handler(req)
+	});
+	return {
+		url: `http://${hostname === "0.0.0.0" ? "127.0.0.1" : hostname}:${server.port}`,
+		stop: () => server.stop(true)
+	};
+}
+/**
+* **Last-resort escape hatch for unsafe type assertions. Not a sanctioned tool to reach for.**
+*
+* Before reaching for `blindCast`, **rewrite the surrounding code so the cast becomes
+* unnecessary**: tighten an input type, add a runtime check that narrows via a type
+* predicate, restructure a generic so the compiler can see the relationship you're
+* asserting, or use {@link castAs} when the value already satisfies the target type.
+* Only when no rewrite is feasible does `blindCast` become the right answer — and at
+* that point, the `Reason` literal you supply must articulate the compromise in
+* language a reviewer can evaluate.
+*
+* The reviewer **will** validate the `Reason`. If it doesn't hold up under scrutiny,
+* that is not a signal to soften the reason; it is a signal to go back and solve the
+* underlying type-system problem properly. An unconvincing justification is rework,
+* not a free pass.
+*
+* `blindCast` is the auditable form of `as Foo` / `as unknown as Foo`: it bypasses
+* the compiler's checks (the input type is `unknown`, the output type is whatever the
+* caller asks for), but it forces the unsafety to be named at the call site instead of
+* smuggled in via a bare `as`. The `Reason` type parameter exists only at compile
+* time — it is not present in the emitted JavaScript — but it is grep-able and
+* visible to future readers.
+*
+* @example
+* ```typescript
+* const stringValue = blindCast<
+*   string,
+*   "JSON.parse returns `unknown`; this field is documented to be a string in the API contract"
+* >(parsed[key]);
+* ```
+*
+* @typeParam TargetType - The type the caller is asserting the input has.
+* @typeParam _Reason - A string literal describing why bypassing the type system is necessary here.
+*                     Only meaningful at compile time. The reviewer evaluates whether it justifies the unsafety.
+*/
+function blindCast(input) {
+	return input;
+}
+/**
+* Core model: node types and the factories that construct them, plain frozen
+* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).
+*/
+const NODE = Symbol.for("prisma:node");
+function requireType(type, factory) {
+	if (typeof type !== "string" || type.length === 0) throw new Error(`${factory}() requires a non-empty node type.`);
+}
+function requireName(name, factory) {
+	if (typeof name !== "string" || name.length === 0) throw new Error(`${factory}() requires a non-empty name.`);
+}
+function requireExtension(extension, factory) {
+	if (typeof extension !== "string" || extension.length === 0) throw new Error(`${factory}() requires a non-empty extension (the authoring extension's package name).`);
+}
+/**
+* Config keys join address/input/param names with "_" and uppercase — an
+* underscore inside a name would collide with that separator (e.g. param
+* "db_url" vs input "db"'s param "url" both hitting env key "DB_URL").
+*/
+function requireNoUnderscoreName(name, kind, factory) {
+	if (name.includes("_")) throw new Error(`${factory}() ${kind} name "${name}" may not contain "_" — config keys join names with "_" as the separator (e.g. an input "db"'s param "url" becomes env key "DB_URL"), so an underscore inside a name would collide with that separator.`);
+}
+function requireNoUnderscoreNames(names, kind, factory) {
+	for (const name of names) requireNoUnderscoreName(name, kind, factory);
+}
+function freezeParams(params) {
+	const frozen = {};
+	for (const [name, param] of Object.entries(params)) frozen[name] = Object.freeze({ ...param });
+	return Object.freeze(frozen);
+}
+function freezeSecrets(secrets) {
+	const frozen = {};
+	for (const [name, need] of Object.entries(secrets)) frozen[name] = Object.freeze({ ...need });
+	return blindCast(Object.freeze(frozen));
+}
+/** A frozen shallow copy that keeps the caller's declared type. */
+function frozenShallowCopy(obj) {
+	return blindCast(Object.freeze({ ...obj }));
+}
+/**
+* Seals a node instance after its constructor has assigned all fields — the
+* last statement of a concrete node class's constructor. A free function, not
+* a base-class method, so an instance stays structurally a plain frozen node.
+*/
+function freezeNode(node) {
+	Object.freeze(node);
+	return node;
+}
+/**
+* Everything `resource()` establishes, minus the freeze — an extension
+* whose resource node carries extra fields extends this, assigns them, and
+* calls `freezeNode(this)` as its constructor's last statement.
+*/
+var ResourceNodeBase = class {
+	[NODE] = true;
+	kind = "resource";
+	name;
+	extension;
+	type;
+	provides;
+	constructor(def) {
+		requireName(def.name, "resource");
+		requireExtension(def.extension, "resource");
+		const provides = def.provides;
+		if (typeof provides !== "object" || provides === null || typeof provides.kind !== "string" || provides.kind.length === 0 || typeof provides.satisfies !== "function") throw new Error("resource() requires `provides` — the Contract this resource offers (a non-empty `kind` plus its `satisfies()`).");
+		this.name = def.name;
+		this.extension = def.extension;
+		this.type = provides.kind;
+		this.provides = provides;
+	}
+};
+/** The core leaf: exactly the base, frozen. */
+var FrozenResourceNode = class extends ResourceNodeBase {
+	constructor(def) {
+		super(def);
+		freezeNode(this);
+	}
+};
+/**
+* Constructs a branded, frozen Resource node — an identity plus the Contract
+* it provides; the routing `type` is the contract's `kind`. Pure — nothing
+* is provisioned until a module provisions it.
+*/
+function resource(def) {
+	return new FrozenResourceNode(def);
+}
+/**
+* Constructs a branded, frozen Service node — declarations only (inputs,
+* params, build adapter, and the ports it exposes). Pure; carries no runtime behavior.
+*/
+function service$1(def) {
+	requireName(def.name, "service");
+	requireExtension(def.extension, "service");
+	requireType(def.type, "service");
+	requireNoUnderscoreNames(Object.keys(def.inputs), "input", "service");
+	requireNoUnderscoreNames(Object.keys(def.params), "param", "service");
+	requireNoUnderscoreNames(Object.keys(def.secrets ?? {}), "secret", "service");
+	for (const slot of Object.keys(def.secrets ?? {})) if (Object.hasOwn(def.params, slot)) throw new Error(`service() secret slot "${slot}" collides with a param of the same name — a secret slot and a service param derive the same config key (COMPOSE_<addr>_${slot.toUpperCase()}); rename one.`);
+	return Object.freeze({
+		[NODE]: true,
+		kind: "service",
+		name: def.name,
+		extension: def.extension,
+		type: def.type,
+		inputs: frozenShallowCopy(def.inputs),
+		params: freezeParams(def.params),
+		secretSlots: freezeSecrets(def.secrets ?? blindCast({})),
+		build: Object.freeze({ ...def.build }),
+		expose: def.expose !== void 0 ? frozenShallowCopy(def.expose) : void 0
+	});
+}
+/**
+* Constructs a branded, frozen DependencyEnd. `required` (if given) is the
+* contract Load compares a wired ref against via `satisfies()`; an unnamed
+* end's diagnostic `name` falls back to its `type`.
+*/
+function dependency(def) {
+	requireType(def.type, "dependency");
+	requireNoUnderscoreNames(Object.keys(def.connection.params), "param", "dependency");
+	const connection = Object.freeze({
+		params: freezeParams(def.connection.params),
+		hydrate: def.connection.hydrate
+	});
+	return Object.freeze({
+		[NODE]: true,
+		kind: "dependency",
+		name: def.name !== void 0 && def.name.length > 0 ? def.name : def.type,
+		type: def.type,
+		connection,
+		required: def.required
+	});
+}
+/**
+* A value wrapper that redacts everywhere except the one explicit reader,
+* `expose()`. Sensitivity is carried by the TYPE (`SecretBox<T>`), not a flag a
+* sink must remember to check: `String(box)`, template interpolation,
+* `JSON.stringify`, and `console.log`/`util.inspect` all print `[REDACTED]`, so
+* a secret can't leak through an accidental log or serialization.
+*
+* Shape matches the platform's own `secrecy` type (pdp-control-plane). The class
+* is nominal enough on its own — no phantom brand.
+*/
+const REDACTED = "[REDACTED]";
+var SecretBox = class {
+	#value;
+	constructor(value) {
+		this.#value = value;
+	}
+	/** The sole explicit door to the wrapped value. */
+	expose() {
+		return this.#value;
+	}
+	toString() {
+		return REDACTED;
+	}
+	toJSON() {
+		return REDACTED;
+	}
+	valueOf() {
+		return REDACTED;
+	}
+	[Symbol.toPrimitive]() {
+		return REDACTED;
+	}
+	[Symbol.for("nodejs.util.inspect.custom")]() {
+		return REDACTED;
+	}
+};
+function scalarSchema(name, check) {
+	return { "~standard": {
+		version: 1,
+		vendor: "@prisma/composer",
+		validate: (value) => check(value) ? { value } : { issues: [{ message: `expected ${name}, got ${typeof value}` }] }
+	} };
+}
+const stringSchema = scalarSchema("string", (v) => typeof v === "string");
+const numberSchema = scalarSchema("number", (v) => typeof v === "number" && Number.isFinite(v));
+function withFacets(schema, opts) {
+	return {
+		schema,
+		...opts.optional !== void 0 ? { optional: opts.optional } : {},
+		...opts.default !== void 0 ? { default: opts.default } : {}
+	};
+}
+/** A string-valued param. */
+function string(opts = {}) {
+	return withFacets(stringSchema, opts);
+}
+/** A number-valued param. */
+function number(opts = {}) {
+	return withFacets(numberSchema, opts);
+}
+/**
+* Synchronous hydrate — what the node's `load()` uses so
+* `const { db } = service.load()` reads without `await`. Requires every
+* connection.hydrate to return synchronously; a Promise return is a loud error
+* naming the input (an async client factory must use the async `hydrate` path).
+*/
+function hydrateSync(root, config) {
+	const deps = {};
+	for (const [name, inputNode] of Object.entries(root.inputs)) {
+		const values = config.inputs[name] ?? {};
+		const client = inputNode.connection.hydrate(values);
+		if (client instanceof Promise) throw new Error(`Connection hydrate for input "${name}" returned a Promise; load() requires a synchronous client factory.`);
+		deps[name] = client;
+	}
+	return deps;
+}
+/**
+* Wraps each of a service's resolved secret values in a redacting `SecretBox`
+* — what the node's `secrets()` accessor returns (ADR-0021, sibling to
+* `load()`/`config()`). The RESOLUTION of a secret's value (the boot
+* double-lookup that reads the platform var the pointer names) is the target
+* pack's job; core is handed the already-resolved strings and only boxes them,
+* so a secret is redacted by TYPE from here on. A declared slot missing from
+* `values` is a target contract violation, named loudly.
+*/
+function hydrateSecrets(root, values) {
+	const boxed = {};
+	for (const slot of Object.keys(root.secretSlots)) {
+		const value = values[slot];
+		if (value === void 0) throw new Error(`secret slot "${slot}" has no resolved value — the target must resolve every declared secret before hydrateSecrets().`);
+		boxed[slot] = new SecretBox(value);
+	}
+	return blindCast(boxed);
+}
+const nodeBuild = (opts) => ({
+	extension: "@prisma/composer/node",
+	type: "node",
+	module: opts.module,
+	entry: opts.entry
+});
+/**
+* Walks a node's own params, then each dependency input's connection params —
+* the same enumeration order `configOf` uses, but carrying the raw
+* `ConfigParam` (with its `serialize`/`deserialize`) instead of a pure-data
+* projection.
+*/
+function paramEntries(node) {
+	const entries = [];
+	for (const [input, value] of Object.entries(node.inputs)) {
+		if (typeof value !== "object" || value === null) continue;
+		const params = blindCast(value).connection.params;
+		for (const [name, param] of Object.entries(params)) entries.push({
+			owner: { input },
+			name,
+			param
+		});
+	}
+	for (const [name, param] of Object.entries(node.params)) entries.push({
+		owner: "service",
+		name,
+		param
+	});
+	return entries;
+}
+const configKey = (address, d) => {
+	const segments = address.split(".").filter((s) => s.length > 0);
+	const owner = d.owner === "service" ? [] : [d.owner.input];
+	return [
+		"COMPOSE",
+		...segments,
+		...owner,
+		d.name
+	].join("_").toUpperCase();
+};
+/**
+* Typed value → its stored string. Service-own literals are JSON-encoded; a
+* dependency-input value is a provisioning ref at deploy (and a resolved
+* string at boot) and passes through untouched — LANDMINE: JSON-encoding it
+* would break the ordering edge Alchemy resolves through it.
+*/
+function encode(owner, value) {
+	return owner === "service" ? JSON.stringify(value) : blindCast(value);
+}
+/** Reverses `encode`: JSON-parse a service-own value, take a dependency-input value raw. */
+function decode(owner, raw) {
+	return owner === "service" ? JSON.parse(raw) : raw;
+}
+function coerce(raw, d, key) {
+	if (!(raw !== void 0 && raw !== "")) {
+		if (d.param.default !== void 0) return d.param.default;
+		if (d.param.optional === true) return void 0;
+		throw new Error(`missing required config param "${d.name}" (env ${key})`);
+	}
+	try {
+		return standardValidateSync(d.param.schema, decode(d.owner, raw));
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`invalid value for config param "${d.name}" (env ${key}): ${message}`);
+	}
+}
+/**
+* Boot: read each declared param from env by its key, reverse the param's own
+* serialization (missing/invalid fails loudly), assemble the typed Config.
+* Secrets ride a separate channel (deserializeSecrets), not this one.
+*/
+const deserialize = (node, address) => {
+	const service = {};
+	const inputs = {};
+	for (const d of paramEntries(node)) {
+		const key = configKey(address, d);
+		const value = coerce(process.env[key], d, key);
+		if (d.owner === "service") service[d.name] = value;
+		else {
+			let bucket = inputs[d.owner.input];
+			if (bucket === void 0) {
+				bucket = {};
+				inputs[d.owner.input] = bucket;
+			}
+			bucket[d.name] = value;
+		}
+	}
+	return {
+		service,
+		inputs
+	};
+};
+/**
+* run()'s setup step: write the resolved config to the environment under
+* address-free keys (configKey("", d) + each serialize suffix), which load()
+* reads back with no address. Uses env, not a module variable, because a
+* framework may fork worker processes that inherit env but not memory.
+* Writes only these keys; nothing else is touched.
+*/
+const stash = (node, config) => {
+	for (const d of paramEntries(node)) {
+		const value = d.owner === "service" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];
+		if (value === void 0) continue;
+		process.env[configKey("", d)] = encode(d.owner, value);
+	}
+};
+/** The pointer-row key for a secret slot: COMPOSE_<addr>_<slot> (secrets are service-level). */
+const secretKey = (address, slot) => configKey(address, {
+	owner: "service",
+	name: slot
+});
+/**
+* Boot: resolve every secret slot to its value by double-lookup — read the
+* pointer key (the platform NAME), then read that platform var. A missing
+* pointer or a missing/empty platform value is a loud failure naming both keys.
+* Returns a plain Record for core's `hydrateSecrets` to box.
+*/
+const deserializeSecrets = (node, address) => {
+	const values = {};
+	for (const slot of Object.keys(node.secretSlots)) {
+		const key = secretKey(address, slot);
+		const name = process.env[key];
+		if (name === void 0 || name === "") throw new Error(`missing secret pointer for slot "${slot}" (env ${key}) — the deploy did not write it.`);
+		const value = process.env[name];
+		if (value === void 0 || value === "") throw new Error(`secret "${slot}" is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
+		values[slot] = value;
+	}
+	return values;
+};
+/**
+* run()'s setup step for secrets: re-emit each slot's pointer NAME under its
+* address-free key, so the address-free `deserializeSecrets` double-looks-up
+* identically. Never the value — the value stays only in the platform var.
+*/
+const stashSecrets = (node, address) => {
+	for (const slot of Object.keys(node.secretSlots)) {
+		const name = process.env[secretKey(address, slot)];
+		if (name === void 0) continue;
+		process.env[secretKey("", slot)] = name;
+	}
+};
+/** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */
+function standardValidateSync(schema, value) {
+	const result = schema["~standard"].validate(value);
+	if (result instanceof Promise) throw new Error("config param schema validation must be synchronous — async Standard Schema validators are not supported for config params");
+	if (result.issues !== void 0) throw new Error(`config param validation failed: ${result.issues.map((issue) => issue.message).join("; ")}`);
+	return result.value;
+}
+const reservedParams = { port: number({ default: 3e3 }) };
+/**
+* A Prisma Compute service — declarations only (deps + params + build + the
+* ports it exposes), no descriptor. `params` merges with the reserved
+* `ReservedParams` (`port`); a user param whose name collides with a reserved
+* one fails at authoring, the same way a colliding dependency name does.
+* Returns the extension's runnable/loadable node:
+*   · run(address, boot) — the process controller: deserialize the platform
+*     environment (keyed off `address`, the extension's ONE env read) into a
+*     typed Config, re-emit it under address-free process-local stash keys,
+*     then call boot() to start the app's entry.
+*   · load() / config() — called from inside the app's entry: read the stash;
+*     load() hydrates + memoizes the deps, config() returns the typed params.
+*     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+*
+* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
+* the control-plane registry key `prisma-composer deploy` resolves through the
+* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
+* deploy time; nodes are pure data.
+*/
+const compute = (def) => {
+	const userParams = def.params ?? blindCast({});
+	for (const reserved of Object.keys(reservedParams)) {
+		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
+		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
+	}
+	const params = blindCast({
+		...userParams,
+		...reservedParams
+	});
+	const node = service$1({
+		name: def.name,
+		extension: "@prisma/composer-prisma-cloud",
+		type: "compute",
+		inputs: def.deps,
+		params,
+		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
+		build: def.build,
+		...def.expose !== void 0 ? { expose: def.expose } : {}
+	});
+	let resolved;
+	let loadedDeps;
+	let loadedParams;
+	let loadedSecrets;
+	function processConfig() {
+		if (resolved === void 0) resolved = deserialize(node, "");
+		return resolved;
+	}
+	const runnable = {
+		...node,
+		async run(address, boot) {
+			const config = deserialize(node, address);
+			stash(node, config);
+			stashSecrets(node, address);
+			const port = config.service["port"];
+			if (typeof port === "number") process.env["PORT"] = String(port);
+			return boot();
+		},
+		load() {
+			if (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));
+			return loadedDeps;
+		},
+		config() {
+			if (loadedParams === void 0) loadedParams = blindCast(processConfig().service);
+			return loadedParams;
+		},
+		secrets() {
+			if (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, "")));
+			return loadedSecrets;
+		}
+	};
+	return Object.freeze(blindCast(runnable));
+};
+/**
+* The contract a Postgres provides — and the contract its consumers require.
+* `satisfies` compares KIND, not identity: an extension module can be duplicated
+* across a workspace (same rationale as the Symbol.for node brand), and every
+* duplicate's contract must still satisfy. `__cmp` is the connection config a
+* postgres offers; core never inspects it.
+*/
+const postgresContract = Object.freeze({
+	kind: "postgres",
+	__cmp: { url: "" },
+	satisfies: (required) => required.kind === "postgres"
+});
+function postgres(opts) {
+	if (opts?.name !== void 0) return resource({
+		name: opts.name,
+		extension: "@prisma/composer-prisma-cloud",
+		provides: postgresContract
+	});
+	return dependency({
+		type: "postgres",
+		connection: {
+			params: { url: string() },
+			hydrate: (v) => v
+		},
+		required: postgresContract
+	});
+}
+/**
+* The contract the `s3-credentials` resource provides — a minted SigV4 key
+* pair. `satisfies` compares KIND only (mirrors `postgresContract`); `__cmp` is
+* the config the resource offers, which core never inspects.
+*/
+const credentialsContract = Object.freeze({
+	kind: "credentials",
+	__cmp: {
+		accessKeyId: "",
+		secretAccessKey: ""
+	},
+	satisfies: (required) => required.kind === "credentials"
+});
+function s3Credentials(opts) {
+	if (opts?.name !== void 0) return resource({
+		name: opts.name,
+		extension: "@prisma/composer-prisma-cloud",
+		provides: credentialsContract
+	});
+	return dependency({
+		type: "credentials",
+		connection: {
+			params: {
+				accessKeyId: string(),
+				secretAccessKey: string()
+			},
+			hydrate: (v) => v
+		},
+		required: credentialsContract
+	});
+}
+/**
+* The storage service authoring factory — a `compute` service routed to the
+* `s3-store` lowering instead of `compute`'s. It is exactly `compute`'s
+* runnable (run/load/config, deps, params, build, expose) with the routing
+* `type` overridden to `'s3-store'`: nothing at runtime keys off `type` (the
+* serializer keys off the deployment address and each param's owner/name, and
+* `load`/`config` off deps/params), so only the deploy-time descriptor lookup
+* sees the override and routes to the extended-output lowering (§ 5). The
+* return type is compute's exactly (including the reserved `port` param). The
+* storage module (D4b) calls this with its `db`/`credentials` deps, a `bucket`
+* param, and `expose: { store: s3Contract }`.
+*/
+function s3StoreService(def) {
+	const node = compute(def);
+	return Object.freeze(blindCast({
+		...node,
+		type: "s3-store"
+	}));
+}
+const s3Contract = Object.freeze({
+	kind: "s3",
+	__cmp: {
+		url: "",
+		bucket: "",
+		accessKeyId: "",
+		secretAccessKey: ""
+	},
+	satisfies: (required) => required.kind === "s3"
+});
+/**
+* The storage service node (like cron's `scheduler.ts` + `scheduler-service.ts`
+* combined): `storageService` builds the `s3-store` service — a Postgres `db`
+* dependency, a minted `credentials` dependency, a `bucket` param, and the
+* `store` port exposing `s3Contract`. The deploy bootstrap runs the
+* default-exported bare node (`main.run(address, boot)`); the real bucket comes
+* from serialized config at runtime, so the default's `bucket` is only a
+* placeholder — exactly like `scheduler-service.ts` default-exports
+* `cronScheduler({ jobs: [] })`.
+*/
+function storageService(opts) {
+	return s3StoreService({
+		name: "storage",
+		deps: {
+			db: postgres(),
+			credentials: s3Credentials()
+		},
+		params: { bucket: string({ default: opts.bucket }) },
+		build: nodeBuild({
+			module: new URL("./storage-service.mjs", import.meta.url).href,
+			entry: "./storage-entrypoint.mjs"
+		}),
+		expose: { store: s3Contract }
+	});
+}
+storageService({ bucket: "storage" });
+const service = storageService({ bucket: "storage" });
+const { db, credentials } = service.load();
+const { bucket, port } = service.config();
+startStorageServer({
+	store: await createPgStore(db.url),
+	credentials,
+	bucket,
+	port
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=storage-entrypoint.mjs.map