@prisma/composer-prisma-cloud 0.1.0

package/dist/cron/index.mjs

@@ -0,0 +1,356 @@
+import { contract, rpc, serve } from "@prisma/composer/rpc";
+import { type } from "arktype";
+import { hydrateSecrets, hydrateSync, module, number, param, service } from "@prisma/composer";
+import node from "@prisma/composer/node";
+import { blindCast } from "@prisma/composer/casts";
+blindCast(Symbol.for("prisma:prisma-cloud-secret-source"));
+/**
+* Walks a node's own params, then each dependency input's connection params —
+* the same enumeration order `configOf` uses, but carrying the raw
+* `ConfigParam` (with its `serialize`/`deserialize`) instead of a pure-data
+* projection.
+*/
+function paramEntries(node) {
+	const entries = [];
+	for (const [input, value] of Object.entries(node.inputs)) {
+		if (typeof value !== "object" || value === null) continue;
+		const params = blindCast(value).connection.params;
+		for (const [name, param] of Object.entries(params)) entries.push({
+			owner: { input },
+			name,
+			param
+		});
+	}
+	for (const [name, param] of Object.entries(node.params)) entries.push({
+		owner: "service",
+		name,
+		param
+	});
+	return entries;
+}
+const configKey = (address, d) => {
+	const segments = address.split(".").filter((s) => s.length > 0);
+	const owner = d.owner === "service" ? [] : [d.owner.input];
+	return [
+		"COMPOSE",
+		...segments,
+		...owner,
+		d.name
+	].join("_").toUpperCase();
+};
+/**
+* Typed value → its stored string. Service-own literals are JSON-encoded; a
+* dependency-input value is a provisioning ref at deploy (and a resolved
+* string at boot) and passes through untouched — LANDMINE: JSON-encoding it
+* would break the ordering edge Alchemy resolves through it.
+*/
+function encode(owner, value) {
+	return owner === "service" ? JSON.stringify(value) : blindCast(value);
+}
+/** Reverses `encode`: JSON-parse a service-own value, take a dependency-input value raw. */
+function decode(owner, raw) {
+	return owner === "service" ? JSON.parse(raw) : raw;
+}
+function coerce(raw, d, key) {
+	if (!(raw !== void 0 && raw !== "")) {
+		if (d.param.default !== void 0) return d.param.default;
+		if (d.param.optional === true) return void 0;
+		throw new Error(`missing required config param "${d.name}" (env ${key})`);
+	}
+	try {
+		return standardValidateSync(d.param.schema, decode(d.owner, raw));
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`invalid value for config param "${d.name}" (env ${key}): ${message}`);
+	}
+}
+/**
+* Boot: read each declared param from env by its key, reverse the param's own
+* serialization (missing/invalid fails loudly), assemble the typed Config.
+* Secrets ride a separate channel (deserializeSecrets), not this one.
+*/
+const deserialize = (node, address) => {
+	const service = {};
+	const inputs = {};
+	for (const d of paramEntries(node)) {
+		const key = configKey(address, d);
+		const value = coerce(process.env[key], d, key);
+		if (d.owner === "service") service[d.name] = value;
+		else {
+			let bucket = inputs[d.owner.input];
+			if (bucket === void 0) {
+				bucket = {};
+				inputs[d.owner.input] = bucket;
+			}
+			bucket[d.name] = value;
+		}
+	}
+	return {
+		service,
+		inputs
+	};
+};
+/**
+* run()'s setup step: write the resolved config to the environment under
+* address-free keys (configKey("", d) + each serialize suffix), which load()
+* reads back with no address. Uses env, not a module variable, because a
+* framework may fork worker processes that inherit env but not memory.
+* Writes only these keys; nothing else is touched.
+*/
+const stash = (node, config) => {
+	for (const d of paramEntries(node)) {
+		const value = d.owner === "service" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];
+		if (value === void 0) continue;
+		process.env[configKey("", d)] = encode(d.owner, value);
+	}
+};
+/** The pointer-row key for a secret slot: COMPOSE_<addr>_<slot> (secrets are service-level). */
+const secretKey = (address, slot) => configKey(address, {
+	owner: "service",
+	name: slot
+});
+/**
+* Boot: resolve every secret slot to its value by double-lookup — read the
+* pointer key (the platform NAME), then read that platform var. A missing
+* pointer or a missing/empty platform value is a loud failure naming both keys.
+* Returns a plain Record for core's `hydrateSecrets` to box.
+*/
+const deserializeSecrets = (node, address) => {
+	const values = {};
+	for (const slot of Object.keys(node.secretSlots)) {
+		const key = secretKey(address, slot);
+		const name = process.env[key];
+		if (name === void 0 || name === "") throw new Error(`missing secret pointer for slot "${slot}" (env ${key}) — the deploy did not write it.`);
+		const value = process.env[name];
+		if (value === void 0 || value === "") throw new Error(`secret "${slot}" is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
+		values[slot] = value;
+	}
+	return values;
+};
+/**
+* run()'s setup step for secrets: re-emit each slot's pointer NAME under its
+* address-free key, so the address-free `deserializeSecrets` double-looks-up
+* identically. Never the value — the value stays only in the platform var.
+*/
+const stashSecrets = (node, address) => {
+	for (const slot of Object.keys(node.secretSlots)) {
+		const name = process.env[secretKey(address, slot)];
+		if (name === void 0) continue;
+		process.env[secretKey("", slot)] = name;
+	}
+};
+/** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */
+function standardValidateSync(schema, value) {
+	const result = schema["~standard"].validate(value);
+	if (result instanceof Promise) throw new Error("config param schema validation must be synchronous — async Standard Schema validators are not supported for config params");
+	if (result.issues !== void 0) throw new Error(`config param validation failed: ${result.issues.map((issue) => issue.message).join("; ")}`);
+	return result.value;
+}
+//#endregion
+//#region ../../1-prisma-cloud/1-extensions/target/dist/index.mjs
+const reservedParams = { port: number({ default: 3e3 }) };
+/**
+* A Prisma Compute service — declarations only (deps + params + build + the
+* ports it exposes), no descriptor. `params` merges with the reserved
+* `ReservedParams` (`port`); a user param whose name collides with a reserved
+* one fails at authoring, the same way a colliding dependency name does.
+* Returns the extension's runnable/loadable node:
+*   · run(address, boot) — the process controller: deserialize the platform
+*     environment (keyed off `address`, the extension's ONE env read) into a
+*     typed Config, re-emit it under address-free process-local stash keys,
+*     then call boot() to start the app's entry.
+*   · load() / config() — called from inside the app's entry: read the stash;
+*     load() hydrates + memoizes the deps, config() returns the typed params.
+*     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+*
+* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
+* the control-plane registry key `prisma-composer deploy` resolves through the
+* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
+* deploy time; nodes are pure data.
+*/
+const compute = (def) => {
+	const userParams = def.params ?? blindCast({});
+	for (const reserved of Object.keys(reservedParams)) {
+		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
+		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
+	}
+	const params = blindCast({
+		...userParams,
+		...reservedParams
+	});
+	const node = service({
+		name: def.name,
+		extension: "@prisma/composer-prisma-cloud",
+		type: "compute",
+		inputs: def.deps,
+		params,
+		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
+		build: def.build,
+		...def.expose !== void 0 ? { expose: def.expose } : {}
+	});
+	let resolved;
+	let loadedDeps;
+	let loadedParams;
+	let loadedSecrets;
+	function processConfig() {
+		if (resolved === void 0) resolved = deserialize(node, "");
+		return resolved;
+	}
+	const runnable = {
+		...node,
+		async run(address, boot) {
+			const config = deserialize(node, address);
+			stash(node, config);
+			stashSecrets(node, address);
+			const port = config.service["port"];
+			if (typeof port === "number") process.env["PORT"] = String(port);
+			return boot();
+		},
+		load() {
+			if (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));
+			return loadedDeps;
+		},
+		config() {
+			if (loadedParams === void 0) loadedParams = blindCast(processConfig().service);
+			return loadedParams;
+		},
+		secrets() {
+			if (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, "")));
+			return loadedSecrets;
+		}
+	};
+	return Object.freeze(blindCast(runnable));
+};
+Object.freeze({
+	kind: "postgres",
+	__cmp: { url: "" },
+	satisfies: (required) => required.kind === "postgres"
+});
+Object.freeze({
+	kind: "credentials",
+	__cmp: {
+		accessKeyId: "",
+		secretAccessKey: ""
+	},
+	satisfies: (required) => required.kind === "credentials"
+});
+//#endregion
+//#region ../../1-prisma-cloud/2-shared-modules/cron/dist/scheduler-iL9rl3YY.mjs
+/**
+* The one call edge between the scheduler and the app's runner: `trigger(jobId)`.
+* The scheduler depends on it (`rpc(triggerContract)`); the runner exposes it
+* (`expose: { trigger: triggerContract }`). `jobId` travels as data through this
+* single method — adding a job never adds a method, service, or port.
+*/
+const triggerContract = contract({ trigger: rpc({
+	input: type({ jobId: "string" }),
+	output: type({ ok: "boolean" })
+}) });
+/**
+* `defineSchedule({ tick: '60s', mrr: '24h' })` →
+* `{ jobs: [{ jobId: 'tick', every: '60s' }, { jobId: 'mrr', every: '24h' }] }`,
+* preserving key order.
+*/
+function defineSchedule(spec) {
+	return { jobs: Object.entries(spec).map(([jobId, every]) => ({
+		jobId,
+		every
+	})) };
+}
+/**
+* Parses the `every` grammar `<integer><unit>`, unit one of `s`/`m`/`h`/`d`
+* (e.g. `30s`, `24h`), returning milliseconds. Throws on a malformed value —
+* empty, missing/unknown unit, non-integer, or non-positive.
+*/
+function parseEvery(s) {
+	const match = /^(\d+)([smhd])$/.exec(s);
+	if (match === null) throw new Error(`parseEvery(): "${s}" is not a valid interval — expected "<integer><unit>" with unit one of s/m/h/d (e.g. "30s", "24h").`);
+	const [, digits = "", unit = ""] = match;
+	const value = Number(digits);
+	if (!Number.isInteger(value) || value <= 0) throw new Error(`parseEvery(): "${s}" must have a positive integer value.`);
+	switch (unit) {
+		case "s": return value * 1e3;
+		case "m": return value * 6e4;
+		case "h": return value * 36e5;
+		case "d": return value * 864e5;
+		default: throw new Error(`parseEvery(): "${s}" has an unknown unit "${unit}" — expected one of s/m/h/d.`);
+	}
+}
+/**
+* The reusable scheduler node and its firing logic. `cronScheduler` builds a
+* `compute()` whose `jobs` param default is the app's schedule and whose only
+* dependency is `trigger(jobId)`; nothing else about it varies per app.
+* `runScheduler` is the pure, injectable firing loop the entrypoint (and its
+* tests) drive.
+*/
+const scheduleSchema = type({
+	jobId: "string",
+	every: "string"
+}).array();
+/**
+* The always-on scheduler service. `schedule` sets only the `jobs` param's
+* default — the value the deploy serializes into config; the scheduler
+* itself is job-agnostic.
+*/
+function cronScheduler(schedule) {
+	return compute({
+		name: "scheduler",
+		deps: { trigger: rpc(triggerContract) },
+		params: { jobs: param(scheduleSchema, { default: [...schedule.jobs] }) },
+		build: node({
+			module: new URL("./scheduler-service.mjs", import.meta.url).href,
+			entry: "./scheduler-entrypoint.mjs"
+		})
+	});
+}
+/**
+* Fires `call(jobId)` on each job's `every` interval. A rejected `call` is
+* logged, never thrown — a missed tick is healed by an idempotent target, not
+* by scheduler state. `setTimer` defaults to `setInterval`; tests inject a
+* fake to drive time.
+*/
+function runScheduler(opts) {
+	const setTimer = opts.setTimer ?? ((fn, ms) => setInterval(fn, ms));
+	for (const job of opts.jobs) setTimer(() => {
+		opts.call(job.jobId).catch((err) => {
+			console.error(`cron: job "${job.jobId}" failed`, err);
+		});
+	}, parseEvery(job.every));
+}
+//#endregion
+//#region ../../1-prisma-cloud/2-shared-modules/cron/dist/index.mjs
+/**
+* `opts.runner` is a service exposing `{ trigger }`; the returned module
+* provisions it alongside the scheduler that fires `opts.schedule` at it. The
+* module's boundary deps mirror the runner's own deps, so the parent wires the
+* real work target through them, e.g.
+* `provision(cron({ schedule, runner }), { worker: worker.rpc })`. `opts.name`
+* sets the module name (default `'cron'`). Exposes nothing.
+*/
+function cron(opts) {
+	return module(opts.name ?? "cron", { deps: opts.runner.inputs }, ({ inputs, provision }) => {
+		const runner = provision(opts.runner, {
+			id: "runner",
+			deps: inputs
+		});
+		provision(cronScheduler(opts.schedule), {
+			id: "scheduler",
+			deps: { trigger: runner.trigger }
+		});
+		return {};
+	});
+}
+function serveSchedule(service, _schedule, handlers) {
+	const byId = blindCast(handlers);
+	const triggerHandler = async (input, deps) => {
+		const handler = byId[input.jobId];
+		if (handler === void 0) throw new Error(`serveSchedule(): no handler for job id "${input.jobId}" — not in the schedule.`);
+		await handler(deps);
+		return { ok: true };
+	};
+	return serve(service, blindCast({ trigger: { trigger: triggerHandler } }));
+}
+//#endregion
+export { cron, cronScheduler, defineSchedule, runScheduler, serveSchedule, triggerContract };
+
+//# sourceMappingURL=index.mjs.map

package/dist/cron/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../1-prisma-cloud/1-extensions/target/dist/serializer-C2CsA7xm.mjs","../../../../1-prisma-cloud/1-extensions/target/dist/index.mjs","../../../../1-prisma-cloud/2-shared-modules/cron/dist/scheduler-iL9rl3YY.mjs","../../../../1-prisma-cloud/2-shared-modules/cron/dist/index.mjs"],"sourcesContent":["import { secretSource } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/secret.ts\n/**\n* Brands the payload `envSecret` builds. Core's `secretSource()` is a public\n* SPI, so a user could bypass `envSecret` and bind a raw `secretSource('x')`;\n* the brand lets `secretName` reject such a source (or another target's) with a\n* clear error instead of reading an absent `.name`.\n*/\nconst PRISMA_CLOUD_SECRET_SOURCE = blindCast(Symbol.for(\"prisma:prisma-cloud-secret-source\"));\nconst RESERVED_SECRET_PREFIX = \"COMPOSE_\";\nconst POISONED_SECRET_NAMES = /* @__PURE__ */ new Set([\"DATABASE_URL\", \"DATABASE_URL_POOLED\"]);\n/**\n* Binds a secret slot to a named Prisma Cloud platform env var (ADR-0029). The\n* value is provisioned out-of-band; only the name is carried. The name may not\n* use the framework's reserved `COMPOSE_` prefix or the poisoned\n* `DATABASE_URL(_POOLED)` keys.\n*/\nfunction envSecret(name) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(\"envSecret() requires a non-empty platform env-var name, e.g. envSecret('STRIPE_SECRET_KEY').\");\n\tif (name.startsWith(RESERVED_SECRET_PREFIX)) throw new Error(`envSecret name \"${name}\" may not start with \"${RESERVED_SECRET_PREFIX}\" — that prefix is reserved for the framework's own generated config keys.`);\n\tif (POISONED_SECRET_NAMES.has(name)) throw new Error(`envSecret name \"${name}\" is reserved — ${[...POISONED_SECRET_NAMES].join(\" and \")} are poisoned at project provision and cannot back a secret.`);\n\treturn secretSource({\n\t\t[PRISMA_CLOUD_SECRET_SOURCE]: true,\n\t\tname\n\t});\n}\n/** True only for a payload that `envSecret` built — i.e. one carrying the brand. */\nfunction isEnvSecretPayload(payload) {\n\treturn typeof payload === \"object\" && payload !== null && blindCast(payload)[PRISMA_CLOUD_SECRET_SOURCE] === true;\n}\n/**\n* Reads the Prisma Cloud env-var name back out of a secret binding's opaque\n* source. A source not built by `envSecret` (a raw `secretSource(...)` or\n* another target's source) carries no name — reject it here. `secretName` runs\n* in preflight before any provisioning, so a foreign source fails early and\n* clearly rather than producing a broken deploy with an undefined name.\n*/\nfunction secretName(binding) {\n\tconst payload = binding.source.payload;\n\tif (!isEnvSecretPayload(payload)) throw new Error(`secret slot \"${binding.slot}\" of service \"${binding.serviceAddress}\" is bound to a source not created by envSecret() — bind secrets with envSecret('NAME') from @prisma/composer-prisma-cloud.`);\n\treturn payload.name;\n}\n//#endregion\n//#region src/serializer.ts\n/**\n* Walks a node's own params, then each dependency input's connection params —\n* the same enumeration order `configOf` uses, but carrying the raw\n* `ConfigParam` (with its `serialize`/`deserialize`) instead of a pure-data\n* projection.\n*/\nfunction paramEntries(node) {\n\tconst entries = [];\n\tfor (const [input, value] of Object.entries(node.inputs)) {\n\t\tif (typeof value !== \"object\" || value === null) continue;\n\t\tconst params = blindCast(value).connection.params;\n\t\tfor (const [name, param] of Object.entries(params)) entries.push({\n\t\t\towner: { input },\n\t\t\tname,\n\t\t\tparam\n\t\t});\n\t}\n\tfor (const [name, param] of Object.entries(node.params)) entries.push({\n\t\towner: \"service\",\n\t\tname,\n\t\tparam\n\t});\n\treturn entries;\n}\nconst configKey = (address, d) => {\n\tconst segments = address.split(\".\").filter((s) => s.length > 0);\n\tconst owner = d.owner === \"service\" ? [] : [d.owner.input];\n\treturn [\n\t\t\"COMPOSE\",\n\t\t...segments,\n\t\t...owner,\n\t\td.name\n\t].join(\"_\").toUpperCase();\n};\n/**\n* Typed value → its stored string. Service-own literals are JSON-encoded; a\n* dependency-input value is a provisioning ref at deploy (and a resolved\n* string at boot) and passes through untouched — LANDMINE: JSON-encoding it\n* would break the ordering edge Alchemy resolves through it.\n*/\nfunction encode(owner, value) {\n\treturn owner === \"service\" ? JSON.stringify(value) : blindCast(value);\n}\n/** Reverses `encode`: JSON-parse a service-own value, take a dependency-input value raw. */\nfunction decode(owner, raw) {\n\treturn owner === \"service\" ? JSON.parse(raw) : raw;\n}\nfunction coerce(raw, d, key) {\n\tif (!(raw !== void 0 && raw !== \"\")) {\n\t\tif (d.param.default !== void 0) return d.param.default;\n\t\tif (d.param.optional === true) return void 0;\n\t\tthrow new Error(`missing required config param \"${d.name}\" (env ${key})`);\n\t}\n\ttry {\n\t\treturn standardValidateSync(d.param.schema, decode(d.owner, raw));\n\t} catch (cause) {\n\t\tconst message = cause instanceof Error ? cause.message : String(cause);\n\t\tthrow new Error(`invalid value for config param \"${d.name}\" (env ${key}): ${message}`);\n\t}\n}\n/**\n* Boot: read each declared param from env by its key, reverse the param's own\n* serialization (missing/invalid fails loudly), assemble the typed Config.\n* Secrets ride a separate channel (deserializeSecrets), not this one.\n*/\nconst deserialize = (node, address) => {\n\tconst service = {};\n\tconst inputs = {};\n\tfor (const d of paramEntries(node)) {\n\t\tconst key = configKey(address, d);\n\t\tconst value = coerce(process.env[key], d, key);\n\t\tif (d.owner === \"service\") service[d.name] = value;\n\t\telse {\n\t\t\tlet bucket = inputs[d.owner.input];\n\t\t\tif (bucket === void 0) {\n\t\t\t\tbucket = {};\n\t\t\t\tinputs[d.owner.input] = bucket;\n\t\t\t}\n\t\t\tbucket[d.name] = value;\n\t\t}\n\t}\n\treturn {\n\t\tservice,\n\t\tinputs\n\t};\n};\n/**\n* run()'s setup step: write the resolved config to the environment under\n* address-free keys (configKey(\"\", d) + each serialize suffix), which load()\n* reads back with no address. Uses env, not a module variable, because a\n* framework may fork worker processes that inherit env but not memory.\n* Writes only these keys; nothing else is touched.\n*/\nconst stash = (node, config) => {\n\tfor (const d of paramEntries(node)) {\n\t\tconst value = d.owner === \"service\" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];\n\t\tif (value === void 0) continue;\n\t\tprocess.env[configKey(\"\", d)] = encode(d.owner, value);\n\t}\n};\n/** The pointer-row key for a secret slot: COMPOSE_<addr>_<slot> (secrets are service-level). */\nconst secretKey = (address, slot) => configKey(address, {\n\towner: \"service\",\n\tname: slot\n});\n/**\n* Deploy: the pointer rows for a node's secret slots — each slot's key mapped to\n* the platform NAME the root bound it to (looked up in `graph.secrets`). Never a\n* value. A declared slot with no binding is a Load-invariant violation (Load\n* binds every slot), surfaced loudly here rather than written as a blank row.\n*/\nfunction secretPointerRows(node, address, bindings) {\n\tconst rows = [];\n\tfor (const slot of Object.keys(node.secretSlots)) {\n\t\tconst binding = bindings.find((b) => b.serviceAddress === address && b.slot === slot);\n\t\tif (binding === void 0) throw new Error(`secret slot \"${slot}\" of \"${address}\" has no bound platform name — Load should have bound it (ADR-0029).`);\n\t\trows.push({\n\t\t\tkey: secretKey(address, slot),\n\t\t\tname: secretName(binding)\n\t\t});\n\t}\n\treturn rows;\n}\n/**\n* Boot: resolve every secret slot to its value by double-lookup — read the\n* pointer key (the platform NAME), then read that platform var. A missing\n* pointer or a missing/empty platform value is a loud failure naming both keys.\n* Returns a plain Record for core's `hydrateSecrets` to box.\n*/\nconst deserializeSecrets = (node, address) => {\n\tconst values = {};\n\tfor (const slot of Object.keys(node.secretSlots)) {\n\t\tconst key = secretKey(address, slot);\n\t\tconst name = process.env[key];\n\t\tif (name === void 0 || name === \"\") throw new Error(`missing secret pointer for slot \"${slot}\" (env ${key}) — the deploy did not write it.`);\n\t\tconst value = process.env[name];\n\t\tif (value === void 0 || value === \"\") throw new Error(`secret \"${slot}\" is not provisioned (env ${key} → ${name}): the platform var \"${name}\" is unset or empty.`);\n\t\tvalues[slot] = value;\n\t}\n\treturn values;\n};\n/**\n* run()'s setup step for secrets: re-emit each slot's pointer NAME under its\n* address-free key, so the address-free `deserializeSecrets` double-looks-up\n* identically. Never the value — the value stays only in the platform var.\n*/\nconst stashSecrets = (node, address) => {\n\tfor (const slot of Object.keys(node.secretSlots)) {\n\t\tconst name = process.env[secretKey(address, slot)];\n\t\tif (name === void 0) continue;\n\t\tprocess.env[secretKey(\"\", slot)] = name;\n\t}\n};\n/** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */\nfunction standardValidateSync(schema, value) {\n\tconst result = schema[\"~standard\"].validate(value);\n\tif (result instanceof Promise) throw new Error(\"config param schema validation must be synchronous — async Standard Schema validators are not supported for config params\");\n\tif (result.issues !== void 0) throw new Error(`config param validation failed: ${result.issues.map((issue) => issue.message).join(\"; \")}`);\n\treturn result.value;\n}\n//#endregion\nexport { paramEntries as a, stashSecrets as c, encode as i, envSecret as l, deserialize as n, secretPointerRows as o, deserializeSecrets as r, stash as s, configKey as t, secretName as u };\n\n//# sourceMappingURL=serializer-C2CsA7xm.mjs.map","import { c as stashSecrets, l as envSecret, n as deserialize, r as deserializeSecrets, s as stash, t as configKey, u as secretName } from \"./serializer-C2CsA7xm.mjs\";\nimport { dependency, hydrateSecrets, hydrateSync, number, resource, service, string } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/compute.ts\nconst reservedParams = { port: number({ default: 3e3 }) };\n/**\n* A Prisma Compute service — declarations only (deps + params + build + the\n* ports it exposes), no descriptor. `params` merges with the reserved\n* `ReservedParams` (`port`); a user param whose name collides with a reserved\n* one fails at authoring, the same way a colliding dependency name does.\n* Returns the extension's runnable/loadable node:\n*   · run(address, boot) — the process controller: deserialize the platform\n*     environment (keyed off `address`, the extension's ONE env read) into a\n*     typed Config, re-emit it under address-free process-local stash keys,\n*     then call boot() to start the app's entry.\n*   · load() / config() — called from inside the app's entry: read the stash;\n*     load() hydrates + memoizes the deps, config() returns the typed params.\n*     Separate accessors so a dep and a param never share a namespace (ADR-0021).\n*\n* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —\n* the control-plane registry key `prisma-composer deploy` resolves through the\n* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at\n* deploy time; nodes are pure data.\n*/\nconst compute = (def) => {\n\tconst userParams = def.params ?? blindCast({});\n\tfor (const reserved of Object.keys(reservedParams)) {\n\t\tif (reserved in def.deps) throw new Error(`compute(): dependency \"${reserved}\" collides with the reserved service param of the same name — rename the dependency.`);\n\t\tif (reserved in userParams) throw new Error(`compute(): param \"${reserved}\" collides with the reserved service param of the same name — rename the param.`);\n\t}\n\tconst params = blindCast({\n\t\t...userParams,\n\t\t...reservedParams\n\t});\n\tconst node = service({\n\t\tname: def.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\ttype: \"compute\",\n\t\tinputs: def.deps,\n\t\tparams,\n\t\t...def.secrets !== void 0 ? { secrets: def.secrets } : {},\n\t\tbuild: def.build,\n\t\t...def.expose !== void 0 ? { expose: def.expose } : {}\n\t});\n\tlet resolved;\n\tlet loadedDeps;\n\tlet loadedParams;\n\tlet loadedSecrets;\n\tfunction processConfig() {\n\t\tif (resolved === void 0) resolved = deserialize(node, \"\");\n\t\treturn resolved;\n\t}\n\tconst runnable = {\n\t\t...node,\n\t\tasync run(address, boot) {\n\t\t\tconst config = deserialize(node, address);\n\t\t\tstash(node, config);\n\t\t\tstashSecrets(node, address);\n\t\t\tconst port = config.service[\"port\"];\n\t\t\tif (typeof port === \"number\") process.env[\"PORT\"] = String(port);\n\t\t\treturn boot();\n\t\t},\n\t\tload() {\n\t\t\tif (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));\n\t\t\treturn loadedDeps;\n\t\t},\n\t\tconfig() {\n\t\t\tif (loadedParams === void 0) loadedParams = blindCast(processConfig().service);\n\t\t\treturn loadedParams;\n\t\t},\n\t\tsecrets() {\n\t\t\tif (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, \"\")));\n\t\t\treturn loadedSecrets;\n\t\t}\n\t};\n\treturn Object.freeze(blindCast(runnable));\n};\n//#endregion\n//#region src/http.ts\nconst defaultHttpClient = (cfg) => ({\n\turl: cfg.url,\n\tfetch: (path, init) => fetch(new URL(path, cfg.url), init)\n});\n/**\n* A service-to-service dependency. Its binding (what `load()` returns) is a\n* derived HttpClient — a thin URL-anchored fetch wrapper (fetch is standard\n* across runtimes — no driver, no runtime coupling). http() is a\n* protocol-owned kind: the framework owns the transport, so the client is\n* kind-canonical and derived from the contract, with no user client in the\n* declaration (ADR-0015). The typed generated client arrives with the\n* interface primitive (a later extension point).\n*/\nconst http = (opts) => dependency({\n\tname: opts.name,\n\ttype: \"http\",\n\tconnection: {\n\t\tparams: { url: string() },\n\t\thydrate: (v) => defaultHttpClient({ url: v.url })\n\t}\n});\n//#endregion\n//#region src/postgres.ts\n/**\n* The contract a Postgres provides — and the contract its consumers require.\n* `satisfies` compares KIND, not identity: an extension module can be duplicated\n* across a workspace (same rationale as the Symbol.for node brand), and every\n* duplicate's contract must still satisfy. `__cmp` is the connection config a\n* postgres offers; core never inspects it.\n*/\nconst postgresContract = Object.freeze({\n\tkind: \"postgres\",\n\t__cmp: { url: \"\" },\n\tsatisfies: (required) => required.kind === \"postgres\"\n});\nfunction postgres(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: postgresContract\n\t});\n\treturn dependency({\n\t\ttype: \"postgres\",\n\t\tconnection: {\n\t\t\tparams: { url: string() },\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: postgresContract\n\t});\n}\n//#endregion\n//#region src/s3-credentials.ts\n/**\n* The contract the `s3-credentials` resource provides — a minted SigV4 key\n* pair. `satisfies` compares KIND only (mirrors `postgresContract`); `__cmp` is\n* the config the resource offers, which core never inspects.\n*/\nconst credentialsContract = Object.freeze({\n\tkind: \"credentials\",\n\t__cmp: {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\"\n\t},\n\tsatisfies: (required) => required.kind === \"credentials\"\n});\nfunction s3Credentials(opts) {\n\tif (opts?.name !== void 0) return resource({\n\t\tname: opts.name,\n\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\tprovides: credentialsContract\n\t});\n\treturn dependency({\n\t\ttype: \"credentials\",\n\t\tconnection: {\n\t\t\tparams: {\n\t\t\t\taccessKeyId: string(),\n\t\t\t\tsecretAccessKey: string()\n\t\t\t},\n\t\t\thydrate: (v) => v\n\t\t},\n\t\trequired: credentialsContract\n\t});\n}\n//#endregion\n//#region src/s3-store.ts\n/**\n* The storage service authoring factory — a `compute` service routed to the\n* `s3-store` lowering instead of `compute`'s. It is exactly `compute`'s\n* runnable (run/load/config, deps, params, build, expose) with the routing\n* `type` overridden to `'s3-store'`: nothing at runtime keys off `type` (the\n* serializer keys off the deployment address and each param's owner/name, and\n* `load`/`config` off deps/params), so only the deploy-time descriptor lookup\n* sees the override and routes to the extended-output lowering (§ 5). The\n* return type is compute's exactly (including the reserved `port` param). The\n* storage module (D4b) calls this with its `db`/`credentials` deps, a `bucket`\n* param, and `expose: { store: s3Contract }`.\n*/\nfunction s3StoreService(def) {\n\tconst node = compute(def);\n\treturn Object.freeze(blindCast({\n\t\t...node,\n\t\ttype: \"s3-store\"\n\t}));\n}\n//#endregion\nexport { compute, configKey, credentialsContract, envSecret, http, postgres, postgresContract, s3Credentials, s3StoreService, secretName };\n\n//# sourceMappingURL=index.mjs.map","import { contract, rpc } from \"@internal/rpc\";\nimport { type } from \"arktype\";\nimport { param } from \"@internal/core\";\nimport node from \"@internal/node\";\nimport { compute } from \"@internal/prisma-cloud\";\n//#region src/contract.ts\n/**\n* The one call edge between the scheduler and the app's runner: `trigger(jobId)`.\n* The scheduler depends on it (`rpc(triggerContract)`); the runner exposes it\n* (`expose: { trigger: triggerContract }`). `jobId` travels as data through this\n* single method — adding a job never adds a method, service, or port.\n*/\nconst triggerContract = contract({ trigger: rpc({\n\tinput: type({ jobId: \"string\" }),\n\toutput: type({ ok: \"boolean\" })\n}) });\n//#endregion\n//#region src/schedule.ts\n/**\n* `defineSchedule({ tick: '60s', mrr: '24h' })` →\n* `{ jobs: [{ jobId: 'tick', every: '60s' }, { jobId: 'mrr', every: '24h' }] }`,\n* preserving key order.\n*/\nfunction defineSchedule(spec) {\n\treturn { jobs: Object.entries(spec).map(([jobId, every]) => ({\n\t\tjobId,\n\t\tevery\n\t})) };\n}\n/**\n* Parses the `every` grammar `<integer><unit>`, unit one of `s`/`m`/`h`/`d`\n* (e.g. `30s`, `24h`), returning milliseconds. Throws on a malformed value —\n* empty, missing/unknown unit, non-integer, or non-positive.\n*/\nfunction parseEvery(s) {\n\tconst match = /^(\\d+)([smhd])$/.exec(s);\n\tif (match === null) throw new Error(`parseEvery(): \"${s}\" is not a valid interval — expected \"<integer><unit>\" with unit one of s/m/h/d (e.g. \"30s\", \"24h\").`);\n\tconst [, digits = \"\", unit = \"\"] = match;\n\tconst value = Number(digits);\n\tif (!Number.isInteger(value) || value <= 0) throw new Error(`parseEvery(): \"${s}\" must have a positive integer value.`);\n\tswitch (unit) {\n\t\tcase \"s\": return value * 1e3;\n\t\tcase \"m\": return value * 6e4;\n\t\tcase \"h\": return value * 36e5;\n\t\tcase \"d\": return value * 864e5;\n\t\tdefault: throw new Error(`parseEvery(): \"${s}\" has an unknown unit \"${unit}\" — expected one of s/m/h/d.`);\n\t}\n}\n//#endregion\n//#region src/scheduler.ts\n/**\n* The reusable scheduler node and its firing logic. `cronScheduler` builds a\n* `compute()` whose `jobs` param default is the app's schedule and whose only\n* dependency is `trigger(jobId)`; nothing else about it varies per app.\n* `runScheduler` is the pure, injectable firing loop the entrypoint (and its\n* tests) drive.\n*/\nconst scheduleSchema = type({\n\tjobId: \"string\",\n\tevery: \"string\"\n}).array();\n/**\n* The always-on scheduler service. `schedule` sets only the `jobs` param's\n* default — the value the deploy serializes into config; the scheduler\n* itself is job-agnostic.\n*/\nfunction cronScheduler(schedule) {\n\treturn compute({\n\t\tname: \"scheduler\",\n\t\tdeps: { trigger: rpc(triggerContract) },\n\t\tparams: { jobs: param(scheduleSchema, { default: [...schedule.jobs] }) },\n\t\tbuild: node({\n\t\t\tmodule: new URL(\"./scheduler-service.mjs\", import.meta.url).href,\n\t\t\tentry: \"./scheduler-entrypoint.mjs\"\n\t\t})\n\t});\n}\n/**\n* Fires `call(jobId)` on each job's `every` interval. A rejected `call` is\n* logged, never thrown — a missed tick is healed by an idempotent target, not\n* by scheduler state. `setTimer` defaults to `setInterval`; tests inject a\n* fake to drive time.\n*/\nfunction runScheduler(opts) {\n\tconst setTimer = opts.setTimer ?? ((fn, ms) => setInterval(fn, ms));\n\tfor (const job of opts.jobs) setTimer(() => {\n\t\topts.call(job.jobId).catch((err) => {\n\t\t\tconsole.error(`cron: job \"${job.jobId}\" failed`, err);\n\t\t});\n\t}, parseEvery(job.every));\n}\n//#endregion\nexport { triggerContract as i, runScheduler as n, defineSchedule as r, cronScheduler as t };\n\n//# sourceMappingURL=scheduler-iL9rl3YY.mjs.map","import { i as triggerContract, n as runScheduler, r as defineSchedule, t as cronScheduler } from \"./scheduler-iL9rl3YY.mjs\";\nimport { serve } from \"@internal/rpc\";\nimport { module } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/module.ts\n/**\n* `opts.runner` is a service exposing `{ trigger }`; the returned module\n* provisions it alongside the scheduler that fires `opts.schedule` at it. The\n* module's boundary deps mirror the runner's own deps, so the parent wires the\n* real work target through them, e.g.\n* `provision(cron({ schedule, runner }), { worker: worker.rpc })`. `opts.name`\n* sets the module name (default `'cron'`). Exposes nothing.\n*/\nfunction cron(opts) {\n\treturn module(opts.name ?? \"cron\", { deps: opts.runner.inputs }, ({ inputs, provision }) => {\n\t\tconst runner = provision(opts.runner, {\n\t\t\tid: \"runner\",\n\t\t\tdeps: inputs\n\t\t});\n\t\tprovision(cronScheduler(opts.schedule), {\n\t\t\tid: \"scheduler\",\n\t\t\tdeps: { trigger: runner.trigger }\n\t\t});\n\t\treturn {};\n\t});\n}\n//#endregion\n//#region src/serve-schedule.ts\nfunction serveSchedule(service, _schedule, handlers) {\n\tconst byId = blindCast(handlers);\n\tconst triggerHandler = async (input, deps) => {\n\t\tconst handler = byId[input.jobId];\n\t\tif (handler === void 0) throw new Error(`serveSchedule(): no handler for job id \"${input.jobId}\" — not in the schedule.`);\n\t\tawait handler(deps);\n\t\treturn { ok: true };\n\t};\n\treturn serve(service, blindCast({ trigger: { trigger: triggerHandler } }));\n}\n//#endregion\nexport { cron, cronScheduler, defineSchedule, runScheduler, serveSchedule, triggerContract };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;AASmC,UAAU,OAAO,IAAI,mCAAmC,CAAC;;;;;;;AA0C5F,SAAS,aAAa,MAAM;CAC3B,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;EACjD,MAAM,SAAS,UAAU,KAAK,CAAC,CAAC,WAAW;EAC3C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAAG,QAAQ,KAAK;GAChE,OAAO,EAAE,MAAM;GACf;GACA;EACD,CAAC;CACF;CACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG,QAAQ,KAAK;EACrE,OAAO;EACP;EACA;CACD,CAAC;CACD,OAAO;AACR;AACA,MAAM,aAAa,SAAS,MAAM;CACjC,MAAM,WAAW,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,EAAE,SAAS,CAAC;CAC9D,MAAM,QAAQ,EAAE,UAAU,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK;CACzD,OAAO;EACN;EACA,GAAG;EACH,GAAG;EACH,EAAE;CACH,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,YAAY;AACzB;;;;;;;AAOA,SAAS,OAAO,OAAO,OAAO;CAC7B,OAAO,UAAU,YAAY,KAAK,UAAU,KAAK,IAAI,UAAU,KAAK;AACrE;;AAEA,SAAS,OAAO,OAAO,KAAK;CAC3B,OAAO,UAAU,YAAY,KAAK,MAAM,GAAG,IAAI;AAChD;AACA,SAAS,OAAO,KAAK,GAAG,KAAK;CAC5B,IAAI,EAAE,QAAQ,KAAK,KAAK,QAAQ,KAAK;EACpC,IAAI,EAAE,MAAM,YAAY,KAAK,GAAG,OAAO,EAAE,MAAM;EAC/C,IAAI,EAAE,MAAM,aAAa,MAAM,OAAO,KAAK;EAC3C,MAAM,IAAI,MAAM,kCAAkC,EAAE,KAAK,SAAS,IAAI,EAAE;CACzE;CACA,IAAI;EACH,OAAO,qBAAqB,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;CACjE,SAAS,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,MAAM,IAAI,MAAM,mCAAmC,EAAE,KAAK,SAAS,IAAI,KAAK,SAAS;CACtF;AACD;;;;;;AAMA,MAAM,eAAe,MAAM,YAAY;CACtC,MAAM,UAAU,CAAC;CACjB,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,KAAK,aAAa,IAAI,GAAG;EACnC,MAAM,MAAM,UAAU,SAAS,CAAC;EAChC,MAAM,QAAQ,OAAO,QAAQ,IAAI,MAAM,GAAG,GAAG;EAC7C,IAAI,EAAE,UAAU,WAAW,QAAQ,EAAE,QAAQ;OACxC;GACJ,IAAI,SAAS,OAAO,EAAE,MAAM;GAC5B,IAAI,WAAW,KAAK,GAAG;IACtB,SAAS,CAAC;IACV,OAAO,EAAE,MAAM,SAAS;GACzB;GACA,OAAO,EAAE,QAAQ;EAClB;CACD;CACA,OAAO;EACN;EACA;CACD;AACD;;;;;;;;AAQA,MAAM,SAAS,MAAM,WAAW;CAC/B,KAAK,MAAM,KAAK,aAAa,IAAI,GAAG;EACnC,MAAM,QAAQ,EAAE,UAAU,YAAY,OAAO,QAAQ,EAAE,QAAQ,OAAO,OAAO,EAAE,MAAM,MAAM,GAAG,EAAE;EAChG,IAAI,UAAU,KAAK,GAAG;EACtB,QAAQ,IAAI,UAAU,IAAI,CAAC,KAAK,OAAO,EAAE,OAAO,KAAK;CACtD;AACD;;AAEA,MAAM,aAAa,SAAS,SAAS,UAAU,SAAS;CACvD,OAAO;CACP,MAAM;AACP,CAAC;;;;;;;AAyBD,MAAM,sBAAsB,MAAM,YAAY;CAC7C,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,WAAW,GAAG;EACjD,MAAM,MAAM,UAAU,SAAS,IAAI;EACnC,MAAM,OAAO,QAAQ,IAAI;EACzB,IAAI,SAAS,KAAK,KAAK,SAAS,IAAI,MAAM,IAAI,MAAM,oCAAoC,KAAK,SAAS,IAAI,iCAAiC;EAC3I,MAAM,QAAQ,QAAQ,IAAI;EAC1B,IAAI,UAAU,KAAK,KAAK,UAAU,IAAI,MAAM,IAAI,MAAM,WAAW,KAAK,4BAA4B,IAAI,KAAK,KAAK,uBAAuB,KAAK,qBAAqB;EACjK,OAAO,QAAQ;CAChB;CACA,OAAO;AACR;;;;;;AAMA,MAAM,gBAAgB,MAAM,YAAY;CACvC,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,WAAW,GAAG;EACjD,MAAM,OAAO,QAAQ,IAAI,UAAU,SAAS,IAAI;EAChD,IAAI,SAAS,KAAK,GAAG;EACrB,QAAQ,IAAI,UAAU,IAAI,IAAI,KAAK;CACpC;AACD;;AAEA,SAAS,qBAAqB,QAAQ,OAAO;CAC5C,MAAM,SAAS,OAAO,YAAY,CAAC,SAAS,KAAK;CACjD,IAAI,kBAAkB,SAAS,MAAM,IAAI,MAAM,2HAA2H;CAC1K,IAAI,OAAO,WAAW,KAAK,GAAG,MAAM,IAAI,MAAM,mCAAmC,OAAO,OAAO,KAAK,UAAU,MAAM,OAAO,CAAC,CAAC,KAAK,IAAI,GAAG;CACzI,OAAO,OAAO;AACf;;;ACxMA,MAAM,iBAAiB,EAAE,MAAM,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;AAoBxD,MAAM,WAAW,QAAQ;CACxB,MAAM,aAAa,IAAI,UAAU,UAAU,CAAC,CAAC;CAC7C,KAAK,MAAM,YAAY,OAAO,KAAK,cAAc,GAAG;EACnD,IAAI,YAAY,IAAI,MAAM,MAAM,IAAI,MAAM,0BAA0B,SAAS,qFAAqF;EAClK,IAAI,YAAY,YAAY,MAAM,IAAI,MAAM,qBAAqB,SAAS,gFAAgF;CAC3J;CACA,MAAM,SAAS,UAAU;EACxB,GAAG;EACH,GAAG;CACJ,CAAC;CACD,MAAM,OAAO,QAAQ;EACpB,MAAM,IAAI;EACV,WAAW;EACX,MAAM;EACN,QAAQ,IAAI;EACZ;EACA,GAAG,IAAI,YAAY,KAAK,IAAI,EAAE,SAAS,IAAI,QAAQ,IAAI,CAAC;EACxD,OAAO,IAAI;EACX,GAAG,IAAI,WAAW,KAAK,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;CACtD,CAAC;CACD,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,SAAS,gBAAgB;EACxB,IAAI,aAAa,KAAK,GAAG,WAAW,YAAY,MAAM,EAAE;EACxD,OAAO;CACR;CACA,MAAM,WAAW;EAChB,GAAG;EACH,MAAM,IAAI,SAAS,MAAM;GACxB,MAAM,SAAS,YAAY,MAAM,OAAO;GACxC,MAAM,MAAM,MAAM;GAClB,aAAa,MAAM,OAAO;GAC1B,MAAM,OAAO,OAAO,QAAQ;GAC5B,IAAI,OAAO,SAAS,UAAU,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC/D,OAAO,KAAK;EACb;EACA,OAAO;GACN,IAAI,eAAe,KAAK,GAAG,aAAa,UAAU,YAAY,MAAM,cAAc,CAAC,CAAC;GACpF,OAAO;EACR;EACA,SAAS;GACR,IAAI,iBAAiB,KAAK,GAAG,eAAe,UAAU,cAAc,CAAC,CAAC,OAAO;GAC7E,OAAO;EACR;EACA,UAAU;GACT,IAAI,kBAAkB,KAAK,GAAG,gBAAgB,UAAU,eAAe,MAAM,mBAAmB,MAAM,EAAE,CAAC,CAAC;GAC1G,OAAO;EACR;CACD;CACA,OAAO,OAAO,OAAO,UAAU,QAAQ,CAAC;AACzC;AAiCyB,OAAO,OAAO;CACtC,MAAM;CACN,OAAO,EAAE,KAAK,GAAG;CACjB,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;AAuB2B,OAAO,OAAO;CACzC,MAAM;CACN,OAAO;EACN,aAAa;EACb,iBAAiB;CAClB;CACA,YAAY,aAAa,SAAS,SAAS;AAC5C,CAAC;;;;;;;;;ACnID,MAAM,kBAAkB,SAAS,EAAE,SAAS,IAAI;CAC/C,OAAO,KAAK,EAAE,OAAO,SAAS,CAAC;CAC/B,QAAQ,KAAK,EAAE,IAAI,UAAU,CAAC;AAC/B,CAAC,EAAE,CAAC;;;;;;AAQJ,SAAS,eAAe,MAAM;CAC7B,OAAO,EAAE,MAAM,OAAO,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY;EAC5D;EACA;CACD,EAAE,EAAE;AACL;;;;;;AAMA,SAAS,WAAW,GAAG;CACtB,MAAM,QAAQ,kBAAkB,KAAK,CAAC;CACtC,IAAI,UAAU,MAAM,MAAM,IAAI,MAAM,kBAAkB,EAAE,qGAAqG;CAC7J,MAAM,GAAG,SAAS,IAAI,OAAO,MAAM;CACnC,MAAM,QAAQ,OAAO,MAAM;CAC3B,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG,MAAM,IAAI,MAAM,kBAAkB,EAAE,sCAAsC;CACtH,QAAQ,MAAR;EACC,KAAK,KAAK,OAAO,QAAQ;EACzB,KAAK,KAAK,OAAO,QAAQ;EACzB,KAAK,KAAK,OAAO,QAAQ;EACzB,KAAK,KAAK,OAAO,QAAQ;EACzB,SAAS,MAAM,IAAI,MAAM,kBAAkB,EAAE,yBAAyB,KAAK,6BAA6B;CACzG;AACD;;;;;;;;AAUA,MAAM,iBAAiB,KAAK;CAC3B,OAAO;CACP,OAAO;AACR,CAAC,CAAC,CAAC,MAAM;;;;;;AAMT,SAAS,cAAc,UAAU;CAChC,OAAO,QAAQ;EACd,MAAM;EACN,MAAM,EAAE,SAAS,IAAI,eAAe,EAAE;EACtC,QAAQ,EAAE,MAAM,MAAM,gBAAgB,EAAE,SAAS,CAAC,GAAG,SAAS,IAAI,EAAE,CAAC,EAAE;EACvE,OAAO,KAAK;GACX,QAAQ,IAAI,IAAI,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;GAC5D,OAAO;EACR,CAAC;CACF,CAAC;AACF;;;;;;;AAOA,SAAS,aAAa,MAAM;CAC3B,MAAM,WAAW,KAAK,cAAc,IAAI,OAAO,YAAY,IAAI,EAAE;CACjE,KAAK,MAAM,OAAO,KAAK,MAAM,eAAe;EAC3C,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,OAAO,QAAQ;GACnC,QAAQ,MAAM,cAAc,IAAI,MAAM,WAAW,GAAG;EACrD,CAAC;CACF,GAAG,WAAW,IAAI,KAAK,CAAC;AACzB;;;;;;;;;;;AC7EA,SAAS,KAAK,MAAM;CACnB,OAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,MAAM,KAAK,OAAO,OAAO,IAAI,EAAE,QAAQ,gBAAgB;EAC3F,MAAM,SAAS,UAAU,KAAK,QAAQ;GACrC,IAAI;GACJ,MAAM;EACP,CAAC;EACD,UAAU,cAAc,KAAK,QAAQ,GAAG;GACvC,IAAI;GACJ,MAAM,EAAE,SAAS,OAAO,QAAQ;EACjC,CAAC;EACD,OAAO,CAAC;CACT,CAAC;AACF;AAGA,SAAS,cAAc,SAAS,WAAW,UAAU;CACpD,MAAM,OAAO,UAAU,QAAQ;CAC/B,MAAM,iBAAiB,OAAO,OAAO,SAAS;EAC7C,MAAM,UAAU,KAAK,MAAM;EAC3B,IAAI,YAAY,KAAK,GAAG,MAAM,IAAI,MAAM,2CAA2C,MAAM,MAAM,yBAAyB;EACxH,MAAM,QAAQ,IAAI;EAClB,OAAO,EAAE,IAAI,KAAK;CACnB;CACA,OAAO,MAAM,SAAS,UAAU,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC,CAAC;AAC1E"}