@prisma/composer-prisma-cloud 0.11.0-dev.3 → 0.11.0-dev.5

package/dist/{s3-credentials-resource-BUsjCFtj-C-nS9rK-.mjs → s3-credentials-resource-BUsjCFtj-BzHGBAmT.mjs}

@@ -10,15 +10,12 @@ import { createManagementApiClient } from "@prisma/management-api-sdk";
 import * as Redacted from "effect/Redacted";
 import * as Data from "effect/Data";
 import * as Option from "effect/Option";
-import * as Provider from "alchemy/Provider";
-import { Resource } from "alchemy";
-import * as crypto$1 from "node:crypto";
 import "node:crypto";
-import * as fs$1 from "node:fs";
 import "node:fs";
-import * as path$1 from "node:path";
 import path from "node:path";
+import * as Provider from "alchemy/Provider";
 import * as Output from "alchemy/Output";
+import { Resource } from "alchemy";
 import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
 import * as Prisma from "alchemy/Prisma";
 import pg from "pg";
@@ -61,7 +58,7 @@ const normalizeBaseUrl = (value) => Effect.try({
 */
 const managementApiBaseUrl = (env) => env !== void 0 ? normalizeBaseUrl(env["PRISMA_API_URL"] || env["PRISMA_MANAGEMENT_API_URL"] || DEFAULT_BASE_URL) : Config$1.string("PRISMA_API_URL").pipe(Config$1.orElse(() => Config$1.string("PRISMA_MANAGEMENT_API_URL")), Config$1.withDefault(DEFAULT_BASE_URL), Effect.flatMap(normalizeBaseUrl));
 //#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-SXZNNmho.mjs
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/database-url-claim-m_nGXIHa.mjs
 /**
 * The typed Prisma Management API client, built once from the resolved
 * credentials. Providers yield this in their outer Effect and call it inside
@@ -97,8 +94,6 @@ const fail = (r) => Effect.fail(new PrismaApiError({
 }));
 /** Unwrap `data`, failing on any API error. Preserves the SDK's response type. */
 const call = (f) => attempt(f).pipe(Effect.flatMap((r) => r.error !== void 0 || r.data === void 0 ? fail(r) : Effect.succeed(r.data)));
-/** Unwrap `data`, mapping a 404 to `undefined` (resource gone / not found). */
-const callOptional = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status === 404 ? Effect.succeed(void 0) : r.error !== void 0 ? fail(r) : Effect.succeed(r.data)));
 /** Fire-and-forget a call, tolerating a 404 (already deleted). */
 const callVoid = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
 /**
@@ -107,8 +102,6 @@ const callVoid = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status
 * — whoever created it — is left exactly as it is.
 */
 const callCreateOnly = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status === 409 || r.error === void 0 ? Effect.void : fail(r)));
-//#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/database-url-claim-BGCE1rXH.mjs
 /** Far beyond any real collection size per listing; hitting it means the API's pagination is broken. */
 const MAX_PAGES = 1e3;
 const brokenPaginationError = (description, reason) => new PrismaApiError({
@@ -330,82 +323,6 @@ const claimDatabaseUrlKeys = (projectId) => Effect.gen(function* () {
 	if (Option.isNone(client)) return;
 	for (const key of RESERVED_DATABASE_URL_KEYS) for (const environmentClass of ENVIRONMENT_CLASSES) yield* claim(client.value, projectId, key, environmentClass);
 });
-/** A Prisma **Object Store bucket** inside a project. */
-const Bucket = Resource("PrismaComposer.Bucket", { aliases: ["Prisma.Bucket"] });
-const BucketProvider = () => Provider.effect(Bucket, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: ["id"],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } })) : void 0;
-			if (observed) return {
-				id: observed.data.id,
-				name: observed.data.name
-			};
-			const created = yield* call(() => client.POST("/v1/buckets", { body: {
-				projectId: news.projectId,
-				name: news.name,
-				...news.branchId !== void 0 ? { branchId: news.branchId } : {}
-			} }));
-			return {
-				id: created.data.id,
-				name: created.data.name
-			};
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
-		}),
-		read: Effect.fn(function* ({ output }) {
-			if (!output?.id) return void 0;
-			const b = yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
-			return b ? {
-				id: b.data.id,
-				name: b.data.name
-			} : void 0;
-		})
-	};
-}));
-/** A **bucket access key** for a Prisma Object Store bucket — yields the S3 credentials. */
-const BucketKey = Resource("PrismaComposer.BucketKey", { aliases: ["Prisma.BucketKey"] });
-const BucketKeyProvider = () => Provider.effect(BucketKey, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: [
-			"id",
-			"bucketId",
-			"secretAccessKey",
-			"accessKeyId",
-			"endpoint",
-			"bucketName"
-		],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			if (output?.id) return output;
-			const created = yield* call(() => client.POST("/v1/buckets/{bucketId}/keys", {
-				params: { path: { bucketId: news.bucketId } },
-				body: {
-					name: news.name,
-					role: news.role
-				}
-			}));
-			return {
-				id: created.data.id,
-				bucketId: news.bucketId,
-				accessKeyId: created.data.accessKeyId,
-				secretAccessKey: Redacted.make(created.data.secretAccessKey),
-				endpoint: created.data.endpoint,
-				bucketName: created.data.bucketName
-			};
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}/keys/{keyId}", { params: { path: {
-				bucketId: output.bucketId,
-				keyId: output.id
-			} } }));
-		})
-	};
-}));
 //#endregion
 //#region ../../0-framework/2-authoring/bundle-paths/dist/index.mjs
 /**
@@ -424,73 +341,6 @@ function isWithin(root, candidate) {
 //#endregion
 //#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute.mjs
 /**
-* The environment is folded into `artifactPath`: the artifact is hard-linked
-* into a sibling directory named by a hash of the environment. The platform
-* materializes env rows into a deployment at create time and never re-reads
-* them (PRO-211), and nothing an `EnvironmentVariable` exposes can ride
-* upstream `Prisma.Deployment`'s replacement block — so a changed environment
-* must move `artifactPath` to ship a new deployment, and an unchanged one
-* must not, so the deployment is reused.
-*
-* No secret ever enters the hash: rows that are secret-free by construction
-* (ADR-0042 literals and pointers) contribute their text; every other row is
-* `withheld` and contributes only its key and what produces its value.
-* Platform variables a row points at (and Composer never writes) contribute
-* their `updatedAt`, so an out-of-band rotation redeploys. Accepted blind
-* spot: a value re-minted in place by the SAME resources does not move the
-* fingerprint — there is no leak-free signal for it at plan time.
-*
-* Replace this with upstream `Prisma.Deployment`'s `redeployOn` once the
-* pinned alchemy has it; the one call site is `descriptors/compute.ts`.
-*/
-/**
-* The exact text the fingerprint hashes — exported so a test can assert what
-* is, and is not, in it. Entries are sorted by key so the row order the
-* serializer happens to produce cannot move the fingerprint.
-*/
-function deployEnvFingerprintMaterial(entries, pointerUpdatedAt) {
-	const rows = entries.map((entry) => ({
-		key: entry.key,
-		row: [
-			entry.key,
-			entry.value !== void 0 ? ["value", entry.value] : ["withheld", entry.withheld],
-			[...entry.pointers ?? []].sort().map((name) => [name, pointerUpdatedAt(name) ?? "?"])
-		]
-	})).sort((a, b) => a.key < b.key ? -1 : 1).map((r) => r.row);
-	return JSON.stringify(rows);
-}
-/** The environment fingerprint: a sha256 hex digest of `deployEnvFingerprintMaterial`. */
-function deployEnvFingerprint(entries, pointerUpdatedAt) {
-	return crypto$1.createHash("sha256").update(deployEnvFingerprintMaterial(entries, pointerUpdatedAt)).digest("hex");
-}
-/** How much of the digest names the directory — enough that two environments never collide in practice, short enough to read in a log line. */
-const FINGERPRINT_PATH_LENGTH = 12;
-/**
-* Hard-links `artifactPath` into a sibling `deploy-env-<fingerprint>`
-* directory and returns the link's path: same bytes, a path that moves if and
-* only if the environment moved. The canonical path is already
-* content-addressed, so a code change moves the parent directory and a
-* fingerprint change moves the child — either one is a new path, which is what
-* upstream plans a replace on. The empty path
-* (`packageComputeArtifact`'s destroy-run placeholder) passes through untouched.
-*/
-function fingerprintedArtifactPath(artifactPath, fingerprint) {
-	if (artifactPath === "") return artifactPath;
-	const dir = path$1.join(path$1.dirname(artifactPath), `deploy-env-${fingerprint.slice(0, FINGERPRINT_PATH_LENGTH)}`);
-	fs$1.mkdirSync(dir, { recursive: true });
-	const linked = path$1.join(dir, path$1.basename(artifactPath));
-	if (!fs$1.existsSync(linked)) try {
-		fs$1.linkSync(artifactPath, linked);
-	} catch (error) {
-		if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) {
-			const tmp = `${linked}.tmp-${String(process.pid)}`;
-			fs$1.copyFileSync(artifactPath, tmp);
-			fs$1.renameSync(tmp, linked);
-		}
-	}
-	return linked;
-}
-/**
 * Orders a deployment AFTER the environment rows it boots with: the platform
 * materializes rows into a deployment at create time and never re-reads them
 * (PRO-211). Alchemy schedules only on resource references inside prop
@@ -500,7 +350,8 @@ function fingerprintedArtifactPath(artifactPath, fingerprint) {
 * treats `{portMapping, skipCodeUpload, artifactPath, artifactContentType}`
 * as one block and returns "no opinion" if any is unresolved (a brand-new
 * variable always is), which would silently skip the artifact comparison.
-* Ordering only: shipping a CHANGED value is deploy-fingerprint.ts's job.
+* Ordering only: shipping a CHANGED value is `Deployment.triggers`' job (the
+* compute descriptor declares one member per environment row).
 */
 const appAfterEnvironment = (app, environment) => environment.length === 0 ? app : Output.flatMap(Output.all(app, ...environment.map((variable) => variable.environmentVariableId)), () => app);
 /**
@@ -560,15 +411,17 @@ const prismaEnvironment = () => Layer.effect(Prisma.PrismaEnvironment, Effect.ge
 }));
 /**
 * Upstream alchemy's live providers for the postgres family (Project,
-* Database, Connection) and the compute family (App, Deployment,
-* EnvironmentVariable), over upstream's management client, authenticated by
+* Database, Connection), the compute family (App, Deployment,
+* EnvironmentVariable), and the bucket family (Bucket, BucketAccessKey),
+* over upstream's management client, authenticated by
 * {@link prismaEnvironment}.
 *
-* alchemy 2.0.0-beta.67 exports only the per-resource provider layers, so
-* they are composed by hand here. TODO: switch to upstream's
-* `liveProviderLayer` in the alchemy release that exports it.
+* Composed from the per-resource provider layers rather than upstream's own
+* `providers()` bundle: that bundle pulls in the profile store
+* (`AlchemyProfile`/`CredentialsStore`), and Composer deliberately runs
+* without one — no TTY prompt, no non-interactive hard-fail.
 */
-const upstreamPrismaProviders = () => Layer.mergeAll(Prisma.ProjectProvider(), Prisma.DatabaseProvider(), Prisma.ConnectionProvider(), Prisma.AppProvider(), Prisma.DeploymentProvider(), Prisma.EnvironmentVariableProvider()).pipe(Layer.provideMerge(Prisma.PrismaClientLive), Layer.provide(NodeHttpClient.layerNodeHttp), Layer.provideMerge(prismaEnvironment()));
+const upstreamPrismaProviders = () => Layer.mergeAll(Prisma.ProjectProvider(), Prisma.DatabaseProvider(), Prisma.ConnectionProvider(), Prisma.AppProvider(), Prisma.DeploymentProvider(), Prisma.EnvironmentVariableProvider(), Prisma.BucketProvider(), Prisma.BucketAccessKeyProvider()).pipe(Layer.provideMerge(Prisma.PrismaClientLive), Layer.provide(NodeHttpClient.layerNodeHttp), Layer.provideMerge(prismaEnvironment()));
 /**
 * The Prisma provider bundle: every resource provider, the Management API
 * client, and env-based credentials. Plug into a stack with
@@ -589,9 +442,9 @@ const providers = () => Layer.effect(Providers, Provider.collection([
 	Prisma.App,
 	Prisma.Deployment,
 	Prisma.EnvironmentVariable,
-	Bucket,
-	BucketKey
-])).pipe(Layer.provide(Layer.mergeAll(upstreamPrismaProviders(), BucketProvider(), BucketKeyProvider())), Layer.provideMerge(NodeHttpClient.layerNodeHttp), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
+	Prisma.Bucket,
+	Prisma.BucketAccessKey
+])).pipe(Layer.provide(upstreamPrismaProviders()), Layer.provideMerge(NodeHttpClient.layerNodeHttp), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
 //#endregion
 //#region ../../1-prisma-cloud/0-lowering/s3-protocol/dist/index.mjs
 /**
@@ -1236,6 +1089,6 @@ const s3CredentialsProviderService = {
 /** The `S3Credentials` provider layer — merged into the extension descriptor's `providers()`. */
 const S3CredentialsProvider = () => Provider.effect(S3Credentials, Effect.succeed(s3CredentialsProviderService));
 //#endregion
-export { claimDatabaseUrlKeys as A, managementApiBaseUrl as B, appAfterEnvironment as C, Bucket as D, isWithin as E, PrismaApiError as F, call as I, layer as L, drivePagesAsync as M, resolveDefaultBranchId as N, BucketKey as O, ManagementClient as P, PrismaCredentials as R, ServiceKeyProvider as S, fingerprintedArtifactPath as T, resolveTargetRef as _, PgWarmProvider as a, providers as b, PrismaCloudContainer as c, collectPreflightNames as d, containerDescriptor as f, resolvePrismaNextConfig as g, prismaCloudContainerOf as h, PgWarm as i, collectPages as j, RESERVED_DATABASE_URL_KEYS as k, S3Credentials as l, packHeadRefHashes as m, GeneratedParamProvider as n, PnMigration as o, deserialize as p, PRISMA_CLOUD_EXTENSION_ID as r, PnMigrationProvider as s, GeneratedParam as t, S3CredentialsProvider as u, mintKeyPair as v, deployEnvFingerprint as w, ServiceKey as x, Providers as y, fromEnv as z };
+export { collectPages as A, appAfterEnvironment as C, RESERVED_DATABASE_URL_KEYS as D, PrismaApiError as E, fromEnv as F, managementApiBaseUrl as I, layer as M, resolveDefaultBranchId as N, call as O, PrismaCredentials as P, ServiceKeyProvider as S, ManagementClient as T, resolveTargetRef as _, PgWarmProvider as a, providers as b, PrismaCloudContainer as c, collectPreflightNames as d, containerDescriptor as f, resolvePrismaNextConfig as g, prismaCloudContainerOf as h, PgWarm as i, drivePagesAsync as j, claimDatabaseUrlKeys as k, S3Credentials as l, packHeadRefHashes as m, GeneratedParamProvider as n, PnMigration as o, deserialize as p, PRISMA_CLOUD_EXTENSION_ID as r, PnMigrationProvider as s, GeneratedParam as t, S3CredentialsProvider as u, mintKeyPair as v, isWithin as w, ServiceKey as x, Providers as y };
 
-//# sourceMappingURL=s3-credentials-resource-BUsjCFtj-C-nS9rK-.mjs.map
+//# sourceMappingURL=s3-credentials-resource-BUsjCFtj-BzHGBAmT.mjs.map