@prisma/composer-prisma-cloud 0.2.0-dev.10 → 0.2.0-dev.12

package/dist/control.mjs

@@ -1403,6 +1403,32 @@ const prismaStateLayer = (ids) => {
 	})).pipe(Layer.orDie);
 };
 //#endregion
+//#region ../../1-prisma-cloud/0-lowering/s3-protocol/dist/index.mjs
+/**
+* AWS SigV4 verification for the S3 wire protocol (spec § 2 auth). The payload
+* hash comes from the client — `x-amz-content-sha256` (a real hash or
+* `UNSIGNED-PAYLOAD`) for header auth, `UNSIGNED-PAYLOAD` for presign — and is
+* never re-hashed; the verifier trusts what was signed, like a real S3 endpoint.
+* Runtime engine code (`node:crypto`); not re-exported from the authoring barrel.
+*
+* Also owns `mintKeyPair` (local-dev spec § 1) — the one key-pair generator
+* both the deploy-time `S3Credentials` resource and the local dev bucket
+* emulator's credential provisioning use.
+*/
+function randomBytes(n) {
+	return crypto.getRandomValues(new Uint8Array(n));
+}
+function toHexUpper(bytes) {
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
+}
+/** A fresh SigV4 key pair: an AKIA-prefixed id and a 40-char base64 secret. */
+function mintKeyPair() {
+	return {
+		accessKeyId: `AKIA${toHexUpper(randomBytes(8))}`,
+		secretAccessKey: btoa(String.fromCharCode(...randomBytes(30)))
+	};
+}
+//#endregion
 //#region ../../1-prisma-cloud/1-extensions/target/dist/control.mjs
 const PRISMA_CLOUD_EXTENSION_ID = "@prisma/composer-prisma-cloud";
 var PrismaCloudContainer = class {
@@ -2093,31 +2119,19 @@ function prismaNextDescriptor(o) {
 /**
 * The `S3Credentials` Alchemy resource (S5) — mints a random SigV4 key pair
 * ONCE at create and keeps it STABLE across deploys, so an unchanged module
-* no-ops on redeploy. The pair is generated with the Web Crypto global
-* (`crypto.getRandomValues` — no `node:` import, matching this package's
-* runtime-coupling invariant) and persisted in Alchemy state; on every later
-* apply the provider returns the persisted attributes (`reconcile`'s `output`)
-* unchanged — the same way the postgres resource keeps a Connection stable.
-* Rotation is destroy/recreate (a platform ask, not solved here).
+* no-ops on redeploy. The pair is generated by `@internal/s3-protocol`'s
+* `mintKeyPair` (moved there per the local-dev spec § 1, so deploy and local
+* dev credential minting share one implementation) and persisted in Alchemy
+* state; on every later apply the provider returns the persisted attributes
+* (`reconcile`'s `output`) unchanged — the same way the postgres resource
+* keeps a Connection stable. Rotation is destroy/recreate (a platform ask,
+* not solved here).
 *
 * Deploy-time only: imports `alchemy`. Imported by `control.ts` and tests,
 * never by `index.ts` / the authoring entry.
 */
 /** The `S3Credentials` resource constructor — `yield* S3Credentials(id, {})` in the lowering. */
 const S3Credentials = Resource("PrismaCloud.S3Credentials");
-function randomBytes(n) {
-	return crypto.getRandomValues(new Uint8Array(n));
-}
-function toHexUpper(bytes) {
-	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
-}
-/** A fresh SigV4 key pair: an AKIA-prefixed id and a 40-char base64 secret. */
-function mintKeyPair() {
-	return {
-		accessKeyId: `AKIA${toHexUpper(randomBytes(8))}`,
-		secretAccessKey: btoa(String.fromCharCode(...randomBytes(30)))
-	};
-}
 /**
 * The `S3Credentials` provider service. `reconcile` runs for create and update;
 * it returns the persisted `output` when present (a redeploy reuses the stored