@prisma/composer-prisma-cloud 0.2.0-dev.2 → 0.2.0-dev.4

package/dist/email/testing.mjs

@@ -0,0 +1,1321 @@
+import { type } from "arktype";
+//#region ../../1-prisma-cloud/2-shared-modules/email/dist/testing.mjs
+const nodeBuild = (opts) => ({
+	extension: "@prisma/composer/node",
+	type: "node",
+	module: opts.module,
+	entry: opts.entry,
+	...opts.dir === void 0 ? {} : { dir: opts.dir }
+});
+/**
+* **Last-resort escape hatch for unsafe type assertions. Not a sanctioned tool to reach for.**
+*
+* Before reaching for `blindCast`, **rewrite the surrounding code so the cast becomes
+* unnecessary**: tighten an input type, add a runtime check that narrows via a type
+* predicate, restructure a generic so the compiler can see the relationship you're
+* asserting, or use {@link castAs} when the value already satisfies the target type.
+* Only when no rewrite is feasible does `blindCast` become the right answer — and at
+* that point, the `Reason` literal you supply must articulate the compromise in
+* language a reviewer can evaluate.
+*
+* The reviewer **will** validate the `Reason`. If it doesn't hold up under scrutiny,
+* that is not a signal to soften the reason; it is a signal to go back and solve the
+* underlying type-system problem properly. An unconvincing justification is rework,
+* not a free pass.
+*
+* `blindCast` is the auditable form of `as Foo` / `as unknown as Foo`: it bypasses
+* the compiler's checks (the input type is `unknown`, the output type is whatever the
+* caller asks for), but it forces the unsafety to be named at the call site instead of
+* smuggled in via a bare `as`. The `Reason` type parameter exists only at compile
+* time — it is not present in the emitted JavaScript — but it is grep-able and
+* visible to future readers.
+*
+* @example
+* ```typescript
+* const stringValue = blindCast<
+*   string,
+*   "JSON.parse returns `unknown`; this field is documented to be a string in the API contract"
+* >(parsed[key]);
+* ```
+*
+* @typeParam TargetType - The type the caller is asserting the input has.
+* @typeParam _Reason - A string literal describing why bypassing the type system is necessary here.
+*                     Only meaningful at compile time. The reviewer evaluates whether it justifies the unsafety.
+*/
+function blindCast(input) {
+	return input;
+}
+/**
+* Core model: node types and the factories that construct them, plain frozen
+* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).
+*/
+const NODE = Symbol.for("prisma:node");
+const PROVISION_NEED = blindCast(Symbol.for("prisma:provision-need"));
+/** Builds an opaque provisioning need — the declaring package's own brand plus whatever payload its provisioner reads back. */
+function provisionNeed(brand, payload) {
+	return blindCast(Object.freeze({
+		[PROVISION_NEED]: true,
+		brand,
+		payload
+	}));
+}
+function requireType(type, factory) {
+	if (typeof type !== "string" || type.length === 0) throw new Error(`${factory}() requires a non-empty node type.`);
+}
+function requireName(name, factory) {
+	if (typeof name !== "string" || name.length === 0) throw new Error(`${factory}() requires a non-empty name.`);
+}
+function requireExtension(extension, factory) {
+	if (typeof extension !== "string" || extension.length === 0) throw new Error(`${factory}() requires a non-empty extension (the authoring extension's package name).`);
+}
+/**
+* Core's grammar for every name that becomes a config-key segment —
+* addresses, input/param/secret names: ASCII letters and digits only.
+* Conservative by design so any target medium — POSIX env-var keys
+* included — can uppercase and "_"-join segments without escaping.
+*/
+function isConfigKeySegment(name) {
+	return /^[A-Za-z0-9]+$/.test(name);
+}
+function requireConfigKeySegmentName(name, kind, factory) {
+	if (!isConfigKeySegment(name)) throw new Error(`${factory}() ${kind} name "${name}" must contain only ASCII letters and digits ([A-Za-z0-9]) — declared names derive deterministic config keys, uppercased and joined with "_" (an input "db"'s param "url" becomes config key "DB_URL"), so an underscore inside a name collides with that separator and any other character has no place in a config key. "${name}" would put "${name.toUpperCase()}" inside the derived key.`);
+}
+function requireConfigKeySegmentNames(names, kind, factory) {
+	for (const name of names) requireConfigKeySegmentName(name, kind, factory);
+}
+function freezeParams(params) {
+	const frozen = {};
+	for (const [name, param] of Object.entries(params)) frozen[name] = Object.freeze({ ...param });
+	return Object.freeze(frozen);
+}
+function freezeSecrets(secrets) {
+	const frozen = {};
+	for (const [name, need] of Object.entries(secrets)) frozen[name] = Object.freeze({ ...need });
+	return blindCast(Object.freeze(frozen));
+}
+/** A frozen shallow copy that keeps the caller's declared type. */
+function frozenShallowCopy(obj) {
+	return blindCast(Object.freeze({ ...obj }));
+}
+/**
+* Constructs a branded, frozen Service node — declarations only (inputs,
+* params, build adapter, and the ports it exposes). Pure; carries no runtime behavior.
+*/
+function service(def) {
+	requireName(def.name, "service");
+	requireExtension(def.extension, "service");
+	requireType(def.type, "service");
+	requireConfigKeySegmentNames(Object.keys(def.inputs), "input", "service");
+	requireConfigKeySegmentNames(Object.keys(def.params), "param", "service");
+	requireConfigKeySegmentNames(Object.keys(def.secrets ?? {}), "secret", "service");
+	for (const slot of Object.keys(def.secrets ?? {})) if (Object.hasOwn(def.params, slot)) throw new Error(`service() secret slot "${slot}" collides with a param of the same name — a secret slot and a service param derive the same config key (COMPOSER_<addr>_${slot.toUpperCase()}); rename one.`);
+	return Object.freeze({
+		[NODE]: true,
+		kind: "service",
+		name: def.name,
+		extension: def.extension,
+		type: def.type,
+		inputs: frozenShallowCopy(def.inputs),
+		params: freezeParams(def.params),
+		secretSlots: freezeSecrets(def.secrets ?? blindCast({})),
+		build: Object.freeze({ ...def.build }),
+		expose: def.expose !== void 0 ? frozenShallowCopy(def.expose) : void 0
+	});
+}
+/**
+* Constructs a branded, frozen DependencyEnd. `required` (if given) is the
+* contract Load compares a wired ref against via `satisfies()`; an unnamed
+* end's diagnostic `name` falls back to its `type`.
+*/
+function dependency(def) {
+	requireType(def.type, "dependency");
+	requireConfigKeySegmentNames(Object.keys(def.connection.params), "param", "dependency");
+	const connection = Object.freeze({
+		params: freezeParams(def.connection.params),
+		hydrate: def.connection.hydrate
+	});
+	return Object.freeze({
+		[NODE]: true,
+		kind: "dependency",
+		name: def.name !== void 0 && def.name.length > 0 ? def.name : def.type,
+		type: def.type,
+		connection,
+		required: def.required
+	});
+}
+/**
+* A value wrapper that redacts everywhere except the one explicit reader,
+* `expose()`. Sensitivity is carried by the TYPE (`SecretBox<T>`), not a flag a
+* sink must remember to check: `String(box)`, template interpolation,
+* `JSON.stringify`, and `console.log`/`util.inspect` all print `[REDACTED]`, so
+* a secret can't leak through an accidental log or serialization.
+*
+* Shape matches the platform's own `secrecy` type (pdp-control-plane). The class
+* is nominal enough on its own — no phantom brand.
+*/
+const REDACTED = "[REDACTED]";
+var SecretBox = class {
+	#value;
+	constructor(value) {
+		this.#value = value;
+	}
+	/** The sole explicit door to the wrapped value. */
+	expose() {
+		return this.#value;
+	}
+	toString() {
+		return REDACTED;
+	}
+	toJSON() {
+		return REDACTED;
+	}
+	valueOf() {
+		return REDACTED;
+	}
+	[Symbol.toPrimitive]() {
+		return REDACTED;
+	}
+	[Symbol.for("nodejs.util.inspect.custom")]() {
+		return REDACTED;
+	}
+};
+function scalarSchema(name, check) {
+	return { "~standard": {
+		version: 1,
+		vendor: "@prisma/composer",
+		validate: (value) => check(value) ? { value } : { issues: [{ message: `expected ${name}, got ${typeof value}` }] }
+	} };
+}
+const stringSchema = scalarSchema("string", (v) => typeof v === "string");
+const numberSchema = scalarSchema("number", (v) => typeof v === "number" && Number.isFinite(v));
+function withFacets(schema, opts) {
+	return {
+		schema,
+		...opts.optional !== void 0 ? { optional: opts.optional } : {},
+		...opts.default !== void 0 ? { default: opts.default } : {},
+		...opts.provision !== void 0 ? { provision: opts.provision } : {}
+	};
+}
+/** A string-valued param. */
+function string(opts = {}) {
+	return withFacets(stringSchema, opts);
+}
+/** A number-valued param. */
+function number(opts = {}) {
+	return withFacets(numberSchema, opts);
+}
+/**
+* Synchronous hydrate — what the node's `load()` uses so
+* `const { db } = service.load()` reads without `await`. Requires every
+* connection.hydrate to return synchronously; a Promise return is a loud error
+* naming the input (an async client factory must use the async `hydrate` path).
+*/
+function hydrateSync(root, config) {
+	const deps = {};
+	for (const [name, inputNode] of Object.entries(root.inputs)) {
+		const values = config.inputs[name] ?? {};
+		const client = inputNode.connection.hydrate(values);
+		if (client instanceof Promise) throw new Error(`Connection hydrate for input "${name}" returned a Promise; load() requires a synchronous client factory.`);
+		deps[name] = client;
+	}
+	return deps;
+}
+/**
+* Wraps each of a service's resolved secret values in a redacting `SecretBox`
+* — what the node's `secrets()` accessor returns (ADR-0021, sibling to
+* `load()`/`config()`). The RESOLUTION of a secret's value (the boot
+* double-lookup that reads the platform var the pointer names) is the target
+* pack's job; core is handed the already-resolved strings and only boxes them,
+* so a secret is redacted by TYPE from here on. A declared slot missing from
+* `values` is a target contract violation, named loudly.
+*/
+function hydrateSecrets(root, values) {
+	const boxed = {};
+	for (const slot of Object.keys(root.secretSlots)) {
+		const value = values[slot];
+		if (value === void 0) throw new Error(`secret slot "${slot}" has no resolved value — the target must resolve every declared secret before hydrateSecrets().`);
+		boxed[slot] = new SecretBox(value);
+	}
+	return blindCast(boxed);
+}
+/**
+* Walks a node's own params, then each dependency input's connection params —
+* the same enumeration order `configOf` uses, but carrying the raw
+* `ConfigParam` (with its `serialize`/`deserialize`) instead of a pure-data
+* projection.
+*/
+function paramEntries(node) {
+	const entries = [];
+	for (const [input, value] of Object.entries(node.inputs)) {
+		if (typeof value !== "object" || value === null) continue;
+		const params = blindCast(value).connection.params;
+		for (const [name, param] of Object.entries(params)) entries.push({
+			owner: { input },
+			name,
+			param
+		});
+	}
+	for (const [name, param] of Object.entries(node.params)) entries.push({
+		owner: "service",
+		name,
+		param
+	});
+	return entries;
+}
+const configKey = (address, d) => {
+	const segments = address.split(".").filter((s) => s.length > 0);
+	const owner = d.owner === "service" ? [] : [d.owner.input];
+	return [
+		"COMPOSER",
+		...segments,
+		...owner,
+		d.name
+	].join("_").toUpperCase();
+};
+/**
+* Typed value → its stored string. Service-own literals are JSON-encoded; a
+* dependency-input value is a provisioning ref at deploy (and a resolved
+* string at boot) and passes through untouched — LANDMINE: JSON-encoding it
+* would break the ordering edge Alchemy resolves through it.
+*/
+function encode(owner, value) {
+	return owner === "service" ? JSON.stringify(value) : blindCast(value);
+}
+/** Reverses `encode`: JSON-parse a service-own value, take a dependency-input value raw. */
+function decode(owner, raw) {
+	return owner === "service" ? JSON.parse(raw) : raw;
+}
+const PARAM_POINTER_PREFIX = "@composer-param-pointer:";
+/** True iff `raw` is a param pointer row (as opposed to a JSON-encoded literal). */
+const isParamPointerRow = (raw) => raw.startsWith(PARAM_POINTER_PREFIX);
+/** Reverses `encodeParamPointer`: the platform var NAME a pointer row points to. */
+const decodeParamPointer = (raw) => raw.slice(24);
+function coerce(raw, d, key) {
+	if (!(raw !== void 0 && raw !== "")) {
+		if (d.param.default !== void 0) return d.param.default;
+		if (d.param.optional === true) return void 0;
+		throw new Error(`missing required config param "${d.name}" (env ${key})`);
+	}
+	if (d.owner === "service" && isParamPointerRow(raw)) return coerceEnvSourcedParam(raw, d, key);
+	try {
+		return standardValidateSync(d.param.schema, decode(d.owner, raw));
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`invalid value for config param "${d.name}" (env ${key}): ${message}`);
+	}
+}
+/**
+* Boot resolution for an env-sourced param: double-lookup (pointer → platform
+* var), then the param's own schema on the raw string — no JSON decode, and
+* no redaction (it's config, not a secret). An UNSET platform var is a loud
+* boot failure naming both the param and the platform var; an EMPTY string is
+* not special-cased here — it reaches the schema like any other value, so it
+* passes iff the schema accepts it (deliberately unlike a literal param's own
+* ""-means-absent rule, and unlike a secret's non-empty requirement).
+*/
+function coerceEnvSourcedParam(raw, d, key) {
+	const platformVar = decodeParamPointer(raw);
+	const value = process.env[platformVar];
+	if (value === void 0) throw new Error(`env-sourced config param "${d.name}" (env ${key} → ${platformVar}) is unset: the platform variable "${platformVar}" was not injected — the deploy did not provision it.`);
+	try {
+		return standardValidateSync(d.param.schema, value);
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`invalid value for env-sourced config param "${d.name}" (env ${key} → ${platformVar}): ${message}`);
+	}
+}
+/**
+* Boot: read each declared param from env by its key, reverse the param's own
+* serialization (missing/invalid fails loudly), assemble the typed Config.
+* Secrets ride a separate channel (deserializeSecrets), not this one.
+*/
+const deserialize = (node, address) => {
+	const service = {};
+	const inputs = {};
+	for (const d of paramEntries(node)) {
+		const key = configKey(address, d);
+		const value = coerce(process.env[key], d, key);
+		if (d.owner === "service") service[d.name] = value;
+		else {
+			let bucket = inputs[d.owner.input];
+			if (bucket === void 0) {
+				bucket = {};
+				inputs[d.owner.input] = bucket;
+			}
+			bucket[d.name] = value;
+		}
+	}
+	return {
+		service,
+		inputs
+	};
+};
+/**
+* run()'s setup step: write the resolved config to the environment under
+* address-free keys (configKey("", d) + each serialize suffix), which load()
+* reads back with no address. Uses env, not a module variable, because a
+* framework may fork worker processes that inherit env but not memory.
+* Writes only these keys; nothing else is touched.
+*/
+const stash = (node, config) => {
+	for (const d of paramEntries(node)) {
+		const value = d.owner === "service" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];
+		if (value === void 0) continue;
+		process.env[configKey("", d)] = encode(d.owner, value);
+	}
+};
+/** The pointer-row key for a secret slot: COMPOSER_<addr>_<slot> (secrets are service-level). */
+const secretKey = (address, slot) => configKey(address, {
+	owner: "service",
+	name: slot
+});
+/**
+* Boot: resolve every secret slot to its value by double-lookup — read the
+* pointer key (the platform NAME), then read that platform var. A missing
+* pointer or a missing/empty platform value is a loud failure naming both keys.
+* Returns a plain Record for core's `hydrateSecrets` to box.
+*/
+const deserializeSecrets = (node, address) => {
+	const values = {};
+	for (const slot of Object.keys(node.secretSlots)) {
+		const key = secretKey(address, slot);
+		const name = process.env[key];
+		if (name === void 0 || name === "") throw new Error(`missing secret pointer for slot "${slot}" (env ${key}) — the deploy did not write it.`);
+		const value = process.env[name];
+		if (value === void 0 || value === "") throw new Error(`secret "${slot}" is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
+		values[slot] = value;
+	}
+	return values;
+};
+/**
+* run()'s setup step for secrets: re-emit each slot's pointer NAME under its
+* address-free key, so the address-free `deserializeSecrets` double-looks-up
+* identically. Never the value — the value stays only in the platform var.
+*/
+const stashSecrets = (node, address) => {
+	for (const slot of Object.keys(node.secretSlots)) {
+		const name = process.env[secretKey(address, slot)];
+		if (name === void 0) continue;
+		process.env[secretKey("", slot)] = name;
+	}
+};
+/**
+* Boot: for each reserved provider param, read its address-scoped row through
+* the same `coerce` a declared param uses (JSON-decode, schema-validate), and
+* re-emit it address-free — `stash`'s counterpart for this separate
+* declaration space. A param is declared optional here unconditionally: an
+* absent row means "never provisioned" (local dev, tests, a provider with no
+* registered value for this deploy), never a boot failure, so nothing is
+* stashed and the runtime reader that owns this slot falls back to its own
+* pass-through behavior.
+*/
+function stashProviderParams(entries, address) {
+	for (const entry of entries) {
+		const d = {
+			owner: "service",
+			name: entry.name,
+			param: {
+				schema: entry.schema,
+				optional: true
+			}
+		};
+		const key = configKey(address, d);
+		const value = coerce(process.env[key], d, key);
+		if (value === void 0) continue;
+		process.env[configKey("", d)] = encode("service", value);
+	}
+}
+/** The framework-resolved origin row: COMPOSER_<addr>_ORIGIN. Written per
+*  compute service at serialize — the service's own provisioned endpoint URL,
+*  riding the reserved-provider-param machinery (`origin-key.ts`'s
+*  `ORIGIN_PARAM`); never a declared param, never in config(). A harness with
+*  no deploy behind it supplies it by setting `COMPOSER_ORIGIN` to the
+*  JSON-encoded origin URL — exactly how the existing entrypoint tests supply
+*  their other `COMPOSER_*` rows. */
+const ORIGIN_KEY_NAME = "ORIGIN";
+/**
+* Reads this service's origin back out of the address-free stash
+* `stashProviderParams` wrote for the ORIGIN entry. `COMPOSER_ORIGIN` unset is
+* a loud failure — a deployed environment always writes it, so an unset row
+* means either a local harness that hasn't supplied it or a boot() called
+* before run().
+*/
+function readOrigin() {
+	const d = {
+		owner: "service",
+		name: ORIGIN_KEY_NAME,
+		param: {
+			schema: type("string"),
+			optional: true
+		}
+	};
+	const key = configKey("", d);
+	const value = coerce(process.env[key], d, key);
+	if (value === void 0) throw new Error("this service's origin is not available (env COMPOSER_ORIGIN is unset) — a deployed environment writes it automatically; a local harness must supply it like any other config value (set COMPOSER_ORIGIN to the JSON-encoded origin URL).");
+	return blindCast(value);
+}
+/** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */
+function standardValidateSync(schema, value) {
+	const result = schema["~standard"].validate(value);
+	if (result instanceof Promise) throw new Error("config param schema validation must be synchronous — async Standard Schema validators are not supported for config params");
+	if (result.issues !== void 0) throw new Error(`config param validation failed: ${result.issues.map((issue) => issue.message).join("; ")}`);
+	return result.value;
+}
+/** Bounded jittered backoff for retrying a dropped call. `maxRetries` is retries after the first attempt. */
+const RETRY = {
+	initialDelayMs: 250,
+	multiplier: 2,
+	maxDelayMs: 5e3,
+	maxRetries: 5
+};
+const IDEMPOTENCY_KEY_HEADER$1 = "Idempotency-Key";
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Whether a non-OK response is safe to retry: 429 or any 5xx, never another 4xx. */
+function isRetryableStatus(status) {
+	return status === 429 || status >= 500;
+}
+/** The server's `{ error }` body, if the response has one — undefined otherwise. */
+async function errorDetail(res) {
+	try {
+		const body = await res.json();
+		return typeof body === "object" && body !== null && "error" in body ? String(body.error) : void 0;
+	} catch {
+		return;
+	}
+}
+/** `<base>/rpc/<method>`, preserving a base URL's own path (e.g. a mount point). */
+function methodUrl(base, method) {
+	const normalizedBase = base.endsWith("/") ? base : `${base}/`;
+	return new URL(`rpc/${method}`, normalizedBase).toString();
+}
+/**
+* Sends one call over `send`, retrying a thrown error, 429, or 5xx with
+* full-jitter backoff. `buildRequest` runs per attempt but carries the same
+* idempotency key each time — only the transport call repeats, not the key.
+*/
+async function callWithRetry(send, buildRequest, method) {
+	let delay = RETRY.initialDelayMs;
+	let retries = 0;
+	for (;;) {
+		let res;
+		try {
+			res = await send(buildRequest());
+		} catch (err) {
+			if (retries >= RETRY.maxRetries) throw err;
+			retries += 1;
+			await sleep(Math.random() * delay);
+			delay = Math.min(delay * RETRY.multiplier, RETRY.maxDelayMs);
+			continue;
+		}
+		if (res.ok) return res.json();
+		if (!isRetryableStatus(res.status) || retries >= RETRY.maxRetries) {
+			const detail = await errorDetail(res);
+			throw new Error(`RPC call "${method}" failed: ${res.status} ${res.statusText}` + (detail !== void 0 ? ` — ${detail}` : ""));
+		}
+		retries += 1;
+		await sleep(Math.random() * delay);
+		delay = Math.min(delay * RETRY.multiplier, RETRY.maxDelayMs);
+	}
+}
+function makeClient(contract, url, opts) {
+	const send = opts?.fetch ?? fetch;
+	const baseHeaders = { "content-type": "application/json" };
+	if (opts?.serviceKey !== void 0) baseHeaders["Authorization"] = `Bearer ${opts.serviceKey}`;
+	const client = {};
+	for (const method of Object.keys(contract.__cmp)) client[method] = async (input) => {
+		const idempotencyKey = crypto.randomUUID();
+		const body = JSON.stringify(input);
+		return callWithRetry(send, () => new Request(methodUrl(url, method), {
+			method: "POST",
+			headers: {
+				...baseHeaders,
+				[IDEMPOTENCY_KEY_HEADER$1]: idempotencyKey
+			},
+			body
+		}), method);
+	};
+	return blindCast(client);
+}
+function contract(fns) {
+	const value = {
+		kind: "rpc",
+		__cmp: fns,
+		satisfies: (required) => value === required
+	};
+	return Object.freeze(value);
+}
+/** ADR-0031's need brand for RPC's per-binding service key — the target registers a provisioner under this. */
+const RPC_PEER_KEY = Symbol.for("prisma:rpc/per-binding-key");
+/** The provisioning need `rpc()`'s `serviceKey` param declares (ADR-0030): a shared, unguessable value the target mints per consumer edge. */
+const perBindingToken = () => provisionNeed(RPC_PEER_KEY);
+function rpc(arg) {
+	if (!isRpcContract(arg)) return arg;
+	return dependency({
+		type: "rpc",
+		connection: {
+			params: {
+				url: string(),
+				serviceKey: string({
+					optional: true,
+					provision: perBindingToken()
+				})
+			},
+			hydrate: ({ url, serviceKey }) => makeClient(arg, url, { serviceKey })
+		},
+		required: arg
+	});
+}
+function isRpcContract(value) {
+	return typeof value === "object" && value !== null && "kind" in value && value.kind === "rpc" && "__cmp" in value && "satisfies" in value;
+}
+async function standardValidate(schema, value) {
+	const result = await schema["~standard"].validate(value);
+	if (result.issues !== void 0) throw new Error(`Schema validation failed: ${result.issues.map((issue) => issue.message).join("; ")}`);
+	return result.value;
+}
+/** The reserved env var the target (slice 2) writes the accepted key set to. */
+const RPC_ACCEPTED_KEYS_ENV = "COMPOSER_RPC_ACCEPTED_KEYS";
+function outcome(body, status = 200) {
+	return {
+		status,
+		bodyText: JSON.stringify(body)
+	};
+}
+function toResponse(o) {
+	return new Response(o.bodyText, {
+		status: o.status,
+		headers: { "content-type": "application/json" }
+	});
+}
+/** The generic message every caller-facing 500 carries — the real error goes to `console.error` instead. */
+const INTERNAL_ERROR_MESSAGE = "Internal server error";
+/** Request body cap. Internal RPC payloads are small records, not uploads; 1 MiB bounds a slow request's memory. */
+const MAX_BODY_BYTES = 1048576;
+var RequestBodyTooLargeError = class extends Error {};
+/** Reads the body as text, aborting past `maxBytes` of bytes actually read — `content-length` is caller-supplied, so untrusted. */
+async function readBoundedBody(req, maxBytes) {
+	const reader = req.body?.getReader();
+	if (reader === void 0) return "";
+	const decoder = new TextDecoder();
+	let text = "";
+	let total = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > maxBytes) {
+			await reader.cancel();
+			throw new RequestBodyTooLargeError();
+		}
+		text += decoder.decode(value, { stream: true });
+	}
+	text += decoder.decode();
+	return text;
+}
+/** How long a completed 2xx/4xx answer stays replayable for a repeated key. */
+const REPLAY_TTL_MS = 6e4;
+/**
+* Per-method, per-key deduplication. A duplicate arriving mid-execution
+* single-flights onto the same promise; a completed 2xx/4xx replays for
+* REPLAY_TTL_MS; a 5xx is never kept, since that is what a retry re-executes.
+* Keyed by method first, so a replay can never answer a different method.
+*/
+var IdempotencyStore = class {
+	byMethod = /* @__PURE__ */ new Map();
+	lru = /* @__PURE__ */ new Set();
+	async dispatch(method, key, run) {
+		const bucket = this.bucketFor(method);
+		const existing = bucket.get(key);
+		if (existing?.kind === "pending") return existing.promise;
+		if (existing?.kind === "completed") {
+			if (Date.now() - existing.completedAt < REPLAY_TTL_MS) {
+				this.lru.delete(existing);
+				this.lru.add(existing);
+				return existing.outcome;
+			}
+			bucket.delete(key);
+			this.lru.delete(existing);
+		}
+		const promise = run();
+		bucket.set(key, {
+			kind: "pending",
+			promise
+		});
+		let result;
+		try {
+			result = await promise;
+		} catch (err) {
+			bucket.delete(key);
+			throw err;
+		}
+		if (result.status >= 500) bucket.delete(key);
+		else {
+			const entry = {
+				kind: "completed",
+				outcome: result,
+				completedAt: Date.now(),
+				method,
+				key
+			};
+			bucket.set(key, entry);
+			this.lru.add(entry);
+			this.evictOverflow();
+		}
+		return result;
+	}
+	bucketFor(method) {
+		let bucket = this.byMethod.get(method);
+		if (bucket === void 0) {
+			bucket = /* @__PURE__ */ new Map();
+			this.byMethod.set(method, bucket);
+		}
+		return bucket;
+	}
+	evictOverflow() {
+		if (this.lru.size <= 1e3) return;
+		const oldest = this.lru.values().next().value;
+		if (oldest !== void 0) {
+			this.lru.delete(oldest);
+			this.byMethod.get(oldest.method)?.delete(oldest.key);
+		}
+	}
+};
+/** The provisioned accepted key set, or undefined when the deploy never provisioned one (local/test — enforcement off). */
+function acceptedKeys() {
+	const raw = process.env[RPC_ACCEPTED_KEYS_ENV];
+	if (raw === void 0 || raw === "") return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return [];
+	}
+	return Array.isArray(parsed) && parsed.every((key) => typeof key === "string") ? parsed : [];
+}
+/**
+* Length-independent constant-time string equality — no early exit on the
+* first mismatched character or on a length difference, so a caller cannot
+* time its way toward a valid key. No `node:crypto`, to keep this module
+* runtime-agnostic.
+*/
+function constantTimeEquals(a, b) {
+	const length = Math.max(a.length, b.length);
+	let diff = a.length ^ b.length;
+	for (let i = 0; i < length; i++) diff |= (i < a.length ? a.charCodeAt(i) : 0) ^ (i < b.length ? b.charCodeAt(i) : 0);
+	return diff === 0;
+}
+/** Whether `presented` is a member of `accepted` — always compares against every key. */
+function isAcceptedKey(presented, accepted) {
+	let matched = false;
+	for (const key of accepted) matched = constantTimeEquals(presented, key) || matched;
+	return matched;
+}
+const BEARER_PREFIX = "Bearer ";
+/** The bearer token on `Authorization`, or `''` if the header is missing or malformed. */
+function bearerToken(req) {
+	const header = req.headers.get("authorization");
+	return header?.startsWith(BEARER_PREFIX) ? header.slice(7) : "";
+}
+const IDEMPOTENCY_KEY_HEADER = "Idempotency-Key";
+/**
+* Flattens every exposed port's methods into one method → {schemas, handler}
+* table. RPC dispatch is flat (`/rpc/<method>`), so a method name exposed by
+* more than one port is a construction-time error, as is a missing handler.
+*/
+function methodTable(expose, handlers) {
+	const table = /* @__PURE__ */ new Map();
+	for (const [port, contract] of Object.entries(expose)) {
+		const portHandlers = handlers[port] ?? {};
+		for (const [method, fn] of Object.entries(contract.__cmp)) {
+			if (table.has(method)) throw new Error(`serve(): method "${method}" is exposed by more than one port — RPC dispatch is flat (POST /rpc/<method>), so method names must be unique across a service's exposed ports.`);
+			const handler = portHandlers[method];
+			if (handler === void 0) throw new Error(`serve(): no handler supplied for exposed method "${port}.${method}".`);
+			const { input, output } = blindCast(fn);
+			table.set(method, {
+				input,
+				output,
+				handler
+			});
+		}
+	}
+	return table;
+}
+/**
+* Routes `POST /rpc/<method>`: checks the service key, requires an
+* Idempotency-Key, single-flights/replays through `IdempotencyStore`, and —
+* per call — parses JSON within the body cap, validates input, calls the
+* handler with `service.load()`'s deps plus `{ idempotencyKey }`, validates
+* the output, and responds JSON. A handler or output-validation failure
+* masks its message behind a generic 500 and logs the real error; an
+* unknown method or invalid input is a 4xx. `load()` is called exactly
+* once, here, before the handler ever runs.
+*/
+function serve(service, handlers) {
+	const table = methodTable(service.expose ?? {}, blindCast(handlers));
+	const deps = service.load();
+	const idempotency = new IdempotencyStore();
+	return async (req) => {
+		const accepted = acceptedKeys();
+		if (accepted !== void 0 && !isAcceptedKey(bearerToken(req), accepted)) return toResponse(outcome({ error: "Unauthorized: missing or invalid service key" }, 401));
+		const { pathname } = new URL(req.url);
+		const methodName = /^\/rpc\/([^/]+)$/.exec(pathname)?.[1];
+		if (methodName === void 0) return toResponse(outcome({ error: `Not found: ${pathname}` }, 404));
+		const method = table.get(methodName);
+		if (method === void 0) return toResponse(outcome({ error: `Unknown RPC method "${methodName}"` }, 404));
+		if (req.method !== "POST") return toResponse(outcome({ error: `Method "${methodName}" requires POST` }, 405));
+		const idempotencyKey = req.headers.get(IDEMPOTENCY_KEY_HEADER.toLowerCase()) || void 0;
+		const ctx = { idempotencyKey };
+		const run = async () => {
+			let bodyText;
+			try {
+				bodyText = await readBoundedBody(req, MAX_BODY_BYTES);
+			} catch (err) {
+				if (err instanceof RequestBodyTooLargeError) return outcome({ error: `Request body exceeds the ${MAX_BODY_BYTES}-byte limit` }, 413);
+				console.error(`serve(): reading the request body for "${methodName}" failed:`, err);
+				return outcome({ error: INTERNAL_ERROR_MESSAGE }, 500);
+			}
+			let body;
+			try {
+				body = JSON.parse(bodyText);
+			} catch {
+				return outcome({ error: "Request body must be JSON" }, 400);
+			}
+			let input;
+			try {
+				input = await standardValidate(method.input, body);
+			} catch (err) {
+				return outcome({ error: err instanceof Error ? err.message : String(err) }, 400);
+			}
+			try {
+				const result = await method.handler(input, deps, ctx);
+				let output;
+				try {
+					output = await standardValidate(method.output, result);
+				} catch (err) {
+					console.error(`serve(): handler for "${methodName}" returned output that failed schema validation — this is a provider bug:`, err);
+					return outcome({ error: INTERNAL_ERROR_MESSAGE }, 500);
+				}
+				return outcome(output);
+			} catch (err) {
+				console.error(`serve(): handler for "${methodName}" threw:`, err);
+				return outcome({ error: INTERNAL_ERROR_MESSAGE }, 500);
+			}
+		};
+		return toResponse(idempotencyKey === void 0 ? await run() : await idempotency.dispatch(methodName, idempotencyKey, run));
+	};
+}
+/**
+* The service's own origin as a reserved provider param (ADR-0031): the ONE
+* brand and the ONE entry — shared by control.ts (which registers the
+* deploy-side value function that resolves the provisioned service's
+* `endpointDomain` — see its `selfOriginValue`) and compute.ts (which
+* validates and stashes the row at boot through the generic
+* `stashProviderParams` loop), so writer and reader cannot drift.
+*
+* Unlike the key-minting brands (`service-keys.ts`, `streams-keys.ts`) this
+* brand has no provisioner and no consumer edges: the value derives from the
+* service's OWN provisioned attributes, so control.ts registers it as a
+* service-derived provider param (`descriptors/shared.ts`'s
+* `ServiceProviderParam`) and the descriptor writes it for EVERY compute
+* service, exposing or not.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side value function lives in control.ts, the
+* control-plane-only entry).
+*/
+/** ADR-0031's brand for the service's own origin — control.ts registers the deploy-side value function under this. */
+const SELF_ORIGIN = Symbol.for("prisma:self-origin");
+/**
+* The reserved provider param for the origin row: the var name is `ORIGIN`,
+* derived through `configKey` at both ends (`configKey(address, …)` at
+* deploy, `configKey('', …)` — `COMPOSER_ORIGIN` — at boot, where
+* `readOrigin` reads it back). `brand` is `SELF_ORIGIN` — control.ts looks
+* its deploy-side value function up by this field.
+*/
+const ORIGIN_PARAM = {
+	name: ORIGIN_KEY_NAME,
+	schema: type("string"),
+	brand: SELF_ORIGIN
+};
+/**
+* RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —
+* name + schema + brand — for the accepted-keys set a provider stores, shared
+* by `control.ts` (which registers the deploy-side `value(refs)` that mints
+* and aggregates it — see its `rpcAcceptedKeysValue`) and `compute.ts` (which
+* validates and stashes it at boot), so writer and reader cannot drift.
+* Finding the edges themselves is `provisioned-edges.ts`'s generic,
+* brand-blind scan — RPC is not special-cased anywhere in this target.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side `value(refs)` lives in control.ts, the
+* control-plane-only entry).
+*/
+/**
+* The reserved provider param for RPC's accepted-keys set: the var name is
+* `RPC_ACCEPTED_KEYS`, derived through `configKey` at both ends
+* (`configKey(address, …)` at deploy, `configKey('', …)` at boot — the
+* address-free form is `@internal/service-rpc`'s `RPC_ACCEPTED_KEYS_ENV`). `brand` is
+* `RPC_PEER_KEY`, the same brand `perBindingToken()`'s need carries — control.ts
+* looks its `value(refs)` up by this field.
+*/
+const RPC_ACCEPTED_KEYS_PARAM = {
+	name: "RPC_ACCEPTED_KEYS",
+	schema: type("string[]"),
+	brand: RPC_PEER_KEY
+};
+/** ADR-0031's need brand for the streams module's bearer key — control.ts registers the provisioner under this. */
+const STREAMS_API_KEY = Symbol.for("prisma:streams/api-key");
+/**
+* The reserved provider param for the streams bearer key: the var name is
+* `STREAMS_API_KEY`. `brand` is `STREAMS_API_KEY` itself (the same symbol
+* `streamsApiKeyNeed()`'s need carries) — control.ts looks its `value(refs)`
+* up by this field.
+*/
+const STREAMS_API_KEY_PARAM = {
+	name: "STREAMS_API_KEY",
+	schema: type("string"),
+	brand: STREAMS_API_KEY
+};
+configKey("", {
+	owner: "service",
+	name: STREAMS_API_KEY_PARAM.name
+});
+/**
+* The list of provider-side reserved params the boot path validates and
+* stashes (ADR-0031): every brand's `{name, schema, brand}` declaration,
+* collected from that brand's own module (`service-keys.ts`,
+* `streams-keys.ts`, `origin-key.ts`) so `compute.ts` names no brand itself.
+*
+* This list exists separately from `control.ts`'s deploy-side registry
+* (`PROVIDER_PARAMS`) because `control.ts` is deploy-only code — it imports
+* `@internal/lowering` and `effect` to mint values — and a booted service
+* must never import it. This module is reachable from a user service's
+* bundle through `compute.ts`, so it must never import `@internal/lowering`,
+* `effect`, `alchemy`, or `control.ts`.
+*
+* This is the single source of which reserved provider params exist:
+* control.ts builds `PROVIDER_PARAMS` by mapping over this list and looking
+* up each entry's deploy-side value function (edge-derived `value(refs)` or
+* service-derived `valueForService(provisioned, address)`) by its `brand`,
+* throwing at module load if one is missing. Adding a brand means adding its
+* entry here, plus its deploy-side value function in control.ts — a brand
+* registered for deploy but absent here is no longer expressible, because
+* deploy no longer names its own param set independently.
+*/
+const RESERVED_PROVIDER_PARAMS = [
+	RPC_ACCEPTED_KEYS_PARAM,
+	STREAMS_API_KEY_PARAM,
+	ORIGIN_PARAM
+];
+Object.freeze({
+	kind: "s3",
+	__cmp: {
+		url: "",
+		bucket: "",
+		accessKeyId: "",
+		secretAccessKey: ""
+	},
+	satisfies: (required) => required.kind === "s3"
+});
+const reservedParams = { port: number({ default: 3e3 }) };
+/**
+* A Prisma Compute service — declarations only (deps + params + build + the
+* ports it exposes), no descriptor. `params` merges with the reserved
+* `ReservedParams` (`port`); a user param whose name collides with a reserved
+* one fails at authoring, the same way a colliding dependency name does.
+*
+*   · run(address, boot) — the process controller: deserialize the platform
+*     environment (keyed off `address`, the extension's ONE env read) into a
+*     typed Config, re-emit it under address-free process-local stash keys,
+*     then call boot() to start the app's entry.
+*   · load() / config() — called from inside the app's entry: read the stash;
+*     load() hydrates + memoizes the deps, config() returns the typed params.
+*     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+*   · origin() — this service's platform-assigned public origin, read from the
+*     stash `run()` populates; memoized per process.
+*
+* The underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
+* the control-plane registry key `prisma-composer deploy` resolves through the
+* app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
+* deploy time; nodes are pure data until run() or load() is called.
+*/
+var ComputeService = class {
+	#resolved;
+	#loadedDeps;
+	#loadedParams;
+	#loadedSecrets;
+	#origin;
+	constructor(node) {
+		Object.assign(this, node);
+	}
+	#processConfig() {
+		if (this.#resolved === void 0) this.#resolved = deserialize(this, "");
+		return this.#resolved;
+	}
+	async run(address, boot) {
+		const config = deserialize(this, address);
+		stash(this, config);
+		stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
+		stashSecrets(this, address);
+		const port = config.service["port"];
+		if (typeof port === "number") process.env["PORT"] = String(port);
+		return boot();
+	}
+	load() {
+		if (this.#loadedDeps === void 0) this.#loadedDeps = blindCast(hydrateSync(this, this.#processConfig()));
+		return this.#loadedDeps;
+	}
+	config() {
+		if (this.#loadedParams === void 0) this.#loadedParams = blindCast(this.#processConfig().service);
+		return this.#loadedParams;
+	}
+	secrets() {
+		if (this.#loadedSecrets === void 0) this.#loadedSecrets = blindCast(hydrateSecrets(this, deserializeSecrets(this, "")));
+		return this.#loadedSecrets;
+	}
+	/** This service's platform-assigned public origin — read from the stash
+	*  run() populates and memoized per process. Throws if called before run()
+	*  has stashed it (readOrigin's pinned message). */
+	origin() {
+		this.#origin ??= readOrigin();
+		return this.#origin;
+	}
+};
+const compute = (def) => {
+	const userParams = def.params ?? blindCast({});
+	for (const reserved of Object.keys(reservedParams)) {
+		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
+		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
+	}
+	for (const name of Object.keys(userParams)) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): param "${name}" collides with the framework-written origin row — rename the param.`);
+	for (const name of Object.keys(def.secrets ?? {})) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): secret "${name}" collides with the framework-written origin row — rename the secret.`);
+	const params = blindCast({
+		...userParams,
+		...reservedParams
+	});
+	const instance = new ComputeService(service({
+		name: def.name,
+		extension: "@prisma/composer-prisma-cloud",
+		type: "compute",
+		inputs: def.deps,
+		params,
+		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
+		build: def.build,
+		...def.expose !== void 0 ? { expose: def.expose } : {}
+	}));
+	Object.freeze(instance);
+	return instance;
+};
+Object.freeze({
+	kind: "postgres",
+	__cmp: { url: "" },
+	satisfies: (required) => required.kind === "postgres"
+});
+Object.freeze({
+	kind: "credentials",
+	__cmp: {
+		accessKeyId: "",
+		secretAccessKey: ""
+	},
+	satisfies: (required) => required.kind === "credentials"
+});
+const emailStatus = type("'stored'|'queued'|'sent'|'failed'");
+const emailSendContract = contract({ send: rpc({
+	input: type({
+		templateId: "string",
+		to: "1<=string[]<=50",
+		"cc?": "string[]",
+		"bcc?": "string[]",
+		"replyTo?": "string",
+		subject: "string",
+		html: "string",
+		"text?": "string",
+		idempotencyKey: "1<=string<=256"
+	}),
+	output: type({
+		id: "string",
+		status: emailStatus,
+		"error?": "string"
+	})
+}) });
+const emailRecord = type({
+	id: "string",
+	templateId: "string",
+	to: "string[]",
+	cc: "string[]",
+	bcc: "string[]",
+	replyTo: "string | null",
+	from: "string",
+	subject: "string",
+	html: "string",
+	text: "string | null",
+	status: emailStatus,
+	providerMessageId: "string | null",
+	error: "string | null",
+	attempts: "number",
+	createdAt: "string",
+	updatedAt: "string"
+});
+const emailOutboxContract = contract({
+	getEmail: rpc({
+		input: type({ id: "string" }),
+		output: type({ email: emailRecord.or("null") })
+	}),
+	listEmails: rpc({
+		input: type({
+			"to?": "string",
+			"templateId?": "string",
+			"status?": emailStatus,
+			"cursor?": "string",
+			"limit?": "1<=number.integer<=200"
+		}),
+		output: type({
+			emails: emailRecord.array(),
+			"nextCursor?": "string"
+		})
+	})
+});
+/** Mode `none` never calls `Delivery` (`handlers.ts`'s `send` returns before it) — this placeholder satisfies the required config slot in the entrypoint and the local test server without a real backing. */
+const noneDelivery = { deliver: () => {
+	throw new Error("unreachable: deliveryMode \"none\" never calls Delivery.deliver");
+} };
+/** Not documented to consumers as parseable (spec) — treat the string as opaque outside this pair. */
+function encodeCursor(cursor) {
+	return Buffer.from(`${cursor.createdAt}|${cursor.id}`, "utf-8").toString("base64");
+}
+function decodeCursor(value) {
+	const decoded = Buffer.from(value, "base64").toString("utf-8");
+	const separatorIndex = decoded.indexOf("|");
+	if (separatorIndex === -1) throw new Error(`invalid outbox cursor: ${value}`);
+	return {
+		createdAt: decoded.slice(0, separatorIndex),
+		id: decoded.slice(separatorIndex + 1)
+	};
+}
+const DEFAULT_LIST_LIMIT = 50;
+function toEmailRecord(row) {
+	return {
+		id: row.id,
+		templateId: row.templateId,
+		to: [...row.to],
+		cc: [...row.cc],
+		bcc: [...row.bcc],
+		replyTo: row.replyTo,
+		from: row.from,
+		subject: row.subject,
+		html: row.html,
+		text: row.text,
+		status: row.status,
+		providerMessageId: row.providerMessageId,
+		error: row.error,
+		attempts: row.attempts,
+		createdAt: row.createdAt,
+		updatedAt: row.updatedAt
+	};
+}
+function toSendResult(row) {
+	return row.error === null ? {
+		id: row.id,
+		status: row.status
+	} : {
+		id: row.id,
+		status: row.status,
+		error: row.error
+	};
+}
+function createHandlers(config) {
+	const { store, delivery, deliveryMode, from } = config;
+	async function send(input) {
+		const status = deliveryMode === "none" ? "stored" : "queued";
+		const outcome = await store.insert({
+			id: crypto.randomUUID(),
+			templateId: input.templateId,
+			to: input.to,
+			cc: input.cc ?? [],
+			bcc: input.bcc ?? [],
+			replyTo: input.replyTo ?? null,
+			from,
+			subject: input.subject,
+			html: input.html,
+			text: input.text ?? null,
+			status,
+			idempotencyKey: input.idempotencyKey
+		});
+		if (!outcome.inserted || deliveryMode === "none") return toSendResult(outcome.row);
+		const result = await delivery.deliver(outcome.row).catch((caught) => ({
+			ok: false,
+			error: caught instanceof Error ? caught.message : String(caught),
+			attempts: 1
+		}));
+		return toSendResult(await store.updateDelivery(outcome.row.id, result.ok ? {
+			status: "sent",
+			providerMessageId: result.providerMessageId,
+			attempts: result.attempts
+		} : {
+			status: "failed",
+			error: result.error,
+			attempts: result.attempts
+		}));
+	}
+	async function getEmail(input) {
+		const row = await store.getById(input.id);
+		return { email: row === null ? null : toEmailRecord(row) };
+	}
+	async function listEmails(input) {
+		const limit = input.limit ?? DEFAULT_LIST_LIMIT;
+		const after = input.cursor === void 0 ? void 0 : decodeCursor(input.cursor);
+		const page = await store.list({
+			...input.to !== void 0 ? { to: input.to } : {},
+			...input.templateId !== void 0 ? { templateId: input.templateId } : {},
+			...input.status !== void 0 ? { status: input.status } : {},
+			...after !== void 0 ? { after } : {},
+			limit
+		});
+		const last = page.rows.at(-1);
+		return {
+			emails: page.rows.map(toEmailRecord),
+			...page.hasMore && last !== void 0 ? { nextCursor: encodeCursor({
+				createdAt: last.createdAt,
+				id: last.id
+			}) } : {}
+		};
+	}
+	return {
+		send,
+		getEmail,
+		listEmails
+	};
+}
+var MemoryOutboxStore = class {
+	rowsById = /* @__PURE__ */ new Map();
+	idByIdempotencyKey = /* @__PURE__ */ new Map();
+	async insert(row) {
+		const existingId = this.idByIdempotencyKey.get(row.idempotencyKey);
+		if (existingId !== void 0) {
+			const existing = this.rowsById.get(existingId);
+			if (existing === void 0) throw new Error(`outbox insert: idempotency index pointed at a missing row ${existingId}`);
+			return {
+				row: existing,
+				inserted: false
+			};
+		}
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const inserted = {
+			id: row.id,
+			templateId: row.templateId,
+			to: [...row.to],
+			cc: [...row.cc],
+			bcc: [...row.bcc],
+			replyTo: row.replyTo,
+			from: row.from,
+			subject: row.subject,
+			html: row.html,
+			text: row.text,
+			status: row.status,
+			providerMessageId: null,
+			error: null,
+			idempotencyKey: row.idempotencyKey,
+			attempts: 0,
+			createdAt: now,
+			updatedAt: now
+		};
+		this.rowsById.set(row.id, inserted);
+		this.idByIdempotencyKey.set(row.idempotencyKey, row.id);
+		return {
+			row: inserted,
+			inserted: true
+		};
+	}
+	async updateDelivery(id, update) {
+		const existing = this.rowsById.get(id);
+		if (existing === void 0) throw new Error(`outbox updateDelivery: no row found for id ${id}`);
+		const updated = {
+			...existing,
+			status: update.status,
+			providerMessageId: update.status === "sent" ? update.providerMessageId : null,
+			error: update.status === "failed" ? update.error : null,
+			attempts: existing.attempts + update.attempts,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		this.rowsById.set(id, updated);
+		return updated;
+	}
+	async getById(id) {
+		return this.rowsById.get(id) ?? null;
+	}
+	async list(filters) {
+		const matches = [...this.rowsById.values()].filter((row) => filters.to === void 0 || row.to.includes(filters.to)).filter((row) => filters.templateId === void 0 || row.templateId === filters.templateId).filter((row) => filters.status === void 0 || row.status === filters.status).sort((a, b) => {
+			if (a.createdAt !== b.createdAt) return a.createdAt < b.createdAt ? 1 : -1;
+			return a.id < b.id ? 1 : -1;
+		}).filter((row) => {
+			const after = filters.after;
+			if (after === void 0) return true;
+			if (row.createdAt !== after.createdAt) return row.createdAt < after.createdAt;
+			return row.id < after.id;
+		});
+		const hasMore = matches.length > filters.limit;
+		return {
+			rows: hasMore ? matches.slice(0, filters.limit) : matches,
+			hasMore
+		};
+	}
+};
+function createMemoryOutboxStore() {
+	return new MemoryOutboxStore();
+}
+/**
+* The local stand-in: boots `handlers.ts` over the in-memory store with
+* `deliveryMode: 'none'`, loopback only, no auth (`serve()`'s accepted-keys
+* pass-through when the env set is absent — the same as any un-deployed
+* service). `serve()` needs a service node with the right `expose`, so this
+* wraps a bare `compute()` whose `build` is inert (never assembled or
+* deployed) — mirrors the auth module's test fake
+* (`examples/storefront-auth/modules/auth/testing/fake.ts`), promoted here
+* to the module's own official local-dev surface.
+*/
+async function startLocalEmailServer(opts) {
+	const localService = compute({
+		name: "emailLocal",
+		deps: {},
+		build: nodeBuild({
+			module: import.meta.url,
+			entry: "testing.ts"
+		}),
+		expose: {
+			send: emailSendContract,
+			outbox: emailOutboxContract
+		}
+	});
+	const handlers = createHandlers({
+		store: createMemoryOutboxStore(),
+		delivery: noneDelivery,
+		deliveryMode: "none",
+		from: "local@example.com"
+	});
+	const fetchHandler = serve(localService, {
+		send: { send: handlers.send },
+		outbox: {
+			getEmail: handlers.getEmail,
+			listEmails: handlers.listEmails
+		}
+	});
+	const server = Bun.serve({
+		port: opts?.port ?? 0,
+		hostname: "127.0.0.1",
+		fetch: fetchHandler
+	});
+	return {
+		url: `http://127.0.0.1:${server.port}`,
+		stop: async () => {
+			server.stop(true);
+		}
+	};
+}
+//#endregion
+export { startLocalEmailServer };
+
+//# sourceMappingURL=testing.mjs.map