@prisma/composer-prisma-cloud 0.2.0 → 0.3.0-dev.1

package/dist/preflight-names-BPL-qsZF-BfoRgbgb.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight-names-BPL-qsZF-BfoRgbgb.mjs","names":["Config","os","randomBytes","managementClientLayer"],"sources":["../../../1-prisma-cloud/0-lowering/lowering/dist/http-CJM0E6rj.mjs","../../../1-prisma-cloud/0-lowering/lowering/dist/buckets.mjs","../../../1-prisma-cloud/0-lowering/lowering/dist/compute.mjs","../../../1-prisma-cloud/0-lowering/lowering/dist/postgres.mjs","../../../1-prisma-cloud/0-lowering/lowering/dist/index.mjs","../../../1-prisma-cloud/0-lowering/s3-protocol/dist/index.mjs","../../../1-prisma-cloud/1-extensions/target/dist/preflight-names-BPL-qsZF.mjs"],"sourcesContent":["import { createManagementApiClient } from \"@prisma/management-api-sdk\";\nimport * as Context from \"effect/Context\";\nimport * as Effect from \"effect/Effect\";\nimport * as Layer from \"effect/Layer\";\nimport * as Redacted from \"effect/Redacted\";\nimport * as Config from \"effect/Config\";\nimport * as Data from \"effect/Data\";\n//#region src/credentials.ts\n/**\n* The Prisma service token used to authenticate Management API calls. Kept\n* as a Redacted value so it never lands in logs or error output.\n*/\nvar PrismaCredentials = class extends Context.Service()(\"PrismaCredentials\") {};\n/** Resolve the token from the `PRISMA_SERVICE_TOKEN` environment variable. */\nconst fromEnv = () => Layer.effect(PrismaCredentials, Effect.gen(function* () {\n\treturn { token: yield* Config.redacted(\"PRISMA_SERVICE_TOKEN\") };\n}));\n//#endregion\n//#region src/client.ts\n/**\n* The typed Prisma Management API client, built once from the resolved\n* credentials. Providers yield this in their outer Effect and call it inside\n* `reconcile` / `delete`.\n*/\nvar ManagementClient = class extends Context.Service()(\"PrismaManagementClient\") {};\nconst layer = () => Layer.effect(ManagementClient, Effect.gen(function* () {\n\tconst { token } = yield* PrismaCredentials;\n\treturn createManagementApiClient({ token: Redacted.value(token) });\n}));\n//#endregion\n//#region src/http.ts\n/** A non-2xx response from the Management API (or a transport failure). */\nvar PrismaApiError = class extends Data.TaggedError(\"PrismaApiError\") {};\nconst attempt = (f) => Effect.tryPromise({\n\ttry: f,\n\tcatch: (cause) => new PrismaApiError({\n\t\tstatus: 0,\n\t\tmessage: String(cause)\n\t})\n});\nconst fail = (r) => Effect.fail(new PrismaApiError({\n\tstatus: r.response.status,\n\tmessage: JSON.stringify(r.error)\n}));\n/** Unwrap `data`, failing on any API error. Preserves the SDK's response type. */\nconst call = (f) => attempt(f).pipe(Effect.flatMap((r) => r.error !== void 0 || r.data === void 0 ? fail(r) : Effect.succeed(r.data)));\n/** Unwrap `data`, mapping a 404 to `undefined` (resource gone / not found). */\nconst callOptional = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status === 404 ? Effect.succeed(void 0) : r.error !== void 0 ? fail(r) : Effect.succeed(r.data)));\n/** Fire-and-forget a call, tolerating a 404 (already deleted). */\nconst callVoid = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));\n//#endregion\nexport { ManagementClient as a, fromEnv as c, callVoid as i, call as n, layer as o, callOptional as r, PrismaCredentials as s, PrismaApiError as t };\n\n//# sourceMappingURL=http-CJM0E6rj.mjs.map","import { a as ManagementClient, i as callVoid, n as call, r as callOptional } from \"./http-CJM0E6rj.mjs\";\nimport * as Effect from \"effect/Effect\";\nimport * as Redacted from \"effect/Redacted\";\nimport * as Provider from \"alchemy/Provider\";\nimport { Resource } from \"alchemy\";\n//#region src/buckets/Bucket.ts\n/** A Prisma **Object Store bucket** inside a project. */\nconst Bucket = Resource(\"Prisma.Bucket\");\nconst BucketProvider = () => Provider.effect(Bucket, Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\treturn {\n\t\tstables: [\"id\"],\n\t\tlist: () => Effect.succeed([]),\n\t\treconcile: Effect.fn(function* ({ news, output }) {\n\t\t\tconst observed = output?.id ? yield* callOptional(() => client.GET(\"/v1/buckets/{bucketId}\", { params: { path: { bucketId: output.id } } })) : void 0;\n\t\t\tif (observed) return {\n\t\t\t\tid: observed.data.id,\n\t\t\t\tname: observed.data.name\n\t\t\t};\n\t\t\tconst created = yield* call(() => client.POST(\"/v1/buckets\", { body: {\n\t\t\t\tprojectId: news.projectId,\n\t\t\t\tname: news.name,\n\t\t\t\t...news.branchId !== void 0 ? { branchId: news.branchId } : {}\n\t\t\t} }));\n\t\t\treturn {\n\t\t\t\tid: created.data.id,\n\t\t\t\tname: created.data.name\n\t\t\t};\n\t\t}),\n\t\tdelete: Effect.fn(function* ({ output }) {\n\t\t\tyield* callVoid(() => client.DELETE(\"/v1/buckets/{bucketId}\", { params: { path: { bucketId: output.id } } }));\n\t\t}),\n\t\tread: Effect.fn(function* ({ output }) {\n\t\t\tif (!output?.id) return void 0;\n\t\t\tconst b = yield* callOptional(() => client.GET(\"/v1/buckets/{bucketId}\", { params: { path: { bucketId: output.id } } }));\n\t\t\treturn b ? {\n\t\t\t\tid: b.data.id,\n\t\t\t\tname: b.data.name\n\t\t\t} : void 0;\n\t\t})\n\t};\n}));\n//#endregion\n//#region src/buckets/BucketKey.ts\n/** A **bucket access key** for a Prisma Object Store bucket — yields the S3 credentials. */\nconst BucketKey = Resource(\"Prisma.BucketKey\");\nconst BucketKeyProvider = () => Provider.effect(BucketKey, Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\treturn {\n\t\tstables: [\n\t\t\t\"id\",\n\t\t\t\"bucketId\",\n\t\t\t\"secretAccessKey\",\n\t\t\t\"accessKeyId\",\n\t\t\t\"endpoint\",\n\t\t\t\"bucketName\"\n\t\t],\n\t\tlist: () => Effect.succeed([]),\n\t\treconcile: Effect.fn(function* ({ news, output }) {\n\t\t\tif (output?.id) return output;\n\t\t\tconst created = yield* call(() => client.POST(\"/v1/buckets/{bucketId}/keys\", {\n\t\t\t\tparams: { path: { bucketId: news.bucketId } },\n\t\t\t\tbody: {\n\t\t\t\t\tname: news.name,\n\t\t\t\t\trole: news.role\n\t\t\t\t}\n\t\t\t}));\n\t\t\treturn {\n\t\t\t\tid: created.data.id,\n\t\t\t\tbucketId: news.bucketId,\n\t\t\t\taccessKeyId: created.data.accessKeyId,\n\t\t\t\tsecretAccessKey: Redacted.make(created.data.secretAccessKey),\n\t\t\t\tendpoint: created.data.endpoint,\n\t\t\t\tbucketName: created.data.bucketName\n\t\t\t};\n\t\t}),\n\t\tdelete: Effect.fn(function* ({ output }) {\n\t\t\tyield* callVoid(() => client.DELETE(\"/v1/buckets/{bucketId}/keys/{keyId}\", { params: { path: {\n\t\t\t\tbucketId: output.bucketId,\n\t\t\t\tkeyId: output.id\n\t\t\t} } }));\n\t\t})\n\t};\n}));\n//#endregion\nexport { Bucket, BucketKey, BucketKeyProvider, BucketProvider };\n\n//# sourceMappingURL=buckets.mjs.map","import { a as ManagementClient, i as callVoid, n as call, r as callOptional, t as PrismaApiError } from \"./http-CJM0E6rj.mjs\";\nimport * as Effect from \"effect/Effect\";\nimport * as Provider from \"alchemy/Provider\";\nimport { Resource } from \"alchemy\";\nimport * as Schedule from \"effect/Schedule\";\nimport * as fs from \"node:fs\";\nimport * as crypto$1 from \"node:crypto\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport * as zlib from \"node:zlib\";\n//#region src/compute/ComputeService.ts\n/**\n* Stopping a deployment before the app that owns it can be\n* deleted is asynchronous on the platform's side: DELETE can 409 with this\n* message while the deployment is still winding down. Retrying blindly on\n* every API error would mask real failures (bad auth, a genuinely conflicting\n* state, etc.), so this only matches the platform's specific \"not delete-safe\n* yet\" wording — everything else fails immediately, as before.\n*/\nconst isDeleteNotSafeYet = (error) => error.message.includes(\"did not reach a delete-safe state\");\n/**\n* Backs off exponentially from 2s, capped at 5 minutes total — long enough\n* for the platform to finish stopping the deployment, short enough to still\n* fail loudly (rather than hang forever) if it never does.\n*/\nconst deleteSafeRetrySchedule = Schedule.both(Schedule.exponential(\"2 seconds\", 2), Schedule.during(\"5 minutes\"));\n/** Every region Prisma Compute serves — the runtime source of truth; `ComputeRegion` is derived from it so the two can never drift. */\nconst COMPUTE_REGIONS = [\n\t\"us-east-1\",\n\t\"us-west-1\",\n\t\"eu-west-3\",\n\t\"eu-central-1\",\n\t\"ap-northeast-1\",\n\t\"ap-southeast-1\"\n];\n/** A Prisma **Compute service** — the stable app identity behind a project. */\nconst ComputeService = Resource(\"Prisma.ComputeService\");\nconst ComputeServiceProvider = () => Provider.effect(ComputeService, Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\treturn {\n\t\tstables: [\"id\"],\n\t\tlist: () => Effect.succeed([]),\n\t\treconcile: Effect.fn(function* ({ news, output }) {\n\t\t\tconst observed = output?.id ? yield* callOptional(() => client.GET(\"/v1/apps/{appId}\", { params: { path: { appId: output.id } } })) : void 0;\n\t\t\tif (observed) return {\n\t\t\t\tid: observed.data.id,\n\t\t\t\tname: observed.data.name,\n\t\t\t\tendpointDomain: observed.data.appEndpointDomain\n\t\t\t};\n\t\t\tconst created = yield* call(() => client.POST(\"/v1/apps\", { body: {\n\t\t\t\tdisplayName: news.name,\n\t\t\t\tprojectId: news.projectId,\n\t\t\t\t...news.region && { regionId: news.region },\n\t\t\t\t...news.branchId !== void 0 && { branchId: news.branchId }\n\t\t\t} }));\n\t\t\treturn {\n\t\t\t\tid: created.data.id,\n\t\t\t\tname: created.data.name,\n\t\t\t\tendpointDomain: created.data.appEndpointDomain\n\t\t\t};\n\t\t}),\n\t\tdelete: Effect.fn(function* ({ output }) {\n\t\t\tyield* callVoid(() => client.DELETE(\"/v1/apps/{appId}\", { params: { path: { appId: output.id } } })).pipe(Effect.retry({\n\t\t\t\tschedule: deleteSafeRetrySchedule,\n\t\t\t\twhile: isDeleteNotSafeYet\n\t\t\t}));\n\t\t}),\n\t\tread: Effect.fn(function* ({ output }) {\n\t\t\tif (!output?.id) return void 0;\n\t\t\tconst s = yield* callOptional(() => client.GET(\"/v1/apps/{appId}\", { params: { path: { appId: output.id } } }));\n\t\t\treturn s ? {\n\t\t\t\tid: s.data.id,\n\t\t\t\tname: s.data.name,\n\t\t\t\tendpointDomain: s.data.appEndpointDomain\n\t\t\t} : void 0;\n\t\t})\n\t};\n}));\n//#endregion\n//#region src/compute/Deployment.ts\n/**\n* A **deployment** of a Prisma app — creates a deployment, uploads\n* its artifact, starts the VM, waits for it to run, then promotes it to the\n* app's stable endpoint.\n*/\nconst Deployment = Resource(\"Prisma.Deployment\");\nconst DeploymentProvider = () => Provider.effect(Deployment, Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\tconst waitForRunning = (deploymentId) => call(() => client.GET(\"/v1/deployments/{deploymentId}\", { params: { path: { deploymentId } } })).pipe(Effect.flatMap((v) => v.data.status === \"running\" ? Effect.void : Effect.fail(new PrismaApiError({\n\t\tstatus: 409,\n\t\tmessage: `deployment ${deploymentId} is ${v.data.status}, not running`\n\t}))), Effect.retry(Schedule.both(Schedule.spaced(\"2 seconds\"), Schedule.during(\"2 minutes\"))));\n\treturn {\n\t\tstables: [],\n\t\tlist: () => Effect.succeed([]),\n\t\treconcile: Effect.fn(function* ({ news }) {\n\t\t\tconst created = yield* call(() => client.POST(\"/v1/apps/{appId}/deployments\", {\n\t\t\t\tparams: { path: { appId: news.computeServiceId } },\n\t\t\t\tbody: news.port !== void 0 ? { portMapping: { http: news.port } } : {}\n\t\t\t}));\n\t\t\tconst deploymentId = created.data.id;\n\t\t\tif (created.data.uploadUrl) {\n\t\t\t\tconst uploadUrl = created.data.uploadUrl;\n\t\t\t\tconst artifact = yield* Effect.try({\n\t\t\t\t\ttry: () => fs.readFileSync(news.artifactPath),\n\t\t\t\t\tcatch: (cause) => new PrismaApiError({\n\t\t\t\t\t\tstatus: 0,\n\t\t\t\t\t\tmessage: `failed to read artifact ${news.artifactPath}: ${String(cause)}`\n\t\t\t\t\t})\n\t\t\t\t});\n\t\t\t\tyield* Effect.tryPromise({\n\t\t\t\t\ttry: async () => {\n\t\t\t\t\t\tconst res = await fetch(uploadUrl, {\n\t\t\t\t\t\t\tmethod: \"PUT\",\n\t\t\t\t\t\t\tbody: artifact\n\t\t\t\t\t\t});\n\t\t\t\t\t\tif (!res.ok) throw new PrismaApiError({\n\t\t\t\t\t\t\tstatus: res.status,\n\t\t\t\t\t\t\tmessage: `artifact upload failed: ${res.status} ${res.statusText}`\n\t\t\t\t\t\t});\n\t\t\t\t\t},\n\t\t\t\t\tcatch: (cause) => cause instanceof PrismaApiError ? cause : new PrismaApiError({\n\t\t\t\t\t\tstatus: 0,\n\t\t\t\t\t\tmessage: String(cause)\n\t\t\t\t\t})\n\t\t\t\t});\n\t\t\t}\n\t\t\tyield* call(() => client.POST(\"/v1/deployments/{deploymentId}/start\", { params: { path: { deploymentId } } }));\n\t\t\tyield* waitForRunning(deploymentId);\n\t\t\tconst deployedUrl = (yield* call(() => client.POST(\"/v1/apps/{appId}/promote\", {\n\t\t\t\tparams: { path: { appId: news.computeServiceId } },\n\t\t\t\tbody: { deploymentId }\n\t\t\t}))).data.appEndpointDomain;\n\t\t\treturn {\n\t\t\t\tdeploymentId,\n\t\t\t\t...deployedUrl !== void 0 && { deployedUrl }\n\t\t\t};\n\t\t}),\n\t\tdelete: Effect.fn(function* () {}),\n\t\tread: Effect.fn(function* ({ output }) {\n\t\t\tif (!output?.deploymentId) return void 0;\n\t\t\tconst v = yield* callOptional(() => client.GET(\"/v1/deployments/{deploymentId}\", { params: { path: { deploymentId: output.deploymentId } } }));\n\t\t\treturn v ? {\n\t\t\t\tdeploymentId: v.data.id,\n\t\t\t\t...v.data.previewDomain && { deployedUrl: v.data.previewDomain }\n\t\t\t} : void 0;\n\t\t})\n\t};\n}));\n//#endregion\n//#region src/compute/EnvironmentVariable.ts\n/**\n* A project-scoped **environment variable** that Compute injects into the\n* project's services from their attached branch (e.g. wiring one module's URL into\n* another).\n*/\nconst EnvironmentVariable = Resource(\"Prisma.EnvironmentVariable\");\nconst EnvironmentVariableProvider = () => Provider.effect(EnvironmentVariable, Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\treturn {\n\t\tstables: [\"id\"],\n\t\tlist: () => Effect.succeed([]),\n\t\treconcile: Effect.fn(function* ({ news, output }) {\n\t\t\tconst cls = news.class ?? \"production\";\n\t\t\tlet id = output?.id;\n\t\t\tif (id !== void 0) {\n\t\t\t\tconst priorId = id;\n\t\t\t\tif (!(yield* callOptional(() => client.GET(\"/v1/environment-variables/{envVarId}\", { params: { path: { envVarId: priorId } } })))) id = void 0;\n\t\t\t}\n\t\t\tif (id === void 0) {\n\t\t\t\tconst matchId = (yield* call(() => client.GET(\"/v1/environment-variables\", { params: { query: {\n\t\t\t\t\tprojectId: news.projectId,\n\t\t\t\t\tclass: cls,\n\t\t\t\t\tkey: news.key\n\t\t\t\t} } }))).data?.[0]?.id;\n\t\t\t\tif (matchId !== void 0) {\n\t\t\t\t\tif (!(news.key === \"DATABASE_URL\" || news.key === \"DATABASE_URL_POOLED\")) throw new Error(`EnvironmentVariable \"${news.key}\" (project \"${news.projectId}\", class \"${cls}\") exists but is untracked in this deploy state — refusing to overwrite a reserved COMPOSER_ key. Restore this deploy's hosted state, or remove the variable to let this deploy recreate it.`);\n\t\t\t\t\tid = matchId;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (id !== void 0) {\n\t\t\t\tconst targetId = id;\n\t\t\t\tyield* call(() => client.PATCH(\"/v1/environment-variables/{envVarId}\", {\n\t\t\t\t\tparams: { path: { envVarId: targetId } },\n\t\t\t\t\tbody: { value: news.value }\n\t\t\t\t}));\n\t\t\t\treturn {\n\t\t\t\t\tid,\n\t\t\t\t\tkey: news.key\n\t\t\t\t};\n\t\t\t}\n\t\t\tconst created = yield* call(() => client.POST(\"/v1/environment-variables\", { body: {\n\t\t\t\tprojectId: news.projectId,\n\t\t\t\tclass: cls,\n\t\t\t\tkey: news.key,\n\t\t\t\tvalue: news.value,\n\t\t\t\t...news.branchId ? { branchId: news.branchId } : {}\n\t\t\t} }));\n\t\t\treturn {\n\t\t\t\tid: created.data.id,\n\t\t\t\tkey: created.data.key\n\t\t\t};\n\t\t}),\n\t\tdelete: Effect.fn(function* ({ output }) {\n\t\t\tyield* callVoid(() => client.DELETE(\"/v1/environment-variables/{envVarId}\", { params: { path: { envVarId: output.id } } }));\n\t\t}),\n\t\tread: Effect.fn(function* ({ output }) {\n\t\t\tif (!output?.id) return void 0;\n\t\t\tconst v = yield* callOptional(() => client.GET(\"/v1/environment-variables/{envVarId}\", { params: { path: { envVarId: output.id } } }));\n\t\t\treturn v ? {\n\t\t\t\tid: v.data.id,\n\t\t\t\tkey: v.data.key\n\t\t\t} : void 0;\n\t\t})\n\t};\n}));\n//#endregion\n//#region src/compute/artifact.ts\n/**\n* Assembles a Prisma Compute artifact: the app-built bundle plus the\n* extension-printed bootstrap and manifest, tarred and gzipped deterministically\n* (fixed mtimes, sorted entry order) so an unchanged service noops on\n* redeploy — a rebuild is the only thing that changes the hash. Lives here\n* (not in @prisma/composer-prisma-cloud/control) because it needs node:fs/node:zlib,\n* which the extension's shipped src may never import (invariant 5).\n*/\nconst MANIFEST_VERSION = \"1\";\n/** Finds main.js/main.mjs in a bundle dir when no explicit entry is given. */\nfunction resolveEntry(bundleDir, entry) {\n\tif (entry !== void 0) return entry;\n\tconst found = fs.readdirSync(bundleDir).find((f) => /^main\\.m?js$/.test(f));\n\tif (found === void 0) throw new Error(`no main.js/main.mjs found in bundle dir ${bundleDir}`);\n\treturn found;\n}\n/** All files under `dir`, as dir-relative POSIX paths, in sorted order. A\n* symlink is a hard error: deploy bundles must be flat (ADR-0005), and the\n* user's build owns flattening — dereferencing here would relink the tree and\n* risk packaging files from outside it. */\nfunction walkFiles(dir) {\n\tconst out = [];\n\tconst visit = (sub) => {\n\t\tfor (const entry of fs.readdirSync(path.join(dir, sub), { withFileTypes: true })) {\n\t\t\tconst rel = sub.length > 0 ? `${sub}/${entry.name}` : entry.name;\n\t\t\tif (entry.isSymbolicLink()) throw new Error(`bundle contains a symlink at ${rel} — deploy bundles must be flat; materialize links in your build (e.g. cp -RL) so the tree is self-contained.`);\n\t\t\tif (entry.isDirectory()) visit(rel);\n\t\t\telse out.push(rel);\n\t\t}\n\t};\n\tvisit(\"\");\n\treturn out.sort();\n}\nfunction octal(value, length) {\n\treturn `${value.toString(8).padStart(length - 1, \"0\")}\\0`;\n}\n/** Splits a path into ustar's name (<=100 bytes) + prefix (<=155 bytes) fields. */\nfunction splitUstarPath(relPath) {\n\tif (Buffer.byteLength(relPath, \"utf8\") <= 100) return {\n\t\tname: relPath,\n\t\tprefix: \"\"\n\t};\n\tfor (let i = relPath.length - 1; i >= 0; i--) {\n\t\tif (relPath[i] !== \"/\") continue;\n\t\tconst prefix = relPath.slice(0, i);\n\t\tconst name = relPath.slice(i + 1);\n\t\tif (Buffer.byteLength(prefix, \"utf8\") <= 155 && Buffer.byteLength(name, \"utf8\") <= 100) return {\n\t\t\tname,\n\t\t\tprefix\n\t\t};\n\t}\n\tthrow new Error(`path too long for a ustar tar entry: ${relPath}`);\n}\nfunction ustarHeader(relPath, size) {\n\tconst { name, prefix } = splitUstarPath(relPath);\n\tconst buf = Buffer.alloc(512);\n\tbuf.write(name, 0, 100, \"utf8\");\n\tbuf.write(octal(420, 8), 100, 8, \"utf8\");\n\tbuf.write(octal(0, 8), 108, 8, \"utf8\");\n\tbuf.write(octal(0, 8), 116, 8, \"utf8\");\n\tbuf.write(octal(size, 12), 124, 12, \"utf8\");\n\tbuf.write(octal(0, 12), 136, 12, \"utf8\");\n\tbuf.write(\"        \", 148, 8, \"utf8\");\n\tbuf.write(\"0\", 156, 1, \"utf8\");\n\tbuf.write(\"ustar\\0\", 257, 6, \"utf8\");\n\tbuf.write(\"00\", 263, 2, \"utf8\");\n\tbuf.write(prefix, 345, 155, \"utf8\");\n\tlet sum = 0;\n\tfor (const b of buf) sum += b;\n\tbuf.write(`${sum.toString(8).padStart(6, \"0\")}\\0 `, 148, 8, \"utf8\");\n\treturn buf;\n}\nfunction createDeterministicTarGz(entries) {\n\tconst sorted = [...entries].sort((a, b) => a.relPath.localeCompare(b.relPath));\n\tconst chunks = [];\n\tfor (const entry of sorted) {\n\t\tchunks.push(ustarHeader(entry.relPath, entry.content.length));\n\t\tchunks.push(entry.content);\n\t\tconst pad = (512 - entry.content.length % 512) % 512;\n\t\tif (pad > 0) chunks.push(Buffer.alloc(pad));\n\t}\n\tchunks.push(Buffer.alloc(1024));\n\treturn zlib.gzipSync(Buffer.concat(chunks));\n}\n/**\n* Prints the bootstrap + manifest and tars them with the bundle into a\n* deterministic artifact. If bundleDir doesn't exist (e.g. `alchemy destroy`\n* run before any build), returns a placeholder rather than throwing — the\n* artifact is never read on destroy.\n*/\nfunction packageComputeArtifact(opts) {\n\tif (!fs.existsSync(opts.bundleDir)) return {\n\t\tpath: \"\",\n\t\tsha256: \"absent\"\n\t};\n\tconst bootstrap = `import main from \"./${resolveEntry(opts.bundleDir, opts.bundleEntry)}\";\\nawait main.run(${JSON.stringify(opts.address)}, () => import(${JSON.stringify(`./${opts.appEntry}`)}));\\n`;\n\tconst manifest = `${JSON.stringify({\n\t\tmanifestVersion: MANIFEST_VERSION,\n\t\tentrypoint: \"bootstrap.js\",\n\t\taddress: opts.address\n\t}, null, 2)}\\n`;\n\tconst files = walkFiles(opts.bundleDir).map((relPath) => ({\n\t\trelPath,\n\t\tcontent: fs.readFileSync(path.join(opts.bundleDir, relPath))\n\t}));\n\tfiles.push({\n\t\trelPath: \"bootstrap.js\",\n\t\tcontent: Buffer.from(bootstrap, \"utf8\")\n\t});\n\tfiles.push({\n\t\trelPath: \"compute.manifest.json\",\n\t\tcontent: Buffer.from(manifest, \"utf8\")\n\t});\n\tfiles.push({\n\t\trelPath: \"bunfig.toml\",\n\t\tcontent: Buffer.from(\"[install]\\nauto = \\\"disable\\\"\\n\", \"utf8\")\n\t});\n\tconst gz = createDeterministicTarGz(files);\n\tconst sha256 = crypto$1.createHash(\"sha256\").update(gz).digest(\"hex\");\n\tconst outDir = path.join(os.tmpdir(), `prisma-composer-compute-${String(os.userInfo().uid)}`, sha256.slice(0, 16));\n\tfs.mkdirSync(outDir, { recursive: true });\n\tconst outPath = path.join(outDir, `${opts.id}.tar.gz`);\n\tconst tmpPath = path.join(outDir, `.${opts.id}.${crypto$1.randomUUID()}.tmp`);\n\tfs.writeFileSync(tmpPath, gz);\n\tfs.renameSync(tmpPath, outPath);\n\treturn {\n\t\tpath: outPath,\n\t\tsha256\n\t};\n}\n//#endregion\n//#region src/compute/ServiceKey.ts\n/**\n* The `ServiceKey` Alchemy resource (ADR-0030) — mints a random 256-bit key\n* ONCE at create and keeps it STABLE across deploys, so an unchanged edge\n* no-ops on redeploy. Same mint-once-stable lifecycle as `S3Credentials`\n* (`packages/1-prisma-cloud/1-extensions/target/src/s3-credentials-resource.ts`):\n* Web Crypto only (`crypto.getRandomValues` — no `node:` import), persisted in\n* Alchemy state; on every later apply the provider returns the persisted\n* attributes (`reconcile`'s `output`) unchanged. One resource per RPC edge;\n* rotation is destroy/recreate.\n*/\n/** The `ServiceKey` resource constructor — `yield* Prisma.ServiceKey(id, {})` in the lowering. */\nconst ServiceKey = Resource(\"PrismaCloud.ServiceKey\");\n/** A fresh 256-bit key as 64 lowercase hex chars (Web Crypto — no node import). */\nfunction mintServiceKey() {\n\tconst bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));\n\treturn { value: Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\") };\n}\n/**\n* The `ServiceKey` provider service. `reconcile` runs for create and update;\n* it returns the persisted `output` when present (a redeploy reuses the\n* stored key — the no-op property) and mints a fresh key only on first\n* create. Nothing to enumerate (`list` → `[]`) or tear down (`delete` →\n* no-op; the key lives only in state).\n*/\nconst serviceKeyProviderService = {\n\tlist: () => Effect.succeed([]),\n\treconcile: ({ output }) => Effect.sync(() => output ?? mintServiceKey()),\n\tdelete: () => Effect.void\n};\n/** The `ServiceKey` provider layer — merged into the Prisma Cloud extension's `providers()`. */\nconst ServiceKeyProvider = () => Provider.effect(ServiceKey, Effect.succeed(serviceKeyProviderService));\n//#endregion\nexport { COMPUTE_REGIONS, ComputeService, ComputeServiceProvider, Deployment, DeploymentProvider, EnvironmentVariable, EnvironmentVariableProvider, ServiceKey, ServiceKeyProvider, deleteSafeRetrySchedule, isDeleteNotSafeYet, mintServiceKey, packageComputeArtifact, serviceKeyProviderService };\n\n//# sourceMappingURL=compute.mjs.map","import { a as ManagementClient, i as callVoid, n as call, r as callOptional, t as PrismaApiError } from \"./http-CJM0E6rj.mjs\";\nimport * as Effect from \"effect/Effect\";\nimport * as Redacted from \"effect/Redacted\";\nimport * as Provider from \"alchemy/Provider\";\nimport { Resource } from \"alchemy\";\n//#region src/postgres/Connection.ts\n/** A **connection** to a Prisma Postgres database — yields the connection string. */\nconst Connection = Resource(\"Prisma.Connection\");\nconst ConnectionProvider = () => Provider.effect(Connection, Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\treturn {\n\t\tstables: [\"id\", \"connectionString\"],\n\t\tlist: () => Effect.succeed([]),\n\t\treconcile: Effect.fn(function* ({ news, output }) {\n\t\t\tif (output?.id) return output;\n\t\t\tconst created = yield* call(() => client.POST(\"/v1/databases/{databaseId}/connections\", {\n\t\t\t\tparams: { path: { databaseId: news.databaseId } },\n\t\t\t\tbody: { name: news.name }\n\t\t\t}));\n\t\t\tconst endpoints = created.data.endpoints;\n\t\t\tconst dsn = endpoints?.direct?.connectionString ?? endpoints?.pooled?.connectionString;\n\t\t\tif (dsn === void 0) return yield* Effect.fail(new PrismaApiError({\n\t\t\t\tstatus: 0,\n\t\t\t\tmessage: `connection ${created.data.id} returned no direct/pooled connection string`\n\t\t\t}));\n\t\t\treturn {\n\t\t\t\tid: created.data.id,\n\t\t\t\tconnectionString: Redacted.make(dsn)\n\t\t\t};\n\t\t}),\n\t\tdelete: Effect.fn(function* ({ output }) {\n\t\t\tyield* callVoid(() => client.DELETE(\"/v1/connections/{id}\", { params: { path: { id: output.id } } }));\n\t\t})\n\t};\n}));\n//#endregion\n//#region src/postgres/Database.ts\n/** A Prisma **Postgres database** inside a project. */\nconst Database = Resource(\"Prisma.Database\");\nconst DatabaseProvider = () => Provider.effect(Database, Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\treturn {\n\t\tstables: [\"id\"],\n\t\tlist: () => Effect.succeed([]),\n\t\treconcile: Effect.fn(function* ({ news, output }) {\n\t\t\tconst observed = output?.id ? yield* callOptional(() => client.GET(\"/v1/databases/{databaseId}\", { params: { path: { databaseId: output.id } } })) : void 0;\n\t\t\tif (!observed) {\n\t\t\t\tconst created = yield* call(() => client.POST(\"/v1/databases\", { body: {\n\t\t\t\t\tprojectId: news.projectId,\n\t\t\t\t\tname: news.name,\n\t\t\t\t\tregion: news.region,\n\t\t\t\t\t...news.isDefault !== void 0 && { isDefault: news.isDefault },\n\t\t\t\t\t...news.branchId !== void 0 && { branchId: news.branchId }\n\t\t\t\t} }));\n\t\t\t\treturn {\n\t\t\t\t\tid: created.data.id,\n\t\t\t\t\tname: created.data.name\n\t\t\t\t};\n\t\t\t}\n\t\t\tconst result = {\n\t\t\t\tid: observed.data.id,\n\t\t\t\tname: observed.data.name\n\t\t\t};\n\t\t\tif (news.branchId !== void 0) {\n\t\t\t\tconst branchId = news.branchId;\n\t\t\t\tyield* call(() => client.PATCH(\"/v1/databases/{databaseId}\", {\n\t\t\t\t\tparams: { path: { databaseId: result.id } },\n\t\t\t\t\tbody: { branchId }\n\t\t\t\t}));\n\t\t\t}\n\t\t\treturn result;\n\t\t}),\n\t\tdelete: Effect.fn(function* ({ output }) {\n\t\t\tyield* callVoid(() => client.DELETE(\"/v1/databases/{databaseId}\", { params: { path: { databaseId: output.id } } }));\n\t\t}),\n\t\tread: Effect.fn(function* ({ output }) {\n\t\t\tif (!output?.id) return void 0;\n\t\t\tconst d = yield* callOptional(() => client.GET(\"/v1/databases/{databaseId}\", { params: { path: { databaseId: output.id } } }));\n\t\t\treturn d ? {\n\t\t\t\tid: d.data.id,\n\t\t\t\tname: d.data.name\n\t\t\t} : void 0;\n\t\t})\n\t};\n}));\n//#endregion\n//#region src/postgres/Project.ts\n/** A Prisma Developer Platform **Project** — the container for databases and compute services. */\nconst Project = Resource(\"Prisma.Project\");\nconst ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\treturn {\n\t\tstables: [\"id\"],\n\t\tlist: () => Effect.succeed([]),\n\t\treconcile: Effect.fn(function* ({ news, output }) {\n\t\t\tconst observed = output?.id ? yield* callOptional(() => client.GET(\"/v1/projects/{id}\", { params: { path: { id: output.id } } })) : void 0;\n\t\t\tif (observed) return {\n\t\t\t\tid: observed.data.id,\n\t\t\t\tname: observed.data.name\n\t\t\t};\n\t\t\tconst created = yield* call(() => client.POST(\"/v1/projects\", { body: {\n\t\t\t\tname: news.name,\n\t\t\t\tworkspaceId: news.workspaceId\n\t\t\t} }));\n\t\t\treturn {\n\t\t\t\tid: created.data.id,\n\t\t\t\tname: created.data.name\n\t\t\t};\n\t\t}),\n\t\tdelete: Effect.fn(function* ({ output }) {\n\t\t\tyield* callVoid(() => client.DELETE(\"/v1/projects/{id}\", { params: { path: { id: output.id } } }));\n\t\t}),\n\t\tread: Effect.fn(function* ({ output }) {\n\t\t\tif (!output?.id) return void 0;\n\t\t\tconst p = yield* callOptional(() => client.GET(\"/v1/projects/{id}\", { params: { path: { id: output.id } } }));\n\t\t\treturn p ? {\n\t\t\t\tid: p.data.id,\n\t\t\t\tname: p.data.name\n\t\t\t} : void 0;\n\t\t})\n\t};\n}));\n//#endregion\nexport { Connection, ConnectionProvider, Database, DatabaseProvider, Project, ProjectProvider };\n\n//# sourceMappingURL=postgres.mjs.map","import { a as ManagementClient, c as fromEnv, i as callVoid, n as call, o as layer, s as PrismaCredentials } from \"./http-CJM0E6rj.mjs\";\nimport { Bucket, BucketKey, BucketKeyProvider, BucketProvider } from \"./buckets.mjs\";\nimport { COMPUTE_REGIONS, ComputeService, ComputeServiceProvider, Deployment, DeploymentProvider, EnvironmentVariable, EnvironmentVariableProvider, ServiceKey, ServiceKeyProvider, deleteSafeRetrySchedule, isDeleteNotSafeYet, mintServiceKey, packageComputeArtifact, serviceKeyProviderService } from \"./compute.mjs\";\nimport { Connection, ConnectionProvider, Database, DatabaseProvider, Project, ProjectProvider } from \"./postgres.mjs\";\nimport * as Effect from \"effect/Effect\";\nimport * as Layer from \"effect/Layer\";\nimport * as Data from \"effect/Data\";\nimport * as Provider from \"alchemy/Provider\";\n//#region src/container.ts\n/** Raised with `ensure: false` when the app's Project (or a named stage's Branch) doesn't exist. */\nvar ContainerNotFoundError = class extends Data.TaggedError(\"ContainerNotFoundError\") {};\nconst listAllProjects = (client) => Effect.gen(function* () {\n\tconst projects = [];\n\tlet cursor;\n\tfor (;;) {\n\t\tconst query = cursor === void 0 ? {} : { cursor };\n\t\tconst page = yield* call(() => client.GET(\"/v1/projects\", { params: { query } }));\n\t\tprojects.push(...page.data);\n\t\tif (!page.pagination.hasMore || page.pagination.nextCursor === null) break;\n\t\tcursor = page.pagination.nextCursor;\n\t}\n\treturn projects;\n});\n/**\n* Workspace ids circulate in two shapes: `wksp_`-prefixed and bare. Compare\n* bare-to-bare so a `wksp_`-prefixed API id still matches a bare configured\n* one (the same normalization `state/bootstrap.ts` applies to the same\n* `/v1/projects` listing).\n*/\nconst bareWorkspaceId = (id) => id.startsWith(\"wksp_\") ? id.slice(5) : id;\n/**\n* Finds the app's Project by name in the workspace — PDP allows duplicate\n* project names, so more than one can match; the oldest wins. Creates one\n* if none match, unless `ensure` is `false` (find-only — `destroy`), in\n* which case an absent Project fails with `ContainerNotFoundError`. No\n* ownership marker and no `--project` override (both deferred — see\n* ADR-0019).\n*/\nconst resolveProject = (client, workspaceId, appName, ensure) => Effect.gen(function* () {\n\tconst oldest = (yield* listAllProjects(client)).filter((p) => bareWorkspaceId(p.workspace.id) === bareWorkspaceId(workspaceId) && p.name === appName).sort((a, b) => a.createdAt.localeCompare(b.createdAt))[0];\n\tif (oldest !== void 0) return oldest.id;\n\tif (!ensure) return yield* Effect.fail(new ContainerNotFoundError({ appName }));\n\treturn (yield* call(() => client.POST(\"/v1/projects\", { body: {\n\t\tname: appName,\n\t\tworkspaceId\n\t} }))).data.id;\n});\nconst findBranchId = (client, projectId, gitName) => call(() => client.GET(\"/v1/projects/{projectId}/branches\", { params: {\n\tpath: { projectId },\n\tquery: { gitName }\n} })).pipe(Effect.map((page) => page.data[0]?.id));\n/**\n* Finds the stage's Branch by its exact `gitName`, creating it if absent\n* unless `ensure` is `false` (find-only — `destroy`), in which case an\n* absent Branch fails with `ContainerNotFoundError`. The Management API has\n* no server-side \"create-or-return\" idempotency (`POST\n* /v1/projects/:id/branches` 409s on a duplicate `gitName`, with no request\n* field to make that a no-op), so idempotency is client-side: observe\n* first, and on a racing 409 from create, re-observe rather than fail.\n*/\nconst resolveBranch = (client, projectId, gitName, appName, ensure) => Effect.gen(function* () {\n\tconst existing = yield* findBranchId(client, projectId, gitName);\n\tif (existing !== void 0) return existing;\n\tif (!ensure) return yield* Effect.fail(new ContainerNotFoundError({\n\t\tappName,\n\t\tstage: gitName\n\t}));\n\treturn yield* call(() => client.POST(\"/v1/projects/{projectId}/branches\", {\n\t\tparams: { path: { projectId } },\n\t\tbody: { gitName }\n\t})).pipe(Effect.map((r) => r.data.id), Effect.catch((err) => err.status === 409 ? findBranchId(client, projectId, gitName).pipe(Effect.flatMap((id) => id === void 0 ? Effect.fail(err) : Effect.succeed(id))) : Effect.fail(err)));\n});\n/**\n* Resolves the two containers a stage's deploy runs into (ADR-0019): the\n* app's **Project**, found-or-created by name, and — for a named stage\n* only — its **Branch**, found-or-created by `gitName`. The default stage\n* (no `stage`) creates no Branch; `branchId` is omitted. With `ensure:\n* false` (`destroy`), nothing is created — an absent Project or Branch\n* fails with `ContainerNotFoundError` instead.\n*/\nconst resolveContainer = (opts) => Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\tconst ensure = opts.ensure ?? true;\n\tconst projectId = yield* resolveProject(client, opts.workspaceId, opts.appName, ensure);\n\tif (opts.stage === void 0) return { projectId };\n\treturn {\n\t\tprojectId,\n\t\tbranchId: yield* resolveBranch(client, projectId, opts.stage, opts.appName, ensure)\n\t};\n});\n/**\n* Soft-deletes a Branch. Tolerates a 404 (already gone). The API refuses if\n* the Branch still has live members or is the production/default Branch —\n* that surfaces as a `PrismaApiError`.\n*/\nconst deleteBranch = (branchId) => Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\tyield* callVoid(() => client.DELETE(\"/v1/branches/{branchId}\", { params: { path: { branchId } } }));\n});\n/**\n* Deletes a Project. Tolerates a 404 (already gone). The API refuses with a\n* 400 if the Project still has live dependencies (e.g. another stage's\n* Branch/resources) — that surfaces as a `PrismaApiError`.\n*/\nconst deleteProject = (projectId) => Effect.gen(function* () {\n\tconst client = yield* ManagementClient;\n\tyield* callVoid(() => client.DELETE(\"/v1/projects/{id}\", { params: { path: { id: projectId } } }));\n});\n//#endregion\n//#region src/providers.ts\n/** The collection of Prisma resource providers. */\nvar Providers = class extends Provider.ProviderCollection()(\"Prisma\") {};\n/**\n* The Prisma provider bundle: every resource provider, the Management API\n* client, and env-based credentials. Plug into a stack with\n* `{ providers: Prisma.providers() }`.\n*/\nconst providers = () => Layer.effect(Providers, Provider.collection([\n\tProject,\n\tDatabase,\n\tConnection,\n\tComputeService,\n\tDeployment,\n\tEnvironmentVariable,\n\tBucket,\n\tBucketKey\n])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider(), BucketProvider(), BucketKeyProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);\n//#endregion\nexport { Bucket, BucketKey, BucketKeyProvider, BucketProvider, COMPUTE_REGIONS, ComputeService, ComputeServiceProvider, Connection, ConnectionProvider, ContainerNotFoundError, Database, DatabaseProvider, Deployment, DeploymentProvider, EnvironmentVariable, EnvironmentVariableProvider, ManagementClient, PrismaCredentials, Project, ProjectProvider, Providers, ServiceKey, ServiceKeyProvider, deleteBranch, deleteProject, deleteSafeRetrySchedule, fromEnv, isDeleteNotSafeYet, layer as managementClientLayer, mintServiceKey, packageComputeArtifact, providers, resolveContainer, serviceKeyProviderService };\n\n//# sourceMappingURL=index.mjs.map","import { createHash, createHmac, randomUUID, timingSafeEqual } from \"node:crypto\";\nimport * as fs from \"node:fs/promises\";\nimport * as path from \"node:path\";\nconst DEFAULT_CONTENT_TYPE$1 = \"application/octet-stream\";\nconst TMP_DIR_NAME = \".tmp\";\nconst META_DIR_NAME = \".meta\";\nconst RESERVED_SEGMENTS = /* @__PURE__ */ new Set([TMP_DIR_NAME, META_DIR_NAME]);\nconst BUCKET_NAME_RE = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;\nfunction etagOf$1(bytes) {\n\treturn `\"${createHash(\"sha256\").update(bytes).digest(\"hex\")}\"`;\n}\nfunction isErrnoException(err) {\n\treturn err instanceof Error && \"code\" in err;\n}\nfunction isEnoent(err) {\n\treturn isErrnoException(err) && err.code === \"ENOENT\";\n}\n/**\n* Splits a key into its `/` segments, rejecting anything that could escape\n* the bucket dir or collide with the reserved `.tmp`/`.meta` namespaces:\n* `..` segments, an empty segment (leading/trailing/doubled `/`, which also\n* catches a leading-slash \"absolute\" key), or a segment literally `.tmp` or\n* `.meta` at any depth.\n*/\nfunction keySegments(key) {\n\tconst segments = key.split(\"/\");\n\tfor (const segment of segments) if (segment === \"\" || segment === \".\" || segment === \"..\" || RESERVED_SEGMENTS.has(segment)) throw new Error(`invalid object key: \"${key}\"`);\n\treturn segments;\n}\n/** `<bucketDir>/<key's segments>`, double-checked to still resolve inside `bucketDir`. */\nfunction objectPath(bucketDir, key) {\n\tconst target = path.join(bucketDir, ...keySegments(key));\n\tconst resolvedRoot = path.resolve(bucketDir) + path.sep;\n\tif (!(path.resolve(target) + path.sep).startsWith(resolvedRoot)) throw new Error(`invalid object key: \"${key}\"`);\n\treturn target;\n}\n/** `<bucketDir>/.meta/<key's segments>.json` — mirrors `objectPath`'s tree under `.meta`. */\nfunction sidecarPath(bucketDir, key) {\n\tconst segments = keySegments(key);\n\tconst last = segments[segments.length - 1];\n\tconst dirs = segments.slice(0, -1);\n\treturn path.join(bucketDir, META_DIR_NAME, ...dirs, `${last}.json`);\n}\n/** Write-temp-then-rename: never leaves a reader observing a partial file. */\nasync function writeAtomic(finalPath, tmpRoot, bytes) {\n\tawait fs.mkdir(tmpRoot, { recursive: true });\n\tconst tmpPath = path.join(tmpRoot, randomUUID());\n\tawait fs.writeFile(tmpPath, bytes);\n\tawait fs.mkdir(path.dirname(finalPath), { recursive: true });\n\tawait fs.rename(tmpPath, finalPath);\n}\nfunction isSidecar(value) {\n\treturn typeof value === \"object\" && value !== null && \"contentType\" in value && typeof value.contentType === \"string\" && \"etag\" in value && typeof value.etag === \"string\";\n}\nasync function readSidecar(sidecar) {\n\tlet raw;\n\ttry {\n\t\traw = await fs.readFile(sidecar, \"utf8\");\n\t} catch (err) {\n\t\tif (isEnoent(err)) return null;\n\t\tthrow err;\n\t}\n\ttry {\n\t\tconst parsed = JSON.parse(raw);\n\t\tif (isSidecar(parsed)) return parsed;\n\t} catch {}\n\treturn null;\n}\n/** Read the object's bytes plus its metadata — adopting a sidecar-less file (dropped in by a developer) by computing and lazily persisting one. `null` when the object is missing. */\nasync function readObject(bucketDir, key) {\n\tconst target = objectPath(bucketDir, key);\n\tlet bytes;\n\ttry {\n\t\tbytes = await fs.readFile(target);\n\t} catch (err) {\n\t\tif (isEnoent(err)) return null;\n\t\tthrow err;\n\t}\n\tconst existing = await readSidecar(sidecarPath(bucketDir, key));\n\tif (existing) return {\n\t\tbytes,\n\t\tmeta: existing\n\t};\n\tconst meta = {\n\t\tcontentType: DEFAULT_CONTENT_TYPE$1,\n\t\tetag: etagOf$1(bytes)\n\t};\n\tawait writeAtomic(sidecarPath(bucketDir, key), path.join(bucketDir, TMP_DIR_NAME), Buffer.from(JSON.stringify(meta)));\n\treturn {\n\t\tbytes,\n\t\tmeta\n\t};\n}\n/** Remove now-empty directories from `startDir` up to (never including) `root`. */\nasync function pruneEmptyDirs(root, startDir) {\n\tconst resolvedRoot = path.resolve(root);\n\tlet dir = path.resolve(startDir);\n\twhile (dir !== resolvedRoot && dir.startsWith(resolvedRoot + path.sep)) {\n\t\tlet entries;\n\t\ttry {\n\t\t\tentries = await fs.readdir(dir);\n\t\t} catch (err) {\n\t\t\tif (isEnoent(err)) {\n\t\t\t\tdir = path.dirname(dir);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow err;\n\t\t}\n\t\tif (entries.length > 0) break;\n\t\ttry {\n\t\t\tawait fs.rmdir(dir);\n\t\t} catch (err) {\n\t\t\tif (!isEnoent(err)) throw err;\n\t\t}\n\t\tdir = path.dirname(dir);\n\t}\n}\n/** Recursively lists every object key under `dir`, skipping `.tmp`/`.meta` at any depth. */\nasync function walkKeys(dir) {\n\tconst keys = [];\n\tasync function walk(current, prefix) {\n\t\tlet entries;\n\t\ttry {\n\t\t\tentries = await fs.readdir(current, { withFileTypes: true });\n\t\t} catch (err) {\n\t\t\tif (isEnoent(err)) return;\n\t\t\tthrow err;\n\t\t}\n\t\tfor (const entry of entries) {\n\t\t\tif (RESERVED_SEGMENTS.has(entry.name)) continue;\n\t\t\tconst rel = prefix === \"\" ? entry.name : `${prefix}/${entry.name}`;\n\t\t\tif (entry.isDirectory()) await walk(path.join(current, entry.name), rel);\n\t\t\telse if (entry.isFile()) keys.push(rel);\n\t\t}\n\t}\n\tawait walk(dir, \"\");\n\treturn keys;\n}\n/**\n* A disk-backed `ObjectStore`: object bytes and a metadata sidecar under a\n* per-bucket directory the caller resolves. See the module doc for the\n* unknown-bucket / invalid-key failure shapes.\n*/\nfunction fsStore(resolveBucketDir) {\n\tfunction resolveDir(bucket) {\n\t\tif (!BUCKET_NAME_RE.test(bucket)) return void 0;\n\t\treturn resolveBucketDir(bucket);\n\t}\n\treturn {\n\t\tasync put(bucket, key, bytes, opts = {}) {\n\t\t\tconst dir = resolveDir(bucket);\n\t\t\tif (dir === void 0) throw new Error(`no such bucket: \"${bucket}\"`);\n\t\t\tconst target = objectPath(dir, key);\n\t\t\tconst tmpRoot = path.join(dir, TMP_DIR_NAME);\n\t\t\tconst etag = etagOf$1(bytes);\n\t\t\tconst contentType = opts.contentType ?? DEFAULT_CONTENT_TYPE$1;\n\t\t\tawait writeAtomic(target, tmpRoot, bytes);\n\t\t\tawait writeAtomic(sidecarPath(dir, key), tmpRoot, Buffer.from(JSON.stringify({\n\t\t\t\tcontentType,\n\t\t\t\tetag\n\t\t\t})));\n\t\t\treturn { etag };\n\t\t},\n\t\tasync get(bucket, key, opts = {}) {\n\t\t\tconst dir = resolveDir(bucket);\n\t\t\tif (dir === void 0) return null;\n\t\t\tconst found = await readObject(dir, key);\n\t\t\tif (!found) return null;\n\t\t\tconst { bytes, meta } = found;\n\t\t\tconst size = bytes.byteLength;\n\t\t\tif (opts.range) {\n\t\t\t\tconst start = opts.range.start;\n\t\t\t\tconst end = opts.range.end === void 0 ? size - 1 : Math.min(opts.range.end, size - 1);\n\t\t\t\treturn {\n\t\t\t\t\tbytes: start > end ? /* @__PURE__ */ new Uint8Array(0) : bytes.subarray(start, end + 1),\n\t\t\t\t\tetag: meta.etag,\n\t\t\t\t\tcontentType: meta.contentType,\n\t\t\t\t\tsize\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tbytes: new Uint8Array(bytes),\n\t\t\t\tetag: meta.etag,\n\t\t\t\tcontentType: meta.contentType,\n\t\t\t\tsize\n\t\t\t};\n\t\t},\n\t\tasync head(bucket, key) {\n\t\t\tconst dir = resolveDir(bucket);\n\t\t\tif (dir === void 0) return null;\n\t\t\tconst found = await readObject(dir, key);\n\t\t\tif (!found) return null;\n\t\t\treturn {\n\t\t\t\tetag: found.meta.etag,\n\t\t\t\tsize: found.bytes.byteLength,\n\t\t\t\tcontentType: found.meta.contentType\n\t\t\t};\n\t\t},\n\t\tasync delete(bucket, key) {\n\t\t\tconst dir = resolveDir(bucket);\n\t\t\tif (dir === void 0) return;\n\t\t\tconst target = objectPath(dir, key);\n\t\t\tconst sidecar = sidecarPath(dir, key);\n\t\t\ttry {\n\t\t\t\tawait fs.unlink(target);\n\t\t\t} catch (err) {\n\t\t\t\tif (!isEnoent(err)) throw err;\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tawait fs.unlink(sidecar);\n\t\t\t} catch (err) {\n\t\t\t\tif (!isEnoent(err)) throw err;\n\t\t\t}\n\t\t\tawait pruneEmptyDirs(dir, path.dirname(target));\n\t\t\tawait pruneEmptyDirs(path.join(dir, META_DIR_NAME), path.dirname(sidecar));\n\t\t},\n\t\tasync list(bucket, opts = {}) {\n\t\t\tconst dir = resolveDir(bucket);\n\t\t\tif (dir === void 0) return {\n\t\t\t\tkeys: [],\n\t\t\t\tisTruncated: false\n\t\t\t};\n\t\t\tconst prefix = opts.prefix ?? \"\";\n\t\t\tconst maxKeys = opts.maxKeys ?? 1e3;\n\t\t\tconst token = opts.continuationToken;\n\t\t\tconst matching = (await walkKeys(dir)).filter((key) => key.startsWith(prefix)).sort().filter((key) => token === void 0 ? true : key > token);\n\t\t\tconst page = matching.slice(0, maxKeys);\n\t\t\tconst isTruncated = matching.length > maxKeys;\n\t\t\tconst last = page.at(-1);\n\t\t\treturn {\n\t\t\t\tkeys: page,\n\t\t\t\tisTruncated,\n\t\t\t\t...isTruncated && last !== void 0 ? { nextContinuationToken: last } : {}\n\t\t\t};\n\t\t}\n\t};\n}\n//#endregion\n//#region src/sigv4.ts\n/**\n* AWS SigV4 verification for the S3 wire protocol (spec § 2 auth). The payload\n* hash comes from the client — `x-amz-content-sha256` (a real hash or\n* `UNSIGNED-PAYLOAD`) for header auth, `UNSIGNED-PAYLOAD` for presign — and is\n* never re-hashed; the verifier trusts what was signed, like a real S3 endpoint.\n* Runtime engine code (`node:crypto`); not re-exported from the authoring barrel.\n*\n* Also owns `mintKeyPair` (local-dev spec § 1) — the one key-pair generator\n* both the deploy-time `S3Credentials` resource and the local dev bucket\n* emulator's credential provisioning use.\n*/\nfunction randomBytes(n) {\n\treturn crypto.getRandomValues(new Uint8Array(n));\n}\nfunction toHexUpper(bytes) {\n\treturn Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\").toUpperCase();\n}\n/** A fresh SigV4 key pair: an AKIA-prefixed id and a 40-char base64 secret. */\nfunction mintKeyPair() {\n\treturn {\n\t\taccessKeyId: `AKIA${toHexUpper(randomBytes(8))}`,\n\t\tsecretAccessKey: btoa(String.fromCharCode(...randomBytes(30)))\n\t};\n}\nconst ALGORITHM = \"AWS4-HMAC-SHA256\";\nconst UNSIGNED_PAYLOAD = \"UNSIGNED-PAYLOAD\";\nfunction sha256Hex(data) {\n\treturn createHash(\"sha256\").update(data).digest(\"hex\");\n}\nfunction hmac(key, data) {\n\treturn createHmac(\"sha256\", key).update(data).digest();\n}\n/** AWS canonical URI encoding: every byte except the unreserved set is %XX. */\nfunction awsUriEncode(value) {\n\treturn encodeURIComponent(value).replace(/[!'()*]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%7E/g, \"~\");\n}\nfunction parseCredential(credential) {\n\tconst parts = credential.split(\"/\");\n\tif (parts.length !== 5 || parts[4] !== \"aws4_request\") return null;\n\tconst [accessKeyId, date, region, service] = parts;\n\tif (!accessKeyId || !date || !region || !service) return null;\n\treturn {\n\t\taccessKeyId,\n\t\tdate,\n\t\tregion,\n\t\tservice\n\t};\n}\nfunction signingKey(secret, scope) {\n\treturn hmac(hmac(hmac(hmac(`AWS4${secret}`, scope.date), scope.region), scope.service), \"aws4_request\");\n}\nfunction canonicalHeaders(url, req, signedHeaders) {\n\treturn signedHeaders.map((name) => {\n\t\treturn `${name}:${(name === \"host\" ? url.host : req.headers.get(name) ?? \"\").trim().replace(/\\s+/g, \" \")}\\n`;\n\t}).join(\"\");\n}\nfunction canonicalQuery(url, exclude) {\n\tconst entries = [];\n\tfor (const [key, value] of url.searchParams.entries()) {\n\t\tif (exclude !== void 0 && key === exclude) continue;\n\t\tentries.push([awsUriEncode(key), awsUriEncode(value)]);\n\t}\n\tconst cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;\n\tentries.sort(([ak, av], [bk, bv]) => cmp(ak, bk) || cmp(av, bv));\n\treturn entries.map(([k, v]) => `${k}=${v}`).join(\"&\");\n}\nfunction stringToSign(amzDate, scope, canonicalRequest) {\n\tconst scopeString = `${scope.date}/${scope.region}/${scope.service}/aws4_request`;\n\treturn [\n\t\tALGORITHM,\n\t\tamzDate,\n\t\tscopeString,\n\t\tsha256Hex(canonicalRequest)\n\t].join(\"\\n\");\n}\nfunction signatureMatches(expected, provided) {\n\tconst a = Buffer.from(expected, \"hex\");\n\tconst b = Buffer.from(provided, \"hex\");\n\treturn a.length === b.length && a.length > 0 && timingSafeEqual(a, b);\n}\n/** `YYYYMMDDTHHMMSSZ` → epoch ms, or null when malformed. */\nfunction parseAmzDate(amzDate) {\n\tconst match = /^(\\d{4})(\\d{2})(\\d{2})T(\\d{2})(\\d{2})(\\d{2})Z$/.exec(amzDate);\n\tif (!match) return null;\n\tconst [, y, mo, d, h, mi, s] = match;\n\treturn Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s));\n}\nfunction parseAuthorizationHeader(header) {\n\tif (!header.startsWith(`${ALGORITHM} `)) return null;\n\tconst rest = header.slice(17);\n\tconst fields = /* @__PURE__ */ new Map();\n\tfor (const part of rest.split(\",\")) {\n\t\tconst eq = part.indexOf(\"=\");\n\t\tif (eq === -1) continue;\n\t\tfields.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());\n\t}\n\tconst credential = fields.get(\"Credential\");\n\tconst signedHeaders = fields.get(\"SignedHeaders\");\n\tconst signature = fields.get(\"Signature\");\n\tif (!credential || !signedHeaders || !signature) return null;\n\treturn {\n\t\tcredential,\n\t\tsignedHeaders: signedHeaders.split(\";\"),\n\t\tsignature\n\t};\n}\n/** The one signing core both auth forms share: check the access key, rebuild the canonical request, derive the key, compare in constant time. */\nfunction verifySignature(req, url, credentials, params) {\n\tif (params.scope.accessKeyId !== credentials.accessKeyId) return {\n\t\tok: false,\n\t\treason: \"unknown access key\"\n\t};\n\tconst canonicalRequest = [\n\t\treq.method,\n\t\turl.pathname,\n\t\tcanonicalQuery(url, params.excludeQuery),\n\t\tcanonicalHeaders(url, req, params.signedHeaders),\n\t\tparams.signedHeaders.join(\";\"),\n\t\tparams.payloadHash\n\t].join(\"\\n\");\n\treturn signatureMatches(hmac(signingKey(credentials.secretAccessKey, params.scope), stringToSign(params.amzDate, params.scope, canonicalRequest)).toString(\"hex\"), params.signature) ? { ok: true } : {\n\t\tok: false,\n\t\treason: \"signature mismatch\"\n\t};\n}\nfunction verifyHeader(req, url, credentials) {\n\tconst auth = parseAuthorizationHeader(req.headers.get(\"authorization\") ?? \"\");\n\tif (!auth) return {\n\t\tok: false,\n\t\treason: \"malformed Authorization header\"\n\t};\n\tconst scope = parseCredential(auth.credential);\n\tif (!scope) return {\n\t\tok: false,\n\t\treason: \"malformed credential scope\"\n\t};\n\tconst amzDate = req.headers.get(\"x-amz-date\");\n\tif (!amzDate) return {\n\t\tok: false,\n\t\treason: \"missing x-amz-date\"\n\t};\n\tconst payloadHash = req.headers.get(\"x-amz-content-sha256\");\n\tif (!payloadHash) return {\n\t\tok: false,\n\t\treason: \"missing x-amz-content-sha256\"\n\t};\n\treturn verifySignature(req, url, credentials, {\n\t\tscope,\n\t\tamzDate,\n\t\tsignedHeaders: auth.signedHeaders,\n\t\tpayloadHash,\n\t\tsignature: auth.signature\n\t});\n}\nfunction verifyPresigned(req, url, credentials, now) {\n\tconst q = url.searchParams;\n\tif (q.get(\"X-Amz-Algorithm\") !== ALGORITHM) return {\n\t\tok: false,\n\t\treason: \"unsupported presign algorithm\"\n\t};\n\tconst credentialRaw = q.get(\"X-Amz-Credential\");\n\tconst amzDate = q.get(\"X-Amz-Date\");\n\tconst expiresRaw = q.get(\"X-Amz-Expires\");\n\tconst signedHeadersRaw = q.get(\"X-Amz-SignedHeaders\");\n\tconst signature = q.get(\"X-Amz-Signature\");\n\tif (!credentialRaw || !amzDate || !expiresRaw || !signedHeadersRaw || !signature) return {\n\t\tok: false,\n\t\treason: \"incomplete presign parameters\"\n\t};\n\tconst scope = parseCredential(credentialRaw);\n\tif (!scope) return {\n\t\tok: false,\n\t\treason: \"malformed credential scope\"\n\t};\n\tconst signedAt = parseAmzDate(amzDate);\n\tconst expires = Number(expiresRaw);\n\tif (signedAt === null || !Number.isFinite(expires)) return {\n\t\tok: false,\n\t\treason: \"malformed presign date\"\n\t};\n\tif (now.getTime() > signedAt + expires * 1e3) return {\n\t\tok: false,\n\t\treason: \"presign expired\"\n\t};\n\treturn verifySignature(req, url, credentials, {\n\t\tscope,\n\t\tamzDate,\n\t\tsignedHeaders: signedHeadersRaw.split(\";\"),\n\t\tpayloadHash: UNSIGNED_PAYLOAD,\n\t\tsignature,\n\t\texcludeQuery: \"X-Amz-Signature\"\n\t});\n}\n/**\n* Verify a request's SigV4 signature against a single credential pair. Picks\n* the presigned form when `X-Amz-Signature` is present, otherwise the\n* `Authorization`-header form. `now` is injectable for deterministic\n* expiry tests.\n*/\nfunction verifyRequest(req, credentials, now = /* @__PURE__ */ new Date()) {\n\tconst url = new URL(req.url);\n\tif (url.searchParams.has(\"X-Amz-Signature\")) return verifyPresigned(req, url, credentials, now);\n\tif (req.headers.has(\"authorization\")) return verifyHeader(req, url, credentials);\n\treturn {\n\t\tok: false,\n\t\treason: \"unsigned request\"\n\t};\n}\n//#endregion\n//#region src/handler.ts\nconst DEFAULT_CONTENT_TYPE = \"application/octet-stream\";\n/** Path-style: `/{bucket}/{key…}`. Each segment is percent-decoded. */\nfunction parseTarget(url) {\n\tconst segments = url.pathname.split(\"/\").filter((s) => s.length > 0);\n\tif (segments.length === 0) return null;\n\tconst [bucket, ...keyParts] = segments;\n\treturn {\n\t\tbucket: decodeURIComponent(bucket ?? \"\"),\n\t\tkey: keyParts.map(decodeURIComponent).join(\"/\")\n\t};\n}\n/** `bytes=a-b` (inclusive) or `bytes=a-` (open-ended). Null when absent/malformed. */\nfunction parseRange(header) {\n\tif (!header) return null;\n\tconst match = /^bytes=(\\d+)-(\\d*)$/.exec(header.trim());\n\tif (!match) return null;\n\tconst start = Number(match[1]);\n\treturn match[2] ? {\n\t\tstart,\n\t\tend: Number(match[2])\n\t} : { start };\n}\nfunction xmlEscape(value) {\n\treturn value.replace(/&/g, \"&amp;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\").replace(/\"/g, \"&quot;\").replace(/'/g, \"&apos;\");\n}\nfunction listXml(bucket, prefix, maxKeys, result) {\n\tconst contents = result.keys.map((k) => `<Contents><Key>${xmlEscape(k)}</Key></Contents>`).join(\"\");\n\tconst next = result.isTruncated && result.nextContinuationToken !== void 0 ? `<NextContinuationToken>${xmlEscape(result.nextContinuationToken)}</NextContinuationToken>` : \"\";\n\treturn `<?xml version=\"1.0\" encoding=\"UTF-8\"?><ListBucketResult xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\"><Name>${xmlEscape(bucket)}</Name><Prefix>${xmlEscape(prefix)}</Prefix><KeyCount>${result.keys.length}</KeyCount><MaxKeys>${maxKeys}</MaxKeys><IsTruncated>${result.isTruncated}</IsTruncated>` + contents + next + \"</ListBucketResult>\";\n}\nconst DEFAULT_MAX_KEYS$1 = 1e3;\nasync function handleList(store, bucket, url) {\n\tconst prefix = url.searchParams.get(\"prefix\") ?? \"\";\n\tconst continuationToken = url.searchParams.get(\"continuation-token\");\n\tconst maxKeysRaw = url.searchParams.get(\"max-keys\");\n\tconst maxKeys = maxKeysRaw !== null && Number.isFinite(Number(maxKeysRaw)) ? Number(maxKeysRaw) : DEFAULT_MAX_KEYS$1;\n\tconst result = await store.list(bucket, {\n\t\tprefix,\n\t\tmaxKeys,\n\t\t...continuationToken !== null ? { continuationToken } : {}\n\t});\n\treturn new Response(listXml(bucket, prefix, maxKeys, result), {\n\t\tstatus: 200,\n\t\theaders: { \"content-type\": \"application/xml\" }\n\t});\n}\n/** aws-chunked / flexible-checksum PUTs frame the body as chunks + a trailer (signalled by `x-amz-content-sha256: STREAMING-…` or `content-encoding: aws-chunked`); the seed signature still verifies, so reject them (501) rather than store the raw framing as the object bytes. Decoding is out of scope. */\nfunction isStreamingPut(req) {\n\tconst contentSha = req.headers.get(\"x-amz-content-sha256\") ?? \"\";\n\tconst contentEncoding = req.headers.get(\"content-encoding\") ?? \"\";\n\treturn contentSha.startsWith(\"STREAMING-\") || contentEncoding.split(\",\").some((e) => e.trim() === \"aws-chunked\");\n}\nasync function handlePut(store, t, req) {\n\tif (isStreamingPut(req)) return new Response(\"aws-chunked / flexible checksums not supported; set requestChecksumCalculation: 'WHEN_REQUIRED'\", { status: 501 });\n\tconst body = new Uint8Array(await req.arrayBuffer());\n\tconst contentType = req.headers.get(\"content-type\") ?? DEFAULT_CONTENT_TYPE;\n\tconst { etag } = await store.put(t.bucket, t.key, body, { contentType });\n\treturn new Response(null, {\n\t\tstatus: 200,\n\t\theaders: { etag }\n\t});\n}\n/** The etag/content-type/content-length/accept-ranges headers GET and HEAD share — `contentLength` is the slice length for GET, the total object size for HEAD. */\nfunction metaHeaders(meta) {\n\treturn new Headers({\n\t\tetag: meta.etag,\n\t\t\"content-type\": meta.contentType,\n\t\t\"content-length\": String(meta.contentLength),\n\t\t\"accept-ranges\": \"bytes\"\n\t});\n}\nasync function handleGet(store, t, req) {\n\tconst range = parseRange(req.headers.get(\"range\"));\n\tconst object = await store.get(t.bucket, t.key, range ? { range } : void 0);\n\tif (!object) return new Response(null, { status: 404 });\n\tconst headers = metaHeaders({\n\t\tetag: object.etag,\n\t\tcontentType: object.contentType,\n\t\tcontentLength: object.bytes.byteLength\n\t});\n\tif (!range) return new Response(object.bytes, {\n\t\tstatus: 200,\n\t\theaders\n\t});\n\tif (range.start >= object.size && object.size > 0) return new Response(null, {\n\t\tstatus: 416,\n\t\theaders: { \"content-range\": `bytes */${object.size}` }\n\t});\n\tconst end = range.end === void 0 ? object.size - 1 : Math.min(range.end, object.size - 1);\n\theaders.set(\"content-range\", `bytes ${range.start}-${end}/${object.size}`);\n\treturn new Response(object.bytes, {\n\t\tstatus: 206,\n\t\theaders\n\t});\n}\nasync function handleHead(store, t) {\n\tconst meta = await store.head(t.bucket, t.key);\n\tif (!meta) return new Response(null, { status: 404 });\n\treturn new Response(null, {\n\t\tstatus: 200,\n\t\theaders: metaHeaders({\n\t\t\tetag: meta.etag,\n\t\t\tcontentType: meta.contentType,\n\t\t\tcontentLength: meta.size\n\t\t})\n\t});\n}\nasync function handleDelete(store, t) {\n\tawait store.delete(t.bucket, t.key);\n\treturn new Response(null, { status: 204 });\n}\nfunction createS3Handler(opts) {\n\tconst { store, credentials } = opts;\n\treturn async (req) => {\n\t\tif (!verifyRequest(req, credentials).ok) return new Response(null, { status: 403 });\n\t\tconst url = new URL(req.url);\n\t\tconst target = parseTarget(url);\n\t\tif (!target) return new Response(null, { status: 400 });\n\t\tif (req.method === \"GET\" && url.searchParams.get(\"list-type\") === \"2\" && target.key === \"\") return handleList(store, target.bucket, url);\n\t\tif (target.key === \"\") return new Response(null, { status: 400 });\n\t\tswitch (req.method) {\n\t\t\tcase \"PUT\": return handlePut(store, target, req);\n\t\t\tcase \"GET\": return handleGet(store, target, req);\n\t\t\tcase \"HEAD\": return handleHead(store, target);\n\t\t\tcase \"DELETE\": return handleDelete(store, target);\n\t\t\tdefault: return new Response(null, { status: 405 });\n\t\t}\n\t};\n}\n//#endregion\n//#region src/memory-store.ts\n/**\n* An in-memory `ObjectStore` for the protocol tests — the same contract the\n* Postgres store (D3) implements. Test-only; never wired into a deployed\n* service. Not re-exported from the authoring barrel.\n*/\nconst DEFAULT_MAX_KEYS = 1e3;\nfunction etagOf(bytes) {\n\treturn `\"${createHash(\"sha256\").update(bytes).digest(\"hex\")}\"`;\n}\nvar MemoryObjectStore = class {\n\tentries = /* @__PURE__ */ new Map();\n\tid(bucket, key) {\n\t\treturn `${bucket}\\x00${key}`;\n\t}\n\tasync put(bucket, key, bytes, opts = {}) {\n\t\tconst copy = bytes.slice();\n\t\tconst etag = etagOf(copy);\n\t\tthis.entries.set(this.id(bucket, key), {\n\t\t\tbytes: copy,\n\t\t\tetag,\n\t\t\tcontentType: opts.contentType ?? \"application/octet-stream\"\n\t\t});\n\t\treturn { etag };\n\t}\n\tasync get(bucket, key, opts = {}) {\n\t\tconst entry = this.entries.get(this.id(bucket, key));\n\t\tif (!entry) return null;\n\t\tconst size = entry.bytes.byteLength;\n\t\tif (opts.range) {\n\t\t\tconst start = opts.range.start;\n\t\t\tconst end = opts.range.end === void 0 ? size - 1 : Math.min(opts.range.end, size - 1);\n\t\t\treturn {\n\t\t\t\tbytes: start > end ? /* @__PURE__ */ new Uint8Array(0) : entry.bytes.slice(start, end + 1),\n\t\t\t\tetag: entry.etag,\n\t\t\t\tcontentType: entry.contentType,\n\t\t\t\tsize\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tbytes: entry.bytes.slice(),\n\t\t\tetag: entry.etag,\n\t\t\tcontentType: entry.contentType,\n\t\t\tsize\n\t\t};\n\t}\n\tasync head(bucket, key) {\n\t\tconst entry = this.entries.get(this.id(bucket, key));\n\t\tif (!entry) return null;\n\t\treturn {\n\t\t\tetag: entry.etag,\n\t\t\tsize: entry.bytes.byteLength,\n\t\t\tcontentType: entry.contentType\n\t\t};\n\t}\n\tasync delete(bucket, key) {\n\t\tthis.entries.delete(this.id(bucket, key));\n\t}\n\tasync list(bucket, opts = {}) {\n\t\tconst prefix = opts.prefix ?? \"\";\n\t\tconst maxKeys = opts.maxKeys ?? DEFAULT_MAX_KEYS;\n\t\tconst token = opts.continuationToken;\n\t\tconst prefixHit = `${bucket}\\x00${prefix}`;\n\t\tconst matching = [...this.entries.keys()].filter((id) => id.startsWith(prefixHit)).map((id) => id.slice(bucket.length + 1)).sort().filter((key) => token === void 0 ? true : key > token);\n\t\tconst page = matching.slice(0, maxKeys);\n\t\tconst isTruncated = matching.length > maxKeys;\n\t\tconst last = page.at(-1);\n\t\treturn {\n\t\t\tkeys: page,\n\t\t\tisTruncated,\n\t\t\t...isTruncated && last !== void 0 ? { nextContinuationToken: last } : {}\n\t\t};\n\t}\n};\n//#endregion\nexport { MemoryObjectStore, createS3Handler, fsStore, mintKeyPair, verifyRequest };\n\n//# sourceMappingURL=index.mjs.map","import { n as secretName } from \"./secret-rz_ZqNeq.mjs\";\nimport { i as paramName, n as isEnvParamSource } from \"./param-BTzY0ne5.mjs\";\nimport { i as withConnectionRetry, n as normalizeSslMode } from \"./pg-connection-CadPZuEK.mjs\";\nimport { paramManifest, provisionManifest } from \"@internal/core\";\nimport { ManagementClient, deleteBranch, deleteProject, fromEnv, managementClientLayer, resolveContainer } from \"@internal/lowering\";\nimport * as Effect from \"effect/Effect\";\nimport * as Layer from \"effect/Layer\";\nimport { Resource } from \"alchemy\";\nimport * as Provider from \"alchemy/Provider\";\nimport pg from \"pg\";\nimport { readRef } from \"@prisma-next/migration-tools/refs\";\nimport { APP_SPACE_ID, readContractSpaceHeadRef, spaceMigrationDirectory, spaceRefsDirectory } from \"@prisma-next/migration-tools/spaces\";\nimport { createPostgresControlClient } from \"@prisma-next/postgres/control\";\nimport { mintKeyPair } from \"@internal/s3-protocol\";\n//#region src/container.ts\nconst PRISMA_CLOUD_EXTENSION_ID = \"@prisma/composer-prisma-cloud\";\nvar PrismaCloudContainer = class {\n\tinput;\n\tprojectId;\n\tbranchId;\n\tconstructor(input, projectId, branchId) {\n\t\tthis.input = input;\n\t\tthis.projectId = projectId;\n\t\tthis.branchId = branchId;\n\t}\n\tserialize() {\n\t\treturn JSON.stringify({\n\t\t\tinput: this.input,\n\t\t\tprojectId: this.projectId,\n\t\t\t...this.branchId !== void 0 ? { branchId: this.branchId } : {}\n\t\t});\n\t}\n};\n/** `instanceof` — parent-side instances and child-side deserialized instances are both constructed by this module. */\nfunction isPrismaCloudContainer(value) {\n\treturn value instanceof PrismaCloudContainer;\n}\n/** Narrow-or-throw for hook inputs. */\nfunction prismaCloudContainerOf(value) {\n\tif (!isPrismaCloudContainer(value)) throw new Error(\"the Prisma Cloud container was not resolved — the extension's container descriptor did not run.\");\n\treturn value;\n}\nfunction isRecord(value) {\n\treturn typeof value === \"object\" && value !== null;\n}\nfunction invalidPayloadError(reason) {\n\treturn /* @__PURE__ */ new Error(`${PRISMA_CLOUD_EXTENSION_ID}: invalid container transport payload — ${reason}.`);\n}\n/**\n* Reconstructs a `PrismaCloudContainer` from `serialize()`'s JSON output —\n* real narrowing, no casts. Exported so `dev/container.ts`'s\n* `devContainerDescriptor` can reuse it verbatim (local-dev spec § 5) — the\n* dev and deploy container descriptors deserialize the identical wire shape.\n*/\nfunction deserialize(serialized) {\n\tlet parsed;\n\ttry {\n\t\tparsed = JSON.parse(serialized);\n\t} catch (error) {\n\t\tthrow invalidPayloadError(`not valid JSON (${error instanceof Error ? error.message : String(error)})`);\n\t}\n\tif (!isRecord(parsed)) throw invalidPayloadError(\"not an object\");\n\tconst input = parsed[\"input\"];\n\tif (!isRecord(input)) throw invalidPayloadError(\"\\\"input\\\" is not an object\");\n\tconst appName = input[\"appName\"];\n\tif (typeof appName !== \"string\") throw invalidPayloadError(\"\\\"input.appName\\\" is not a string\");\n\tconst stage = input[\"stage\"];\n\tif (stage !== void 0 && typeof stage !== \"string\") throw invalidPayloadError(\"\\\"input.stage\\\" is not a string or absent\");\n\tconst projectId = parsed[\"projectId\"];\n\tif (typeof projectId !== \"string\") throw invalidPayloadError(\"\\\"projectId\\\" is not a string\");\n\tconst branchId = parsed[\"branchId\"];\n\tif (branchId !== void 0 && typeof branchId !== \"string\") throw invalidPayloadError(\"\\\"branchId\\\" is not a string or absent\");\n\treturn new PrismaCloudContainer({\n\t\tappName,\n\t\tstage\n\t}, projectId, branchId);\n}\nconst workspaceRequiredError = () => /* @__PURE__ */ new Error(\"environment variable PRISMA_WORKSPACE_ID is required.\");\nconst tokenRequiredError = () => /* @__PURE__ */ new Error(\"environment variable PRISMA_SERVICE_TOKEN is required.\");\nfunction requireWorkspaceId() {\n\tconst workspaceId = process.env[\"PRISMA_WORKSPACE_ID\"];\n\tif (workspaceId === void 0 || workspaceId.length === 0) throw workspaceRequiredError();\n\treturn workspaceId;\n}\nfunction requireTokenUnlessInjected(deps) {\n\tif (deps?.client === void 0 && (process.env[\"PRISMA_SERVICE_TOKEN\"] ?? \"\").length === 0) throw tokenRequiredError();\n}\nasync function ensureContainer(input, deps) {\n\tconst workspaceId = requireWorkspaceId();\n\trequireTokenUnlessInjected(deps);\n\tconst program = resolveContainer({\n\t\tworkspaceId,\n\t\tappName: input.appName,\n\t\t...input.stage !== void 0 ? { stage: input.stage } : {},\n\t\tensure: true\n\t}).pipe(Effect.map((c) => ({\n\t\tok: true,\n\t\tcontainer: c\n\t})), Effect.catchTag(\"PrismaApiError\", (e) => Effect.succeed({\n\t\tok: false,\n\t\tmessage: `Prisma Management API error resolving containers: ${e.message}.`\n\t})));\n\tconst provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(managementClientLayer().pipe(Layer.provide(fromEnv()))));\n\tconst outcome = await Effect.runPromise(provided);\n\tif (!outcome.ok) throw new Error(outcome.message);\n\treturn new PrismaCloudContainer(input, outcome.container.projectId, outcome.container.branchId);\n}\nasync function locateContainer(input, deps) {\n\tconst workspaceId = requireWorkspaceId();\n\trequireTokenUnlessInjected(deps);\n\tconst program = resolveContainer({\n\t\tworkspaceId,\n\t\tappName: input.appName,\n\t\t...input.stage !== void 0 ? { stage: input.stage } : {},\n\t\tensure: false\n\t}).pipe(Effect.map((c) => ({\n\t\tok: true,\n\t\tcontainer: c\n\t})), Effect.catchTag(\"ContainerNotFoundError\", () => Effect.succeed({ ok: false })), Effect.catchTag(\"PrismaApiError\", (e) => Effect.fail(/* @__PURE__ */ new Error(`Prisma Management API error resolving containers: ${e.message}.`))));\n\tconst provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(managementClientLayer().pipe(Layer.provide(fromEnv()))));\n\tconst outcome = await Effect.runPromise(provided);\n\tif (!outcome.ok) return void 0;\n\treturn new PrismaCloudContainer(input, outcome.container.projectId, outcome.container.branchId);\n}\n/**\n* Soft-deletes a named stage's Branch after a successful `alchemy destroy`\n* has removed its members — the Management API refuses to delete a Branch\n* that still has live members.\n*/\nasync function removeStageBranch(branchId, deps) {\n\trequireTokenUnlessInjected(deps);\n\tconst program = deleteBranch(branchId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag(\"PrismaApiError\", (e) => Effect.succeed({\n\t\tok: false,\n\t\tmessage: `Failed to delete the stage Branch: ${e.message}.`\n\t})));\n\tconst provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(managementClientLayer().pipe(Layer.provide(fromEnv()))));\n\tconst outcome = await Effect.runPromise(provided);\n\tif (!outcome.ok) throw new Error(outcome.message);\n}\n/**\n* Best-effort cleanup after a successful `--production` destroy: removes\n* the app's Project so hand-run stacks don't accumulate as empty Projects\n* (they eventually hit the workspace's plan limit). Unlike `removeStageBranch`,\n* this never throws: the destroy itself already succeeded, and the API's own\n* 400 (\"still has dependencies\") is the only check that matters — failing\n* the command over a cleanup step would be worse than leaving a Project shell.\n*/\nasync function removeAppProject(projectId, deps) {\n\tif (deps?.client === void 0 && (process.env[\"PRISMA_SERVICE_TOKEN\"] ?? \"\").length === 0) {\n\t\tconsole.warn(`Skipped removing the Project (${projectId}): PRISMA_SERVICE_TOKEN is not set.`);\n\t\treturn;\n\t}\n\tconst program = deleteProject(projectId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag(\"PrismaApiError\", (e) => Effect.succeed({\n\t\tok: false,\n\t\terror: e\n\t})));\n\tconst provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(managementClientLayer().pipe(Layer.provide(fromEnv()))));\n\tconst outcome = await Effect.runPromise(provided);\n\tif (outcome.ok) {\n\t\tconsole.log(`Removed the Project (${projectId}) — nothing was left in it.`);\n\t\treturn;\n\t}\n\tif (outcome.error.status === 400) {\n\t\tconsole.log(`Kept the Project (${projectId}) — it still has another stage's resources.`);\n\t\treturn;\n\t}\n\tconsole.warn(`Could not remove the Project (${projectId}) after destroy: ${outcome.error.message}.`);\n}\nfunction containerDescriptor(deps) {\n\treturn {\n\t\tensure: (input) => ensureContainer(input, deps),\n\t\tlocate: (input) => locateContainer(input, deps),\n\t\tremove: (instance) => instance.input.stage !== void 0 ? removeStageBranch(instance.branchId ?? missingBranchId(instance), deps) : removeAppProject(instance.projectId, deps),\n\t\tdeserialize\n\t};\n}\n/** Defensive: a named-stage container always resolves a Branch together with its stage — `ensure`/`locate`/`deserialize` never produce one without the other. */\nfunction missingBranchId(instance) {\n\tthrow new Error(`${PRISMA_CLOUD_EXTENSION_ID}: a named-stage (\"${instance.input.stage}\") container instance is missing its branchId — this is a bug in ensure/locate/deserialize.`);\n}\n//#endregion\n//#region src/pg-warm-resource.ts\n/**\n* The `PgWarm` Alchemy resource (slice 3, FT-5226) — warm a freshly-provisioned\n* Prisma Postgres database at apply-time so it is ready by deploy-end, and the\n* first real connection (a service's runtime client, or the migration) doesn't\n* eat the cold-start reject.\n*\n* The DB `url` is a lazy `Output` at lowering time, so warming must be an\n* apply-time tracked resource (same pattern as `PnMigration`): its `reconcile`\n* receives the RESOLVED url and connects with `withConnectionRetry` + `select 1`,\n* riding out the cold-start. Shared by BOTH the bare-`postgres` and the\n* `prisma-next` lowerings; keyed on the connection `url`, so an unchanged\n* redeploy is a no-op (warming is idempotent anyway).\n*\n* Deploy-time only: imports `pg` directly + `alchemy`. Imported by `control.ts`\n* and tests, never by `index.ts` / the `./prisma-next` authoring entry — the\n* isolation invariants hold.\n*/\n/** The `PgWarm` resource constructor — `yield* PgWarm(id, { url })` in a lowering. */\nconst PgWarm = Resource(\"PrismaCloud.PgWarm\");\n/** Connect (retrying the cold-start) and run `select 1`, then release the connection. */\nasync function warmDatabase(url) {\n\tawait withConnectionRetry(async () => {\n\t\tconst client = new pg.Client({ connectionString: normalizeSslMode(url) });\n\t\tawait client.connect();\n\t\ttry {\n\t\t\tawait client.query(\"select 1\");\n\t\t} finally {\n\t\t\tawait client.end();\n\t\t}\n\t});\n}\n/**\n* The `PgWarm` provider service. `reconcile` warms the DB (retrying the\n* cold-start) and echoes the `url` so a downstream resource that reads\n* `warm.url` runs only after the DB is warm. Idempotent — safe on redeploy;\n* nothing to enumerate (`list` → `[]`) or tear down (`delete` → no-op; the DB's\n* own deletion handles teardown). Exported so tests can drive it directly.\n*/\nconst pgWarmProviderService = {\n\tlist: () => Effect.succeed([]),\n\treconcile: ({ news }) => Effect.tryPromise({\n\t\ttry: () => warmDatabase(news.url),\n\t\tcatch: (error) => error\n\t}).pipe(Effect.map(() => ({ url: news.url }))),\n\tdelete: () => Effect.void\n};\n/** The `PgWarm` provider layer — merged into the extension descriptor's `providers()`. */\nconst PgWarmProvider = () => Provider.effect(PgWarm, Effect.succeed(pgWarmProviderService));\n//#endregion\n//#region src/prisma-next-migrate.ts\n/**\n* The Prisma Next migration step of the deploy lowering (ADR-0022, slice 2) —\n* the safety-critical decision that brings a live database to a target REF\n* using ONLY Prisma Next's authored migrations.\n*\n* Deploy-time only: this module imports `@prisma-next/postgres/control` (which\n* transitively pulls PN's control/migration machinery + `pg`). It is imported\n* by the deploy descriptors and this package's tests, NEVER by `index.ts` / the\n* `./prisma-next` authoring entry — so it never lands in an app runtime bundle\n* (the index-isolation invariant holds).\n*\n* The target is a ref `{ hash, invariants }` — not a bare `storageHash`. A\n* ref's `invariants` are named postconditions established by `data`-class\n* migration steps (e.g. a backfill), recorded monotonically on the live\n* marker. Keying on the hash alone would make a pure data-invariant change an\n* A→A self-edge the deploy wrongly skips. The decision, given the live marker\n* and the target ref (see {@link decideMigrationAction}):\n*   - marker at ref.hash AND ref.invariants ⊆ marker.invariants → no-op\n*   - no marker (fresh DB) AND no required invariants           → `dbInit`\n*   - otherwise                                                  → `migrate`\n*\n* `dbInit` is additive-only synthesis — it NEVER runs app-space data steps —\n* so it is only correct when the ref requires no invariants; a fresh DB whose\n* target carries invariants goes through `migrate`, which walks the AUTHORED\n* graph (including the invariant-bearing data migrations) from empty.\n*\n* Never `dbUpdate`: synthesized diff-and-apply plans are never run against a\n* deployed database. A no-authored-path (`MIGRATION_PATH_NOT_FOUND`) or a\n* runner failure fails the deploy as a typed `PnMigrationError` (not swallowed).\n* PN applies each migration in its own transaction, so a failed apply is atomic\n* and resume-safe — the marker and schema are left as the last committed step.\n*/\n/** A deploy-failing migration error — surfaced, never swallowed. */\nvar PnMigrationError = class extends Error {\n\tcode;\n\t/** PN's structured explanation, when present. */\n\twhy;\n\tconstructor(code, summary, why) {\n\t\tsuper(`prisma-next migrate (${code}): ${summary}`);\n\t\tthis.name = \"PnMigrationError\";\n\t\tthis.code = code;\n\t\tthis.why = why;\n\t}\n};\n/**\n* The target `storageHash` a contract heads to — `contractJson.storage.storageHash`.\n* Read defensively: `contractJson` crosses the boundary as `unknown`.\n*/\nfunction targetStorageHash(contractJson) {\n\tif (typeof contractJson === \"object\" && contractJson !== null && \"storage\" in contractJson) {\n\t\tconst storage = contractJson.storage;\n\t\tif (typeof storage === \"object\" && storage !== null && \"storageHash\" in storage) {\n\t\t\tconst hash = storage.storageHash;\n\t\t\tif (typeof hash === \"string\" && hash.length > 0) return hash;\n\t\t}\n\t}\n\tthrow new PnMigrationError(\"INIT_FAILED\", \"the contract has no storage.storageHash — cannot determine the target schema version\");\n}\n/**\n* Resolve the deploy's target ref from the migrations dir.\n*\n* - `targetRef` named: read `migrations/app/refs/<name>.json` — fail loudly\n*   (`TARGET_REF_NOT_FOUND`) when the ref doesn't exist or can't be parsed.\n* - Default: the app space's head. PN synthesizes the app head from the\n*   emitted contract — `{ hash: contract.storage.storageHash, invariants: [] }`\n*   (`contract emit` writes no app-space `refs/head.json` today; extension\n*   spaces have one on disk). When a future PN version does emit one, the\n*   on-disk `head.json` wins — read via `readContractSpaceHeadRef`, exactly\n*   the loader PN's own migrate uses.\n*/\nasync function resolveTargetRef(migrationsDir, contractJson, targetRef) {\n\tif (targetRef !== void 0) {\n\t\tconst refsDir = spaceRefsDirectory(spaceMigrationDirectory(migrationsDir, APP_SPACE_ID));\n\t\ttry {\n\t\t\tconst ref = await readRef(refsDir, targetRef);\n\t\t\treturn {\n\t\t\t\thash: ref.hash,\n\t\t\t\tinvariants: ref.invariants\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tthrow new PnMigrationError(\"TARGET_REF_NOT_FOUND\", `targetRef \"${targetRef}\" could not be read from ${refsDir}`, error instanceof Error ? error.message : String(error));\n\t\t}\n\t}\n\tconst head = await readContractSpaceHeadRef(migrationsDir, APP_SPACE_ID);\n\tif (head !== null) return {\n\t\thash: head.hash,\n\t\tinvariants: head.invariants\n\t};\n\treturn {\n\t\thash: targetStorageHash(contractJson),\n\t\tinvariants: []\n\t};\n}\n/**\n* The pure migration decision, mirroring PN's own verifier: the database is\n* AT the target when the marker's hash equals the ref's hash AND every ref\n* invariant is on the marker (marker invariants are monotonic). `dbInit` is\n* additive-only synthesis, so it is chosen only for a fresh DB whose\n* effective required invariants (`ref.invariants − marker.invariants`) are\n* empty; anything else — different hash, missing invariant (the A→A\n* data-only self-edge), or a fresh DB with required invariants — walks the\n* authored graph via `migrate`.\n*/\nfunction decideMigrationAction(marker, ref) {\n\tconst markerInvariants = new Set(marker?.invariants ?? []);\n\tconst missing = ref.invariants.filter((id) => !markerInvariants.has(id));\n\tif (marker !== null && marker.storageHash === ref.hash && missing.length === 0) return \"noop\";\n\tif (marker === null && missing.length === 0) return \"init\";\n\treturn \"migrate\";\n}\n/**\n* Bring the database at `url` to the target ref via PN's authored migrations.\n* Reads the live marker, decides no-op / init / migrate\n* ({@link decideMigrationAction}), applies, and throws a typed\n* {@link PnMigrationError} on a no-path or runner failure. `migrationsDir` is\n* the on-disk migrations root and `ref` the resolved target\n* ({@link resolveTargetRef} — both resolved by the lowering, which also keys\n* the PnMigration resource on them). `refName` (the resource's `targetRef`,\n* when set) is threaded into `migrate` so PN targets the named ref's hash and\n* plans an invariant-bearing path.\n*/\nasync function applyPnMigration(opts) {\n\tconst connection = normalizeSslMode(opts.url);\n\treturn withConnectionRetry(() => runMigration(connection, opts.contractJson, opts.migrationsDir, opts.ref, opts.refName), { shouldRetry: (error) => !(error instanceof PnMigrationError) });\n}\nasync function runMigration(connection, contractJson, migrationsDir, ref, refName) {\n\tconst client = createPostgresControlClient({ connection });\n\tawait client.connect();\n\ttry {\n\t\tconst marker = await client.readMarker();\n\t\tconst markerHashBefore = marker?.storageHash ?? null;\n\t\tconst action = decideMigrationAction(marker, ref);\n\t\tif (action === \"noop\") return {\n\t\t\taction,\n\t\t\ttargetHash: ref.hash,\n\t\t\tmarkerHashBefore\n\t\t};\n\t\tif (action === \"init\") {\n\t\t\tconst result = await client.dbInit({\n\t\t\t\tcontract: contractJson,\n\t\t\t\tmode: \"apply\",\n\t\t\t\tmigrationsDir\n\t\t\t});\n\t\t\tif (!result.ok) throw new PnMigrationError(\"INIT_FAILED\", result.failure.summary, result.failure.why);\n\t\t\treturn {\n\t\t\t\taction,\n\t\t\t\ttargetHash: ref.hash,\n\t\t\t\tmarkerHashBefore\n\t\t\t};\n\t\t}\n\t\tconst result = await client.migrate({\n\t\t\tcontract: contractJson,\n\t\t\tmigrationsDir,\n\t\t\t...refName !== void 0 ? {\n\t\t\t\trefHash: ref.hash,\n\t\t\t\trefInvariants: ref.invariants,\n\t\t\t\trefName\n\t\t\t} : {}\n\t\t});\n\t\tif (!result.ok) throw new PnMigrationError(result.failure.code === \"MIGRATION_PATH_NOT_FOUND\" ? \"MIGRATION_PATH_NOT_FOUND\" : \"RUNNER_FAILED\", result.failure.summary, result.failure.why);\n\t\treturn {\n\t\t\taction,\n\t\t\ttargetHash: ref.hash,\n\t\t\tmarkerHashBefore\n\t\t};\n\t} finally {\n\t\tawait client.close();\n\t}\n}\n//#endregion\n//#region src/pn-migration-resource.ts\n/**\n* The `PnMigration` Alchemy resource (ADR-0022, slice 2 D2) — the migration\n* step modeled as a tracked resource so it participates in deploy state: keyed\n* on the target REF identity (`targetHash` + sorted `invariants`), an\n* unchanged redeploy is an Alchemy-level no-op (on top of the marker read),\n* and a contract change — or a DATA-ONLY change that adds a ref invariant at\n* the same hash — re-runs the migration.\n*\n* Its provider's `reconcile` receives the RESOLVED props at apply-time — in\n* particular the concrete DB `url` (a lazy `Output` until the Connection\n* provisions) — and delegates to the proven `applyPnMigration` decision. The\n* provider is a standalone `Provider<PnMigration>` layer; the extension\n* descriptor merges it into its `providers()` (`Layer.merge(Prisma.providers(),\n* PnMigrationProvider())`), and Alchemy resolves it at apply via a direct\n* provider-tag lookup (`tryFindProviderByType`) — no change to `@internal/lowering`.\n*\n* Deploy-time only: imports `@prisma-next/postgres/control` (via the helper) +\n* `alchemy`. Imported by `control.ts` and tests, never by `index.ts` / the\n* `./prisma-next` authoring entry — index isolation holds.\n*/\n/** The `PnMigration` resource constructor — `yield* PnMigration(id, props)` in the lowering. */\nconst PnMigration = Resource(\"PrismaNext.Migration\");\n/**\n* The `PnMigration` provider service. `reconcile` runs for both create and\n* update (Alchemy's unified lifecycle); `applyPnMigration` is idempotent via\n* the live marker read, so it is safe to run for either — the marker decides\n* no-op / init / migrate. A migration has nothing to enumerate (`list` → `[]`)\n* and nothing to tear down on its own (`delete` → no-op; the DB's own deletion\n* handles teardown). Exported so tests can drive `reconcile` directly, without\n* building an Effect layer.\n*/\nconst pnMigrationProviderService = {\n\tlist: () => Effect.succeed([]),\n\treconcile: ({ news }) => Effect.tryPromise({\n\t\ttry: () => applyPnMigration({\n\t\t\turl: news.url,\n\t\t\tcontractJson: news.contractJson,\n\t\t\tmigrationsDir: news.migrationsDir,\n\t\t\tref: {\n\t\t\t\thash: news.targetHash,\n\t\t\t\tinvariants: news.invariants\n\t\t\t},\n\t\t\t...news.refName !== void 0 ? { refName: news.refName } : {}\n\t\t}),\n\t\tcatch: (error) => error\n\t}).pipe(Effect.map((outcome) => ({\n\t\tstorageHash: outcome.targetHash,\n\t\tinvariants: news.invariants\n\t}))),\n\tdelete: () => Effect.void\n};\n/** The `PnMigration` provider layer — merged into the extension descriptor's `providers()`. */\nconst PnMigrationProvider = () => Provider.effect(PnMigration, Effect.succeed(pnMigrationProviderService));\n//#endregion\n//#region src/s3-credentials-resource.ts\n/**\n* The `S3Credentials` Alchemy resource (S5) — mints a random SigV4 key pair\n* ONCE at create and keeps it STABLE across deploys, so an unchanged module\n* no-ops on redeploy. The pair is generated by `@internal/s3-protocol`'s\n* `mintKeyPair` (moved there per the local-dev spec § 1, so deploy and local\n* dev credential minting share one implementation) and persisted in Alchemy\n* state; on every later apply the provider returns the persisted attributes\n* (`reconcile`'s `output`) unchanged — the same way the postgres resource\n* keeps a Connection stable. Rotation is destroy/recreate (a platform ask,\n* not solved here).\n*\n* Deploy-time only: imports `alchemy`. Imported by `control.ts` and tests,\n* never by `index.ts` / the authoring entry.\n*/\n/** The `S3Credentials` resource constructor — `yield* S3Credentials(id, {})` in the lowering. */\nconst S3Credentials = Resource(\"PrismaCloud.S3Credentials\");\n/**\n* The `S3Credentials` provider service. `reconcile` runs for create and update;\n* it returns the persisted `output` when present (a redeploy reuses the stored\n* pair — the no-op property) and mints a fresh pair only on first create.\n* Nothing to enumerate (`list` → `[]`) or tear down (`delete` → no-op; the pair\n* lives only in state). Exported so tests can drive it directly.\n*/\nconst s3CredentialsProviderService = {\n\tlist: () => Effect.succeed([]),\n\treconcile: ({ output }) => Effect.sync(() => output ?? mintKeyPair()),\n\tdelete: () => Effect.void\n};\n/** The `S3Credentials` provider layer — merged into the extension descriptor's `providers()`. */\nconst S3CredentialsProvider = () => Provider.effect(S3Credentials, Effect.succeed(s3CredentialsProviderService));\n//#endregion\n//#region src/preflight-names.ts\nfunction dedupedNames(entries) {\n\tconst byName = /* @__PURE__ */ new Map();\n\tfor (const entry of entries) if (!byName.has(entry.name)) byName.set(entry.name, entry);\n\treturn [...byName.values()];\n}\n/** Walks `graph.secrets`/`graph.params` exactly as `runPreflight` did before this extraction. */\nfunction collectPreflightNames(graph) {\n\treturn {\n\t\tsecrets: dedupedNames(provisionManifest(graph).map((binding) => ({\n\t\t\tname: secretName(binding),\n\t\t\tserviceAddress: binding.serviceAddress\n\t\t}))),\n\t\tenvParams: dedupedNames(paramManifest(graph).filter((binding) => isEnvParamSource(binding.binding)).map((binding) => ({\n\t\t\tname: paramName(binding),\n\t\t\tserviceAddress: binding.serviceAddress\n\t\t})))\n\t};\n}\n//#endregion\nexport { PnMigrationProvider as a, PgWarmProvider as c, containerDescriptor as d, deserialize as f, PnMigration as i, PRISMA_CLOUD_EXTENSION_ID as l, S3Credentials as n, resolveTargetRef as o, prismaCloudContainerOf as p, S3CredentialsProvider as r, PgWarm as s, collectPreflightNames as t, PrismaCloudContainer as u };\n\n//# sourceMappingURL=preflight-names-BPL-qsZF.mjs.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,IAAI,oBAAoB,cAAc,QAAQ,QAAQ,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;;AAE9E,MAAM,gBAAgB,MAAM,OAAO,mBAAmB,OAAO,IAAI,aAAa;CAC7E,OAAO,EAAE,OAAO,OAAOA,SAAO,SAAS,sBAAsB,EAAE;AAChE,CAAC,CAAC;;;;;;AAQF,IAAI,mBAAmB,cAAc,QAAQ,QAAQ,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAClF,MAAM,cAAc,MAAM,OAAO,kBAAkB,OAAO,IAAI,aAAa;CAC1E,MAAM,EAAE,UAAU,OAAO;CACzB,OAAO,0BAA0B,EAAE,OAAO,SAAS,MAAM,KAAK,EAAE,CAAC;AAClE,CAAC,CAAC;;AAIF,IAAI,iBAAiB,cAAc,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC;AACvE,MAAM,WAAW,MAAM,OAAO,WAAW;CACxC,KAAK;CACL,QAAQ,UAAU,IAAI,eAAe;EACpC,QAAQ;EACR,SAAS,OAAO,KAAK;CACtB,CAAC;AACF,CAAC;AACD,MAAM,QAAQ,MAAM,OAAO,KAAK,IAAI,eAAe;CAClD,QAAQ,EAAE,SAAS;CACnB,SAAS,KAAK,UAAU,EAAE,KAAK;AAChC,CAAC,CAAC;;AAEF,MAAM,QAAQ,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,MAAM,EAAE,UAAU,KAAK,KAAK,EAAE,SAAS,KAAK,IAAI,KAAK,CAAC,IAAI,OAAO,QAAQ,EAAE,IAAI,CAAC,CAAC;;AAErI,MAAM,gBAAgB,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,MAAM,EAAE,SAAS,WAAW,MAAM,OAAO,QAAQ,KAAK,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,KAAK,CAAC,IAAI,OAAO,QAAQ,EAAE,IAAI,CAAC,CAAC;;AAE7K,MAAM,YAAY,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,MAAM,EAAE,SAAS,WAAW,OAAO,EAAE,UAAU,KAAK,IAAI,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC;;;;AC1CtI,MAAM,SAAS,SAAS,eAAe;AACvC,MAAM,uBAAuB,SAAS,OAAO,QAAQ,OAAO,IAAI,aAAa;CAC5E,MAAM,SAAS,OAAO;CACtB,OAAO;EACN,SAAS,CAAC,IAAI;EACd,YAAY,OAAO,QAAQ,CAAC,CAAC;EAC7B,WAAW,OAAO,GAAG,WAAW,EAAE,MAAM,UAAU;GACjD,MAAM,WAAW,QAAQ,KAAK,OAAO,mBAAmB,OAAO,IAAI,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK;GACpJ,IAAI,UAAU,OAAO;IACpB,IAAI,SAAS,KAAK;IAClB,MAAM,SAAS,KAAK;GACrB;GACA,MAAM,UAAU,OAAO,WAAW,OAAO,KAAK,eAAe,EAAE,MAAM;IACpE,WAAW,KAAK;IAChB,MAAM,KAAK;IACX,GAAG,KAAK,aAAa,KAAK,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;GAC9D,EAAE,CAAC,CAAC;GACJ,OAAO;IACN,IAAI,QAAQ,KAAK;IACjB,MAAM,QAAQ,KAAK;GACpB;EACD,CAAC;EACD,QAAQ,OAAO,GAAG,WAAW,EAAE,UAAU;GACxC,OAAO,eAAe,OAAO,OAAO,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;EAC7G,CAAC;EACD,MAAM,OAAO,GAAG,WAAW,EAAE,UAAU;GACtC,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK;GAC7B,MAAM,IAAI,OAAO,mBAAmB,OAAO,IAAI,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;GACvH,OAAO,IAAI;IACV,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,KAAK;GACd,IAAI,KAAK;EACV,CAAC;CACF;AACD,CAAC,CAAC;;AAIF,MAAM,YAAY,SAAS,kBAAkB;AAC7C,MAAM,0BAA0B,SAAS,OAAO,WAAW,OAAO,IAAI,aAAa;CAClF,MAAM,SAAS,OAAO;CACtB,OAAO;EACN,SAAS;GACR;GACA;GACA;GACA;GACA;GACA;EACD;EACA,YAAY,OAAO,QAAQ,CAAC,CAAC;EAC7B,WAAW,OAAO,GAAG,WAAW,EAAE,MAAM,UAAU;GACjD,IAAI,QAAQ,IAAI,OAAO;GACvB,MAAM,UAAU,OAAO,WAAW,OAAO,KAAK,+BAA+B;IAC5E,QAAQ,EAAE,MAAM,EAAE,UAAU,KAAK,SAAS,EAAE;IAC5C,MAAM;KACL,MAAM,KAAK;KACX,MAAM,KAAK;IACZ;GACD,CAAC,CAAC;GACF,OAAO;IACN,IAAI,QAAQ,KAAK;IACjB,UAAU,KAAK;IACf,aAAa,QAAQ,KAAK;IAC1B,iBAAiB,SAAS,KAAK,QAAQ,KAAK,eAAe;IAC3D,UAAU,QAAQ,KAAK;IACvB,YAAY,QAAQ,KAAK;GAC1B;EACD,CAAC;EACD,QAAQ,OAAO,GAAG,WAAW,EAAE,UAAU;GACxC,OAAO,eAAe,OAAO,OAAO,uCAAuC,EAAE,QAAQ,EAAE,MAAM;IAC5F,UAAU,OAAO;IACjB,OAAO,OAAO;GACf,EAAE,EAAE,CAAC,CAAC;EACP,CAAC;CACF;AACD,CAAC,CAAC;;;;;;;;;;;AChEF,MAAM,sBAAsB,UAAU,MAAM,QAAQ,SAAS,mCAAmC;;;;;;AAMhG,MAAM,0BAA0B,SAAS,KAAK,SAAS,YAAY,aAAa,CAAC,GAAG,SAAS,OAAO,WAAW,CAAC;;AAEhH,MAAM,kBAAkB;CACvB;CACA;CACA;CACA;CACA;CACA;AACD;;AAEA,MAAM,iBAAiB,SAAS,uBAAuB;AACvD,MAAM,+BAA+B,SAAS,OAAO,gBAAgB,OAAO,IAAI,aAAa;CAC5F,MAAM,SAAS,OAAO;CACtB,OAAO;EACN,SAAS,CAAC,IAAI;EACd,YAAY,OAAO,QAAQ,CAAC,CAAC;EAC7B,WAAW,OAAO,GAAG,WAAW,EAAE,MAAM,UAAU;GACjD,MAAM,WAAW,QAAQ,KAAK,OAAO,mBAAmB,OAAO,IAAI,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK;GAC3I,IAAI,UAAU,OAAO;IACpB,IAAI,SAAS,KAAK;IAClB,MAAM,SAAS,KAAK;IACpB,gBAAgB,SAAS,KAAK;GAC/B;GACA,MAAM,UAAU,OAAO,WAAW,OAAO,KAAK,YAAY,EAAE,MAAM;IACjE,aAAa,KAAK;IAClB,WAAW,KAAK;IAChB,GAAG,KAAK,UAAU,EAAE,UAAU,KAAK,OAAO;IAC1C,GAAG,KAAK,aAAa,KAAK,KAAK,EAAE,UAAU,KAAK,SAAS;GAC1D,EAAE,CAAC,CAAC;GACJ,OAAO;IACN,IAAI,QAAQ,KAAK;IACjB,MAAM,QAAQ,KAAK;IACnB,gBAAgB,QAAQ,KAAK;GAC9B;EACD,CAAC;EACD,QAAQ,OAAO,GAAG,WAAW,EAAE,UAAU;GACxC,OAAO,eAAe,OAAO,OAAO,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;IACtH,UAAU;IACV,OAAO;GACR,CAAC,CAAC;EACH,CAAC;EACD,MAAM,OAAO,GAAG,WAAW,EAAE,UAAU;GACtC,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK;GAC7B,MAAM,IAAI,OAAO,mBAAmB,OAAO,IAAI,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;GAC9G,OAAO,IAAI;IACV,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,KAAK;IACb,gBAAgB,EAAE,KAAK;GACxB,IAAI,KAAK;EACV,CAAC;CACF;AACD,CAAC,CAAC;;;;;;AAQF,MAAM,aAAa,SAAS,mBAAmB;AAC/C,MAAM,2BAA2B,SAAS,OAAO,YAAY,OAAO,IAAI,aAAa;CACpF,MAAM,SAAS,OAAO;CACtB,MAAM,kBAAkB,iBAAiB,WAAW,OAAO,IAAI,kCAAkC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,MAAM,EAAE,KAAK,WAAW,YAAY,OAAO,OAAO,OAAO,KAAK,IAAI,eAAe;EAC/O,QAAQ;EACR,SAAS,cAAc,aAAa,MAAM,EAAE,KAAK,OAAO;CACzD,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,SAAS,KAAK,SAAS,OAAO,WAAW,GAAG,SAAS,OAAO,WAAW,CAAC,CAAC,CAAC;CAC7F,OAAO;EACN,SAAS,CAAC;EACV,YAAY,OAAO,QAAQ,CAAC,CAAC;EAC7B,WAAW,OAAO,GAAG,WAAW,EAAE,QAAQ;GACzC,MAAM,UAAU,OAAO,WAAW,OAAO,KAAK,gCAAgC;IAC7E,QAAQ,EAAE,MAAM,EAAE,OAAO,KAAK,iBAAiB,EAAE;IACjD,MAAM,KAAK,SAAS,KAAK,IAAI,EAAE,aAAa,EAAE,MAAM,KAAK,KAAK,EAAE,IAAI,CAAC;GACtE,CAAC,CAAC;GACF,MAAM,eAAe,QAAQ,KAAK;GAClC,IAAI,QAAQ,KAAK,WAAW;IAC3B,MAAM,YAAY,QAAQ,KAAK;IAC/B,MAAM,WAAW,OAAO,OAAO,IAAI;KAClC,WAAW,GAAG,aAAa,KAAK,YAAY;KAC5C,QAAQ,UAAU,IAAI,eAAe;MACpC,QAAQ;MACR,SAAS,2BAA2B,KAAK,aAAa,IAAI,OAAO,KAAK;KACvE,CAAC;IACF,CAAC;IACD,OAAO,OAAO,WAAW;KACxB,KAAK,YAAY;MAChB,MAAM,MAAM,MAAM,MAAM,WAAW;OAClC,QAAQ;OACR,MAAM;MACP,CAAC;MACD,IAAI,CAAC,IAAI,IAAI,MAAM,IAAI,eAAe;OACrC,QAAQ,IAAI;OACZ,SAAS,2BAA2B,IAAI,OAAO,GAAG,IAAI;MACvD,CAAC;KACF;KACA,QAAQ,UAAU,iBAAiB,iBAAiB,QAAQ,IAAI,eAAe;MAC9E,QAAQ;MACR,SAAS,OAAO,KAAK;KACtB,CAAC;IACF,CAAC;GACF;GACA,OAAO,WAAW,OAAO,KAAK,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;GAC7G,OAAO,eAAe,YAAY;GAClC,MAAM,eAAe,OAAO,WAAW,OAAO,KAAK,4BAA4B;IAC9E,QAAQ,EAAE,MAAM,EAAE,OAAO,KAAK,iBAAiB,EAAE;IACjD,MAAM,EAAE,aAAa;GACtB,CAAC,CAAC,EAAA,CAAG,KAAK;GACV,OAAO;IACN;IACA,GAAG,gBAAgB,KAAK,KAAK,EAAE,YAAY;GAC5C;EACD,CAAC;EACD,QAAQ,OAAO,GAAG,aAAa,CAAC,CAAC;EACjC,MAAM,OAAO,GAAG,WAAW,EAAE,UAAU;GACtC,IAAI,CAAC,QAAQ,cAAc,OAAO,KAAK;GACvC,MAAM,IAAI,OAAO,mBAAmB,OAAO,IAAI,kCAAkC,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,OAAO,aAAa,EAAE,EAAE,CAAC,CAAC;GAC7I,OAAO,IAAI;IACV,cAAc,EAAE,KAAK;IACrB,GAAG,EAAE,KAAK,iBAAiB,EAAE,aAAa,EAAE,KAAK,cAAc;GAChE,IAAI,KAAK;EACV,CAAC;CACF;AACD,CAAC,CAAC;;;;;;AAQF,MAAM,sBAAsB,SAAS,4BAA4B;AACjE,MAAM,oCAAoC,SAAS,OAAO,qBAAqB,OAAO,IAAI,aAAa;CACtG,MAAM,SAAS,OAAO;CACtB,OAAO;EACN,SAAS,CAAC,IAAI;EACd,YAAY,OAAO,QAAQ,CAAC,CAAC;EAC7B,WAAW,OAAO,GAAG,WAAW,EAAE,MAAM,UAAU;GACjD,MAAM,MAAM,KAAK,SAAS;GAC1B,IAAI,KAAK,QAAQ;GACjB,IAAI,OAAO,KAAK,GAAG;IAClB,MAAM,UAAU;IAChB,IAAI,EAAE,OAAO,mBAAmB,OAAO,IAAI,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,KAAK;GAC9I;GACA,IAAI,OAAO,KAAK,GAAG;IAClB,MAAM,WAAW,OAAO,WAAW,OAAO,IAAI,6BAA6B,EAAE,QAAQ,EAAE,OAAO;KAC7F,WAAW,KAAK;KAChB,OAAO;KACP,KAAK,KAAK;IACX,EAAE,EAAE,CAAC,CAAC,EAAA,CAAG,OAAO,EAAE,EAAE;IACpB,IAAI,YAAY,KAAK,GAAG;KACvB,IAAI,EAAE,KAAK,QAAQ,kBAAkB,KAAK,QAAQ,wBAAwB,MAAM,IAAI,MAAM,wBAAwB,KAAK,IAAI,cAAc,KAAK,UAAU,YAAY,IAAI,6LAA6L;KACrW,KAAK;IACN;GACD;GACA,IAAI,OAAO,KAAK,GAAG;IAClB,MAAM,WAAW;IACjB,OAAO,WAAW,OAAO,MAAM,wCAAwC;KACtE,QAAQ,EAAE,MAAM,EAAE,UAAU,SAAS,EAAE;KACvC,MAAM,EAAE,OAAO,KAAK,MAAM;IAC3B,CAAC,CAAC;IACF,OAAO;KACN;KACA,KAAK,KAAK;IACX;GACD;GACA,MAAM,UAAU,OAAO,WAAW,OAAO,KAAK,6BAA6B,EAAE,MAAM;IAClF,WAAW,KAAK;IAChB,OAAO;IACP,KAAK,KAAK;IACV,OAAO,KAAK;IACZ,GAAG,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;GACnD,EAAE,CAAC,CAAC;GACJ,OAAO;IACN,IAAI,QAAQ,KAAK;IACjB,KAAK,QAAQ,KAAK;GACnB;EACD,CAAC;EACD,QAAQ,OAAO,GAAG,WAAW,EAAE,UAAU;GACxC,OAAO,eAAe,OAAO,OAAO,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;EAC3H,CAAC;EACD,MAAM,OAAO,GAAG,WAAW,EAAE,UAAU;GACtC,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK;GAC7B,MAAM,IAAI,OAAO,mBAAmB,OAAO,IAAI,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;GACrI,OAAO,IAAI;IACV,IAAI,EAAE,KAAK;IACX,KAAK,EAAE,KAAK;GACb,IAAI,KAAK;EACV,CAAC;CACF;AACD,CAAC,CAAC;;;;;;;;;AAWF,MAAM,mBAAmB;;AAEzB,SAAS,aAAa,WAAW,OAAO;CACvC,IAAI,UAAU,KAAK,GAAG,OAAO;CAC7B,MAAM,QAAQ,GAAG,YAAY,SAAS,CAAC,CAAC,MAAM,MAAM,eAAe,KAAK,CAAC,CAAC;CAC1E,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,MAAM,2CAA2C,WAAW;CAC5F,OAAO;AACR;;;;;AAKA,SAAS,UAAU,KAAK;CACvB,MAAM,MAAM,CAAC;CACb,MAAM,SAAS,QAAQ;EACtB,KAAK,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,KAAK,GAAG,GAAG,EAAE,eAAe,KAAK,CAAC,GAAG;GACjF,MAAM,MAAM,IAAI,SAAS,IAAI,GAAG,IAAI,GAAG,MAAM,SAAS,MAAM;GAC5D,IAAI,MAAM,eAAe,GAAG,MAAM,IAAI,MAAM,gCAAgC,IAAI,6GAA6G;GAC7L,IAAI,MAAM,YAAY,GAAG,MAAM,GAAG;QAC7B,IAAI,KAAK,GAAG;EAClB;CACD;CACA,MAAM,EAAE;CACR,OAAO,IAAI,KAAK;AACjB;AACA,SAAS,MAAM,OAAO,QAAQ;CAC7B,OAAO,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,GAAG,EAAE;AACvD;;AAEA,SAAS,eAAe,SAAS;CAChC,IAAI,OAAO,WAAW,SAAS,MAAM,KAAK,KAAK,OAAO;EACrD,MAAM;EACN,QAAQ;CACT;CACA,KAAK,IAAI,IAAI,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;EAC7C,IAAI,QAAQ,OAAO,KAAK;EACxB,MAAM,SAAS,QAAQ,MAAM,GAAG,CAAC;EACjC,MAAM,OAAO,QAAQ,MAAM,IAAI,CAAC;EAChC,IAAI,OAAO,WAAW,QAAQ,MAAM,KAAK,OAAO,OAAO,WAAW,MAAM,MAAM,KAAK,KAAK,OAAO;GAC9F;GACA;EACD;CACD;CACA,MAAM,IAAI,MAAM,wCAAwC,SAAS;AAClE;AACA,SAAS,YAAY,SAAS,MAAM;CACnC,MAAM,EAAE,MAAM,WAAW,eAAe,OAAO;CAC/C,MAAM,MAAM,OAAO,MAAM,GAAG;CAC5B,IAAI,MAAM,MAAM,GAAG,KAAK,MAAM;CAC9B,IAAI,MAAM,MAAM,KAAK,CAAC,GAAG,KAAK,GAAG,MAAM;CACvC,IAAI,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,MAAM;CACrC,IAAI,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,MAAM;CACrC,IAAI,MAAM,MAAM,MAAM,EAAE,GAAG,KAAK,IAAI,MAAM;CAC1C,IAAI,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,IAAI,MAAM;CACvC,IAAI,MAAM,YAAY,KAAK,GAAG,MAAM;CACpC,IAAI,MAAM,KAAK,KAAK,GAAG,MAAM;CAC7B,IAAI,MAAM,WAAW,KAAK,GAAG,MAAM;CACnC,IAAI,MAAM,MAAM,KAAK,GAAG,MAAM;CAC9B,IAAI,MAAM,QAAQ,KAAK,KAAK,MAAM;CAClC,IAAI,MAAM;CACV,KAAK,MAAM,KAAK,KAAK,OAAO;CAC5B,IAAI,MAAM,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,MAAM,KAAK,GAAG,MAAM;CAClE,OAAO;AACR;AACA,SAAS,yBAAyB,SAAS;CAC1C,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;CAC7E,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,SAAS,QAAQ;EAC3B,OAAO,KAAK,YAAY,MAAM,SAAS,MAAM,QAAQ,MAAM,CAAC;EAC5D,OAAO,KAAK,MAAM,OAAO;EACzB,MAAM,OAAO,MAAM,MAAM,QAAQ,SAAS,OAAO;EACjD,IAAI,MAAM,GAAG,OAAO,KAAK,OAAO,MAAM,GAAG,CAAC;CAC3C;CACA,OAAO,KAAK,OAAO,MAAM,IAAI,CAAC;CAC9B,OAAO,KAAK,SAAS,OAAO,OAAO,MAAM,CAAC;AAC3C;;;;;;;AAOA,SAAS,uBAAuB,MAAM;CACrC,IAAI,CAAC,GAAG,WAAW,KAAK,SAAS,GAAG,OAAO;EAC1C,MAAM;EACN,QAAQ;CACT;CACA,MAAM,YAAY,uBAAuB,aAAa,KAAK,WAAW,KAAK,WAAW,EAAE,qBAAqB,KAAK,UAAU,KAAK,OAAO,EAAE,iBAAiB,KAAK,UAAU,KAAK,KAAK,UAAU,EAAE;CAChM,MAAM,WAAW,GAAG,KAAK,UAAU;EAClC,iBAAiB;EACjB,YAAY;EACZ,SAAS,KAAK;CACf,GAAG,MAAM,CAAC,EAAE;CACZ,MAAM,QAAQ,UAAU,KAAK,SAAS,CAAC,CAAC,KAAK,aAAa;EACzD;EACA,SAAS,GAAG,aAAa,KAAK,KAAK,KAAK,WAAW,OAAO,CAAC;CAC5D,EAAE;CACF,MAAM,KAAK;EACV,SAAS;EACT,SAAS,OAAO,KAAK,WAAW,MAAM;CACvC,CAAC;CACD,MAAM,KAAK;EACV,SAAS;EACT,SAAS,OAAO,KAAK,UAAU,MAAM;CACtC,CAAC;CACD,MAAM,KAAK;EACV,SAAS;EACT,SAAS,OAAO,KAAK,mCAAmC,MAAM;CAC/D,CAAC;CACD,MAAM,KAAK,yBAAyB,KAAK;CACzC,MAAM,SAAS,SAAS,WAAW,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK;CACpE,MAAM,SAAS,KAAK,KAAKC,KAAG,OAAO,GAAG,2BAA2B,OAAOA,KAAG,SAAS,CAAC,CAAC,GAAG,KAAK,OAAO,MAAM,GAAG,EAAE,CAAC;CACjH,GAAG,UAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;CACxC,MAAM,UAAU,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG,QAAQ;CACrD,MAAM,UAAU,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,GAAG,SAAS,WAAW,EAAE,KAAK;CAC5E,GAAG,cAAc,SAAS,EAAE;CAC5B,GAAG,WAAW,SAAS,OAAO;CAC9B,OAAO;EACN,MAAM;EACN;CACD;AACD;;;;;;;;;;;;AAcA,MAAM,aAAa,SAAS,wBAAwB;;AAEpD,SAAS,iBAAiB;CACzB,MAAM,QAAQ,OAAO,gCAAgC,IAAI,WAAW,EAAE,CAAC;CACvE,OAAO,EAAE,OAAO,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE;AACpF;;;;;;;;AAQA,MAAM,4BAA4B;CACjC,YAAY,OAAO,QAAQ,CAAC,CAAC;CAC7B,YAAY,EAAE,aAAa,OAAO,WAAW,UAAU,eAAe,CAAC;CACvE,cAAc,OAAO;AACtB;;AAEA,MAAM,2BAA2B,SAAS,OAAO,YAAY,OAAO,QAAQ,yBAAyB,CAAC;;;;ACrXtG,MAAM,aAAa,SAAS,mBAAmB;AAC/C,MAAM,2BAA2B,SAAS,OAAO,YAAY,OAAO,IAAI,aAAa;CACpF,MAAM,SAAS,OAAO;CACtB,OAAO;EACN,SAAS,CAAC,MAAM,kBAAkB;EAClC,YAAY,OAAO,QAAQ,CAAC,CAAC;EAC7B,WAAW,OAAO,GAAG,WAAW,EAAE,MAAM,UAAU;GACjD,IAAI,QAAQ,IAAI,OAAO;GACvB,MAAM,UAAU,OAAO,WAAW,OAAO,KAAK,0CAA0C;IACvF,QAAQ,EAAE,MAAM,EAAE,YAAY,KAAK,WAAW,EAAE;IAChD,MAAM,EAAE,MAAM,KAAK,KAAK;GACzB,CAAC,CAAC;GACF,MAAM,YAAY,QAAQ,KAAK;GAC/B,MAAM,MAAM,WAAW,QAAQ,oBAAoB,WAAW,QAAQ;GACtE,IAAI,QAAQ,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,IAAI,eAAe;IAChE,QAAQ;IACR,SAAS,cAAc,QAAQ,KAAK,GAAG;GACxC,CAAC,CAAC;GACF,OAAO;IACN,IAAI,QAAQ,KAAK;IACjB,kBAAkB,SAAS,KAAK,GAAG;GACpC;EACD,CAAC;EACD,QAAQ,OAAO,GAAG,WAAW,EAAE,UAAU;GACxC,OAAO,eAAe,OAAO,OAAO,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;EACrG,CAAC;CACF;AACD,CAAC,CAAC;;AAIF,MAAM,WAAW,SAAS,iBAAiB;AAC3C,MAAM,yBAAyB,SAAS,OAAO,UAAU,OAAO,IAAI,aAAa;CAChF,MAAM,SAAS,OAAO;CACtB,OAAO;EACN,SAAS,CAAC,IAAI;EACd,YAAY,OAAO,QAAQ,CAAC,CAAC;EAC7B,WAAW,OAAO,GAAG,WAAW,EAAE,MAAM,UAAU;GACjD,MAAM,WAAW,QAAQ,KAAK,OAAO,mBAAmB,OAAO,IAAI,8BAA8B,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK;GAC1J,IAAI,CAAC,UAAU;IACd,MAAM,UAAU,OAAO,WAAW,OAAO,KAAK,iBAAiB,EAAE,MAAM;KACtE,WAAW,KAAK;KAChB,MAAM,KAAK;KACX,QAAQ,KAAK;KACb,GAAG,KAAK,cAAc,KAAK,KAAK,EAAE,WAAW,KAAK,UAAU;KAC5D,GAAG,KAAK,aAAa,KAAK,KAAK,EAAE,UAAU,KAAK,SAAS;IAC1D,EAAE,CAAC,CAAC;IACJ,OAAO;KACN,IAAI,QAAQ,KAAK;KACjB,MAAM,QAAQ,KAAK;IACpB;GACD;GACA,MAAM,SAAS;IACd,IAAI,SAAS,KAAK;IAClB,MAAM,SAAS,KAAK;GACrB;GACA,IAAI,KAAK,aAAa,KAAK,GAAG;IAC7B,MAAM,WAAW,KAAK;IACtB,OAAO,WAAW,OAAO,MAAM,8BAA8B;KAC5D,QAAQ,EAAE,MAAM,EAAE,YAAY,OAAO,GAAG,EAAE;KAC1C,MAAM,EAAE,SAAS;IAClB,CAAC,CAAC;GACH;GACA,OAAO;EACR,CAAC;EACD,QAAQ,OAAO,GAAG,WAAW,EAAE,UAAU;GACxC,OAAO,eAAe,OAAO,OAAO,8BAA8B,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;EACnH,CAAC;EACD,MAAM,OAAO,GAAG,WAAW,EAAE,UAAU;GACtC,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK;GAC7B,MAAM,IAAI,OAAO,mBAAmB,OAAO,IAAI,8BAA8B,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;GAC7H,OAAO,IAAI;IACV,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,KAAK;GACd,IAAI,KAAK;EACV,CAAC;CACF;AACD,CAAC,CAAC;;AAIF,MAAM,UAAU,SAAS,gBAAgB;AACzC,MAAM,wBAAwB,SAAS,OAAO,SAAS,OAAO,IAAI,aAAa;CAC9E,MAAM,SAAS,OAAO;CACtB,OAAO;EACN,SAAS,CAAC,IAAI;EACd,YAAY,OAAO,QAAQ,CAAC,CAAC;EAC7B,WAAW,OAAO,GAAG,WAAW,EAAE,MAAM,UAAU;GACjD,MAAM,WAAW,QAAQ,KAAK,OAAO,mBAAmB,OAAO,IAAI,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK;GACzI,IAAI,UAAU,OAAO;IACpB,IAAI,SAAS,KAAK;IAClB,MAAM,SAAS,KAAK;GACrB;GACA,MAAM,UAAU,OAAO,WAAW,OAAO,KAAK,gBAAgB,EAAE,MAAM;IACrE,MAAM,KAAK;IACX,aAAa,KAAK;GACnB,EAAE,CAAC,CAAC;GACJ,OAAO;IACN,IAAI,QAAQ,KAAK;IACjB,MAAM,QAAQ,KAAK;GACpB;EACD,CAAC;EACD,QAAQ,OAAO,GAAG,WAAW,EAAE,UAAU;GACxC,OAAO,eAAe,OAAO,OAAO,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;EAClG,CAAC;EACD,MAAM,OAAO,GAAG,WAAW,EAAE,UAAU;GACtC,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK;GAC7B,MAAM,IAAI,OAAO,mBAAmB,OAAO,IAAI,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;GAC5G,OAAO,IAAI;IACV,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,KAAK;GACd,IAAI,KAAK;EACV,CAAC;CACF;AACD,CAAC,CAAC;;;;AC/GF,IAAI,yBAAyB,cAAc,KAAK,YAAY,wBAAwB,CAAC,CAAC,CAAC;AACvF,MAAM,mBAAmB,WAAW,OAAO,IAAI,aAAa;CAC3D,MAAM,WAAW,CAAC;CAClB,IAAI;CACJ,SAAS;EACR,MAAM,QAAQ,WAAW,KAAK,IAAI,CAAC,IAAI,EAAE,OAAO;EAChD,MAAM,OAAO,OAAO,WAAW,OAAO,IAAI,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;EAChF,SAAS,KAAK,GAAG,KAAK,IAAI;EAC1B,IAAI,CAAC,KAAK,WAAW,WAAW,KAAK,WAAW,eAAe,MAAM;EACrE,SAAS,KAAK,WAAW;CAC1B;CACA,OAAO;AACR,CAAC;;;;;;;AAOD,MAAM,mBAAmB,OAAO,GAAG,WAAW,OAAO,IAAI,GAAG,MAAM,CAAC,IAAI;;;;;;;;;AASvE,MAAM,kBAAkB,QAAQ,aAAa,SAAS,WAAW,OAAO,IAAI,aAAa;CACxF,MAAM,UAAU,OAAO,gBAAgB,MAAM,EAAA,CAAG,QAAQ,MAAM,gBAAgB,EAAE,UAAU,EAAE,MAAM,gBAAgB,WAAW,KAAK,EAAE,SAAS,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,UAAU,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;CAC7M,IAAI,WAAW,KAAK,GAAG,OAAO,OAAO;CACrC,IAAI,CAAC,QAAQ,OAAO,OAAO,OAAO,KAAK,IAAI,uBAAuB,EAAE,QAAQ,CAAC,CAAC;CAC9E,QAAQ,OAAO,WAAW,OAAO,KAAK,gBAAgB,EAAE,MAAM;EAC7D,MAAM;EACN;CACD,EAAE,CAAC,CAAC,EAAA,CAAG,KAAK;AACb,CAAC;AACD,MAAM,gBAAgB,QAAQ,WAAW,YAAY,WAAW,OAAO,IAAI,qCAAqC,EAAE,QAAQ;CACzH,MAAM,EAAE,UAAU;CAClB,OAAO,EAAE,QAAQ;AAClB,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,SAAS,KAAK,KAAK,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;AAUjD,MAAM,iBAAiB,QAAQ,WAAW,SAAS,SAAS,WAAW,OAAO,IAAI,aAAa;CAC9F,MAAM,WAAW,OAAO,aAAa,QAAQ,WAAW,OAAO;CAC/D,IAAI,aAAa,KAAK,GAAG,OAAO;CAChC,IAAI,CAAC,QAAQ,OAAO,OAAO,OAAO,KAAK,IAAI,uBAAuB;EACjE;EACA,OAAO;CACR,CAAC,CAAC;CACF,OAAO,OAAO,WAAW,OAAO,KAAK,qCAAqC;EACzE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE;EAC9B,MAAM,EAAE,QAAQ;CACjB,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,OAAO,QAAQ,IAAI,WAAW,MAAM,aAAa,QAAQ,WAAW,OAAO,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,OAAO,KAAK,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,QAAQ,EAAE,CAAC,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;AACnO,CAAC;;;;;;;;;AASD,MAAM,oBAAoB,SAAS,OAAO,IAAI,aAAa;CAC1D,MAAM,SAAS,OAAO;CACtB,MAAM,SAAS,KAAK,UAAU;CAC9B,MAAM,YAAY,OAAO,eAAe,QAAQ,KAAK,aAAa,KAAK,SAAS,MAAM;CACtF,IAAI,KAAK,UAAU,KAAK,GAAG,OAAO,EAAE,UAAU;CAC9C,OAAO;EACN;EACA,UAAU,OAAO,cAAc,QAAQ,WAAW,KAAK,OAAO,KAAK,SAAS,MAAM;CACnF;AACD,CAAC;;;;;;AAMD,MAAM,gBAAgB,aAAa,OAAO,IAAI,aAAa;CAC1D,MAAM,SAAS,OAAO;CACtB,OAAO,eAAe,OAAO,OAAO,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AACnG,CAAC;;;;;;AAMD,MAAM,iBAAiB,cAAc,OAAO,IAAI,aAAa;CAC5D,MAAM,SAAS,OAAO;CACtB,OAAO,eAAe,OAAO,OAAO,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;;AAID,IAAI,YAAY,cAAc,SAAS,mBAAmB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;;;;;;AAMvE,MAAM,kBAAkB,MAAM,OAAO,WAAW,SAAS,WAAW;CACnE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,QAAQ,MAAM,SAAS,gBAAgB,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,4BAA4B,GAAG,eAAe,GAAG,kBAAkB,CAAC,CAAC,GAAG,MAAM,aAAa,MAAM,CAAC,GAAG,MAAM,aAAa,QAAQ,CAAC,GAAG,MAAM,KAAK;;;;;;;;;;;;;;AC4HlS,SAASC,cAAY,GAAG;CACvB,OAAO,OAAO,gBAAgB,IAAI,WAAW,CAAC,CAAC;AAChD;AACA,SAAS,WAAW,OAAO;CAC1B,OAAO,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY;AACvF;;AAEA,SAAS,cAAc;CACtB,OAAO;EACN,aAAa,OAAO,WAAWA,cAAY,CAAC,CAAC;EAC7C,iBAAiB,KAAK,OAAO,aAAa,GAAGA,cAAY,EAAE,CAAC,CAAC;CAC9D;AACD;;;ACvPA,MAAM,4BAA4B;AAClC,IAAI,uBAAuB,MAAM;CAChC;CACA;CACA;CACA,YAAY,OAAO,WAAW,UAAU;EACvC,KAAK,QAAQ;EACb,KAAK,YAAY;EACjB,KAAK,WAAW;CACjB;CACA,YAAY;EACX,OAAO,KAAK,UAAU;GACrB,OAAO,KAAK;GACZ,WAAW,KAAK;GAChB,GAAG,KAAK,aAAa,KAAK,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;EAC9D,CAAC;CACF;AACD;;AAEA,SAAS,uBAAuB,OAAO;CACtC,OAAO,iBAAiB;AACzB;;AAEA,SAAS,uBAAuB,OAAO;CACtC,IAAI,CAAC,uBAAuB,KAAK,GAAG,MAAM,IAAI,MAAM,iGAAiG;CACrJ,OAAO;AACR;AACA,SAAS,SAAS,OAAO;CACxB,OAAO,OAAO,UAAU,YAAY,UAAU;AAC/C;AACA,SAAS,oBAAoB,QAAQ;CACpC,uBAAuB,IAAI,MAAM,GAAG,0BAA0B,0CAA0C,OAAO,EAAE;AAClH;;;;;;;AAOA,SAAS,YAAY,YAAY;CAChC,IAAI;CACJ,IAAI;EACH,SAAS,KAAK,MAAM,UAAU;CAC/B,SAAS,OAAO;EACf,MAAM,oBAAoB,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,EAAE;CACvG;CACA,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,oBAAoB,eAAe;CAChE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,oBAAoB,4BAA4B;CAC5E,MAAM,UAAU,MAAM;CACtB,IAAI,OAAO,YAAY,UAAU,MAAM,oBAAoB,mCAAmC;CAC9F,MAAM,QAAQ,MAAM;CACpB,IAAI,UAAU,KAAK,KAAK,OAAO,UAAU,UAAU,MAAM,oBAAoB,2CAA2C;CACxH,MAAM,YAAY,OAAO;CACzB,IAAI,OAAO,cAAc,UAAU,MAAM,oBAAoB,+BAA+B;CAC5F,MAAM,WAAW,OAAO;CACxB,IAAI,aAAa,KAAK,KAAK,OAAO,aAAa,UAAU,MAAM,oBAAoB,wCAAwC;CAC3H,OAAO,IAAI,qBAAqB;EAC/B;EACA;CACD,GAAG,WAAW,QAAQ;AACvB;AACA,MAAM,+CAA+C,IAAI,MAAM,uDAAuD;AACtH,MAAM,2CAA2C,IAAI,MAAM,wDAAwD;AACnH,SAAS,qBAAqB;CAC7B,MAAM,cAAc,QAAQ,IAAI;CAChC,IAAI,gBAAgB,KAAK,KAAK,YAAY,WAAW,GAAG,MAAM,uBAAuB;CACrF,OAAO;AACR;AACA,SAAS,2BAA2B,MAAM;CACzC,IAAI,MAAM,WAAW,KAAK,MAAM,QAAQ,IAAI,2BAA2B,GAAA,CAAI,WAAW,GAAG,MAAM,mBAAmB;AACnH;AACA,eAAe,gBAAgB,OAAO,MAAM;CAC3C,MAAM,cAAc,mBAAmB;CACvC,2BAA2B,IAAI;CAC/B,MAAM,UAAU,iBAAiB;EAChC;EACA,SAAS,MAAM;EACf,GAAG,MAAM,UAAU,KAAK,IAAI,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EACtD,QAAQ;CACT,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,OAAO;EAC1B,IAAI;EACJ,WAAW;CACZ,EAAE,GAAG,OAAO,SAAS,mBAAmB,MAAM,OAAO,QAAQ;EAC5D,IAAI;EACJ,SAAS,qDAAqD,EAAE,QAAQ;CACzE,CAAC,CAAC,CAAC;CACH,MAAM,WAAW,MAAM,WAAW,KAAK,IAAI,QAAQ,KAAK,OAAO,eAAe,kBAAkB,KAAK,MAAM,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQC,MAAsB,CAAC,CAAC,KAAK,MAAM,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC;CACnM,MAAM,UAAU,MAAM,OAAO,WAAW,QAAQ;CAChD,IAAI,CAAC,QAAQ,IAAI,MAAM,IAAI,MAAM,QAAQ,OAAO;CAChD,OAAO,IAAI,qBAAqB,OAAO,QAAQ,UAAU,WAAW,QAAQ,UAAU,QAAQ;AAC/F;AACA,eAAe,gBAAgB,OAAO,MAAM;CAC3C,MAAM,cAAc,mBAAmB;CACvC,2BAA2B,IAAI;CAC/B,MAAM,UAAU,iBAAiB;EAChC;EACA,SAAS,MAAM;EACf,GAAG,MAAM,UAAU,KAAK,IAAI,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EACtD,QAAQ;CACT,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,OAAO;EAC1B,IAAI;EACJ,WAAW;CACZ,EAAE,GAAG,OAAO,SAAS,gCAAgC,OAAO,QAAQ,EAAE,IAAI,MAAM,CAAC,CAAC,GAAG,OAAO,SAAS,mBAAmB,MAAM,OAAO,qBAAqB,IAAI,MAAM,qDAAqD,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;CACxO,MAAM,WAAW,MAAM,WAAW,KAAK,IAAI,QAAQ,KAAK,OAAO,eAAe,kBAAkB,KAAK,MAAM,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQA,MAAsB,CAAC,CAAC,KAAK,MAAM,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC;CACnM,MAAM,UAAU,MAAM,OAAO,WAAW,QAAQ;CAChD,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK;CAC7B,OAAO,IAAI,qBAAqB,OAAO,QAAQ,UAAU,WAAW,QAAQ,UAAU,QAAQ;AAC/F;;;;;;AAMA,eAAe,kBAAkB,UAAU,MAAM;CAChD,2BAA2B,IAAI;CAC/B,MAAM,UAAU,aAAa,QAAQ,CAAC,CAAC,KAAK,OAAO,WAAW,EAAE,IAAI,KAAK,EAAE,GAAG,OAAO,SAAS,mBAAmB,MAAM,OAAO,QAAQ;EACrI,IAAI;EACJ,SAAS,sCAAsC,EAAE,QAAQ;CAC1D,CAAC,CAAC,CAAC;CACH,MAAM,WAAW,MAAM,WAAW,KAAK,IAAI,QAAQ,KAAK,OAAO,eAAe,kBAAkB,KAAK,MAAM,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQA,MAAsB,CAAC,CAAC,KAAK,MAAM,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC;CACnM,MAAM,UAAU,MAAM,OAAO,WAAW,QAAQ;CAChD,IAAI,CAAC,QAAQ,IAAI,MAAM,IAAI,MAAM,QAAQ,OAAO;AACjD;;;;;;;;;AASA,eAAe,iBAAiB,WAAW,MAAM;CAChD,IAAI,MAAM,WAAW,KAAK,MAAM,QAAQ,IAAI,2BAA2B,GAAA,CAAI,WAAW,GAAG;EACxF,QAAQ,KAAK,iCAAiC,UAAU,oCAAoC;EAC5F;CACD;CACA,MAAM,UAAU,cAAc,SAAS,CAAC,CAAC,KAAK,OAAO,WAAW,EAAE,IAAI,KAAK,EAAE,GAAG,OAAO,SAAS,mBAAmB,MAAM,OAAO,QAAQ;EACvI,IAAI;EACJ,OAAO;CACR,CAAC,CAAC,CAAC;CACH,MAAM,WAAW,MAAM,WAAW,KAAK,IAAI,QAAQ,KAAK,OAAO,eAAe,kBAAkB,KAAK,MAAM,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQA,MAAsB,CAAC,CAAC,KAAK,MAAM,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC;CACnM,MAAM,UAAU,MAAM,OAAO,WAAW,QAAQ;CAChD,IAAI,QAAQ,IAAI;EACf,QAAQ,IAAI,wBAAwB,UAAU,4BAA4B;EAC1E;CACD;CACA,IAAI,QAAQ,MAAM,WAAW,KAAK;EACjC,QAAQ,IAAI,qBAAqB,UAAU,4CAA4C;EACvF;CACD;CACA,QAAQ,KAAK,iCAAiC,UAAU,mBAAmB,QAAQ,MAAM,QAAQ,EAAE;AACpG;AACA,SAAS,oBAAoB,MAAM;CAClC,OAAO;EACN,SAAS,UAAU,gBAAgB,OAAO,IAAI;EAC9C,SAAS,UAAU,gBAAgB,OAAO,IAAI;EAC9C,SAAS,aAAa,SAAS,MAAM,UAAU,KAAK,IAAI,kBAAkB,SAAS,YAAY,gBAAgB,QAAQ,GAAG,IAAI,IAAI,iBAAiB,SAAS,WAAW,IAAI;EAC3K;CACD;AACD;;AAEA,SAAS,gBAAgB,UAAU;CAClC,MAAM,IAAI,MAAM,GAAG,0BAA0B,oBAAoB,SAAS,MAAM,MAAM,4FAA4F;AACnL;;;;;;;;;;;;;;;;;;;AAqBA,MAAM,SAAS,SAAS,oBAAoB;;AAE5C,eAAe,aAAa,KAAK;CAChC,MAAM,oBAAoB,YAAY;EACrC,MAAM,SAAS,IAAI,GAAG,OAAO,EAAE,kBAAkB,iBAAiB,GAAG,EAAE,CAAC;EACxE,MAAM,OAAO,QAAQ;EACrB,IAAI;GACH,MAAM,OAAO,MAAM,UAAU;EAC9B,UAAU;GACT,MAAM,OAAO,IAAI;EAClB;CACD,CAAC;AACF;;;;;;;;AAQA,MAAM,wBAAwB;CAC7B,YAAY,OAAO,QAAQ,CAAC,CAAC;CAC7B,YAAY,EAAE,WAAW,OAAO,WAAW;EAC1C,WAAW,aAAa,KAAK,GAAG;EAChC,QAAQ,UAAU;CACnB,CAAC,CAAC,CAAC,KAAK,OAAO,WAAW,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;CAC7C,cAAc,OAAO;AACtB;;AAEA,MAAM,uBAAuB,SAAS,OAAO,QAAQ,OAAO,QAAQ,qBAAqB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoC1F,IAAI,mBAAmB,cAAc,MAAM;CAC1C;;CAEA;CACA,YAAY,MAAM,SAAS,KAAK;EAC/B,MAAM,wBAAwB,KAAK,KAAK,SAAS;EACjD,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,MAAM;CACZ;AACD;;;;;AAKA,SAAS,kBAAkB,cAAc;CACxC,IAAI,OAAO,iBAAiB,YAAY,iBAAiB,QAAQ,aAAa,cAAc;EAC3F,MAAM,UAAU,aAAa;EAC7B,IAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,iBAAiB,SAAS;GAChF,MAAM,OAAO,QAAQ;GACrB,IAAI,OAAO,SAAS,YAAY,KAAK,SAAS,GAAG,OAAO;EACzD;CACD;CACA,MAAM,IAAI,iBAAiB,eAAe,sFAAsF;AACjI;;;;;;;;;;;;;AAaA,eAAe,iBAAiB,eAAe,cAAc,WAAW;CACvE,IAAI,cAAc,KAAK,GAAG;EACzB,MAAM,UAAU,mBAAmB,wBAAwB,eAAe,YAAY,CAAC;EACvF,IAAI;GACH,MAAM,MAAM,MAAM,QAAQ,SAAS,SAAS;GAC5C,OAAO;IACN,MAAM,IAAI;IACV,YAAY,IAAI;GACjB;EACD,SAAS,OAAO;GACf,MAAM,IAAI,iBAAiB,wBAAwB,cAAc,UAAU,2BAA2B,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;EACxK;CACD;CACA,MAAM,OAAO,MAAM,yBAAyB,eAAe,YAAY;CACvE,IAAI,SAAS,MAAM,OAAO;EACzB,MAAM,KAAK;EACX,YAAY,KAAK;CAClB;CACA,OAAO;EACN,MAAM,kBAAkB,YAAY;EACpC,YAAY,CAAC;CACd;AACD;;;;;;;;;;;AAWA,SAAS,sBAAsB,QAAQ,KAAK;CAC3C,MAAM,mBAAmB,IAAI,IAAI,QAAQ,cAAc,CAAC,CAAC;CACzD,MAAM,UAAU,IAAI,WAAW,QAAQ,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;CACvE,IAAI,WAAW,QAAQ,OAAO,gBAAgB,IAAI,QAAQ,QAAQ,WAAW,GAAG,OAAO;CACvF,IAAI,WAAW,QAAQ,QAAQ,WAAW,GAAG,OAAO;CACpD,OAAO;AACR;;;;;;;;;;;;AAYA,eAAe,iBAAiB,MAAM;CACrC,MAAM,aAAa,iBAAiB,KAAK,GAAG;CAC5C,OAAO,0BAA0B,aAAa,YAAY,KAAK,cAAc,KAAK,eAAe,KAAK,KAAK,KAAK,OAAO,GAAG,EAAE,cAAc,UAAU,EAAE,iBAAiB,kBAAkB,CAAC;AAC3L;AACA,eAAe,aAAa,YAAY,cAAc,eAAe,KAAK,SAAS;CAClF,MAAM,SAAS,4BAA4B,EAAE,WAAW,CAAC;CACzD,MAAM,OAAO,QAAQ;CACrB,IAAI;EACH,MAAM,SAAS,MAAM,OAAO,WAAW;EACvC,MAAM,mBAAmB,QAAQ,eAAe;EAChD,MAAM,SAAS,sBAAsB,QAAQ,GAAG;EAChD,IAAI,WAAW,QAAQ,OAAO;GAC7B;GACA,YAAY,IAAI;GAChB;EACD;EACA,IAAI,WAAW,QAAQ;GACtB,MAAM,SAAS,MAAM,OAAO,OAAO;IAClC,UAAU;IACV,MAAM;IACN;GACD,CAAC;GACD,IAAI,CAAC,OAAO,IAAI,MAAM,IAAI,iBAAiB,eAAe,OAAO,QAAQ,SAAS,OAAO,QAAQ,GAAG;GACpG,OAAO;IACN;IACA,YAAY,IAAI;IAChB;GACD;EACD;EACA,MAAM,SAAS,MAAM,OAAO,QAAQ;GACnC,UAAU;GACV;GACA,GAAG,YAAY,KAAK,IAAI;IACvB,SAAS,IAAI;IACb,eAAe,IAAI;IACnB;GACD,IAAI,CAAC;EACN,CAAC;EACD,IAAI,CAAC,OAAO,IAAI,MAAM,IAAI,iBAAiB,OAAO,QAAQ,SAAS,6BAA6B,6BAA6B,iBAAiB,OAAO,QAAQ,SAAS,OAAO,QAAQ,GAAG;EACxL,OAAO;GACN;GACA,YAAY,IAAI;GAChB;EACD;CACD,UAAU;EACT,MAAM,OAAO,MAAM;CACpB;AACD;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,cAAc,SAAS,sBAAsB;;;;;;;;;;AAUnD,MAAM,6BAA6B;CAClC,YAAY,OAAO,QAAQ,CAAC,CAAC;CAC7B,YAAY,EAAE,WAAW,OAAO,WAAW;EAC1C,WAAW,iBAAiB;GAC3B,KAAK,KAAK;GACV,cAAc,KAAK;GACnB,eAAe,KAAK;GACpB,KAAK;IACJ,MAAM,KAAK;IACX,YAAY,KAAK;GAClB;GACA,GAAG,KAAK,YAAY,KAAK,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;EAC3D,CAAC;EACD,QAAQ,UAAU;CACnB,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,aAAa;EAChC,aAAa,QAAQ;EACrB,YAAY,KAAK;CAClB,EAAE,CAAC;CACH,cAAc,OAAO;AACtB;;AAEA,MAAM,4BAA4B,SAAS,OAAO,aAAa,OAAO,QAAQ,0BAA0B,CAAC;;;;;;;;;;;;;;;;AAkBzG,MAAM,gBAAgB,SAAS,2BAA2B;;;;;;;;AAQ1D,MAAM,+BAA+B;CACpC,YAAY,OAAO,QAAQ,CAAC,CAAC;CAC7B,YAAY,EAAE,aAAa,OAAO,WAAW,UAAU,YAAY,CAAC;CACpE,cAAc,OAAO;AACtB;;AAEA,MAAM,8BAA8B,SAAS,OAAO,eAAe,OAAO,QAAQ,4BAA4B,CAAC;AAG/G,SAAS,aAAa,SAAS;CAC9B,MAAM,yBAAyB,IAAI,IAAI;CACvC,KAAK,MAAM,SAAS,SAAS,IAAI,CAAC,OAAO,IAAI,MAAM,IAAI,GAAG,OAAO,IAAI,MAAM,MAAM,KAAK;CACtF,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC;AAC3B;;AAEA,SAAS,sBAAsB,OAAO;CACrC,OAAO;EACN,SAAS,aAAa,kBAAkB,KAAK,CAAC,CAAC,KAAK,aAAa;GAChE,MAAM,WAAW,OAAO;GACxB,gBAAgB,QAAQ;EACzB,EAAE,CAAC;EACH,WAAW,aAAa,cAAc,KAAK,CAAC,CAAC,QAAQ,YAAY,iBAAiB,QAAQ,OAAO,CAAC,CAAC,CAAC,KAAK,aAAa;GACrH,MAAM,UAAU,OAAO;GACvB,gBAAgB,QAAQ;EACzB,EAAE,CAAC;CACJ;AACD"}

package/dist/{prisma-next-DlU01kXJ-2sP5mQb6.mjs → prisma-next-BvBwGCIt-DssgnctU.mjs}

@@ -1,84 +1,9 @@
+import { n as retryTransientConnect, t as normalizeSslMode } from "./pg-connection-CadPZuEK-CF3FsSQu.mjs";
 import { ResourceNodeBase, dependency, freezeNode, string } from "@prisma/composer";
 import { blindCast } from "@prisma/composer/casts";
 import pg from "pg";
 import pnPostgresRuntime from "@prisma-next/postgres/runtime";
-//#region ../../1-prisma-cloud/1-extensions/target/dist/pg-connection-CadPZuEK.mjs
-/** Connection resilience helpers for Prisma Postgres cold-starts (FT-5226); no heavy imports (no `effect`/`alchemy`/`pg`), so the deploy lowerings, the pnPostgres runtime client, and bun-runnable services (the storage store, via the pure `@internal/prisma-cloud/connection` subpath) all share one implementation. */
-/** Network-level socket failures node-postgres surfaces as `err.code`. */
-const TRANSIENT_CODES = /* @__PURE__ */ new Set([
-	"ECONNREFUSED",
-	"ECONNRESET",
-	"ETIMEDOUT",
-	"EPIPE",
-	"ENOTFOUND",
-	"EAI_AGAIN"
-]);
-/** Connection-establishment failure messages (no useful `err.code`). */
-const TRANSIENT_MESSAGE_FRAGMENTS = [
-	"upstream database",
-	"connection terminated",
-	"connection refused",
-	"terminating connection",
-	"server closed the connection",
-	"connection timeout",
-	"timeout expired"
-];
-/** Whether an error is a transient connection failure worth retrying, as opposed to a real query error that must surface at once. */
-function isTransientConnectionError(error) {
-	if (typeof error !== "object" || error === null) return false;
-	const code = "code" in error && typeof error.code === "string" ? error.code : void 0;
-	if (code !== void 0 && TRANSIENT_CODES.has(code)) return true;
-	const message = "message" in error && typeof error.message === "string" ? error.message.toLowerCase() : "";
-	return TRANSIENT_MESSAGE_FRAGMENTS.some((fragment) => message.includes(fragment));
-}
-/**
-* Rewrites a deprecating `sslmode` (`require`/`prefer`/`verify-ca`) to the
-* explicit `verify-full` these already mean, silencing node-postgres's
-* deprecation warning. `disable`/`no-verify`/unset are left untouched.
-*/
-function normalizeSslMode(url) {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		return url;
-	}
-	const sslmode = parsed.searchParams.get("sslmode");
-	if (sslmode === "require" || sslmode === "prefer" || sslmode === "verify-ca") {
-		parsed.searchParams.set("sslmode", "verify-full");
-		return parsed.toString();
-	}
-	return url;
-}
-/**
-* Retries an operation past a transient connection failure, bounded (default
-* ~1 min). `shouldRetry` decides what's transient — defaults to retrying
-* everything; the runtime client passes {@link isTransientConnectionError}.
-*/
-async function withConnectionRetry(operation, opts = {}) {
-	const attempts = opts.attempts ?? 12;
-	const delayMs = opts.delayMs ?? 5e3;
-	const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-	const shouldRetry = opts.shouldRetry ?? (() => true);
-	let lastError;
-	for (let attempt = 1; attempt <= attempts; attempt++) try {
-		return await operation();
-	} catch (error) {
-		if (!shouldRetry(error)) throw error;
-		lastError = error;
-		if (attempt < attempts) await sleep(delayMs);
-	}
-	throw lastError;
-}
-/** Retries acquiring a connection past a transient cold-start; {@link withConnectionRetry} with {@link isTransientConnectionError} fixed as the predicate. */
-function retryTransientConnect(acquire, opts = {}) {
-	return withConnectionRetry(acquire, {
-		...opts,
-		shouldRetry: isTransientConnectionError
-	});
-}
-//#endregion
-//#region ../../1-prisma-cloud/1-extensions/target/dist/prisma-next-DlU01kXJ.mjs
+//#region ../../1-prisma-cloud/1-extensions/target/dist/prisma-next-BvBwGCIt.mjs
 /**
 * The `prisma-next` resource node: a core Resource node plus `config`, the
 * `prisma-next.config.ts` path the deploy-only migration lowering loads to
@@ -119,7 +44,7 @@ function pnPostgres(arg) {
 		type: "prisma-next",
 		connection: {
 			params: { url: string() },
-			hydrate: ({ url }) => buildClient(contract, url)
+			hydrate: ({ url }) => bindLazyClient(contract, url)
 		},
 		required: contract
 	});
@@ -128,6 +53,22 @@ function isPnPostgresContract(value) {
 	return typeof value === "object" && value !== null && "kind" in value && value.kind === "prisma-next" && "__cmp" in value && "satisfies" in value;
 }
 /**
+* The hydrated binding: `url` as delivered, `client` built by `buildClient`
+* on first access. Construction stays out of hydrate because the runtime
+* validates `contractJson` eagerly — deferring it keeps a bad contract from
+* poisoning `load()` and spares URL-only consumers the cost (ADR-0040).
+*/
+function bindLazyClient(contract, url) {
+	let client;
+	return Object.freeze({
+		url,
+		get client() {
+			client ??= buildClient(contract, url);
+			return client;
+		}
+	});
+}
+/**
 * Builds the typed Prisma Next client over a connection pool that rides out
 * a transient cold-start (FT-5226). We pass our own `pg.Pool` rather than a
 * bare `url`: the runtime's bare-`url` connect is a one-shot that fails
@@ -171,6 +112,6 @@ function storageHashOf(contract) {
 	return typeof hash === "string" ? hash : void 0;
 }
 //#endregion
-export { normalizeSslMode as a, pnPostgres as i, isPnPostgresResourceNode as n, withConnectionRetry as o, pnContract as r, PnPostgresResourceNode as t };
+export { pnPostgres as i, isPnPostgresResourceNode as n, pnContract as r, PnPostgresResourceNode as t };
 
-//# sourceMappingURL=prisma-next-DlU01kXJ-2sP5mQb6.mjs.map
+//# sourceMappingURL=prisma-next-BvBwGCIt-DssgnctU.mjs.map

package/dist/prisma-next-BvBwGCIt-DssgnctU.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-next-BvBwGCIt-DssgnctU.mjs","names":[],"sources":["../../../1-prisma-cloud/1-extensions/target/dist/prisma-next-BvBwGCIt.mjs"],"sourcesContent":["import { n as normalizeSslMode, r as retryTransientConnect } from \"./pg-connection-CadPZuEK.mjs\";\nimport { ResourceNodeBase, dependency, freezeNode, string } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\nimport pg from \"pg\";\nimport pnPostgresRuntime from \"@prisma-next/postgres/runtime\";\n//#region src/prisma-next.ts\n/**\n* The `prisma-next` resource node: a core Resource node plus `config`, the\n* `prisma-next.config.ts` path the deploy-only migration lowering loads to\n* find the migrations directory — the app build never imports it.\n*/\nvar PnPostgresResourceNode = class extends ResourceNodeBase {\n\tconfig;\n\tconstructor(def) {\n\t\tsuper({\n\t\t\tname: def.name,\n\t\t\textension: \"@prisma/composer-prisma-cloud\",\n\t\t\tprovides: def.contract\n\t\t});\n\t\tthis.config = def.config;\n\t\tif (def.targetRef !== void 0) this.targetRef = def.targetRef;\n\t\tfreezeNode(this);\n\t}\n};\n/** Narrows `ctx.node` to a `pnPostgres` resource node so the deploy lowering reads `config` without a bare cast. Structural, never `instanceof`. */\nfunction isPnPostgresResourceNode(node) {\n\treturn node.kind === \"resource\" && node.type === \"prisma-next\" && \"config\" in node && typeof node.config === \"string\";\n}\nfunction pnContract(contract) {\n\tconst value = {\n\t\tkind: \"prisma-next\",\n\t\t__cmp: { contractJson: contract },\n\t\tsatisfies: (required) => {\n\t\t\tconst requiredHash = storageHashOf(required);\n\t\t\treturn requiredHash !== void 0 && requiredHash === storageHashOf(value);\n\t\t}\n\t};\n\treturn Object.freeze(value);\n}\nfunction pnPostgres(arg) {\n\tif (!isPnPostgresContract(arg)) return new PnPostgresResourceNode(arg);\n\tconst contract = arg;\n\treturn dependency({\n\t\ttype: \"prisma-next\",\n\t\tconnection: {\n\t\t\tparams: { url: string() },\n\t\t\thydrate: ({ url }) => bindLazyClient(contract, url)\n\t\t},\n\t\trequired: contract\n\t});\n}\nfunction isPnPostgresContract(value) {\n\treturn typeof value === \"object\" && value !== null && \"kind\" in value && value.kind === \"prisma-next\" && \"__cmp\" in value && \"satisfies\" in value;\n}\n/**\n* The hydrated binding: `url` as delivered, `client` built by `buildClient`\n* on first access. Construction stays out of hydrate because the runtime\n* validates `contractJson` eagerly — deferring it keeps a bad contract from\n* poisoning `load()` and spares URL-only consumers the cost (ADR-0040).\n*/\nfunction bindLazyClient(contract, url) {\n\tlet client;\n\treturn Object.freeze({\n\t\turl,\n\t\tget client() {\n\t\t\tclient ??= buildClient(contract, url);\n\t\t\treturn client;\n\t\t}\n\t});\n}\n/**\n* Builds the typed Prisma Next client over a connection pool that rides out\n* a transient cold-start (FT-5226). We pass our own `pg.Pool` rather than a\n* bare `url`: the runtime's bare-`url` connect is a one-shot that fails\n* permanently, but a pool connects lazily on first query, so a bounded retry there suffices.\n*/\nfunction buildClient(contract, url) {\n\treturn pnPostgresRuntime({\n\t\tcontractJson: contract.__cmp.contractJson,\n\t\tbinding: {\n\t\t\tkind: \"pgPool\",\n\t\t\tpool: resilientPool(url)\n\t\t}\n\t});\n}\n/**\n* A `pg.Pool` whose connection acquisition retries a transient cold-start\n* (bounded ~1 min). Only `pool.connect()` is wrapped — a real query error\n* still surfaces at once from `client.query()`.\n*/\nfunction resilientPool(url) {\n\tconst pool = new pg.Pool({\n\t\tconnectionString: normalizeSslMode(url),\n\t\tconnectionTimeoutMillis: 2e4,\n\t\tidleTimeoutMillis: 5e3\n\t});\n\tpool.on(\"error\", (err) => console.error(\"pg pool idle client error\", err));\n\tconst acquire = pool.connect.bind(pool);\n\tpool.connect = blindCast(() => retryTransientConnect(() => acquire()));\n\treturn pool;\n}\n/** Reads `__cmp.contractJson.storage.storageHash` off a `prisma-next` Contract, defensively — `__cmp` is opaque to core, so nothing guarantees its shape without a runtime check. */\nfunction storageHashOf(contract) {\n\tif (contract === void 0) return void 0;\n\tconst cmp = contract.__cmp;\n\tif (typeof cmp !== \"object\" || cmp === null || !(\"contractJson\" in cmp)) return void 0;\n\tconst contractJson = cmp.contractJson;\n\tif (typeof contractJson !== \"object\" || contractJson === null || !(\"storage\" in contractJson)) return;\n\tconst storage = contractJson.storage;\n\tif (typeof storage !== \"object\" || storage === null || !(\"storageHash\" in storage)) return void 0;\n\tconst hash = storage.storageHash;\n\treturn typeof hash === \"string\" ? hash : void 0;\n}\n//#endregion\nexport { pnPostgres as i, isPnPostgresResourceNode as n, pnContract as r, PnPostgresResourceNode as t };\n\n//# sourceMappingURL=prisma-next-BvBwGCIt.mjs.map"],"mappings":";;;;;;;;;;;AAWA,IAAI,yBAAyB,cAAc,iBAAiB;CAC3D;CACA,YAAY,KAAK;EAChB,MAAM;GACL,MAAM,IAAI;GACV,WAAW;GACX,UAAU,IAAI;EACf,CAAC;EACD,KAAK,SAAS,IAAI;EAClB,IAAI,IAAI,cAAc,KAAK,GAAG,KAAK,YAAY,IAAI;EACnD,WAAW,IAAI;CAChB;AACD;;AAEA,SAAS,yBAAyB,MAAM;CACvC,OAAO,KAAK,SAAS,cAAc,KAAK,SAAS,iBAAiB,YAAY,QAAQ,OAAO,KAAK,WAAW;AAC9G;AACA,SAAS,WAAW,UAAU;CAC7B,MAAM,QAAQ;EACb,MAAM;EACN,OAAO,EAAE,cAAc,SAAS;EAChC,YAAY,aAAa;GACxB,MAAM,eAAe,cAAc,QAAQ;GAC3C,OAAO,iBAAiB,KAAK,KAAK,iBAAiB,cAAc,KAAK;EACvE;CACD;CACA,OAAO,OAAO,OAAO,KAAK;AAC3B;AACA,SAAS,WAAW,KAAK;CACxB,IAAI,CAAC,qBAAqB,GAAG,GAAG,OAAO,IAAI,uBAAuB,GAAG;CACrE,MAAM,WAAW;CACjB,OAAO,WAAW;EACjB,MAAM;EACN,YAAY;GACX,QAAQ,EAAE,KAAK,OAAO,EAAE;GACxB,UAAU,EAAE,UAAU,eAAe,UAAU,GAAG;EACnD;EACA,UAAU;CACX,CAAC;AACF;AACA,SAAS,qBAAqB,OAAO;CACpC,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS,iBAAiB,WAAW,SAAS,eAAe;AAC7I;;;;;;;AAOA,SAAS,eAAe,UAAU,KAAK;CACtC,IAAI;CACJ,OAAO,OAAO,OAAO;EACpB;EACA,IAAI,SAAS;GACZ,WAAW,YAAY,UAAU,GAAG;GACpC,OAAO;EACR;CACD,CAAC;AACF;;;;;;;AAOA,SAAS,YAAY,UAAU,KAAK;CACnC,OAAO,kBAAkB;EACxB,cAAc,SAAS,MAAM;EAC7B,SAAS;GACR,MAAM;GACN,MAAM,cAAc,GAAG;EACxB;CACD,CAAC;AACF;;;;;;AAMA,SAAS,cAAc,KAAK;CAC3B,MAAM,OAAO,IAAI,GAAG,KAAK;EACxB,kBAAkB,iBAAiB,GAAG;EACtC,yBAAyB;EACzB,mBAAmB;CACpB,CAAC;CACD,KAAK,GAAG,UAAU,QAAQ,QAAQ,MAAM,6BAA6B,GAAG,CAAC;CACzE,MAAM,UAAU,KAAK,QAAQ,KAAK,IAAI;CACtC,KAAK,UAAU,gBAAgB,4BAA4B,QAAQ,CAAC,CAAC;CACrE,OAAO;AACR;;AAEA,SAAS,cAAc,UAAU;CAChC,IAAI,aAAa,KAAK,GAAG,OAAO,KAAK;CACrC,MAAM,MAAM,SAAS;CACrB,IAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,EAAE,kBAAkB,MAAM,OAAO,KAAK;CACrF,MAAM,eAAe,IAAI;CACzB,IAAI,OAAO,iBAAiB,YAAY,iBAAiB,QAAQ,EAAE,aAAa,eAAe;CAC/F,MAAM,UAAU,aAAa;CAC7B,IAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,EAAE,iBAAiB,UAAU,OAAO,KAAK;CAChG,MAAM,OAAO,QAAQ;CACrB,OAAO,OAAO,SAAS,WAAW,OAAO,KAAK;AAC/C"}

package/dist/prisma-next.d.mts

@@ -22,8 +22,17 @@ interface PnCmp<C extends AnyPnContract = AnyPnContract> {
 type PnPostgresContract<C extends AnyPnContract = AnyPnContract> = Contract<'prisma-next', PnCmp<C>>;
 /** Recovers the emitted contract type `C` a `prisma-next` Contract carries. */
 type PnContractOf<Ct> = Ct extends PnPostgresContract<infer C> ? C : never;
-/** The typed client a consumer's `pnPostgres(contract)` dependency hydrates to. */
+/** The typed Prisma Next client, reachable as `binding.client` on a `pnPostgres(contract)` dependency. */
 type Client<Ct> = PostgresClient<PnContractOf<Ct>>;
+/**
+ * The binding a consumer's `pnPostgres(contract)` dependency hydrates to
+ * (ADR-0040): the raw connection URL, plus the typed client — constructed on
+ * first access, memoized thereafter.
+ */
+interface PnPostgresBinding<Ct> {
+  readonly url: string;
+  readonly client: Client<Ct>;
+}
 /**
  * The `prisma-next` resource node: a core Resource node plus `config`, the
  * `prisma-next.config.ts` path the deploy-only migration lowering loads to
@@ -62,10 +71,10 @@ declare function pnPostgres<C extends PnPostgresContract>(opts: {
 }): PnPostgresResourceNode<C>;
 /**
  * `pnPostgres(contract)` — a service's dependency on a Prisma Next-typed
- * Postgres. Its binding is the typed Prisma Next client, constructed by the
- * framework in hydrate from the contract plus the injected connection URL.
+ * Postgres. Its binding carries the raw connection URL and the typed Prisma
+ * Next client, built lazily on first `client` access (ADR-0040).
  */
-declare function pnPostgres<C extends PnPostgresContract>(contract: C): DependencyEnd<Client<C>, C>;
+declare function pnPostgres<C extends PnPostgresContract>(contract: C): DependencyEnd<PnPostgresBinding<C>, C>;
 //#endregion
-export { AnyPnContract, Client, PnCmp, PnContractOf, PnPostgresContract, PnPostgresResourceNode, isPnPostgresResourceNode, pnContract, pnPostgres };
+export { AnyPnContract, Client, PnCmp, PnContractOf, PnPostgresBinding, PnPostgresContract, PnPostgresResourceNode, isPnPostgresResourceNode, pnContract, pnPostgres };
 //# sourceMappingURL=prisma-next.d.mts.map

package/dist/prisma-next.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-next.d.mts","names":[],"sources":["../../../1-prisma-cloud/1-extensions/target/dist/prisma-next.d.mts"],"mappings":";;;;;;;;;;KASK,sDAAsD,SAAS;;;;;;UAM1D,MAAM,UAAU,gBAAgB;WAC/B;WACA,YAAY;;;KAGlB,mBAAmB,UAAU,gBAAgB,iBAAiB,wBAAwB,MAAM;;KAE5F,aAAa,MAAM,WAAW,yBAAyB,KAAK;;KAE5D,OAAO,MAAM,eAAe,aAAa;;;;;;UAMpC,kBAAkB;WACjB;WACA,QAAQ,OAAO;;;;;;;cAOZ,uBAAuB,UAAU,qBAAqB,4BAA4B,iBAAiB;WACtG;;WAEA;EACT,YAAY;IACV;IACA,UAAU;IACV;IACA;;;;iBAIa,yBAAyB,MAAM,cAAc,eAAe,QAAQ;;;;;;iBAMpE,iBAAiB,UAAU,eAAe,UAAU,IAAI,mBAAmB;iBAC3E,WAAW,UAAU,eAAe,wBAAwB,mBAAmB;;;;;;iBAM/E,WAAW,UAAU,oBAAoB;EACxD;EACA,UAAU;EACV;EACA;IACE,uBAAuB;;;;;;iBAMV,WAAW,UAAU,oBAAoB,UAAU,IAAI,cAAc,kBAAkB,IAAI"}

package/dist/prisma-next.mjs

@@ -1,2 +1,2 @@
-import { i as pnPostgres, n as isPnPostgresResourceNode, r as pnContract, t as PnPostgresResourceNode } from "./prisma-next-DlU01kXJ-2sP5mQb6.mjs";
+import { i as pnPostgres, n as isPnPostgresResourceNode, r as pnContract, t as PnPostgresResourceNode } from "./prisma-next-BvBwGCIt-DssgnctU.mjs";
 export { PnPostgresResourceNode, isPnPostgresResourceNode, pnContract, pnPostgres };

package/dist/provisioned-edges-C1wSO3cx-YC5C19f9.mjs

@@ -0,0 +1,151 @@
+import { n as configKey, t as ORIGIN_KEY_NAME } from "./serializer-CJiOhF2d-DJUjQj1i.mjs";
+import { provisionNeed } from "@prisma/composer";
+import { type } from "arktype";
+import { RPC_PEER_KEY } from "@prisma/composer/service-rpc";
+//#region ../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-C1wSO3cx.mjs
+/**
+* The service's own origin as a reserved provider param (ADR-0031): the ONE
+* brand and the ONE entry — shared by control.ts (which registers the
+* deploy-side value function that resolves the provisioned service's
+* `endpointDomain` — see its `selfOriginValue`) and compute.ts (which
+* validates and stashes the row at boot through the generic
+* `stashProviderParams` loop), so writer and reader cannot drift.
+*
+* Unlike the key-minting brands (`service-keys.ts`, `streams-keys.ts`) this
+* brand has no provisioner and no consumer edges: the value derives from the
+* service's OWN provisioned attributes, so control.ts registers it as a
+* service-derived provider param (`descriptors/shared.ts`'s
+* `ServiceProviderParam`) and the descriptor writes it for EVERY compute
+* service, exposing or not.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side value function lives in control.ts, the
+* control-plane-only entry).
+*/
+/** ADR-0031's brand for the service's own origin — control.ts registers the deploy-side value function under this. */
+const SELF_ORIGIN = Symbol.for("prisma:self-origin");
+/**
+* The reserved provider param for the origin row: the var name is `ORIGIN`,
+* derived through `configKey` at both ends (`configKey(address, …)` at
+* deploy, `configKey('', …)` — `COMPOSER_ORIGIN` — at boot, where
+* `readOrigin` reads it back). `brand` is `SELF_ORIGIN` — control.ts looks
+* its deploy-side value function up by this field.
+*/
+const ORIGIN_PARAM = {
+	name: ORIGIN_KEY_NAME,
+	schema: type("string"),
+	brand: SELF_ORIGIN
+};
+/**
+* RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —
+* name + schema + brand — for the accepted-keys set a provider stores, shared
+* by `control.ts` (which registers the deploy-side `value(refs)` that mints
+* and aggregates it — see its `rpcAcceptedKeysValue`) and `compute.ts` (which
+* validates and stashes it at boot), so writer and reader cannot drift.
+* Finding the edges themselves is `provisioned-edges.ts`'s generic,
+* brand-blind scan — RPC is not special-cased anywhere in this target.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side `value(refs)` lives in control.ts, the
+* control-plane-only entry).
+*/
+/**
+* The reserved provider param for RPC's accepted-keys set: the var name is
+* `RPC_ACCEPTED_KEYS`, derived through `configKey` at both ends
+* (`configKey(address, …)` at deploy, `configKey('', …)` at boot — the
+* address-free form is `@internal/service-rpc`'s `RPC_ACCEPTED_KEYS_ENV`). `brand` is
+* `RPC_PEER_KEY`, the same brand `perBindingToken()`'s need carries — control.ts
+* looks its `value(refs)` up by this field.
+*/
+const RPC_ACCEPTED_KEYS_PARAM = {
+	name: "RPC_ACCEPTED_KEYS",
+	schema: type("string[]"),
+	brand: RPC_PEER_KEY
+};
+/** ADR-0031's need brand for the streams module's bearer key — control.ts registers the provisioner under this. */
+const STREAMS_API_KEY = Symbol.for("prisma:streams/api-key");
+/**
+* The provisioning need `durableStreams()`'s `apiKey` param declares: an
+* unguessable value the target mints ONCE PER PROVIDER (not per edge) —
+* `@prisma/streams-server` authenticates a single `API_KEY`, so every
+* consumer of one streams module must present the same value. Per-provider
+* cardinality is provisioner policy (ADR-0031), invisible to core.
+*/
+const streamsApiKeyNeed = () => provisionNeed(STREAMS_API_KEY);
+/**
+* The reserved provider param for the streams bearer key: the var name is
+* `STREAMS_API_KEY`. `brand` is `STREAMS_API_KEY` itself (the same symbol
+* `streamsApiKeyNeed()`'s need carries) — control.ts looks its `value(refs)`
+* up by this field.
+*/
+const STREAMS_API_KEY_PARAM = {
+	name: "STREAMS_API_KEY",
+	schema: type("string"),
+	brand: STREAMS_API_KEY
+};
+/** The address-free name compute.ts re-stashes to and the streams entrypoint reads. */
+const STREAMS_API_KEY_ENV = configKey("", {
+	owner: "service",
+	name: STREAMS_API_KEY_PARAM.name
+});
+/**
+* The list of provider-side reserved params the boot path validates and
+* stashes (ADR-0031): every brand's `{name, schema, brand}` declaration,
+* collected from that brand's own module (`service-keys.ts`,
+* `streams-keys.ts`, `origin-key.ts`) so `compute.ts` names no brand itself.
+*
+* This list exists separately from `control.ts`'s deploy-side registry
+* (`PROVIDER_PARAMS`) because `control.ts` is deploy-only code — it imports
+* `@internal/lowering` and `effect` to mint values — and a booted service
+* must never import it. This module is reachable from a user service's
+* bundle through `compute.ts`, so it must never import `@internal/lowering`,
+* `effect`, `alchemy`, or `control.ts`.
+*
+* This is the single source of which reserved provider params exist:
+* control.ts builds `PROVIDER_PARAMS` by mapping over this list and looking
+* up each entry's deploy-side value function (edge-derived `value(refs)` or
+* service-derived `valueForService(provisioned, address)`) by its `brand`,
+* throwing at module load if one is missing. Adding a brand means adding its
+* entry here, plus its deploy-side value function in control.ts — a brand
+* registered for deploy but absent here is no longer expressible, because
+* deploy no longer names its own param set independently.
+*/
+const RESERVED_PROVIDER_PARAMS = [
+	RPC_ACCEPTED_KEYS_PARAM,
+	STREAMS_API_KEY_PARAM,
+	ORIGIN_PARAM
+];
+/**
+* Every provisioned edge in the graph. Core resolves and mints these (one
+* value per edge, keyed by `edgeId`); this scan is how the target finds them
+* again when it gathers a provider's inbound values.
+*/
+function provisionedEdges(graph) {
+	const edges = [];
+	for (const edge of graph.edges) {
+		if (edge.kind !== "dependency") continue;
+		const consumer = graph.nodes.find((n) => n.id === edge.to)?.node;
+		if (consumer === void 0 || consumer.kind !== "service") continue;
+		const slot = consumer.inputs[edge.input];
+		if (slot === void 0) continue;
+		for (const param of Object.values(slot.connection.params)) {
+			const brand = param.provision?.brand;
+			if (brand === void 0) continue;
+			edges.push({
+				edgeId: `${edge.to}.${edge.input}`,
+				consumerAddress: edge.to,
+				input: edge.input,
+				providerAddress: edge.from,
+				brand
+			});
+			break;
+		}
+	}
+	return edges;
+}
+//#endregion
+export { provisionedEdges as a, STREAMS_API_KEY_ENV as i, SELF_ORIGIN as n, streamsApiKeyNeed as o, STREAMS_API_KEY as r, RESERVED_PROVIDER_PARAMS as t };
+
+//# sourceMappingURL=provisioned-edges-C1wSO3cx-YC5C19f9.mjs.map