@prisma/composer-prisma-cloud 0.2.0 → 0.3.0-dev.1

package/dist/cron/scheduler-entrypoint.mjs

@@ -61,15 +61,19 @@ function requireExtension(extension, factory) {
 	if (typeof extension !== "string" || extension.length === 0) throw new Error(`${factory}() requires a non-empty extension (the authoring extension's package name).`);
 }
 /**
-* Config keys join address/input/param names with "_" and uppercase — an
-* underscore inside a name would collide with that separator (e.g. param
-* "db_url" vs input "db"'s param "url" both hitting env key "DB_URL").
+* Core's grammar for every name that becomes a config-key segment —
+* addresses, input/param/secret names: ASCII letters and digits only.
+* Conservative by design so any target medium — POSIX env-var keys
+* included — can uppercase and "_"-join segments without escaping.
 */
-function requireNoUnderscoreName(name, kind, factory) {
-	if (name.includes("_")) throw new Error(`${factory}() ${kind} name "${name}" may not contain "_" — config keys join names with "_" as the separator (e.g. an input "db"'s param "url" becomes env key "DB_URL"), so an underscore inside a name would collide with that separator.`);
+function isConfigKeySegment(name) {
+	return /^[A-Za-z0-9]+$/.test(name);
 }
-function requireNoUnderscoreNames(names, kind, factory) {
-	for (const name of names) requireNoUnderscoreName(name, kind, factory);
+function requireConfigKeySegmentName(name, kind, factory) {
+	if (!isConfigKeySegment(name)) throw new Error(`${factory}() ${kind} name "${name}" must contain only ASCII letters and digits ([A-Za-z0-9]) — declared names derive deterministic config keys, uppercased and joined with "_" (an input "db"'s param "url" becomes config key "DB_URL"), so an underscore inside a name collides with that separator and any other character has no place in a config key. "${name}" would put "${name.toUpperCase()}" inside the derived key.`);
+}
+function requireConfigKeySegmentNames(names, kind, factory) {
+	for (const name of names) requireConfigKeySegmentName(name, kind, factory);
 }
 function freezeParams(params) {
 	const frozen = {};
@@ -93,9 +97,9 @@ function service$1(def) {
 	requireName(def.name, "service");
 	requireExtension(def.extension, "service");
 	requireType(def.type, "service");
-	requireNoUnderscoreNames(Object.keys(def.inputs), "input", "service");
-	requireNoUnderscoreNames(Object.keys(def.params), "param", "service");
-	requireNoUnderscoreNames(Object.keys(def.secrets ?? {}), "secret", "service");
+	requireConfigKeySegmentNames(Object.keys(def.inputs), "input", "service");
+	requireConfigKeySegmentNames(Object.keys(def.params), "param", "service");
+	requireConfigKeySegmentNames(Object.keys(def.secrets ?? {}), "secret", "service");
 	for (const slot of Object.keys(def.secrets ?? {})) if (Object.hasOwn(def.params, slot)) throw new Error(`service() secret slot "${slot}" collides with a param of the same name — a secret slot and a service param derive the same config key (COMPOSER_<addr>_${slot.toUpperCase()}); rename one.`);
 	return Object.freeze({
 		[NODE]: true,
@@ -117,7 +121,7 @@ function service$1(def) {
 */
 function dependency(def) {
 	requireType(def.type, "dependency");
-	requireNoUnderscoreNames(Object.keys(def.connection.params), "param", "dependency");
+	requireConfigKeySegmentNames(Object.keys(def.connection.params), "param", "dependency");
 	const connection = Object.freeze({
 		params: freezeParams(def.connection.params),
 		hydrate: def.connection.hydrate
@@ -237,432 +241,129 @@ const nodeBuild = (opts) => ({
 	entry: opts.entry,
 	...opts.dir === void 0 ? {} : { dir: opts.dir }
 });
+const liftArray = (data) => Array.isArray(data) ? data : [data];
 /**
-* Walks a node's own params, then each dependency input's connection params —
-* the same enumeration order `configOf` uses, but carrying the raw
-* `ConfigParam` (with its `serialize`/`deserialize`) instead of a pure-data
-* projection.
+* Splits an array into two arrays based on the result of a predicate
+*
+* @param predicate - The guard function used to determine which items to include.
+* @returns A tuple containing two arrays:
+* 				- the first includes items for which `predicate` returns true
+* 				- the second includes items for which `predicate` returns false
+*
+* @example
+* const list = [1, "2", "3", 4, 5];
+* const [numbers, strings] = spliterate(list, (x) => typeof x === "number");
+* // Type: number[]
+* // Output: [1, 4, 5]
+* console.log(evens);
+* // Type: string[]
+* // Output: ["2", "3"]
+* console.log(odds);
 */
-function paramEntries(node) {
-	const entries = [];
-	for (const [input, value] of Object.entries(node.inputs)) {
-		if (typeof value !== "object" || value === null) continue;
-		const params = blindCast(value).connection.params;
-		for (const [name, param] of Object.entries(params)) entries.push({
-			owner: { input },
-			name,
-			param
-		});
-	}
-	for (const [name, param] of Object.entries(node.params)) entries.push({
-		owner: "service",
-		name,
-		param
-	});
-	return entries;
-}
-const configKey = (address, d) => {
-	const segments = address.split(".").filter((s) => s.length > 0);
-	const owner = d.owner === "service" ? [] : [d.owner.input];
-	return [
-		"COMPOSER",
-		...segments,
-		...owner,
-		d.name
-	].join("_").toUpperCase();
+const spliterate = (arr, predicate) => {
+	const result = [[], []];
+	for (const item of arr) if (predicate(item)) result[0].push(item);
+	else result[1].push(item);
+	return result;
 };
+const ReadonlyArray = Array;
+const includes = (array, element) => array.includes(element);
+const range = (length, offset = 0) => [...new Array(length)].map((_, i) => i + offset);
 /**
-* Typed value → its stored string. Service-own literals are JSON-encoded; a
-* dependency-input value is a provisioning ref at deploy (and a resolved
-* string at boot) and passes through untouched — LANDMINE: JSON-encoding it
-* would break the ordering edge Alchemy resolves through it.
+* Adds a value or array to an array, returning the concatenated result
 */
-function encode(owner, value) {
-	return owner === "service" ? JSON.stringify(value) : blindCast(value);
-}
-/** Reverses `encode`: JSON-parse a service-own value, take a dependency-input value raw. */
-function decode(owner, raw) {
-	return owner === "service" ? JSON.parse(raw) : raw;
-}
-const PARAM_POINTER_PREFIX = "@composer-param-pointer:";
-/** True iff `raw` is a param pointer row (as opposed to a JSON-encoded literal). */
-const isParamPointerRow = (raw) => raw.startsWith(PARAM_POINTER_PREFIX);
-/** Reverses `encodeParamPointer`: the platform var NAME a pointer row points to. */
-const decodeParamPointer = (raw) => raw.slice(24);
-function coerce(raw, d, key) {
-	if (!(raw !== void 0 && raw !== "")) {
-		if (d.param.default !== void 0) return d.param.default;
-		if (d.param.optional === true) return void 0;
-		throw new Error(`missing required config param "${d.name}" (env ${key})`);
-	}
-	if (d.owner === "service" && isParamPointerRow(raw)) return coerceEnvSourcedParam(raw, d, key);
-	try {
-		return standardValidateSync(d.param.schema, decode(d.owner, raw));
-	} catch (cause) {
-		const message = cause instanceof Error ? cause.message : String(cause);
-		throw new Error(`invalid value for config param "${d.name}" (env ${key}): ${message}`);
-	}
-}
+const append = (to, value, opts) => {
+	if (to === void 0) return value === void 0 ? [] : Array.isArray(value) ? value : [value];
+	if (opts?.prepend) if (Array.isArray(value)) to.unshift(...value);
+	else to.unshift(value);
+	else if (Array.isArray(value)) to.push(...value);
+	else to.push(value);
+	return to;
+};
 /**
-* Boot resolution for an env-sourced param: double-lookup (pointer → platform
-* var), then the param's own schema on the raw string — no JSON decode, and
-* no redaction (it's config, not a secret). An UNSET platform var is a loud
-* boot failure naming both the param and the platform var; an EMPTY string is
-* not special-cased here — it reaches the schema like any other value, so it
-* passes iff the schema accepts it (deliberately unlike a literal param's own
-* ""-means-absent rule, and unlike a secret's non-empty requirement).
+* Concatenates an element or list with a readonly list
 */
-function coerceEnvSourcedParam(raw, d, key) {
-	const platformVar = decodeParamPointer(raw);
-	const value = process.env[platformVar];
-	if (value === void 0) throw new Error(`env-sourced config param "${d.name}" (env ${key} → ${platformVar}) is unset: the platform variable "${platformVar}" was not injected — the deploy did not provision it.`);
-	try {
-		return standardValidateSync(d.param.schema, value);
-	} catch (cause) {
-		const message = cause instanceof Error ? cause.message : String(cause);
-		throw new Error(`invalid value for env-sourced config param "${d.name}" (env ${key} → ${platformVar}): ${message}`);
-	}
-}
+const conflatenate = (to, elementOrList) => {
+	if (elementOrList === void 0 || elementOrList === null) return to ?? [];
+	if (to === void 0 || to === null) return liftArray(elementOrList);
+	return to.concat(elementOrList);
+};
 /**
-* Boot: read each declared param from env by its key, reverse the param's own
-* serialization (missing/invalid fails loudly), assemble the typed Config.
-* Secrets ride a separate channel (deserializeSecrets), not this one.
+* Concatenates a variadic list of elements or lists with a readonly list
 */
-const deserialize = (node, address) => {
-	const service = {};
-	const inputs = {};
-	for (const d of paramEntries(node)) {
-		const key = configKey(address, d);
-		const value = coerce(process.env[key], d, key);
-		if (d.owner === "service") service[d.name] = value;
-		else {
-			let bucket = inputs[d.owner.input];
-			if (bucket === void 0) {
-				bucket = {};
-				inputs[d.owner.input] = bucket;
-			}
-			bucket[d.name] = value;
-		}
-	}
-	return {
-		service,
-		inputs
-	};
-};
+const conflatenateAll = (...elementsOrLists) => elementsOrLists.reduce(conflatenate, []);
 /**
-* run()'s setup step: write the resolved config to the environment under
-* address-free keys (configKey("", d) + each serialize suffix), which load()
-* reads back with no address. Uses env, not a module variable, because a
-* framework may fork worker processes that inherit env but not memory.
-* Writes only these keys; nothing else is touched.
+* Appends a value or concatenates an array to an array if it is not already included, returning the array
 */
-const stash = (node, config) => {
-	for (const d of paramEntries(node)) {
-		const value = d.owner === "service" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];
-		if (value === void 0) continue;
-		process.env[configKey("", d)] = encode(d.owner, value);
-	}
+const appendUnique = (to, value, opts) => {
+	if (to === void 0) return Array.isArray(value) ? value : [value];
+	const isEqual = opts?.isEqual ?? ((l, r) => l === r);
+	for (const v of liftArray(value)) if (!to.some((existing) => isEqual(existing, v))) to.push(v);
+	return to;
 };
-/** The pointer-row key for a secret slot: COMPOSER_<addr>_<slot> (secrets are service-level). */
-const secretKey = (address, slot) => configKey(address, {
-	owner: "service",
-	name: slot
-});
+const groupBy = (array, discriminant) => array.reduce((result, item) => {
+	const key = item[discriminant];
+	result[key] = append(result[key], item);
+	return result;
+}, {});
+const arrayEquals = (l, r, opts) => l.length === r.length && l.every(opts?.isEqual ? (lItem, i) => opts.isEqual(lItem, r[i]) : (lItem, i) => lItem === r[i]);
+const hasDomain = (data, kind) => domainOf(data) === kind;
+const domainOf = (data) => {
+	const builtinType = typeof data;
+	return builtinType === "object" ? data === null ? "null" : "object" : builtinType === "function" ? "object" : builtinType;
+};
+/** Each domain's completion for the phrase "must be _____" */
+const domainDescriptions = {
+	boolean: "boolean",
+	null: "null",
+	undefined: "undefined",
+	bigint: "a bigint",
+	number: "a number",
+	object: "an object",
+	string: "a string",
+	symbol: "a symbol"
+};
+const jsTypeOfDescriptions = {
+	...domainDescriptions,
+	function: "a function"
+};
+var InternalArktypeError = class extends Error {};
+const throwInternalError = (message) => throwError(message, InternalArktypeError);
+const throwError = (message, ctor = Error) => {
+	throw new ctor(message);
+};
+var ParseError = class extends Error {
+	name = "ParseError";
+};
+const throwParseError = (message) => throwError(message, ParseError);
 /**
-* Boot: resolve every secret slot to its value by double-lookup — read the
-* pointer key (the platform NAME), then read that platform var. A missing
-* pointer or a missing/empty platform value is a loud failure naming both keys.
-* Returns a plain Record for core's `hydrateSecrets` to box.
+*  TypeScript won't suggest strings beginning with a space as properties.
+*  Useful for symbol-like string properties.
 */
-const deserializeSecrets = (node, address) => {
-	const values = {};
-	for (const slot of Object.keys(node.secretSlots)) {
-		const key = secretKey(address, slot);
-		const name = process.env[key];
-		if (name === void 0 || name === "") throw new Error(`missing secret pointer for slot "${slot}" (env ${key}) — the deploy did not write it.`);
-		const value = process.env[name];
-		if (value === void 0 || value === "") throw new Error(`secret "${slot}" is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
-		values[slot] = value;
+const noSuggest = (s) => ` ${s}`;
+const flatMorph = (o, flatMapEntry) => {
+	const result = {};
+	const inputIsArray = Array.isArray(o);
+	let outputShouldBeArray = false;
+	for (const [i, entry] of Object.entries(o).entries()) {
+		const mapped = inputIsArray ? flatMapEntry(i, entry[1]) : flatMapEntry(...entry, i);
+		outputShouldBeArray ||= typeof mapped[0] === "number";
+		const flattenedEntries = Array.isArray(mapped[0]) || mapped.length === 0 ? mapped : [mapped];
+		for (const [k, v] of flattenedEntries) if (typeof k === "object") result[k.group] = append(result[k.group], v);
+		else result[k] = v;
 	}
-	return values;
+	return outputShouldBeArray ? Object.values(result) : result;
 };
 /**
-* run()'s setup step for secrets: re-emit each slot's pointer NAME under its
-* address-free key, so the address-free `deserializeSecrets` double-looks-up
-* identically. Never the value — the value stays only in the platform var.
+* Object.entries wrapper providing narrowed types for objects with known sets
+* of keys, e.g. those defined internally as configs
 */
-const stashSecrets = (node, address) => {
-	for (const slot of Object.keys(node.secretSlots)) {
-		const name = process.env[secretKey(address, slot)];
-		if (name === void 0) continue;
-		process.env[secretKey("", slot)] = name;
-	}
-};
-/**
-* Boot: for each reserved provider param, read its address-scoped row through
-* the same `coerce` a declared param uses (JSON-decode, schema-validate), and
-* re-emit it address-free — `stash`'s counterpart for this separate
-* declaration space. A param is declared optional here unconditionally: an
-* absent row means "never provisioned" (local dev, tests, a provider with no
-* registered value for this deploy), never a boot failure, so nothing is
-* stashed and the runtime reader that owns this slot falls back to its own
-* pass-through behavior.
-*/
-function stashProviderParams(entries, address) {
-	for (const entry of entries) {
-		const d = {
-			owner: "service",
-			name: entry.name,
-			param: {
-				schema: entry.schema,
-				optional: true
-			}
-		};
-		const key = configKey(address, d);
-		const value = coerce(process.env[key], d, key);
-		if (value === void 0) continue;
-		process.env[configKey("", d)] = encode("service", value);
-	}
-}
-/** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */
-function standardValidateSync(schema, value) {
-	const result = schema["~standard"].validate(value);
-	if (result instanceof Promise) throw new Error("config param schema validation must be synchronous — async Standard Schema validators are not supported for config params");
-	if (result.issues !== void 0) throw new Error(`config param validation failed: ${result.issues.map((issue) => issue.message).join("; ")}`);
-	return result.value;
-}
-/** Bounded jittered backoff for retrying a dropped call. `maxRetries` is retries after the first attempt. */
-const RETRY = {
-	initialDelayMs: 250,
-	multiplier: 2,
-	maxDelayMs: 5e3,
-	maxRetries: 5
-};
-const IDEMPOTENCY_KEY_HEADER$1 = "Idempotency-Key";
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-/** Whether a non-OK response is safe to retry: 429 or any 5xx, never another 4xx. */
-function isRetryableStatus(status) {
-	return status === 429 || status >= 500;
-}
-/** The server's `{ error }` body, if the response has one — undefined otherwise. */
-async function errorDetail(res) {
-	try {
-		const body = await res.json();
-		return typeof body === "object" && body !== null && "error" in body ? String(body.error) : void 0;
-	} catch {
-		return;
-	}
-}
-/** `<base>/rpc/<method>`, preserving a base URL's own path (e.g. a mount point). */
-function methodUrl(base, method) {
-	const normalizedBase = base.endsWith("/") ? base : `${base}/`;
-	return new URL(`rpc/${method}`, normalizedBase).toString();
-}
-/**
-* Sends one call over `send`, retrying a thrown error, 429, or 5xx with
-* full-jitter backoff. `buildRequest` runs per attempt but carries the same
-* idempotency key each time — only the transport call repeats, not the key.
-*/
-async function callWithRetry(send, buildRequest, method) {
-	let delay = RETRY.initialDelayMs;
-	let retries = 0;
-	for (;;) {
-		let res;
-		try {
-			res = await send(buildRequest());
-		} catch (err) {
-			if (retries >= RETRY.maxRetries) throw err;
-			retries += 1;
-			await sleep(Math.random() * delay);
-			delay = Math.min(delay * RETRY.multiplier, RETRY.maxDelayMs);
-			continue;
-		}
-		if (res.ok) return res.json();
-		if (!isRetryableStatus(res.status) || retries >= RETRY.maxRetries) {
-			const detail = await errorDetail(res);
-			throw new Error(`RPC call "${method}" failed: ${res.status} ${res.statusText}` + (detail !== void 0 ? ` — ${detail}` : ""));
-		}
-		retries += 1;
-		await sleep(Math.random() * delay);
-		delay = Math.min(delay * RETRY.multiplier, RETRY.maxDelayMs);
-	}
-}
-function makeClient(contract, url, opts) {
-	const send = opts?.fetch ?? fetch;
-	const baseHeaders = { "content-type": "application/json" };
-	if (opts?.serviceKey !== void 0) baseHeaders["Authorization"] = `Bearer ${opts.serviceKey}`;
-	const client = {};
-	for (const method of Object.keys(contract.__cmp)) client[method] = async (input) => {
-		const idempotencyKey = crypto.randomUUID();
-		const body = JSON.stringify(input);
-		return callWithRetry(send, () => new Request(methodUrl(url, method), {
-			method: "POST",
-			headers: {
-				...baseHeaders,
-				[IDEMPOTENCY_KEY_HEADER$1]: idempotencyKey
-			},
-			body
-		}), method);
-	};
-	return blindCast(client);
-}
-function contract(fns) {
-	const value = {
-		kind: "rpc",
-		__cmp: fns,
-		satisfies: (required) => value === required
-	};
-	return Object.freeze(value);
-}
-/** ADR-0031's need brand for RPC's per-binding service key — the target registers a provisioner under this. */
-const RPC_PEER_KEY = Symbol.for("prisma:rpc/per-binding-key");
-/** The provisioning need `rpc()`'s `serviceKey` param declares (ADR-0030): a shared, unguessable value the target mints per consumer edge. */
-const perBindingToken = () => provisionNeed(RPC_PEER_KEY);
-function rpc(arg) {
-	if (!isRpcContract(arg)) return arg;
-	return dependency({
-		type: "rpc",
-		connection: {
-			params: {
-				url: string$1(),
-				serviceKey: string$1({
-					optional: true,
-					provision: perBindingToken()
-				})
-			},
-			hydrate: ({ url, serviceKey }) => makeClient(arg, url, { serviceKey })
-		},
-		required: arg
-	});
-}
-function isRpcContract(value) {
-	return typeof value === "object" && value !== null && "kind" in value && value.kind === "rpc" && "__cmp" in value && "satisfies" in value;
-}
-const liftArray = (data) => Array.isArray(data) ? data : [data];
-/**
-* Splits an array into two arrays based on the result of a predicate
-*
-* @param predicate - The guard function used to determine which items to include.
-* @returns A tuple containing two arrays:
-* 				- the first includes items for which `predicate` returns true
-* 				- the second includes items for which `predicate` returns false
-*
-* @example
-* const list = [1, "2", "3", 4, 5];
-* const [numbers, strings] = spliterate(list, (x) => typeof x === "number");
-* // Type: number[]
-* // Output: [1, 4, 5]
-* console.log(evens);
-* // Type: string[]
-* // Output: ["2", "3"]
-* console.log(odds);
-*/
-const spliterate = (arr, predicate) => {
-	const result = [[], []];
-	for (const item of arr) if (predicate(item)) result[0].push(item);
-	else result[1].push(item);
-	return result;
-};
-const ReadonlyArray = Array;
-const includes = (array, element) => array.includes(element);
-const range = (length, offset = 0) => [...new Array(length)].map((_, i) => i + offset);
-/**
-* Adds a value or array to an array, returning the concatenated result
-*/
-const append = (to, value, opts) => {
-	if (to === void 0) return value === void 0 ? [] : Array.isArray(value) ? value : [value];
-	if (opts?.prepend) if (Array.isArray(value)) to.unshift(...value);
-	else to.unshift(value);
-	else if (Array.isArray(value)) to.push(...value);
-	else to.push(value);
-	return to;
-};
-/**
-* Concatenates an element or list with a readonly list
-*/
-const conflatenate = (to, elementOrList) => {
-	if (elementOrList === void 0 || elementOrList === null) return to ?? [];
-	if (to === void 0 || to === null) return liftArray(elementOrList);
-	return to.concat(elementOrList);
-};
-/**
-* Concatenates a variadic list of elements or lists with a readonly list
-*/
-const conflatenateAll = (...elementsOrLists) => elementsOrLists.reduce(conflatenate, []);
-/**
-* Appends a value or concatenates an array to an array if it is not already included, returning the array
-*/
-const appendUnique = (to, value, opts) => {
-	if (to === void 0) return Array.isArray(value) ? value : [value];
-	const isEqual = opts?.isEqual ?? ((l, r) => l === r);
-	for (const v of liftArray(value)) if (!to.some((existing) => isEqual(existing, v))) to.push(v);
-	return to;
-};
-const groupBy = (array, discriminant) => array.reduce((result, item) => {
-	const key = item[discriminant];
-	result[key] = append(result[key], item);
-	return result;
-}, {});
-const arrayEquals = (l, r, opts) => l.length === r.length && l.every(opts?.isEqual ? (lItem, i) => opts.isEqual(lItem, r[i]) : (lItem, i) => lItem === r[i]);
-const hasDomain = (data, kind) => domainOf(data) === kind;
-const domainOf = (data) => {
-	const builtinType = typeof data;
-	return builtinType === "object" ? data === null ? "null" : "object" : builtinType === "function" ? "object" : builtinType;
-};
-/** Each domain's completion for the phrase "must be _____" */
-const domainDescriptions = {
-	boolean: "boolean",
-	null: "null",
-	undefined: "undefined",
-	bigint: "a bigint",
-	number: "a number",
-	object: "an object",
-	string: "a string",
-	symbol: "a symbol"
-};
-const jsTypeOfDescriptions = {
-	...domainDescriptions,
-	function: "a function"
-};
-var InternalArktypeError = class extends Error {};
-const throwInternalError = (message) => throwError(message, InternalArktypeError);
-const throwError = (message, ctor = Error) => {
-	throw new ctor(message);
-};
-var ParseError = class extends Error {
-	name = "ParseError";
-};
-const throwParseError = (message) => throwError(message, ParseError);
-/**
-*  TypeScript won't suggest strings beginning with a space as properties.
-*  Useful for symbol-like string properties.
-*/
-const noSuggest = (s) => ` ${s}`;
-const flatMorph = (o, flatMapEntry) => {
-	const result = {};
-	const inputIsArray = Array.isArray(o);
-	let outputShouldBeArray = false;
-	for (const [i, entry] of Object.entries(o).entries()) {
-		const mapped = inputIsArray ? flatMapEntry(i, entry[1]) : flatMapEntry(...entry, i);
-		outputShouldBeArray ||= typeof mapped[0] === "number";
-		const flattenedEntries = Array.isArray(mapped[0]) || mapped.length === 0 ? mapped : [mapped];
-		for (const [k, v] of flattenedEntries) if (typeof k === "object") result[k.group] = append(result[k.group], v);
-		else result[k] = v;
-	}
-	return outputShouldBeArray ? Object.values(result) : result;
-};
-/**
-* Object.entries wrapper providing narrowed types for objects with known sets
-* of keys, e.g. those defined internally as configs
-*/
-const entriesOf = Object.entries;
-const isKeyOf = (k, o) => k in o;
-const hasKey = (o, k) => k in o;
-var DynamicBase = class {
-	constructor(properties) {
-		Object.assign(this, properties);
+const entriesOf = Object.entries;
+const isKeyOf = (k, o) => k in o;
+const hasKey = (o, k) => k in o;
+var DynamicBase = class {
+	constructor(properties) {
+		Object.assign(this, properties);
 	}
 };
 const NoopBase = class {};
@@ -7583,81 +7284,447 @@ const Record = genericNode(["K", intrinsic.key], "V")((args) => ({
 		signature: args.K,
 		value: args.V
 	}
-}), RecordHkt);
-var PickHkt = class extends Hkt {
-	description = "pick a set of properties from an object like `Pick(User, \"name | age\")`";
-};
-const Pick = genericNode(["T", intrinsic.object], ["K", intrinsic.key])((args) => args.T.pick(args.K), PickHkt);
-var OmitHkt = class extends Hkt {
-	description = "omit a set of properties from an object like `Omit(User, \"age\")`";
-};
-const Omit = genericNode(["T", intrinsic.object], ["K", intrinsic.key])((args) => args.T.omit(args.K), OmitHkt);
-var PartialHkt = class extends Hkt {
-	description = "make all named properties of an object optional like `Partial(User)`";
-};
-const Partial = genericNode(["T", intrinsic.object])((args) => args.T.partial(), PartialHkt);
-var RequiredHkt = class extends Hkt {
-	description = "make all named properties of an object required like `Required(User)`";
+}), RecordHkt);
+var PickHkt = class extends Hkt {
+	description = "pick a set of properties from an object like `Pick(User, \"name | age\")`";
+};
+const Pick = genericNode(["T", intrinsic.object], ["K", intrinsic.key])((args) => args.T.pick(args.K), PickHkt);
+var OmitHkt = class extends Hkt {
+	description = "omit a set of properties from an object like `Omit(User, \"age\")`";
+};
+const Omit = genericNode(["T", intrinsic.object], ["K", intrinsic.key])((args) => args.T.omit(args.K), OmitHkt);
+var PartialHkt = class extends Hkt {
+	description = "make all named properties of an object optional like `Partial(User)`";
+};
+const Partial = genericNode(["T", intrinsic.object])((args) => args.T.partial(), PartialHkt);
+var RequiredHkt = class extends Hkt {
+	description = "make all named properties of an object required like `Required(User)`";
+};
+const Required = genericNode(["T", intrinsic.object])((args) => args.T.required(), RequiredHkt);
+var ExcludeHkt = class extends Hkt {
+	description = "exclude branches of a union like `Exclude(\"boolean\", \"true\")`";
+};
+const Exclude = genericNode("T", "U")((args) => args.T.exclude(args.U), ExcludeHkt);
+var ExtractHkt = class extends Hkt {
+	description = "extract branches of a union like `Extract(\"0 | false | 1\", \"number\")`";
+};
+const Extract = genericNode("T", "U")((args) => args.T.extract(args.U), ExtractHkt);
+const arkTsGenerics = Scope.module({
+	Exclude,
+	Extract,
+	Omit,
+	Partial,
+	Pick,
+	Record,
+	Required
+});
+const ark = scope({
+	...arkTsKeywords,
+	...arkTsGenerics,
+	...arkPrototypes,
+	...arkBuiltins,
+	string,
+	number,
+	object,
+	unknown
+}, {
+	prereducedAliases: true,
+	name: "ark"
+});
+const keywords = ark.export();
+Object.assign($arkTypeRegistry.ambient, keywords);
+$arkTypeRegistry.typeAttachments = {
+	string: keywords.string.root,
+	number: keywords.number.root,
+	bigint: keywords.bigint,
+	boolean: keywords.boolean,
+	symbol: keywords.symbol,
+	undefined: keywords.undefined,
+	null: keywords.null,
+	object: keywords.object.root,
+	unknown: keywords.unknown.root,
+	false: keywords.false,
+	true: keywords.true,
+	never: keywords.never,
+	arrayIndex: keywords.Array.index,
+	Key: keywords.Key,
+	Record: keywords.Record,
+	Array: keywords.Array.root,
+	Date: keywords.Date
+};
+const type = Object.assign(ark.type, $arkTypeRegistry.typeAttachments);
+ark.match;
+ark.fn;
+ark.generic;
+ark.schema;
+ark.define;
+ark.declare;
+/**
+* Walks a node's own params, then each dependency input's connection params —
+* the same enumeration order `configOf` uses, but carrying the raw
+* `ConfigParam` (with its `serialize`/`deserialize`) instead of a pure-data
+* projection.
+*/
+function paramEntries(node) {
+	const entries = [];
+	for (const [input, value] of Object.entries(node.inputs)) {
+		if (typeof value !== "object" || value === null) continue;
+		const params = blindCast(value).connection.params;
+		for (const [name, param] of Object.entries(params)) entries.push({
+			owner: { input },
+			name,
+			param
+		});
+	}
+	for (const [name, param] of Object.entries(node.params)) entries.push({
+		owner: "service",
+		name,
+		param
+	});
+	return entries;
+}
+const configKey = (address, d) => {
+	const segments = address.split(".").filter((s) => s.length > 0);
+	const owner = d.owner === "service" ? [] : [d.owner.input];
+	return [
+		"COMPOSER",
+		...segments,
+		...owner,
+		d.name
+	].join("_").toUpperCase();
+};
+/**
+* Typed value → its stored string. Service-own literals are JSON-encoded; a
+* dependency-input value is a provisioning ref at deploy (and a resolved
+* string at boot) and passes through untouched — LANDMINE: JSON-encoding it
+* would break the ordering edge Alchemy resolves through it.
+*/
+function encode(owner, value) {
+	return owner === "service" ? JSON.stringify(value) : blindCast(value);
+}
+/** Reverses `encode`: JSON-parse a service-own value, take a dependency-input value raw. */
+function decode(owner, raw) {
+	return owner === "service" ? JSON.parse(raw) : raw;
+}
+const PARAM_POINTER_PREFIX = "@composer-param-pointer:";
+/** True iff `raw` is a param pointer row (as opposed to a JSON-encoded literal). */
+const isParamPointerRow = (raw) => raw.startsWith(PARAM_POINTER_PREFIX);
+/** Reverses `encodeParamPointer`: the platform var NAME a pointer row points to. */
+const decodeParamPointer = (raw) => raw.slice(24);
+function coerce(raw, d, key) {
+	if (!(raw !== void 0 && raw !== "")) {
+		if (d.param.default !== void 0) return d.param.default;
+		if (d.param.optional === true) return void 0;
+		throw new Error(`missing required config param "${d.name}" (env ${key})`);
+	}
+	if (d.owner === "service" && isParamPointerRow(raw)) return coerceEnvSourcedParam(raw, d, key);
+	try {
+		return standardValidateSync(d.param.schema, decode(d.owner, raw));
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`invalid value for config param "${d.name}" (env ${key}): ${message}`);
+	}
+}
+/**
+* Boot resolution for an env-sourced param: double-lookup (pointer → platform
+* var), then the param's own schema on the raw string — no JSON decode, and
+* no redaction (it's config, not a secret). An UNSET platform var is a loud
+* boot failure naming both the param and the platform var; an EMPTY string is
+* not special-cased here — it reaches the schema like any other value, so it
+* passes iff the schema accepts it (deliberately unlike a literal param's own
+* ""-means-absent rule, and unlike a secret's non-empty requirement).
+*/
+function coerceEnvSourcedParam(raw, d, key) {
+	const platformVar = decodeParamPointer(raw);
+	const value = process.env[platformVar];
+	if (value === void 0) throw new Error(`env-sourced config param "${d.name}" (env ${key} → ${platformVar}) is unset: the platform variable "${platformVar}" was not injected — the deploy did not provision it.`);
+	try {
+		return standardValidateSync(d.param.schema, value);
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`invalid value for env-sourced config param "${d.name}" (env ${key} → ${platformVar}): ${message}`);
+	}
+}
+/**
+* Boot: read each declared param from env by its key, reverse the param's own
+* serialization (missing/invalid fails loudly), assemble the typed Config.
+* Secrets ride a separate channel (deserializeSecrets), not this one.
+*/
+const deserialize = (node, address) => {
+	const service = {};
+	const inputs = {};
+	for (const d of paramEntries(node)) {
+		const key = configKey(address, d);
+		const value = coerce(process.env[key], d, key);
+		if (d.owner === "service") service[d.name] = value;
+		else {
+			let bucket = inputs[d.owner.input];
+			if (bucket === void 0) {
+				bucket = {};
+				inputs[d.owner.input] = bucket;
+			}
+			bucket[d.name] = value;
+		}
+	}
+	return {
+		service,
+		inputs
+	};
+};
+/**
+* run()'s setup step: write the resolved config to the environment under
+* address-free keys (configKey("", d) + each serialize suffix), which load()
+* reads back with no address. Uses env, not a module variable, because a
+* framework may fork worker processes that inherit env but not memory.
+* Writes only these keys; nothing else is touched.
+*/
+const stash = (node, config) => {
+	for (const d of paramEntries(node)) {
+		const value = d.owner === "service" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];
+		if (value === void 0) continue;
+		process.env[configKey("", d)] = encode(d.owner, value);
+	}
+};
+/** The pointer-row key for a secret slot: COMPOSER_<addr>_<slot> (secrets are service-level). */
+const secretKey = (address, slot) => configKey(address, {
+	owner: "service",
+	name: slot
+});
+/**
+* Boot: resolve every secret slot to its value by double-lookup — read the
+* pointer key (the platform NAME), then read that platform var. A missing
+* pointer or a missing/empty platform value is a loud failure naming both keys.
+* Returns a plain Record for core's `hydrateSecrets` to box.
+*/
+const deserializeSecrets = (node, address) => {
+	const values = {};
+	for (const slot of Object.keys(node.secretSlots)) {
+		const key = secretKey(address, slot);
+		const name = process.env[key];
+		if (name === void 0 || name === "") throw new Error(`missing secret pointer for slot "${slot}" (env ${key}) — the deploy did not write it.`);
+		const value = process.env[name];
+		if (value === void 0 || value === "") throw new Error(`secret "${slot}" is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
+		values[slot] = value;
+	}
+	return values;
 };
-const Required = genericNode(["T", intrinsic.object])((args) => args.T.required(), RequiredHkt);
-var ExcludeHkt = class extends Hkt {
-	description = "exclude branches of a union like `Exclude(\"boolean\", \"true\")`";
+/**
+* run()'s setup step for secrets: re-emit each slot's pointer NAME under its
+* address-free key, so the address-free `deserializeSecrets` double-looks-up
+* identically. Never the value — the value stays only in the platform var.
+*/
+const stashSecrets = (node, address) => {
+	for (const slot of Object.keys(node.secretSlots)) {
+		const name = process.env[secretKey(address, slot)];
+		if (name === void 0) continue;
+		process.env[secretKey("", slot)] = name;
+	}
 };
-const Exclude = genericNode("T", "U")((args) => args.T.exclude(args.U), ExcludeHkt);
-var ExtractHkt = class extends Hkt {
-	description = "extract branches of a union like `Extract(\"0 | false | 1\", \"number\")`";
+/**
+* Boot: for each reserved provider param, read its address-scoped row through
+* the same `coerce` a declared param uses (JSON-decode, schema-validate), and
+* re-emit it address-free — `stash`'s counterpart for this separate
+* declaration space. A param is declared optional here unconditionally: an
+* absent row means "never provisioned" (local dev, tests, a provider with no
+* registered value for this deploy), never a boot failure, so nothing is
+* stashed and the runtime reader that owns this slot falls back to its own
+* pass-through behavior.
+*/
+function stashProviderParams(entries, address) {
+	for (const entry of entries) {
+		const d = {
+			owner: "service",
+			name: entry.name,
+			param: {
+				schema: entry.schema,
+				optional: true
+			}
+		};
+		const key = configKey(address, d);
+		const value = coerce(process.env[key], d, key);
+		if (value === void 0) continue;
+		process.env[configKey("", d)] = encode("service", value);
+	}
+}
+/** The framework-resolved origin row: COMPOSER_<addr>_ORIGIN. Written per
+*  compute service at serialize — the service's own provisioned endpoint URL,
+*  riding the reserved-provider-param machinery (`origin-key.ts`'s
+*  `ORIGIN_PARAM`); never a declared param, never in config(). A harness with
+*  no deploy behind it supplies it by setting `COMPOSER_ORIGIN` to the
+*  JSON-encoded origin URL — exactly how the existing entrypoint tests supply
+*  their other `COMPOSER_*` rows. */
+const ORIGIN_KEY_NAME = "ORIGIN";
+/**
+* Reads this service's origin back out of the address-free stash
+* `stashProviderParams` wrote for the ORIGIN entry. `COMPOSER_ORIGIN` unset is
+* a loud failure — a deployed environment always writes it, so an unset row
+* means either a local harness that hasn't supplied it or a boot() called
+* before run().
+*/
+function readOrigin() {
+	const d = {
+		owner: "service",
+		name: ORIGIN_KEY_NAME,
+		param: {
+			schema: type("string"),
+			optional: true
+		}
+	};
+	const key = configKey("", d);
+	const value = coerce(process.env[key], d, key);
+	if (value === void 0) throw new Error("this service's origin is not available (env COMPOSER_ORIGIN is unset) — a deployed environment writes it automatically; a local harness must supply it like any other config value (set COMPOSER_ORIGIN to the JSON-encoded origin URL).");
+	return blindCast(value);
+}
+/** Synchronous Standard Schema validation — see the matching note in core's `config.ts`. */
+function standardValidateSync(schema, value) {
+	const result = schema["~standard"].validate(value);
+	if (result instanceof Promise) throw new Error("config param schema validation must be synchronous — async Standard Schema validators are not supported for config params");
+	if (result.issues !== void 0) throw new Error(`config param validation failed: ${result.issues.map((issue) => issue.message).join("; ")}`);
+	return result.value;
+}
+/** Bounded jittered backoff for retrying a dropped call. `maxRetries` is retries after the first attempt. */
+const RETRY = {
+	initialDelayMs: 250,
+	multiplier: 2,
+	maxDelayMs: 5e3,
+	maxRetries: 5
 };
-const Extract = genericNode("T", "U")((args) => args.T.extract(args.U), ExtractHkt);
-const arkTsGenerics = Scope.module({
-	Exclude,
-	Extract,
-	Omit,
-	Partial,
-	Pick,
-	Record,
-	Required
-});
-const ark = scope({
-	...arkTsKeywords,
-	...arkTsGenerics,
-	...arkPrototypes,
-	...arkBuiltins,
-	string,
-	number,
-	object,
-	unknown
-}, {
-	prereducedAliases: true,
-	name: "ark"
-});
-const keywords = ark.export();
-Object.assign($arkTypeRegistry.ambient, keywords);
-$arkTypeRegistry.typeAttachments = {
-	string: keywords.string.root,
-	number: keywords.number.root,
-	bigint: keywords.bigint,
-	boolean: keywords.boolean,
-	symbol: keywords.symbol,
-	undefined: keywords.undefined,
-	null: keywords.null,
-	object: keywords.object.root,
-	unknown: keywords.unknown.root,
-	false: keywords.false,
-	true: keywords.true,
-	never: keywords.never,
-	arrayIndex: keywords.Array.index,
-	Key: keywords.Key,
-	Record: keywords.Record,
-	Array: keywords.Array.root,
-	Date: keywords.Date
+const IDEMPOTENCY_KEY_HEADER$1 = "Idempotency-Key";
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Whether a non-OK response is safe to retry: 429 or any 5xx, never another 4xx. */
+function isRetryableStatus(status) {
+	return status === 429 || status >= 500;
+}
+/** The server's `{ error }` body, if the response has one — undefined otherwise. */
+async function errorDetail(res) {
+	try {
+		const body = await res.json();
+		return typeof body === "object" && body !== null && "error" in body ? String(body.error) : void 0;
+	} catch {
+		return;
+	}
+}
+/** `<base>/rpc/<method>`, preserving a base URL's own path (e.g. a mount point). */
+function methodUrl(base, method) {
+	const normalizedBase = base.endsWith("/") ? base : `${base}/`;
+	return new URL(`rpc/${method}`, normalizedBase).toString();
+}
+/**
+* Sends one call over `send`, retrying a thrown error, 429, or 5xx with
+* full-jitter backoff. `buildRequest` runs per attempt but carries the same
+* idempotency key each time — only the transport call repeats, not the key.
+*/
+async function callWithRetry(send, buildRequest, method) {
+	let delay = RETRY.initialDelayMs;
+	let retries = 0;
+	for (;;) {
+		let res;
+		try {
+			res = await send(buildRequest());
+		} catch (err) {
+			if (retries >= RETRY.maxRetries) throw err;
+			retries += 1;
+			await sleep(Math.random() * delay);
+			delay = Math.min(delay * RETRY.multiplier, RETRY.maxDelayMs);
+			continue;
+		}
+		if (res.ok) return res.json();
+		if (!isRetryableStatus(res.status) || retries >= RETRY.maxRetries) {
+			const detail = await errorDetail(res);
+			throw new Error(`RPC call "${method}" failed: ${res.status} ${res.statusText}` + (detail !== void 0 ? ` — ${detail}` : ""));
+		}
+		retries += 1;
+		await sleep(Math.random() * delay);
+		delay = Math.min(delay * RETRY.multiplier, RETRY.maxDelayMs);
+	}
+}
+function makeClient(contract, url, opts) {
+	const send = opts?.fetch ?? fetch;
+	const baseHeaders = { "content-type": "application/json" };
+	if (opts?.serviceKey !== void 0) baseHeaders["Authorization"] = `Bearer ${opts.serviceKey}`;
+	const client = {};
+	for (const method of Object.keys(contract.__cmp)) client[method] = async (input) => {
+		const idempotencyKey = crypto.randomUUID();
+		const body = JSON.stringify(input);
+		return callWithRetry(send, () => new Request(methodUrl(url, method), {
+			method: "POST",
+			headers: {
+				...baseHeaders,
+				[IDEMPOTENCY_KEY_HEADER$1]: idempotencyKey
+			},
+			body
+		}), method);
+	};
+	return blindCast(client);
+}
+function contract(fns) {
+	const value = {
+		kind: "rpc",
+		__cmp: fns,
+		satisfies: (required) => value === required
+	};
+	return Object.freeze(value);
+}
+/** ADR-0031's need brand for RPC's per-binding service key — the target registers a provisioner under this. */
+const RPC_PEER_KEY = Symbol.for("prisma:rpc/per-binding-key");
+/** The provisioning need `rpc()`'s `serviceKey` param declares (ADR-0030): a shared, unguessable value the target mints per consumer edge. */
+const perBindingToken = () => provisionNeed(RPC_PEER_KEY);
+function rpc(arg) {
+	if (!isRpcContract(arg)) return arg;
+	return dependency({
+		type: "rpc",
+		connection: {
+			params: {
+				url: string$1(),
+				serviceKey: string$1({
+					optional: true,
+					provision: perBindingToken()
+				})
+			},
+			hydrate: ({ url, serviceKey }) => makeClient(arg, url, { serviceKey })
+		},
+		required: arg
+	});
+}
+function isRpcContract(value) {
+	return typeof value === "object" && value !== null && "kind" in value && value.kind === "rpc" && "__cmp" in value && "satisfies" in value;
+}
+/**
+* The service's own origin as a reserved provider param (ADR-0031): the ONE
+* brand and the ONE entry — shared by control.ts (which registers the
+* deploy-side value function that resolves the provisioned service's
+* `endpointDomain` — see its `selfOriginValue`) and compute.ts (which
+* validates and stashes the row at boot through the generic
+* `stashProviderParams` loop), so writer and reader cannot drift.
+*
+* Unlike the key-minting brands (`service-keys.ts`, `streams-keys.ts`) this
+* brand has no provisioner and no consumer edges: the value derives from the
+* service's OWN provisioned attributes, so control.ts registers it as a
+* service-derived provider param (`descriptors/shared.ts`'s
+* `ServiceProviderParam`) and the descriptor writes it for EVERY compute
+* service, exposing or not.
+*
+* This module is reachable from the RUNTIME/authoring side — it must never
+* import `@internal/lowering` or `effect`, or those tokens leak into a user
+* service's bundle (the deploy-side value function lives in control.ts, the
+* control-plane-only entry).
+*/
+/** ADR-0031's brand for the service's own origin — control.ts registers the deploy-side value function under this. */
+const SELF_ORIGIN = Symbol.for("prisma:self-origin");
+/**
+* The reserved provider param for the origin row: the var name is `ORIGIN`,
+* derived through `configKey` at both ends (`configKey(address, …)` at
+* deploy, `configKey('', …)` — `COMPOSER_ORIGIN` — at boot, where
+* `readOrigin` reads it back). `brand` is `SELF_ORIGIN` — control.ts looks
+* its deploy-side value function up by this field.
+*/
+const ORIGIN_PARAM = {
+	name: ORIGIN_KEY_NAME,
+	schema: type("string"),
+	brand: SELF_ORIGIN
 };
-const type = Object.assign(ark.type, $arkTypeRegistry.typeAttachments);
-ark.match;
-ark.fn;
-ark.generic;
-ark.schema;
-ark.define;
-ark.declare;
 /**
 * RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —
 * name + schema + brand — for the accepted-keys set a provider stores, shared
@@ -7702,7 +7769,33 @@ configKey("", {
 	owner: "service",
 	name: STREAMS_API_KEY_PARAM.name
 });
-const RESERVED_PROVIDER_PARAMS = [RPC_ACCEPTED_KEYS_PARAM, STREAMS_API_KEY_PARAM];
+/**
+* The list of provider-side reserved params the boot path validates and
+* stashes (ADR-0031): every brand's `{name, schema, brand}` declaration,
+* collected from that brand's own module (`service-keys.ts`,
+* `streams-keys.ts`, `origin-key.ts`) so `compute.ts` names no brand itself.
+*
+* This list exists separately from `control.ts`'s deploy-side registry
+* (`PROVIDER_PARAMS`) because `control.ts` is deploy-only code — it imports
+* `@internal/lowering` and `effect` to mint values — and a booted service
+* must never import it. This module is reachable from a user service's
+* bundle through `compute.ts`, so it must never import `@internal/lowering`,
+* `effect`, `alchemy`, or `control.ts`.
+*
+* This is the single source of which reserved provider params exist:
+* control.ts builds `PROVIDER_PARAMS` by mapping over this list and looking
+* up each entry's deploy-side value function (edge-derived `value(refs)` or
+* service-derived `valueForService(provisioned, address)`) by its `brand`,
+* throwing at module load if one is missing. Adding a brand means adding its
+* entry here, plus its deploy-side value function in control.ts — a brand
+* registered for deploy but absent here is no longer expressible, because
+* deploy no longer names its own param set independently.
+*/
+const RESERVED_PROVIDER_PARAMS = [
+	RPC_ACCEPTED_KEYS_PARAM,
+	STREAMS_API_KEY_PARAM,
+	ORIGIN_PARAM
+];
 Object.freeze({
 	kind: "s3",
 	__cmp: {
@@ -7719,7 +7812,7 @@ const reservedParams = { port: number$1({ default: 3e3 }) };
 * ports it exposes), no descriptor. `params` merges with the reserved
 * `ReservedParams` (`port`); a user param whose name collides with a reserved
 * one fails at authoring, the same way a colliding dependency name does.
-* Returns the extension's runnable/loadable node:
+*
 *   · run(address, boot) — the process controller: deserialize the platform
 *     environment (keyed off `address`, the extension's ONE env read) into a
 *     typed Config, re-emit it under address-free process-local stash keys,
@@ -7727,23 +7820,69 @@ const reservedParams = { port: number$1({ default: 3e3 }) };
 *   · load() / config() — called from inside the app's entry: read the stash;
 *     load() hydrates + memoizes the deps, config() returns the typed params.
 *     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+*   · origin() — this service's platform-assigned public origin, read from the
+*     stash `run()` populates; memoized per process.
 *
-* `service()`'s underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
+* The underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
 * the control-plane registry key `prisma-composer deploy` resolves through the
 * app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
-* deploy time; nodes are pure data.
+* deploy time; nodes are pure data until run() or load() is called.
 */
+var ComputeService = class {
+	#resolved;
+	#loadedDeps;
+	#loadedParams;
+	#loadedSecrets;
+	#origin;
+	constructor(node) {
+		Object.assign(this, node);
+	}
+	#processConfig() {
+		if (this.#resolved === void 0) this.#resolved = deserialize(this, "");
+		return this.#resolved;
+	}
+	async run(address, boot) {
+		const config = deserialize(this, address);
+		stash(this, config);
+		stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
+		stashSecrets(this, address);
+		const port = config.service["port"];
+		if (typeof port === "number") process.env["PORT"] = String(port);
+		return boot();
+	}
+	load() {
+		if (this.#loadedDeps === void 0) this.#loadedDeps = blindCast(hydrateSync(this, this.#processConfig()));
+		return this.#loadedDeps;
+	}
+	config() {
+		if (this.#loadedParams === void 0) this.#loadedParams = blindCast(this.#processConfig().service);
+		return this.#loadedParams;
+	}
+	secrets() {
+		if (this.#loadedSecrets === void 0) this.#loadedSecrets = blindCast(hydrateSecrets(this, deserializeSecrets(this, "")));
+		return this.#loadedSecrets;
+	}
+	/** This service's platform-assigned public origin — read from the stash
+	*  run() populates and memoized per process. Throws if called before run()
+	*  has stashed it (readOrigin's pinned message). */
+	origin() {
+		this.#origin ??= readOrigin();
+		return this.#origin;
+	}
+};
 const compute = (def) => {
 	const userParams = def.params ?? blindCast({});
 	for (const reserved of Object.keys(reservedParams)) {
 		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
 		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
 	}
+	for (const name of Object.keys(userParams)) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): param "${name}" collides with the framework-written origin row — rename the param.`);
+	for (const name of Object.keys(def.secrets ?? {})) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): secret "${name}" collides with the framework-written origin row — rename the secret.`);
 	const params = blindCast({
 		...userParams,
 		...reservedParams
 	});
-	const node = service$1({
+	const instance = new ComputeService(service$1({
 		name: def.name,
 		extension: "@prisma/composer-prisma-cloud",
 		type: "compute",
@@ -7752,40 +7891,9 @@ const compute = (def) => {
 		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
 		build: def.build,
 		...def.expose !== void 0 ? { expose: def.expose } : {}
-	});
-	let resolved;
-	let loadedDeps;
-	let loadedParams;
-	let loadedSecrets;
-	function processConfig() {
-		if (resolved === void 0) resolved = deserialize(node, "");
-		return resolved;
-	}
-	const runnable = {
-		...node,
-		async run(address, boot) {
-			const config = deserialize(node, address);
-			stash(node, config);
-			stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
-			stashSecrets(node, address);
-			const port = config.service["port"];
-			if (typeof port === "number") process.env["PORT"] = String(port);
-			return boot();
-		},
-		load() {
-			if (loadedDeps === void 0) loadedDeps = blindCast(hydrateSync(node, processConfig()));
-			return loadedDeps;
-		},
-		config() {
-			if (loadedParams === void 0) loadedParams = blindCast(processConfig().service);
-			return loadedParams;
-		},
-		secrets() {
-			if (loadedSecrets === void 0) loadedSecrets = blindCast(hydrateSecrets(node, deserializeSecrets(node, "")));
-			return loadedSecrets;
-		}
-	};
-	return Object.freeze(blindCast(runnable));
+	}));
+	Object.freeze(instance);
+	return instance;
 };
 Object.freeze({
 	kind: "postgres",