@prisma/composer-prisma-cloud 0.2.0 → 0.3.0-dev.2

package/dist/provisioned-edges-C1wSO3cx-YC5C19f9.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioned-edges-C1wSO3cx-YC5C19f9.mjs","names":[],"sources":["../../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-C1wSO3cx.mjs"],"sourcesContent":["import { n as configKey, t as ORIGIN_KEY_NAME } from \"./serializer-CJiOhF2d.mjs\";\nimport { provisionNeed } from \"@internal/core\";\nimport { type } from \"arktype\";\nimport { RPC_PEER_KEY } from \"@internal/service-rpc\";\n//#region src/origin-key.ts\n/**\n* The service's own origin as a reserved provider param (ADR-0031): the ONE\n* brand and the ONE entry — shared by control.ts (which registers the\n* deploy-side value function that resolves the provisioned service's\n* `endpointDomain` — see its `selfOriginValue`) and compute.ts (which\n* validates and stashes the row at boot through the generic\n* `stashProviderParams` loop), so writer and reader cannot drift.\n*\n* Unlike the key-minting brands (`service-keys.ts`, `streams-keys.ts`) this\n* brand has no provisioner and no consumer edges: the value derives from the\n* service's OWN provisioned attributes, so control.ts registers it as a\n* service-derived provider param (`descriptors/shared.ts`'s\n* `ServiceProviderParam`) and the descriptor writes it for EVERY compute\n* service, exposing or not.\n*\n* This module is reachable from the RUNTIME/authoring side — it must never\n* import `@internal/lowering` or `effect`, or those tokens leak into a user\n* service's bundle (the deploy-side value function lives in control.ts, the\n* control-plane-only entry).\n*/\n/** ADR-0031's brand for the service's own origin — control.ts registers the deploy-side value function under this. */\nconst SELF_ORIGIN = Symbol.for(\"prisma:self-origin\");\n/**\n* The reserved provider param for the origin row: the var name is `ORIGIN`,\n* derived through `configKey` at both ends (`configKey(address, …)` at\n* deploy, `configKey('', …)` — `COMPOSER_ORIGIN` — at boot, where\n* `readOrigin` reads it back). `brand` is `SELF_ORIGIN` — control.ts looks\n* its deploy-side value function up by this field.\n*/\nconst ORIGIN_PARAM = {\n\tname: ORIGIN_KEY_NAME,\n\tschema: type(\"string\"),\n\tbrand: SELF_ORIGIN\n};\n//#endregion\n//#region src/service-keys.ts\n/**\n* RPC's reserved provider param (ADR-0030/ADR-0031): the declaration —\n* name + schema + brand — for the accepted-keys set a provider stores, shared\n* by `control.ts` (which registers the deploy-side `value(refs)` that mints\n* and aggregates it — see its `rpcAcceptedKeysValue`) and `compute.ts` (which\n* validates and stashes it at boot), so writer and reader cannot drift.\n* Finding the edges themselves is `provisioned-edges.ts`'s generic,\n* brand-blind scan — RPC is not special-cased anywhere in this target.\n*\n* This module is reachable from the RUNTIME/authoring side — it must never\n* import `@internal/lowering` or `effect`, or those tokens leak into a user\n* service's bundle (the deploy-side `value(refs)` lives in control.ts, the\n* control-plane-only entry).\n*/\n/**\n* The reserved provider param for RPC's accepted-keys set: the var name is\n* `RPC_ACCEPTED_KEYS`, derived through `configKey` at both ends\n* (`configKey(address, …)` at deploy, `configKey('', …)` at boot — the\n* address-free form is `@internal/service-rpc`'s `RPC_ACCEPTED_KEYS_ENV`). `brand` is\n* `RPC_PEER_KEY`, the same brand `perBindingToken()`'s need carries — control.ts\n* looks its `value(refs)` up by this field.\n*/\nconst RPC_ACCEPTED_KEYS_PARAM = {\n\tname: \"RPC_ACCEPTED_KEYS\",\n\tschema: type(\"string[]\"),\n\tbrand: RPC_PEER_KEY\n};\n//#endregion\n//#region src/streams-keys.ts\n/** ADR-0031's need brand for the streams module's bearer key — control.ts registers the provisioner under this. */\nconst STREAMS_API_KEY = Symbol.for(\"prisma:streams/api-key\");\n/**\n* The provisioning need `durableStreams()`'s `apiKey` param declares: an\n* unguessable value the target mints ONCE PER PROVIDER (not per edge) —\n* `@prisma/streams-server` authenticates a single `API_KEY`, so every\n* consumer of one streams module must present the same value. Per-provider\n* cardinality is provisioner policy (ADR-0031), invisible to core.\n*/\nconst streamsApiKeyNeed = () => provisionNeed(STREAMS_API_KEY);\n/**\n* The reserved provider param for the streams bearer key: the var name is\n* `STREAMS_API_KEY`. `brand` is `STREAMS_API_KEY` itself (the same symbol\n* `streamsApiKeyNeed()`'s need carries) — control.ts looks its `value(refs)`\n* up by this field.\n*/\nconst STREAMS_API_KEY_PARAM = {\n\tname: \"STREAMS_API_KEY\",\n\tschema: type(\"string\"),\n\tbrand: STREAMS_API_KEY\n};\n/** The address-free name compute.ts re-stashes to and the streams entrypoint reads. */\nconst STREAMS_API_KEY_ENV = configKey(\"\", {\n\towner: \"service\",\n\tname: STREAMS_API_KEY_PARAM.name\n});\n//#endregion\n//#region src/provider-params.ts\n/**\n* The list of provider-side reserved params the boot path validates and\n* stashes (ADR-0031): every brand's `{name, schema, brand}` declaration,\n* collected from that brand's own module (`service-keys.ts`,\n* `streams-keys.ts`, `origin-key.ts`) so `compute.ts` names no brand itself.\n*\n* This list exists separately from `control.ts`'s deploy-side registry\n* (`PROVIDER_PARAMS`) because `control.ts` is deploy-only code — it imports\n* `@internal/lowering` and `effect` to mint values — and a booted service\n* must never import it. This module is reachable from a user service's\n* bundle through `compute.ts`, so it must never import `@internal/lowering`,\n* `effect`, `alchemy`, or `control.ts`.\n*\n* This is the single source of which reserved provider params exist:\n* control.ts builds `PROVIDER_PARAMS` by mapping over this list and looking\n* up each entry's deploy-side value function (edge-derived `value(refs)` or\n* service-derived `valueForService(provisioned, address)`) by its `brand`,\n* throwing at module load if one is missing. Adding a brand means adding its\n* entry here, plus its deploy-side value function in control.ts — a brand\n* registered for deploy but absent here is no longer expressible, because\n* deploy no longer names its own param set independently.\n*/\nconst RESERVED_PROVIDER_PARAMS = [\n\tRPC_ACCEPTED_KEYS_PARAM,\n\tSTREAMS_API_KEY_PARAM,\n\tORIGIN_PARAM\n];\n//#endregion\n//#region src/provisioned-edges.ts\n/**\n* Every provisioned edge in the graph. Core resolves and mints these (one\n* value per edge, keyed by `edgeId`); this scan is how the target finds them\n* again when it gathers a provider's inbound values.\n*/\nfunction provisionedEdges(graph) {\n\tconst edges = [];\n\tfor (const edge of graph.edges) {\n\t\tif (edge.kind !== \"dependency\") continue;\n\t\tconst consumer = graph.nodes.find((n) => n.id === edge.to)?.node;\n\t\tif (consumer === void 0 || consumer.kind !== \"service\") continue;\n\t\tconst slot = consumer.inputs[edge.input];\n\t\tif (slot === void 0) continue;\n\t\tfor (const param of Object.values(slot.connection.params)) {\n\t\t\tconst brand = param.provision?.brand;\n\t\t\tif (brand === void 0) continue;\n\t\t\tedges.push({\n\t\t\t\tedgeId: `${edge.to}.${edge.input}`,\n\t\t\t\tconsumerAddress: edge.to,\n\t\t\t\tinput: edge.input,\n\t\t\t\tproviderAddress: edge.from,\n\t\t\t\tbrand\n\t\t\t});\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn edges;\n}\n//#endregion\nexport { streamsApiKeyNeed as a, STREAMS_API_KEY_ENV as i, RESERVED_PROVIDER_PARAMS as n, SELF_ORIGIN as o, STREAMS_API_KEY as r, provisionedEdges as t };\n\n//# sourceMappingURL=provisioned-edges-C1wSO3cx.mjs.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,MAAM,cAAc,OAAO,IAAI,oBAAoB;;;;;;;;AAQnD,MAAM,eAAe;CACpB,MAAM;CACN,QAAQ,KAAK,QAAQ;CACrB,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,0BAA0B;CAC/B,MAAM;CACN,QAAQ,KAAK,UAAU;CACvB,OAAO;AACR;;AAIA,MAAM,kBAAkB,OAAO,IAAI,wBAAwB;;;;;;;;AAQ3D,MAAM,0BAA0B,cAAc,eAAe;;;;;;;AAO7D,MAAM,wBAAwB;CAC7B,MAAM;CACN,QAAQ,KAAK,QAAQ;CACrB,OAAO;AACR;;AAEA,MAAM,sBAAsB,UAAU,IAAI;CACzC,OAAO;CACP,MAAM,sBAAsB;AAC7B,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAyBD,MAAM,2BAA2B;CAChC;CACA;CACA;AACD;;;;;;AAQA,SAAS,iBAAiB,OAAO;CAChC,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,QAAQ,MAAM,OAAO;EAC/B,IAAI,KAAK,SAAS,cAAc;EAChC,MAAM,WAAW,MAAM,MAAM,MAAM,MAAM,EAAE,OAAO,KAAK,EAAE,CAAC,EAAE;EAC5D,IAAI,aAAa,KAAK,KAAK,SAAS,SAAS,WAAW;EACxD,MAAM,OAAO,SAAS,OAAO,KAAK;EAClC,IAAI,SAAS,KAAK,GAAG;EACrB,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,WAAW,MAAM,GAAG;GAC1D,MAAM,QAAQ,MAAM,WAAW;GAC/B,IAAI,UAAU,KAAK,GAAG;GACtB,MAAM,KAAK;IACV,QAAQ,GAAG,KAAK,GAAG,GAAG,KAAK;IAC3B,iBAAiB,KAAK;IACtB,OAAO,KAAK;IACZ,iBAAiB,KAAK;IACtB;GACD,CAAC;GACD;EACD;CACD;CACA,OAAO;AACR"}

package/dist/secret-rz_ZqNeq-_xd97Jd9.mjs

@@ -0,0 +1,47 @@
+import { secretSource } from "@prisma/composer";
+import { blindCast } from "@prisma/composer/casts";
+//#region ../../1-prisma-cloud/1-extensions/target/dist/secret-rz_ZqNeq.mjs
+/**
+* Brands the payload `envSecret` builds. Core's `secretSource()` is a public
+* SPI, so a user could bypass `envSecret` and bind a raw `secretSource('x')`;
+* the brand lets `secretName` reject such a source (or another target's) with a
+* clear error instead of reading an absent `.name`.
+*/
+const PRISMA_CLOUD_SECRET_SOURCE = blindCast(Symbol.for("prisma:prisma-cloud-secret-source"));
+const RESERVED_SECRET_PREFIX = "COMPOSER_";
+const POISONED_SECRET_NAMES = /* @__PURE__ */ new Set(["DATABASE_URL", "DATABASE_URL_POOLED"]);
+/**
+* Binds a secret slot to a named Prisma Cloud platform env var (ADR-0029). The
+* value is provisioned out-of-band; only the name is carried. The name may not
+* use the framework's reserved `COMPOSER_` prefix or the poisoned
+* `DATABASE_URL(_POOLED)` keys.
+*/
+function envSecret(name) {
+	if (typeof name !== "string" || name.length === 0) throw new Error("envSecret() requires a non-empty platform env-var name, e.g. envSecret('STRIPE_SECRET_KEY').");
+	if (name.startsWith(RESERVED_SECRET_PREFIX)) throw new Error(`envSecret name "${name}" may not start with "${RESERVED_SECRET_PREFIX}" — that prefix is reserved for the framework's own generated config keys.`);
+	if (POISONED_SECRET_NAMES.has(name)) throw new Error(`envSecret name "${name}" is reserved — ${[...POISONED_SECRET_NAMES].join(" and ")} are poisoned at project provision and cannot back a secret.`);
+	return secretSource({
+		[PRISMA_CLOUD_SECRET_SOURCE]: true,
+		name
+	});
+}
+/** True only for a payload that `envSecret` built — i.e. one carrying the brand. */
+function isEnvSecretPayload(payload) {
+	return typeof payload === "object" && payload !== null && blindCast(payload)[PRISMA_CLOUD_SECRET_SOURCE] === true;
+}
+/**
+* Reads the Prisma Cloud env-var name back out of a secret binding's opaque
+* source. A source not built by `envSecret` (a raw `secretSource(...)` or
+* another target's source) carries no name — reject it here. `secretName` runs
+* in preflight before any provisioning, so a foreign source fails early and
+* clearly rather than producing a broken deploy with an undefined name.
+*/
+function secretName(binding) {
+	const payload = binding.source.payload;
+	if (!isEnvSecretPayload(payload)) throw new Error(`secret slot "${binding.slot}" of service "${binding.serviceAddress}" is bound to a source not created by envSecret() — bind secrets with envSecret('NAME') from @prisma/composer-prisma-cloud.`);
+	return payload.name;
+}
+//#endregion
+export { secretName as n, envSecret as t };
+
+//# sourceMappingURL=secret-rz_ZqNeq-_xd97Jd9.mjs.map

package/dist/secret-rz_ZqNeq-_xd97Jd9.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-rz_ZqNeq-_xd97Jd9.mjs","names":[],"sources":["../../../1-prisma-cloud/1-extensions/target/dist/secret-rz_ZqNeq.mjs"],"sourcesContent":["import { secretSource } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/secret.ts\n/**\n* Brands the payload `envSecret` builds. Core's `secretSource()` is a public\n* SPI, so a user could bypass `envSecret` and bind a raw `secretSource('x')`;\n* the brand lets `secretName` reject such a source (or another target's) with a\n* clear error instead of reading an absent `.name`.\n*/\nconst PRISMA_CLOUD_SECRET_SOURCE = blindCast(Symbol.for(\"prisma:prisma-cloud-secret-source\"));\nconst RESERVED_SECRET_PREFIX = \"COMPOSER_\";\nconst POISONED_SECRET_NAMES = /* @__PURE__ */ new Set([\"DATABASE_URL\", \"DATABASE_URL_POOLED\"]);\n/**\n* Binds a secret slot to a named Prisma Cloud platform env var (ADR-0029). The\n* value is provisioned out-of-band; only the name is carried. The name may not\n* use the framework's reserved `COMPOSER_` prefix or the poisoned\n* `DATABASE_URL(_POOLED)` keys.\n*/\nfunction envSecret(name) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(\"envSecret() requires a non-empty platform env-var name, e.g. envSecret('STRIPE_SECRET_KEY').\");\n\tif (name.startsWith(RESERVED_SECRET_PREFIX)) throw new Error(`envSecret name \"${name}\" may not start with \"${RESERVED_SECRET_PREFIX}\" — that prefix is reserved for the framework's own generated config keys.`);\n\tif (POISONED_SECRET_NAMES.has(name)) throw new Error(`envSecret name \"${name}\" is reserved — ${[...POISONED_SECRET_NAMES].join(\" and \")} are poisoned at project provision and cannot back a secret.`);\n\treturn secretSource({\n\t\t[PRISMA_CLOUD_SECRET_SOURCE]: true,\n\t\tname\n\t});\n}\n/** True only for a payload that `envSecret` built — i.e. one carrying the brand. */\nfunction isEnvSecretPayload(payload) {\n\treturn typeof payload === \"object\" && payload !== null && blindCast(payload)[PRISMA_CLOUD_SECRET_SOURCE] === true;\n}\n/**\n* Reads the Prisma Cloud env-var name back out of a secret binding's opaque\n* source. A source not built by `envSecret` (a raw `secretSource(...)` or\n* another target's source) carries no name — reject it here. `secretName` runs\n* in preflight before any provisioning, so a foreign source fails early and\n* clearly rather than producing a broken deploy with an undefined name.\n*/\nfunction secretName(binding) {\n\tconst payload = binding.source.payload;\n\tif (!isEnvSecretPayload(payload)) throw new Error(`secret slot \"${binding.slot}\" of service \"${binding.serviceAddress}\" is bound to a source not created by envSecret() — bind secrets with envSecret('NAME') from @prisma/composer-prisma-cloud.`);\n\treturn payload.name;\n}\n//#endregion\nexport { secretName as n, envSecret as t };\n\n//# sourceMappingURL=secret-rz_ZqNeq.mjs.map"],"mappings":";;;;;;;;;AASA,MAAM,6BAA6B,UAAU,OAAO,IAAI,mCAAmC,CAAC;AAC5F,MAAM,yBAAyB;AAC/B,MAAM,wCAAwC,IAAI,IAAI,CAAC,gBAAgB,qBAAqB,CAAC;;;;;;;AAO7F,SAAS,UAAU,MAAM;CACxB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,8FAA8F;CACjK,IAAI,KAAK,WAAW,sBAAsB,GAAG,MAAM,IAAI,MAAM,mBAAmB,KAAK,wBAAwB,uBAAuB,2EAA2E;CAC/M,IAAI,sBAAsB,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,mBAAmB,KAAK,kBAAkB,CAAC,GAAG,qBAAqB,CAAC,CAAC,KAAK,OAAO,EAAE,6DAA6D;CACrM,OAAO,aAAa;GAClB,6BAA6B;EAC9B;CACD,CAAC;AACF;;AAEA,SAAS,mBAAmB,SAAS;CACpC,OAAO,OAAO,YAAY,YAAY,YAAY,QAAQ,UAAU,OAAO,CAAC,CAAC,gCAAgC;AAC9G;;;;;;;;AAQA,SAAS,WAAW,SAAS;CAC5B,MAAM,UAAU,QAAQ,OAAO;CAC/B,IAAI,CAAC,mBAAmB,OAAO,GAAG,MAAM,IAAI,MAAM,gBAAgB,QAAQ,KAAK,gBAAgB,QAAQ,eAAe,4HAA4H;CAClP,OAAO,QAAQ;AAChB"}