@prisma/composer-prisma-cloud 0.3.0-dev.6 → 0.3.0-dev.8

package/dist/cron/index.d.mts

@@ -1,34 +1,38 @@
-import { BuildAdapter, Deps, Expose, HydratedDeps, ModuleNode, NODE, Params, RunnableServiceNode, SecretValues, Secrets, ServiceNode, Values } from "@prisma/composer";
-import "@standard-schema/spec";
+import { BuildAdapter, Deps, Expose, HydratedDeps, InputValueOf, ModuleNode, NODE, Params, RunnableServiceNode, ServiceNode } from "@prisma/composer";
+import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region ../../1-prisma-cloud/1-extensions/target/dist/index.d.mts
 //#endregion
 //#region src/compute.d.ts
 declare const reservedParams: {
-  readonly port: import("@prisma/composer").ConfigParam<import("@standard-schema/spec").StandardSchemaV1<number, number>>;
+  readonly port: import("@prisma/composer").ConfigParam<StandardSchemaV1<number, number>>;
 };
 type ReservedParams = typeof reservedParams;
 /**
- * A Prisma Compute service — declarations only (deps + params + build + the
- * ports it exposes), no descriptor. `params` merges with the reserved
- * `ReservedParams` (`port`); a user param whose name collides with a reserved
- * one fails at authoring, the same way a colliding dependency name does.
+ * A Prisma Compute service — declarations only (deps + one input schema +
+ * build + the ports it exposes), no descriptor. The reserved `port` param
+ * rides its own channel (ADR-0042 leaves it untouched); a dependency named
+ * like it fails at authoring.
  *
  *   · run(address, boot) — the process controller: deserialize the platform
  *     environment (keyed off `address`, the extension's ONE env read) into a
- *     typed Config, re-emit it under address-free process-local stash keys,
- *     then call boot() to start the app's entry.
- *   · load() / config() — called from inside the app's entry: read the stash;
- *     load() hydrates + memoizes the deps, config() returns the typed params.
- *     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+ *     typed Config, re-emit it (and the input document row) under address-free
+ *     process-local stash keys, then call boot() to start the app's entry.
+ *   · load() / input() — called from inside the app's entry: read the stash;
+ *     load() hydrates + memoizes the deps, input() parses the input document,
+ *     replaces each `$secret` pointer with a redacting box over the named
+ *     platform var, validates with the declared schema, and memoizes (ADR-0042).
  *   · origin() — this service's platform-assigned public origin, read from the
  *     stash `run()` populates; memoized per process.
+ *   · port() — this service's resolved reserved port (the value `run()` routes
+ *     to and exports as PORT), read from that same stash via #processConfig();
+ *     defaults to 3000 when the platform binds none.
  *
  * The underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
  * the control-plane registry key `prisma-composer deploy` resolves through the
  * app's `prisma-composer.config.ts` (ADR-0017). This module loads nothing at
  * deploy time; nodes are pure data until run() or load() is called.
  */
-declare class ComputeService<D extends Deps, P extends Params, E extends Expose, S extends Secrets> implements RunnableServiceNode<D, P & ReservedParams, E, S> {
+declare class ComputeService<D extends Deps, I extends StandardSchemaV1 | undefined, E extends Expose> implements RunnableServiceNode<D, ReservedParams, E, I> {
   #private;
   readonly [NODE]: true;
   readonly kind: 'service';
@@ -36,19 +40,22 @@ declare class ComputeService<D extends Deps, P extends Params, E extends Expose,
   readonly extension: string;
   readonly type: string;
   readonly inputs: D;
-  readonly params: P & ReservedParams;
-  readonly secretSlots: S;
+  readonly params: ReservedParams;
+  readonly inputSchema: I;
   readonly build: BuildAdapter;
   readonly expose: E | undefined;
-  constructor(node: ServiceNode<D, P & ReservedParams, E, S>);
+  constructor(node: ServiceNode<D, ReservedParams, E, I>);
   run(address: string, boot: () => Promise<unknown>): Promise<unknown>;
   load(): HydratedDeps<D>;
-  config(): Values<P & ReservedParams>;
-  secrets(): SecretValues<S>;
+  input(): InputValueOf<I>;
   /** This service's platform-assigned public origin — read from the stash
    *  run() populates and memoized per process. Throws if called before run()
    *  has stashed it (readOrigin's pinned message). */
   origin(): string;
+  /** This service's resolved reserved port — the value run() routes to and
+   *  exports as PORT — read the same way load() reads the stash. Defaults to
+   *  3000 when the platform binds none. */
+  port(): number;
 }
 //#endregion
 //#region ../../1-prisma-cloud/2-shared-modules/cron/dist/index.d.mts
@@ -100,11 +107,11 @@ declare function cron<RD extends Deps, RP extends Params, Ids extends string>(op
 //#endregion
 //#region src/scheduler.d.ts
 /**
- * The always-on scheduler service. `schedule` sets only the `jobs` param's
- * default — the value the deploy serializes into config; the scheduler
- * itself is job-agnostic.
+ * The always-on scheduler service. Job-agnostic: the schedule arrives as the
+ * `jobs` key of the input binding `cron()` supplies at provision, and the
+ * entrypoint reads it back through `input()`.
  */
-declare function cronScheduler<Ids extends string>(schedule: Schedule<Ids>): ComputeService<{
+declare function cronScheduler(): ComputeService<{
   trigger: import("@prisma/composer").DependencyEnd<{
     trigger: (input: {
       jobId: string;
@@ -118,12 +125,12 @@ declare function cronScheduler<Ids extends string>(schedule: Schedule<Ids>): Com
       ok: boolean;
     }>;
   }>>;
-}, {
-  jobs: import("@prisma/composer").ConfigParam<import("arktype/internal/variants/array.ts").ArrayType<{
+}, import("arktype/internal/variants/object.ts").ObjectType<{
+  jobs: {
     jobId: string;
     every: string;
-  }[], {}>>;
-}, Record<never, never>, Record<never, never>>;
+  }[];
+}, {}>, Record<never, never>>;
 /**
  * Fires `call(jobId)` on each job's `every` interval. A rejected `call` is
  * logged, never thrown — a missed tick is healed by an idempotent target, not

package/dist/cron/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../1-prisma-cloud/1-extensions/target/dist/index.d.mts","../../../../1-prisma-cloud/2-shared-modules/cron/dist/index.d.mts"],"mappings":";;;;;cA0Cc;WACH,+BAA+B,4CAA4C;;KAEjF,wBAAwB;;;;;;;;;;;;;;;;;;;;;;cAsBf,eAAe,UAAU,MAAM,UAAU,QAAQ,UAAU,QAAQ,UAAU,oBAAoB,oBAAoB,GAAG,IAAI,gBAAgB,GAAG;;YAEjJ;WACD;WACA;WACA;WACA;WACA,QAAQ;WACR,QAAQ,IAAI;WACZ,aAAa;WACb,OAAO;WACP,QAAQ;EACjB,YAAY,MAAM,YAAY,GAAG,IAAI,gBAAgB,GAAG;EACxD,IAAI,iBAAiB,YAAY,mBAAmB;EACpD,QAAQ,aAAa;EACrB,UAAU,OAAO,IAAI;EACrB,WAAW,aAAa;;;;EAIxB;;;;;cCrFY,0CAA0C;EACtD,UAAU;IACR;QACI;IACJ;;;KAGC,yBAAyB;;;;;;;;UAQpB,SAAS;WACR,MAAM;aACJ,OAAO;aACP;;;;;;;;iBAQI,qBAAqB,UAAU,wBAAwB,MAAM,IAAI,eAAe;;;;;;;;;;;iBAWhF,KAAK,WAAW,MAAM,WAAW,QAAQ,oBAAoB;EAC5E,UAAU,SAAS;EACnB,QAAQ,YAAY,IAAI;IACtB,SAAS;;EAEX;IACE,WAAW,IAAI;;;;;;;;iBAQF,cAAc,oBAAoB,UAAU,SAAS,OAmB7C;EAlBvB,kCAAkC;IAChC,UAAU;MACR;UACI;MACJ;;8BAEwB;IAC1B,UAAU;MACR;UACI;MACJ;;;;EAIJ,+BAA+B,yDAAyD;IACtF;IACA;;GAED,sBAAsB;;;;;;;iBAOR,aAAa;EAC5B,MAAM;IACJ;IACA;;EAEF,OAAO,kBAAkB;EACzB,YAAY,gBAAgB;;;;KAIzB,gBAAgB,MAAM,MAAM,MAAM;iBACtB,cAAc,UAAU,MAAM,UAAU,QAAQ,oBAAoB,SAAS,oBAAoB,GAAG;EACnH,SAAS;IACP,WAAW,SAAS,MAAM,aAAa,MAAM,MAAM,gBAAgB,aAAa,UAAU,KAAK,YAAY,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../1-prisma-cloud/1-extensions/target/dist/index.d.mts","../../../../1-prisma-cloud/2-shared-modules/cron/dist/index.d.mts"],"mappings":";;;;;cA2Cc;WACH,+BAA+B,YAAY;;KAEjD,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;cA0Bf,eAAe,UAAU,MAAM,UAAU,8BAA8B,UAAU,mBAAmB,oBAAoB,GAAG,gBAAgB,GAAG;;YAEhJ;WACD;WACA;WACA;WACA;WACA,QAAQ;WACR,QAAQ;WACR,aAAa;WACb,OAAO;WACP,QAAQ;EACjB,YAAY,MAAM,YAAY,GAAG,gBAAgB,GAAG;EACpD,IAAI,iBAAiB,YAAY,mBAAmB;EACpD,QAAQ,aAAa;EACrB,SAAS,aAAa;;;;EAItB;;;;EAIA;;;;;cC7FY,0CAA0C;EACtD,UAAU;IACR;QACI;IACJ;;;KAGC,yBAAyB;;;;;;;;UAQpB,SAAS;WACR,MAAM;aACJ,OAAO;aACP;;;;;;;;iBAQI,qBAAqB,UAAU,wBAAwB,MAAM,IAAI,eAAe;;;;;;;;;;;iBAWhF,KAAK,WAAW,MAAM,WAAW,QAAQ,oBAAoB;EAC5E,UAAU,SAAS;EACnB,QAAQ,YAAY,IAAI;IACtB,SAAS;;EAEX;IACE,WAAW,IAAI;;;;;;;;iBAQF,iBAmBT;EAlBN,kCAAkC;IAChC,UAAU;MACR;UACI;MACJ;;8BAEwB;IAC1B,UAAU;MACR;UACI;MACJ;;;iDAG2C;EAC/C;IACE;IACA;;QAEI;;;;;;;iBAOS,aAAa;EAC5B,MAAM;IACJ;IACA;;EAEF,OAAO,kBAAkB;EACzB,YAAY,gBAAgB;;;;KAIzB,gBAAgB,MAAM,MAAM,MAAM;iBACtB,cAAc,UAAU,MAAM,UAAU,QAAQ,oBAAoB,SAAS,oBAAoB,GAAG;EACnH,SAAS;IACP,WAAW,SAAS,MAAM,aAAa,MAAM,MAAM,gBAAgB,aAAa,UAAU,KAAK,YAAY,QAAQ"}

package/dist/cron/index.mjs

@@ -1,9 +1,92 @@
 import { RPC_PEER_KEY, contract, rpc, serve } from "@prisma/composer/service-rpc";
 import { type } from "arktype";
-import { hydrateSecrets, hydrateSync, module, number, param, service } from "@prisma/composer";
 import node from "@prisma/composer/node";
+import { hydrateSync, module, number, service } from "@prisma/composer";
 import { blindCast } from "@prisma/composer/casts";
-//#region ../../1-prisma-cloud/1-extensions/target/dist/serializer-CJiOhF2d.mjs
+//#region ../../0-framework/0-foundation/foundation/dist/casts-DpaahrlC.mjs
+/**
+* **Last-resort escape hatch for unsafe type assertions. Not a sanctioned tool to reach for.**
+*
+* Before reaching for `blindCast`, **rewrite the surrounding code so the cast becomes
+* unnecessary**: tighten an input type, add a runtime check that narrows via a type
+* predicate, restructure a generic so the compiler can see the relationship you're
+* asserting, or use {@link castAs} when the value already satisfies the target type.
+* Only when no rewrite is feasible does `blindCast` become the right answer — and at
+* that point, the `Reason` literal you supply must articulate the compromise in
+* language a reviewer can evaluate.
+*
+* The reviewer **will** validate the `Reason`. If it doesn't hold up under scrutiny,
+* that is not a signal to soften the reason; it is a signal to go back and solve the
+* underlying type-system problem properly. An unconvincing justification is rework,
+* not a free pass.
+*
+* `blindCast` is the auditable form of `as Foo` / `as unknown as Foo`: it bypasses
+* the compiler's checks (the input type is `unknown`, the output type is whatever the
+* caller asks for), but it forces the unsafety to be named at the call site instead of
+* smuggled in via a bare `as`. The `Reason` type parameter exists only at compile
+* time — it is not present in the emitted JavaScript — but it is grep-able and
+* visible to future readers.
+*
+* @example
+* ```typescript
+* const stringValue = blindCast<
+*   string,
+*   "JSON.parse returns `unknown`; this field is documented to be a string in the API contract"
+* >(parsed[key]);
+* ```
+*
+* @typeParam TargetType - The type the caller is asserting the input has.
+* @typeParam _Reason - A string literal describing why bypassing the type system is necessary here.
+*                     Only meaningful at compile time. The reviewer evaluates whether it justifies the unsafety.
+*/
+function blindCast$1(input) {
+	return input;
+}
+//#endregion
+//#region ../../0-framework/0-foundation/foundation/dist/secret-DoWGmN7m.mjs
+/**
+* A value wrapper that redacts everywhere except the one explicit reader,
+* `expose()`. Sensitivity is carried by the TYPE (`SecretBox<T>`), not a flag a
+* sink must remember to check: `String(box)`, template interpolation,
+* `JSON.stringify`, and `console.log`/`util.inspect` all print `[REDACTED]`, so
+* a secret can't leak through an accidental log or serialization.
+*
+* Every box carries a brand property keyed by the registered symbol
+* `Symbol.for('prisma:secret-box')`, which is what `isSecretString` checks. A
+* symbol key is invisible to `JSON.stringify` and `Object.keys`, so the box's
+* public shape still matches the platform's own `secrecy` type
+* (pdp-control-plane).
+*/
+const REDACTED = "[REDACTED]";
+const SECRET_BOX = blindCast$1(Symbol.for("prisma:secret-box"));
+var SecretBox = class {
+	[SECRET_BOX] = true;
+	#value;
+	constructor(value) {
+		this.#value = value;
+	}
+	/** The sole explicit door to the wrapped value. */
+	expose() {
+		return this.#value;
+	}
+	toString() {
+		return REDACTED;
+	}
+	toJSON() {
+		return REDACTED;
+	}
+	valueOf() {
+		return REDACTED;
+	}
+	[Symbol.toPrimitive]() {
+		return REDACTED;
+	}
+	[Symbol.for("nodejs.util.inspect.custom")]() {
+		return REDACTED;
+	}
+};
+//#endregion
+//#region ../../1-prisma-cloud/1-extensions/target/dist/serializer-sVE4UAmg.mjs
 /**
 * Walks a node's own params, then each dependency input's connection params —
 * the same enumeration order `configOf` uses, but carrying the raw
@@ -93,7 +176,7 @@ function coerceEnvSourcedParam(raw, d, key) {
 /**
 * Boot: read each declared param from env by its key, reverse the param's own
 * serialization (missing/invalid fails loudly), assemble the typed Config.
-* Secrets ride a separate channel (deserializeSecrets), not this one.
+* The input document rides its own channel (readInput), not this one.
 */
 const deserialize = (node, address) => {
 	const service = {};
@@ -130,40 +213,84 @@ const stash = (node, config) => {
 		process.env[configKey("", d)] = encode(d.owner, value);
 	}
 };
-/** The pointer-row key for a secret slot: COMPOSER_<addr>_<slot> (secrets are service-level). */
-const secretKey = (address, slot) => configKey(address, {
+/** The input document's own row name; its full key is COMPOSER_<addr>_INPUT. */
+const INPUT_KEY_NAME = "INPUT";
+/** The input document row's key for a service address. */
+const inputKey = (address) => configKey(address, {
 	owner: "service",
-	name: slot
+	name: INPUT_KEY_NAME
 });
+const SECRET_MARKER = "$secret";
+const ESCAPED_KEY = /^\$\$+secret$/;
+/** True for the framework's secret pointer: `{ "$secret": "<PLATFORM_VAR>" }` and nothing else. */
+function isSecretPointer(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length === 1 && SECRET_MARKER in value && typeof value[SECRET_MARKER] === "string";
+}
+/** A plain data object (not an array, not a class instance) — the only object shape a binding/document may nest. */
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
 /**
-* Boot: resolve every secret slot to its value by double-lookup — read the
-* pointer key (the platform NAME), then read that platform var. A missing
-* pointer or a missing/empty platform value is a loud failure naming both keys.
-* Returns a plain Record for core's `hydrateSecrets` to box.
+* Boot: read the one input document row (address-free after run()'s
+* re-stash), swap each `$secret` pointer for a redacting box over the named
+* platform var, unescape reserved keys, validate with the service's own
+* schema, and return the typed object. A missing row is a loud failure naming
+* the env var — a deployed environment always writes it; a local harness must
+* supply it (set the row to the serialized input document).
 */
-const deserializeSecrets = (node, address) => {
-	const values = {};
-	for (const slot of Object.keys(node.secretSlots)) {
-		const key = secretKey(address, slot);
-		const name = process.env[key];
-		if (name === void 0 || name === "") throw new Error(`missing secret pointer for slot "${slot}" (env ${key}) — the deploy did not write it.`);
-		const value = process.env[name];
-		if (value === void 0 || value === "") throw new Error(`secret "${slot}" is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
-		values[slot] = value;
+function readInput(node, address) {
+	const schema = node.inputSchema;
+	if (schema === void 0) throw new Error(`input() called on service "${node.name}", which declares no input schema — declare \`input: <schema>\` on compute() to use it (ADR-0042).`);
+	const key = inputKey(address);
+	const raw = process.env[key];
+	if (raw === void 0 || raw === "") throw new Error(`this service's input is not available (env ${key} is unset) — a deployed environment writes it automatically; a local harness must supply it like any other config value (set ${key} to the serialized input document).`);
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`this service's input document is not valid JSON (env ${key}): ${message} — a deployed environment writes it automatically; a local harness must supply the serialized input document (set ${key} to it).`);
 	}
-	return values;
-};
+	const hydrated = hydrateInputDocument(parsed, key);
+	try {
+		return standardValidateSync(schema, hydrated);
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`invalid input document (env ${key}): ${message}`);
+	}
+}
+/** Reverses the document encoding: `$secret` pointers become redacting boxes over the named platform vars; escaped reserved keys drop one "$". */
+function hydrateInputDocument(value, key) {
+	if (isSecretPointer(value)) {
+		const name = value[SECRET_MARKER];
+		const secret = process.env[name];
+		if (secret === void 0 || secret === "") throw new Error(`secret input is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
+		return new SecretBox(secret);
+	}
+	if (Array.isArray(value)) return value.map((member) => hydrateInputDocument(member, key));
+	if (isPlainObject(value)) {
+		const out = {};
+		for (const [k, member] of Object.entries(value)) {
+			const read = ESCAPED_KEY.test(k) ? k.slice(1) : k;
+			out[read] = hydrateInputDocument(member, key);
+		}
+		return out;
+	}
+	return value;
+}
 /**
-* run()'s setup step for secrets: re-emit each slot's pointer NAME under its
-* address-free key, so the address-free `deserializeSecrets` double-looks-up
-* identically. Never the value — the value stays only in the platform var.
+* run()'s setup step for the input document: re-emit the row under its
+* address-free key, so the address-free `readInput` reads identically. The
+* document carries pointers, never values — the values stay only in their
+* platform vars.
 */
-const stashSecrets = (node, address) => {
-	for (const slot of Object.keys(node.secretSlots)) {
-		const name = process.env[secretKey(address, slot)];
-		if (name === void 0) continue;
-		process.env[secretKey("", slot)] = name;
-	}
+const stashInput = (node, address) => {
+	if (node.inputSchema === void 0) return;
+	const raw = process.env[inputKey(address)];
+	if (raw === void 0) return;
+	process.env[inputKey("")] = raw;
 };
 /**
 * Boot: for each reserved provider param, read its address-scoped row through
@@ -228,7 +355,7 @@ function standardValidateSync(schema, value) {
 	return result.value;
 }
 //#endregion
-//#region ../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-C1wSO3cx.mjs
+//#region ../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-Cxy18aoh.mjs
 /**
 * The service's own origin as a reserved provider param (ADR-0031): the ONE
 * brand and the ONE entry — shared by control.ts (which registers the
@@ -346,20 +473,24 @@ Object.freeze({
 });
 const reservedParams = { port: number({ default: 3e3 }) };
 /**
-* A Prisma Compute service — declarations only (deps + params + build + the
-* ports it exposes), no descriptor. `params` merges with the reserved
-* `ReservedParams` (`port`); a user param whose name collides with a reserved
-* one fails at authoring, the same way a colliding dependency name does.
+* A Prisma Compute service — declarations only (deps + one input schema +
+* build + the ports it exposes), no descriptor. The reserved `port` param
+* rides its own channel (ADR-0042 leaves it untouched); a dependency named
+* like it fails at authoring.
 *
 *   · run(address, boot) — the process controller: deserialize the platform
 *     environment (keyed off `address`, the extension's ONE env read) into a
-*     typed Config, re-emit it under address-free process-local stash keys,
-*     then call boot() to start the app's entry.
-*   · load() / config() — called from inside the app's entry: read the stash;
-*     load() hydrates + memoizes the deps, config() returns the typed params.
-*     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+*     typed Config, re-emit it (and the input document row) under address-free
+*     process-local stash keys, then call boot() to start the app's entry.
+*   · load() / input() — called from inside the app's entry: read the stash;
+*     load() hydrates + memoizes the deps, input() parses the input document,
+*     replaces each `$secret` pointer with a redacting box over the named
+*     platform var, validates with the declared schema, and memoizes (ADR-0042).
 *   · origin() — this service's platform-assigned public origin, read from the
 *     stash `run()` populates; memoized per process.
+*   · port() — this service's resolved reserved port (the value `run()` routes
+*     to and exports as PORT), read from that same stash via #processConfig();
+*     defaults to 3000 when the platform binds none.
 *
 * The underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
 * the control-plane registry key `prisma-composer deploy` resolves through the
@@ -369,8 +500,7 @@ const reservedParams = { port: number({ default: 3e3 }) };
 var ComputeService = class {
 	#resolved;
 	#loadedDeps;
-	#loadedParams;
-	#loadedSecrets;
+	#loadedInput;
 	#origin;
 	constructor(node) {
 		Object.assign(this, node);
@@ -383,7 +513,7 @@ var ComputeService = class {
 		const config = deserialize(this, address);
 		stash(this, config);
 		stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
-		stashSecrets(this, address);
+		stashInput(this, address);
 		const port = config.service["port"];
 		if (typeof port === "number") process.env["PORT"] = String(port);
 		return boot();
@@ -392,13 +522,9 @@ var ComputeService = class {
 		if (this.#loadedDeps === void 0) this.#loadedDeps = blindCast(hydrateSync(this, this.#processConfig()));
 		return this.#loadedDeps;
 	}
-	config() {
-		if (this.#loadedParams === void 0) this.#loadedParams = blindCast(this.#processConfig().service);
-		return this.#loadedParams;
-	}
-	secrets() {
-		if (this.#loadedSecrets === void 0) this.#loadedSecrets = blindCast(hydrateSecrets(this, deserializeSecrets(this, "")));
-		return this.#loadedSecrets;
+	input() {
+		if (this.#loadedInput === void 0) this.#loadedInput = blindCast(readInput(this, ""));
+		return this.#loadedInput;
 	}
 	/** This service's platform-assigned public origin — read from the stash
 	*  run() populates and memoized per process. Throws if called before run()
@@ -407,26 +533,24 @@ var ComputeService = class {
 		this.#origin ??= readOrigin();
 		return this.#origin;
 	}
+	/** This service's resolved reserved port — the value run() routes to and
+	*  exports as PORT — read the same way load() reads the stash. Defaults to
+	*  3000 when the platform binds none. */
+	port() {
+		const port = this.#processConfig().service["port"];
+		if (typeof port !== "number") throw new Error(`service "${this.name}" resolved a non-numeric port — the reserved port param is number({ default: 3000 }), so a stashed config always carries a number here.`);
+		return port;
+	}
 };
 const compute = (def) => {
-	const userParams = def.params ?? blindCast({});
-	for (const reserved of Object.keys(reservedParams)) {
-		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
-		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
-	}
-	for (const name of Object.keys(userParams)) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): param "${name}" collides with the framework-written origin row — rename the param.`);
-	for (const name of Object.keys(def.secrets ?? {})) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): secret "${name}" collides with the framework-written origin row — rename the secret.`);
-	const params = blindCast({
-		...userParams,
-		...reservedParams
-	});
+	for (const reserved of Object.keys(reservedParams)) if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
 	const instance = new ComputeService(service({
 		name: def.name,
 		extension: "@prisma/composer-prisma-cloud",
 		type: "compute",
 		inputs: def.deps,
-		params,
-		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
+		params: reservedParams,
+		...def.input !== void 0 ? { input: def.input } : {},
 		build: def.build,
 		...def.expose !== void 0 ? { expose: def.expose } : {}
 	}));
@@ -447,7 +571,7 @@ Object.freeze({
 	satisfies: (required) => required.kind === "credentials"
 });
 //#endregion
-//#region ../../1-prisma-cloud/2-shared-modules/cron/dist/scheduler-DhziPSWE.mjs
+//#region ../../1-prisma-cloud/2-shared-modules/cron/dist/scheduler-QQTyhZzT.mjs
 /**
 * The one call edge between the scheduler and the app's runner: `trigger(jobId)`.
 * The scheduler depends on it (`rpc(triggerContract)`); the runner exposes it
@@ -490,25 +614,25 @@ function parseEvery(s) {
 }
 /**
 * The reusable scheduler node and its firing logic. `cronScheduler` builds a
-* `compute()` whose `jobs` param default is the app's schedule and whose only
-* dependency is `trigger(jobId)`; nothing else about it varies per app.
-* `runScheduler` is the pure, injectable firing loop the entrypoint (and its
-* tests) drive.
+* `compute()` whose one input is the `jobs` schedule (bound at provision by
+* `cron()`, ADR-0042) and whose only dependency is `trigger(jobId)`; nothing
+* else about it varies per app. `runScheduler` is the pure, injectable firing
+* loop the entrypoint (and its tests) drive.
 */
-const scheduleSchema = type({
+const cronInputSchema = type({ jobs: type({
 	jobId: "string",
 	every: "string"
-}).array();
+}).array() });
 /**
-* The always-on scheduler service. `schedule` sets only the `jobs` param's
-* default — the value the deploy serializes into config; the scheduler
-* itself is job-agnostic.
+* The always-on scheduler service. Job-agnostic: the schedule arrives as the
+* `jobs` key of the input binding `cron()` supplies at provision, and the
+* entrypoint reads it back through `input()`.
 */
-function cronScheduler(schedule) {
+function cronScheduler() {
 	return compute({
 		name: "scheduler",
 		deps: { trigger: rpc(triggerContract) },
-		params: { jobs: param(scheduleSchema, { default: [...schedule.jobs] }) },
+		input: cronInputSchema,
 		build: node({
 			module: new URL("./scheduler-service.mjs", import.meta.url).href,
 			entry: "./scheduler-entrypoint.mjs"
@@ -545,9 +669,10 @@ function cron(opts) {
 			id: "runner",
 			deps: inputs
 		});
-		provision(cronScheduler(opts.schedule), {
+		provision(cronScheduler(), {
 			id: "scheduler",
-			deps: { trigger: runner.trigger }
+			deps: { trigger: runner.trigger },
+			input: { jobs: [...opts.schedule.jobs] }
 		});
 		return {};
 	});