@prisma/composer-prisma-cloud 0.3.0-dev.6 → 0.3.0-dev.8

package/dist/email/email-entrypoint.mjs

@@ -66,14 +66,6 @@ function blindCast(input) {
 * data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).
 */
 const NODE = Symbol.for("prisma:node");
-const SECRET_NEED = blindCast(Symbol.for("prisma:secret-need"));
-/** Declares a secret NEED. Nameless — the platform name is bound at the root via `envSecret`. */
-function secret() {
-	return Object.freeze({
-		[SECRET_NEED]: true,
-		kind: "secret"
-	});
-}
 const PROVISION_NEED = blindCast(Symbol.for("prisma:provision-need"));
 /** Builds an opaque provisioning need — the declaring package's own brand plus whatever payload its provisioner reads back. */
 function provisionNeed(brand, payload) {
@@ -112,11 +104,6 @@ function freezeParams(params) {
 	for (const [name, param] of Object.entries(params)) frozen[name] = Object.freeze({ ...param });
 	return Object.freeze(frozen);
 }
-function freezeSecrets(secrets) {
-	const frozen = {};
-	for (const [name, need] of Object.entries(secrets)) frozen[name] = Object.freeze({ ...need });
-	return blindCast(Object.freeze(frozen));
-}
 /** A frozen shallow copy that keeps the caller's declared type. */
 function frozenShallowCopy(obj) {
 	return blindCast(Object.freeze({ ...obj }));
@@ -170,7 +157,8 @@ function resource(def) {
 }
 /**
 * Constructs a branded, frozen Service node — declarations only (inputs,
-* params, build adapter, and the ports it exposes). Pure; carries no runtime behavior.
+* params, the input schema, build adapter, and the ports it exposes). Pure;
+* carries no runtime behavior.
 */
 function service$1(def) {
 	requireName(def.name, "service");
@@ -178,8 +166,7 @@ function service$1(def) {
 	requireType(def.type, "service");
 	requireConfigKeySegmentNames(Object.keys(def.inputs), "input", "service");
 	requireConfigKeySegmentNames(Object.keys(def.params), "param", "service");
-	requireConfigKeySegmentNames(Object.keys(def.secrets ?? {}), "secret", "service");
-	for (const slot of Object.keys(def.secrets ?? {})) if (Object.hasOwn(def.params, slot)) throw new Error(`service() secret slot "${slot}" collides with a param of the same name — a secret slot and a service param derive the same config key (COMPOSER_<addr>_${slot.toUpperCase()}); rename one.`);
+	if (def.input !== void 0 && typeof def.input["~standard"]?.validate !== "function") throw new Error("service() `input` must be a Standard Schema (an object with a \"~standard\".validate function) — see https://standardschema.dev (ADR-0042).");
 	return Object.freeze({
 		[NODE]: true,
 		kind: "service",
@@ -188,7 +175,7 @@ function service$1(def) {
 		type: def.type,
 		inputs: frozenShallowCopy(def.inputs),
 		params: freezeParams(def.params),
-		secretSlots: freezeSecrets(def.secrets ?? blindCast({})),
+		inputSchema: blindCast(def.input),
 		build: Object.freeze({ ...def.build }),
 		expose: def.expose !== void 0 ? frozenShallowCopy(def.expose) : void 0
 	});
@@ -221,11 +208,16 @@ function dependency(def) {
 * `JSON.stringify`, and `console.log`/`util.inspect` all print `[REDACTED]`, so
 * a secret can't leak through an accidental log or serialization.
 *
-* Shape matches the platform's own `secrecy` type (pdp-control-plane). The class
-* is nominal enough on its own — no phantom brand.
+* Every box carries a brand property keyed by the registered symbol
+* `Symbol.for('prisma:secret-box')`, which is what `isSecretString` checks. A
+* symbol key is invisible to `JSON.stringify` and `Object.keys`, so the box's
+* public shape still matches the platform's own `secrecy` type
+* (pdp-control-plane).
 */
 const REDACTED = "[REDACTED]";
+const SECRET_BOX = blindCast(Symbol.for("prisma:secret-box"));
 var SecretBox = class {
+	[SECRET_BOX] = true;
 	#value;
 	constructor(value) {
 		this.#value = value;
@@ -250,6 +242,14 @@ var SecretBox = class {
 		return REDACTED;
 	}
 };
+/**
+* True for a redacting secret box — what a schema's secret leaf checks
+* (ADR-0042). Reads the brand rather than `instanceof`, so a box from a
+* duplicated module copy in a bundle counts and a look-alike does not.
+*/
+function isSecretString(value) {
+	return typeof value === "object" && value !== null && blindCast(value)[SECRET_BOX] === true;
+}
 function scalarSchema(name, check) {
 	return { "~standard": {
 		version: 1,
@@ -275,10 +275,6 @@ function string$1(opts = {}) {
 function number$1(opts = {}) {
 	return withFacets(numberSchema, opts);
 }
-/** A param over any caller-supplied Standard Schema — a structured `jobs`, say. */
-function param(schema, opts = {}) {
-	return withFacets(schema, opts);
-}
 /**
 * Synchronous hydrate — what the node's `load()` uses so
 * `const { db } = service.load()` reads without `await`. Requires every
@@ -295,24 +291,6 @@ function hydrateSync(root, config) {
 	}
 	return deps;
 }
-/**
-* Wraps each of a service's resolved secret values in a redacting `SecretBox`
-* — what the node's `secrets()` accessor returns (ADR-0021, sibling to
-* `load()`/`config()`). The RESOLUTION of a secret's value (the boot
-* double-lookup that reads the platform var the pointer names) is the target
-* pack's job; core is handed the already-resolved strings and only boxes them,
-* so a secret is redacted by TYPE from here on. A declared slot missing from
-* `values` is a target contract violation, named loudly.
-*/
-function hydrateSecrets(root, values) {
-	const boxed = {};
-	for (const slot of Object.keys(root.secretSlots)) {
-		const value = values[slot];
-		if (value === void 0) throw new Error(`secret slot "${slot}" has no resolved value — the target must resolve every declared secret before hydrateSecrets().`);
-		boxed[slot] = new SecretBox(value);
-	}
-	return blindCast(boxed);
-}
 /** Bounded jittered backoff for retrying a dropped call. `maxRetries` is retries after the first attempt. */
 const RETRY = {
 	initialDelayMs: 250,
@@ -11692,13 +11670,6 @@ function smtpAttempt(deliveryUrl, credential) {
 function createSmtpDelivery(opts) {
 	return withRetryPolicy(smtpAttempt(opts.deliveryUrl, opts.credential), opts.retryPolicy);
 }
-const nodeBuild = (opts) => ({
-	extension: "@prisma/composer/node",
-	type: "node",
-	module: opts.module,
-	entry: opts.entry,
-	...opts.dir === void 0 ? {} : { dir: opts.dir }
-});
 const liftArray = (data) => Array.isArray(data) ? data : [data];
 /**
 * Splits an array into two arrays based on the result of a predicate
@@ -18818,6 +18789,28 @@ ark.schema;
 ark.define;
 ark.declare;
 /**
+* ArkType spellings of the framework's schema leaves. Opt-in: the framework
+* accepts any Standard Schema library (ADR-0042) and nothing outside this
+* module imports arktype, so an app that uses Zod never loads it.
+*/
+/**
+* A schema leaf that accepts only a redacting `SecretString` box, so
+* `input().<field>.expose()` type-checks and binding a plain literal there
+* fails the deploy (ADR-0042).
+*
+* ```ts
+* input: type({ signingKey: secretString() })
+* ```
+*/
+const secretString = () => type("unknown").narrow((value, ctx) => isSecretString(value) || ctx.mustBe("a SecretString box — bind this field to a secret"));
+const nodeBuild = (opts) => ({
+	extension: "@prisma/composer/node",
+	type: "node",
+	module: opts.module,
+	entry: opts.entry,
+	...opts.dir === void 0 ? {} : { dir: opts.dir }
+});
+/**
 * Walks a node's own params, then each dependency input's connection params —
 * the same enumeration order `configOf` uses, but carrying the raw
 * `ConfigParam` (with its `serialize`/`deserialize`) instead of a pure-data
@@ -18906,7 +18899,7 @@ function coerceEnvSourcedParam(raw, d, key) {
 /**
 * Boot: read each declared param from env by its key, reverse the param's own
 * serialization (missing/invalid fails loudly), assemble the typed Config.
-* Secrets ride a separate channel (deserializeSecrets), not this one.
+* The input document rides its own channel (readInput), not this one.
 */
 const deserialize = (node, address) => {
 	const service = {};
@@ -18943,40 +18936,84 @@ const stash = (node, config) => {
 		process.env[configKey("", d)] = encode(d.owner, value);
 	}
 };
-/** The pointer-row key for a secret slot: COMPOSER_<addr>_<slot> (secrets are service-level). */
-const secretKey = (address, slot) => configKey(address, {
+/** The input document's own row name; its full key is COMPOSER_<addr>_INPUT. */
+const INPUT_KEY_NAME = "INPUT";
+/** The input document row's key for a service address. */
+const inputKey = (address) => configKey(address, {
 	owner: "service",
-	name: slot
+	name: INPUT_KEY_NAME
 });
+const SECRET_MARKER = "$secret";
+const ESCAPED_KEY = /^\$\$+secret$/;
+/** True for the framework's secret pointer: `{ "$secret": "<PLATFORM_VAR>" }` and nothing else. */
+function isSecretPointer(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length === 1 && SECRET_MARKER in value && typeof value[SECRET_MARKER] === "string";
+}
+/** A plain data object (not an array, not a class instance) — the only object shape a binding/document may nest. */
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
 /**
-* Boot: resolve every secret slot to its value by double-lookup — read the
-* pointer key (the platform NAME), then read that platform var. A missing
-* pointer or a missing/empty platform value is a loud failure naming both keys.
-* Returns a plain Record for core's `hydrateSecrets` to box.
+* Boot: read the one input document row (address-free after run()'s
+* re-stash), swap each `$secret` pointer for a redacting box over the named
+* platform var, unescape reserved keys, validate with the service's own
+* schema, and return the typed object. A missing row is a loud failure naming
+* the env var — a deployed environment always writes it; a local harness must
+* supply it (set the row to the serialized input document).
 */
-const deserializeSecrets = (node, address) => {
-	const values = {};
-	for (const slot of Object.keys(node.secretSlots)) {
-		const key = secretKey(address, slot);
-		const name = process.env[key];
-		if (name === void 0 || name === "") throw new Error(`missing secret pointer for slot "${slot}" (env ${key}) — the deploy did not write it.`);
-		const value = process.env[name];
-		if (value === void 0 || value === "") throw new Error(`secret "${slot}" is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
-		values[slot] = value;
-	}
-	return values;
-};
+function readInput(node, address) {
+	const schema = node.inputSchema;
+	if (schema === void 0) throw new Error(`input() called on service "${node.name}", which declares no input schema — declare \`input: <schema>\` on compute() to use it (ADR-0042).`);
+	const key = inputKey(address);
+	const raw = process.env[key];
+	if (raw === void 0 || raw === "") throw new Error(`this service's input is not available (env ${key} is unset) — a deployed environment writes it automatically; a local harness must supply it like any other config value (set ${key} to the serialized input document).`);
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`this service's input document is not valid JSON (env ${key}): ${message} — a deployed environment writes it automatically; a local harness must supply the serialized input document (set ${key} to it).`);
+	}
+	const hydrated = hydrateInputDocument(parsed, key);
+	try {
+		return standardValidateSync(schema, hydrated);
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`invalid input document (env ${key}): ${message}`);
+	}
+}
+/** Reverses the document encoding: `$secret` pointers become redacting boxes over the named platform vars; escaped reserved keys drop one "$". */
+function hydrateInputDocument(value, key) {
+	if (isSecretPointer(value)) {
+		const name = value[SECRET_MARKER];
+		const secret = process.env[name];
+		if (secret === void 0 || secret === "") throw new Error(`secret input is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
+		return new SecretBox(secret);
+	}
+	if (Array.isArray(value)) return value.map((member) => hydrateInputDocument(member, key));
+	if (isPlainObject(value)) {
+		const out = {};
+		for (const [k, member] of Object.entries(value)) {
+			const read = ESCAPED_KEY.test(k) ? k.slice(1) : k;
+			out[read] = hydrateInputDocument(member, key);
+		}
+		return out;
+	}
+	return value;
+}
 /**
-* run()'s setup step for secrets: re-emit each slot's pointer NAME under its
-* address-free key, so the address-free `deserializeSecrets` double-looks-up
-* identically. Never the value — the value stays only in the platform var.
+* run()'s setup step for the input document: re-emit the row under its
+* address-free key, so the address-free `readInput` reads identically. The
+* document carries pointers, never values — the values stay only in their
+* platform vars.
 */
-const stashSecrets = (node, address) => {
-	for (const slot of Object.keys(node.secretSlots)) {
-		const name = process.env[secretKey(address, slot)];
-		if (name === void 0) continue;
-		process.env[secretKey("", slot)] = name;
-	}
+const stashInput = (node, address) => {
+	if (node.inputSchema === void 0) return;
+	const raw = process.env[inputKey(address)];
+	if (raw === void 0) return;
+	process.env[inputKey("")] = raw;
 };
 /**
 * Boot: for each reserved provider param, read its address-scoped row through
@@ -19157,20 +19194,24 @@ Object.freeze({
 });
 const reservedParams = { port: number$1({ default: 3e3 }) };
 /**
-* A Prisma Compute service — declarations only (deps + params + build + the
-* ports it exposes), no descriptor. `params` merges with the reserved
-* `ReservedParams` (`port`); a user param whose name collides with a reserved
-* one fails at authoring, the same way a colliding dependency name does.
+* A Prisma Compute service — declarations only (deps + one input schema +
+* build + the ports it exposes), no descriptor. The reserved `port` param
+* rides its own channel (ADR-0042 leaves it untouched); a dependency named
+* like it fails at authoring.
 *
 *   · run(address, boot) — the process controller: deserialize the platform
 *     environment (keyed off `address`, the extension's ONE env read) into a
-*     typed Config, re-emit it under address-free process-local stash keys,
-*     then call boot() to start the app's entry.
-*   · load() / config() — called from inside the app's entry: read the stash;
-*     load() hydrates + memoizes the deps, config() returns the typed params.
-*     Separate accessors so a dep and a param never share a namespace (ADR-0021).
+*     typed Config, re-emit it (and the input document row) under address-free
+*     process-local stash keys, then call boot() to start the app's entry.
+*   · load() / input() — called from inside the app's entry: read the stash;
+*     load() hydrates + memoizes the deps, input() parses the input document,
+*     replaces each `$secret` pointer with a redacting box over the named
+*     platform var, validates with the declared schema, and memoizes (ADR-0042).
 *   · origin() — this service's platform-assigned public origin, read from the
 *     stash `run()` populates; memoized per process.
+*   · port() — this service's resolved reserved port (the value `run()` routes
+*     to and exports as PORT), read from that same stash via #processConfig();
+*     defaults to 3000 when the platform binds none.
 *
 * The underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
 * the control-plane registry key `prisma-composer deploy` resolves through the
@@ -19180,8 +19221,7 @@ const reservedParams = { port: number$1({ default: 3e3 }) };
 var ComputeService = class {
 	#resolved;
 	#loadedDeps;
-	#loadedParams;
-	#loadedSecrets;
+	#loadedInput;
 	#origin;
 	constructor(node) {
 		Object.assign(this, node);
@@ -19194,7 +19234,7 @@ var ComputeService = class {
 		const config = deserialize(this, address);
 		stash(this, config);
 		stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
-		stashSecrets(this, address);
+		stashInput(this, address);
 		const port = config.service["port"];
 		if (typeof port === "number") process.env["PORT"] = String(port);
 		return boot();
@@ -19203,13 +19243,9 @@ var ComputeService = class {
 		if (this.#loadedDeps === void 0) this.#loadedDeps = blindCast(hydrateSync(this, this.#processConfig()));
 		return this.#loadedDeps;
 	}
-	config() {
-		if (this.#loadedParams === void 0) this.#loadedParams = blindCast(this.#processConfig().service);
-		return this.#loadedParams;
-	}
-	secrets() {
-		if (this.#loadedSecrets === void 0) this.#loadedSecrets = blindCast(hydrateSecrets(this, deserializeSecrets(this, "")));
-		return this.#loadedSecrets;
+	input() {
+		if (this.#loadedInput === void 0) this.#loadedInput = blindCast(readInput(this, ""));
+		return this.#loadedInput;
 	}
 	/** This service's platform-assigned public origin — read from the stash
 	*  run() populates and memoized per process. Throws if called before run()
@@ -19218,26 +19254,24 @@ var ComputeService = class {
 		this.#origin ??= readOrigin();
 		return this.#origin;
 	}
+	/** This service's resolved reserved port — the value run() routes to and
+	*  exports as PORT — read the same way load() reads the stash. Defaults to
+	*  3000 when the platform binds none. */
+	port() {
+		const port = this.#processConfig().service["port"];
+		if (typeof port !== "number") throw new Error(`service "${this.name}" resolved a non-numeric port — the reserved port param is number({ default: 3000 }), so a stashed config always carries a number here.`);
+		return port;
+	}
 };
 const compute = (def) => {
-	const userParams = def.params ?? blindCast({});
-	for (const reserved of Object.keys(reservedParams)) {
-		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
-		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
-	}
-	for (const name of Object.keys(userParams)) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): param "${name}" collides with the framework-written origin row — rename the param.`);
-	for (const name of Object.keys(def.secrets ?? {})) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): secret "${name}" collides with the framework-written origin row — rename the secret.`);
-	const params = blindCast({
-		...userParams,
-		...reservedParams
-	});
+	for (const reserved of Object.keys(reservedParams)) if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
 	const instance = new ComputeService(service$1({
 		name: def.name,
 		extension: "@prisma/composer-prisma-cloud",
 		type: "compute",
 		inputs: def.deps,
-		params,
-		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
+		params: reservedParams,
+		...def.input !== void 0 ? { input: def.input } : {},
 		build: def.build,
 		...def.expose !== void 0 ? { expose: def.expose } : {}
 	}));
@@ -19337,25 +19371,27 @@ const emailOutboxContract = contract({
 });
 /**
 * The email compute service (spec §"Service definition"): a Postgres `db`
-* dependency, the `deliveryMode`/`deliveryUrl`/`from` params, the
-* `deliveryCredential` secret, and the two exposed ports (`send`, `outbox`).
-* Build/entry mechanics copied from storage's service file
-* (`storage/src/storage-service.ts`), not re-derived: `build.module` points
-* at this file's own built output so the deploy bootstrap can re-import it
-* as `main` and call `main.run(address, boot)`; `entry` resolves the
-* sibling entrypoint pass in the same dist directory.
+* dependency, ONE input schema — `deliveryMode`/`deliveryUrl`/`from` plus the
+* `deliveryCredential` secret leaf (a `SecretString`-typed field, ADR-0042) —
+* and the two exposed ports (`send`, `outbox`). The module (`email-module.ts`)
+* binds the input at provision: forwarded boundary params/secret as leaves,
+* `deliveryUrl` as a literal. Build/entry mechanics copied from storage's
+* service file (`storage/src/storage-service.ts`), not re-derived:
+* `build.module` points at this file's own built output so the deploy
+* bootstrap can re-import it as `main` and call `main.run(address, boot)`;
+* `entry` resolves the sibling entrypoint pass in the same dist directory.
 */
-const deliveryModeSchema = type("'resend'|'smtp'|'none'");
-function emailService(opts) {
+const emailInputSchema = type({
+	deliveryMode: "'resend'|'smtp'|'none'",
+	deliveryUrl: "string",
+	from: "string",
+	deliveryCredential: secretString()
+});
+function emailService() {
 	return compute({
 		name: "email",
 		deps: { db: postgres() },
-		params: {
-			deliveryMode: param(deliveryModeSchema),
-			deliveryUrl: string$1({ default: opts?.deliveryUrl ?? "https://api.resend.com" }),
-			from: string$1()
-		},
-		secrets: { deliveryCredential: secret() },
+		input: emailInputSchema,
 		expose: {
 			send: emailSendContract,
 			outbox: emailOutboxContract
@@ -19704,8 +19740,8 @@ function checkDeliveryUrl(deliveryMode, deliveryUrl) {
 }
 const service = emailService();
 const { db } = service.load();
-const { deliveryMode, deliveryUrl, from, port } = service.config();
-const { deliveryCredential } = service.secrets();
+const { deliveryMode, deliveryUrl, from, deliveryCredential } = service.input();
+const port = service.port();
 const deliveryUrlError = checkDeliveryUrl(deliveryMode, deliveryUrl);
 if (deliveryUrlError !== null) throw new Error(deliveryUrlError);
 const handlers = createHandlers({