@prisma/composer-prisma-cloud 0.3.0-dev.8 → 0.3.0

package/dist/email/email-service.mjs

@@ -1,101 +1,10 @@
-import { dependency, hydrateSync, number, resource, service, string } from "@prisma/composer";
+import { dependency, hydrateSecrets, hydrateSync, number, param, resource, secret, service, string } from "@prisma/composer";
 import "@prisma/composer/assertions";
 import { blindCast } from "@prisma/composer/casts";
 import { RPC_PEER_KEY, contract, rpc } from "@prisma/composer/service-rpc";
 import { type } from "arktype";
 import node from "@prisma/composer/node";
-//#region ../../0-framework/0-foundation/foundation/dist/casts-DpaahrlC.mjs
-/**
-* **Last-resort escape hatch for unsafe type assertions. Not a sanctioned tool to reach for.**
-*
-* Before reaching for `blindCast`, **rewrite the surrounding code so the cast becomes
-* unnecessary**: tighten an input type, add a runtime check that narrows via a type
-* predicate, restructure a generic so the compiler can see the relationship you're
-* asserting, or use {@link castAs} when the value already satisfies the target type.
-* Only when no rewrite is feasible does `blindCast` become the right answer — and at
-* that point, the `Reason` literal you supply must articulate the compromise in
-* language a reviewer can evaluate.
-*
-* The reviewer **will** validate the `Reason`. If it doesn't hold up under scrutiny,
-* that is not a signal to soften the reason; it is a signal to go back and solve the
-* underlying type-system problem properly. An unconvincing justification is rework,
-* not a free pass.
-*
-* `blindCast` is the auditable form of `as Foo` / `as unknown as Foo`: it bypasses
-* the compiler's checks (the input type is `unknown`, the output type is whatever the
-* caller asks for), but it forces the unsafety to be named at the call site instead of
-* smuggled in via a bare `as`. The `Reason` type parameter exists only at compile
-* time — it is not present in the emitted JavaScript — but it is grep-able and
-* visible to future readers.
-*
-* @example
-* ```typescript
-* const stringValue = blindCast<
-*   string,
-*   "JSON.parse returns `unknown`; this field is documented to be a string in the API contract"
-* >(parsed[key]);
-* ```
-*
-* @typeParam TargetType - The type the caller is asserting the input has.
-* @typeParam _Reason - A string literal describing why bypassing the type system is necessary here.
-*                     Only meaningful at compile time. The reviewer evaluates whether it justifies the unsafety.
-*/
-function blindCast$1(input) {
-	return input;
-}
-//#endregion
-//#region ../../0-framework/0-foundation/foundation/dist/secret-DoWGmN7m.mjs
-/**
-* A value wrapper that redacts everywhere except the one explicit reader,
-* `expose()`. Sensitivity is carried by the TYPE (`SecretBox<T>`), not a flag a
-* sink must remember to check: `String(box)`, template interpolation,
-* `JSON.stringify`, and `console.log`/`util.inspect` all print `[REDACTED]`, so
-* a secret can't leak through an accidental log or serialization.
-*
-* Every box carries a brand property keyed by the registered symbol
-* `Symbol.for('prisma:secret-box')`, which is what `isSecretString` checks. A
-* symbol key is invisible to `JSON.stringify` and `Object.keys`, so the box's
-* public shape still matches the platform's own `secrecy` type
-* (pdp-control-plane).
-*/
-const REDACTED = "[REDACTED]";
-const SECRET_BOX = blindCast$1(Symbol.for("prisma:secret-box"));
-var SecretBox = class {
-	[SECRET_BOX] = true;
-	#value;
-	constructor(value) {
-		this.#value = value;
-	}
-	/** The sole explicit door to the wrapped value. */
-	expose() {
-		return this.#value;
-	}
-	toString() {
-		return REDACTED;
-	}
-	toJSON() {
-		return REDACTED;
-	}
-	valueOf() {
-		return REDACTED;
-	}
-	[Symbol.toPrimitive]() {
-		return REDACTED;
-	}
-	[Symbol.for("nodejs.util.inspect.custom")]() {
-		return REDACTED;
-	}
-};
-/**
-* True for a redacting secret box — what a schema's secret leaf checks
-* (ADR-0042). Reads the brand rather than `instanceof`, so a box from a
-* duplicated module copy in a bundle counts and a look-alike does not.
-*/
-function isSecretString(value) {
-	return typeof value === "object" && value !== null && blindCast$1(value)[SECRET_BOX] === true;
-}
-//#endregion
-//#region ../../1-prisma-cloud/1-extensions/target/dist/serializer-sVE4UAmg.mjs
+//#region ../../1-prisma-cloud/1-extensions/target/dist/serializer-CJiOhF2d.mjs
 /**
 * Walks a node's own params, then each dependency input's connection params —
 * the same enumeration order `configOf` uses, but carrying the raw
@@ -185,7 +94,7 @@ function coerceEnvSourcedParam(raw, d, key) {
 /**
 * Boot: read each declared param from env by its key, reverse the param's own
 * serialization (missing/invalid fails loudly), assemble the typed Config.
-* The input document rides its own channel (readInput), not this one.
+* Secrets ride a separate channel (deserializeSecrets), not this one.
 */
 const deserialize = (node, address) => {
 	const service = {};
@@ -222,84 +131,40 @@ const stash = (node, config) => {
 		process.env[configKey("", d)] = encode(d.owner, value);
 	}
 };
-/** The input document's own row name; its full key is COMPOSER_<addr>_INPUT. */
-const INPUT_KEY_NAME = "INPUT";
-/** The input document row's key for a service address. */
-const inputKey = (address) => configKey(address, {
+/** The pointer-row key for a secret slot: COMPOSER_<addr>_<slot> (secrets are service-level). */
+const secretKey = (address, slot) => configKey(address, {
 	owner: "service",
-	name: INPUT_KEY_NAME
+	name: slot
 });
-const SECRET_MARKER = "$secret";
-const ESCAPED_KEY = /^\$\$+secret$/;
-/** True for the framework's secret pointer: `{ "$secret": "<PLATFORM_VAR>" }` and nothing else. */
-function isSecretPointer(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length === 1 && SECRET_MARKER in value && typeof value[SECRET_MARKER] === "string";
-}
-/** A plain data object (not an array, not a class instance) — the only object shape a binding/document may nest. */
-function isPlainObject(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
 /**
-* Boot: read the one input document row (address-free after run()'s
-* re-stash), swap each `$secret` pointer for a redacting box over the named
-* platform var, unescape reserved keys, validate with the service's own
-* schema, and return the typed object. A missing row is a loud failure naming
-* the env var — a deployed environment always writes it; a local harness must
-* supply it (set the row to the serialized input document).
+* Boot: resolve every secret slot to its value by double-lookup — read the
+* pointer key (the platform NAME), then read that platform var. A missing
+* pointer or a missing/empty platform value is a loud failure naming both keys.
+* Returns a plain Record for core's `hydrateSecrets` to box.
 */
-function readInput(node, address) {
-	const schema = node.inputSchema;
-	if (schema === void 0) throw new Error(`input() called on service "${node.name}", which declares no input schema — declare \`input: <schema>\` on compute() to use it (ADR-0042).`);
-	const key = inputKey(address);
-	const raw = process.env[key];
-	if (raw === void 0 || raw === "") throw new Error(`this service's input is not available (env ${key} is unset) — a deployed environment writes it automatically; a local harness must supply it like any other config value (set ${key} to the serialized input document).`);
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch (cause) {
-		const message = cause instanceof Error ? cause.message : String(cause);
-		throw new Error(`this service's input document is not valid JSON (env ${key}): ${message} — a deployed environment writes it automatically; a local harness must supply the serialized input document (set ${key} to it).`);
+const deserializeSecrets = (node, address) => {
+	const values = {};
+	for (const slot of Object.keys(node.secretSlots)) {
+		const key = secretKey(address, slot);
+		const name = process.env[key];
+		if (name === void 0 || name === "") throw new Error(`missing secret pointer for slot "${slot}" (env ${key}) — the deploy did not write it.`);
+		const value = process.env[name];
+		if (value === void 0 || value === "") throw new Error(`secret "${slot}" is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
+		values[slot] = value;
 	}
-	const hydrated = hydrateInputDocument(parsed, key);
-	try {
-		return standardValidateSync(schema, hydrated);
-	} catch (cause) {
-		const message = cause instanceof Error ? cause.message : String(cause);
-		throw new Error(`invalid input document (env ${key}): ${message}`);
-	}
-}
-/** Reverses the document encoding: `$secret` pointers become redacting boxes over the named platform vars; escaped reserved keys drop one "$". */
-function hydrateInputDocument(value, key) {
-	if (isSecretPointer(value)) {
-		const name = value[SECRET_MARKER];
-		const secret = process.env[name];
-		if (secret === void 0 || secret === "") throw new Error(`secret input is not provisioned (env ${key} → ${name}): the platform var "${name}" is unset or empty.`);
-		return new SecretBox(secret);
-	}
-	if (Array.isArray(value)) return value.map((member) => hydrateInputDocument(member, key));
-	if (isPlainObject(value)) {
-		const out = {};
-		for (const [k, member] of Object.entries(value)) {
-			const read = ESCAPED_KEY.test(k) ? k.slice(1) : k;
-			out[read] = hydrateInputDocument(member, key);
-		}
-		return out;
-	}
-	return value;
-}
+	return values;
+};
 /**
-* run()'s setup step for the input document: re-emit the row under its
-* address-free key, so the address-free `readInput` reads identically. The
-* document carries pointers, never values — the values stay only in their
-* platform vars.
+* run()'s setup step for secrets: re-emit each slot's pointer NAME under its
+* address-free key, so the address-free `deserializeSecrets` double-looks-up
+* identically. Never the value — the value stays only in the platform var.
 */
-const stashInput = (node, address) => {
-	if (node.inputSchema === void 0) return;
-	const raw = process.env[inputKey(address)];
-	if (raw === void 0) return;
-	process.env[inputKey("")] = raw;
+const stashSecrets = (node, address) => {
+	for (const slot of Object.keys(node.secretSlots)) {
+		const name = process.env[secretKey(address, slot)];
+		if (name === void 0) continue;
+		process.env[secretKey("", slot)] = name;
+	}
 };
 /**
 * Boot: for each reserved provider param, read its address-scoped row through
@@ -364,7 +229,7 @@ function standardValidateSync(schema, value) {
 	return result.value;
 }
 //#endregion
-//#region ../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-Cxy18aoh.mjs
+//#region ../../1-prisma-cloud/1-extensions/target/dist/provisioned-edges-C1wSO3cx.mjs
 /**
 * The service's own origin as a reserved provider param (ADR-0031): the ONE
 * brand and the ONE entry — shared by control.ts (which registers the
@@ -482,24 +347,20 @@ Object.freeze({
 });
 const reservedParams = { port: number({ default: 3e3 }) };
 /**
-* A Prisma Compute service — declarations only (deps + one input schema +
-* build + the ports it exposes), no descriptor. The reserved `port` param
-* rides its own channel (ADR-0042 leaves it untouched); a dependency named
-* like it fails at authoring.
+* A Prisma Compute service — declarations only (deps + params + build + the
+* ports it exposes), no descriptor. `params` merges with the reserved
+* `ReservedParams` (`port`); a user param whose name collides with a reserved
+* one fails at authoring, the same way a colliding dependency name does.
 *
 *   · run(address, boot) — the process controller: deserialize the platform
 *     environment (keyed off `address`, the extension's ONE env read) into a
-*     typed Config, re-emit it (and the input document row) under address-free
-*     process-local stash keys, then call boot() to start the app's entry.
-*   · load() / input() — called from inside the app's entry: read the stash;
-*     load() hydrates + memoizes the deps, input() parses the input document,
-*     replaces each `$secret` pointer with a redacting box over the named
-*     platform var, validates with the declared schema, and memoizes (ADR-0042).
+*     typed Config, re-emit it under address-free process-local stash keys,
+*     then call boot() to start the app's entry.
+*   · load() / config() — called from inside the app's entry: read the stash;
+*     load() hydrates + memoizes the deps, config() returns the typed params.
+*     Separate accessors so a dep and a param never share a namespace (ADR-0021).
 *   · origin() — this service's platform-assigned public origin, read from the
 *     stash `run()` populates; memoized per process.
-*   · port() — this service's resolved reserved port (the value `run()` routes
-*     to and exports as PORT), read from that same stash via #processConfig();
-*     defaults to 3000 when the platform binds none.
 *
 * The underlying node carries `extension: '@prisma/composer-prisma-cloud'` —
 * the control-plane registry key `prisma-composer deploy` resolves through the
@@ -509,7 +370,8 @@ const reservedParams = { port: number({ default: 3e3 }) };
 var ComputeService = class {
 	#resolved;
 	#loadedDeps;
-	#loadedInput;
+	#loadedParams;
+	#loadedSecrets;
 	#origin;
 	constructor(node) {
 		Object.assign(this, node);
@@ -522,7 +384,7 @@ var ComputeService = class {
 		const config = deserialize(this, address);
 		stash(this, config);
 		stashProviderParams(RESERVED_PROVIDER_PARAMS, address);
-		stashInput(this, address);
+		stashSecrets(this, address);
 		const port = config.service["port"];
 		if (typeof port === "number") process.env["PORT"] = String(port);
 		return boot();
@@ -531,9 +393,13 @@ var ComputeService = class {
 		if (this.#loadedDeps === void 0) this.#loadedDeps = blindCast(hydrateSync(this, this.#processConfig()));
 		return this.#loadedDeps;
 	}
-	input() {
-		if (this.#loadedInput === void 0) this.#loadedInput = blindCast(readInput(this, ""));
-		return this.#loadedInput;
+	config() {
+		if (this.#loadedParams === void 0) this.#loadedParams = blindCast(this.#processConfig().service);
+		return this.#loadedParams;
+	}
+	secrets() {
+		if (this.#loadedSecrets === void 0) this.#loadedSecrets = blindCast(hydrateSecrets(this, deserializeSecrets(this, "")));
+		return this.#loadedSecrets;
 	}
 	/** This service's platform-assigned public origin — read from the stash
 	*  run() populates and memoized per process. Throws if called before run()
@@ -542,24 +408,26 @@ var ComputeService = class {
 		this.#origin ??= readOrigin();
 		return this.#origin;
 	}
-	/** This service's resolved reserved port — the value run() routes to and
-	*  exports as PORT — read the same way load() reads the stash. Defaults to
-	*  3000 when the platform binds none. */
-	port() {
-		const port = this.#processConfig().service["port"];
-		if (typeof port !== "number") throw new Error(`service "${this.name}" resolved a non-numeric port — the reserved port param is number({ default: 3000 }), so a stashed config always carries a number here.`);
-		return port;
-	}
 };
 const compute = (def) => {
-	for (const reserved of Object.keys(reservedParams)) if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
+	const userParams = def.params ?? blindCast({});
+	for (const reserved of Object.keys(reservedParams)) {
+		if (reserved in def.deps) throw new Error(`compute(): dependency "${reserved}" collides with the reserved service param of the same name — rename the dependency.`);
+		if (reserved in userParams) throw new Error(`compute(): param "${reserved}" collides with the reserved service param of the same name — rename the param.`);
+	}
+	for (const name of Object.keys(userParams)) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): param "${name}" collides with the framework-written origin row — rename the param.`);
+	for (const name of Object.keys(def.secrets ?? {})) if (name.toUpperCase() === "ORIGIN") throw new Error(`compute(): secret "${name}" collides with the framework-written origin row — rename the secret.`);
+	const params = blindCast({
+		...userParams,
+		...reservedParams
+	});
 	const instance = new ComputeService(service({
 		name: def.name,
 		extension: "@prisma/composer-prisma-cloud",
 		type: "compute",
 		inputs: def.deps,
-		params: reservedParams,
-		...def.input !== void 0 ? { input: def.input } : {},
+		params,
+		...def.secrets !== void 0 ? { secrets: def.secrets } : {},
 		build: def.build,
 		...def.expose !== void 0 ? { expose: def.expose } : {}
 	}));
@@ -602,24 +470,7 @@ Object.freeze({
 	satisfies: (required) => required.kind === "credentials"
 });
 //#endregion
-//#region ../../0-framework/0-foundation/foundation/dist/arktype.mjs
-/**
-* ArkType spellings of the framework's schema leaves. Opt-in: the framework
-* accepts any Standard Schema library (ADR-0042) and nothing outside this
-* module imports arktype, so an app that uses Zod never loads it.
-*/
-/**
-* A schema leaf that accepts only a redacting `SecretString` box, so
-* `input().<field>.expose()` type-checks and binding a plain literal there
-* fails the deploy (ADR-0042).
-*
-* ```ts
-* input: type({ signingKey: secretString() })
-* ```
-*/
-const secretString = () => type("unknown").narrow((value, ctx) => isSecretString(value) || ctx.mustBe("a SecretString box — bind this field to a secret"));
-//#endregion
-//#region ../../1-prisma-cloud/2-shared-modules/email/dist/email-service-CTqLUEQV.mjs
+//#region ../../1-prisma-cloud/2-shared-modules/email/dist/email-service-DD1VF_64.mjs
 const emailStatus = type("'stored'|'queued'|'sent'|'failed'");
 const emailSendContract = contract({ send: rpc({
 	input: type({
@@ -678,27 +529,25 @@ const emailOutboxContract = contract({
 });
 /**
 * The email compute service (spec §"Service definition"): a Postgres `db`
-* dependency, ONE input schema — `deliveryMode`/`deliveryUrl`/`from` plus the
-* `deliveryCredential` secret leaf (a `SecretString`-typed field, ADR-0042) —
-* and the two exposed ports (`send`, `outbox`). The module (`email-module.ts`)
-* binds the input at provision: forwarded boundary params/secret as leaves,
-* `deliveryUrl` as a literal. Build/entry mechanics copied from storage's
-* service file (`storage/src/storage-service.ts`), not re-derived:
-* `build.module` points at this file's own built output so the deploy
-* bootstrap can re-import it as `main` and call `main.run(address, boot)`;
-* `entry` resolves the sibling entrypoint pass in the same dist directory.
+* dependency, the `deliveryMode`/`deliveryUrl`/`from` params, the
+* `deliveryCredential` secret, and the two exposed ports (`send`, `outbox`).
+* Build/entry mechanics copied from storage's service file
+* (`storage/src/storage-service.ts`), not re-derived: `build.module` points
+* at this file's own built output so the deploy bootstrap can re-import it
+* as `main` and call `main.run(address, boot)`; `entry` resolves the
+* sibling entrypoint pass in the same dist directory.
 */
-const emailInputSchema = type({
-	deliveryMode: "'resend'|'smtp'|'none'",
-	deliveryUrl: "string",
-	from: "string",
-	deliveryCredential: secretString()
-});
-function emailService() {
+const deliveryModeSchema = type("'resend'|'smtp'|'none'");
+function emailService(opts) {
 	return compute({
 		name: "email",
 		deps: { db: postgres() },
-		input: emailInputSchema,
+		params: {
+			deliveryMode: param(deliveryModeSchema),
+			deliveryUrl: string({ default: opts?.deliveryUrl ?? "https://api.resend.com" }),
+			from: string()
+		},
+		secrets: { deliveryCredential: secret() },
 		expose: {
 			send: emailSendContract,
 			outbox: emailOutboxContract