@prisma/composer-prisma-cloud 0.3.0-dev.8 → 0.3.0

package/dist/{secret-BVGxqHxY-DYDfiULl.mjs → param-BTzY0ne5-CW6ojZ3E.mjs}

@@ -1,6 +1,6 @@
-import { isParamSource, paramSource, secretSource } from "@prisma/composer";
+import { isParamSource, paramSource } from "@prisma/composer";
 import { blindCast } from "@prisma/composer/casts";
-//#region ../../1-prisma-cloud/1-extensions/target/dist/secret-BVGxqHxY.mjs
+//#region ../../1-prisma-cloud/1-extensions/target/dist/param-BTzY0ne5.mjs
 /**
 * Brands the payload `envParam` builds. Core's `paramSource()` is a public
 * SPI, so a user could bypass `envParam` and bind a raw `paramSource('x')`;
@@ -60,48 +60,7 @@ function paramBindingFor(bindings, serviceAddress, slot) {
 	if (binding === void 0) throw new Error(`param slot "${slot}" of "${serviceAddress}" resolved to a source but has no bound entry in the manifest — Load should have recorded it.`);
 	return binding;
 }
-/**
-* Brands the payload `envSecret` builds. Core's `secretSource()` is a public
-* SPI, so a user could bypass `envSecret` and bind a raw `secretSource('x')`;
-* the brand lets `secretName` reject such a source (or another target's) with a
-* clear error instead of reading an absent `.name`.
-*/
-const PRISMA_CLOUD_SECRET_SOURCE = blindCast(Symbol.for("prisma:prisma-cloud-secret-source"));
-const RESERVED_SECRET_PREFIX = "COMPOSER_";
-const POISONED_SECRET_NAMES = /* @__PURE__ */ new Set(["DATABASE_URL", "DATABASE_URL_POOLED"]);
-/**
-* Binds a secret slot to a named Prisma Cloud platform env var (ADR-0029). The
-* value is provisioned out-of-band; only the name is carried. The name may not
-* use the framework's reserved `COMPOSER_` prefix or the poisoned
-* `DATABASE_URL(_POOLED)` keys.
-*/
-function envSecret(name) {
-	if (typeof name !== "string" || name.length === 0) throw new Error("envSecret() requires a non-empty platform env-var name, e.g. envSecret('STRIPE_SECRET_KEY').");
-	if (name.startsWith(RESERVED_SECRET_PREFIX)) throw new Error(`envSecret name "${name}" may not start with "${RESERVED_SECRET_PREFIX}" — that prefix is reserved for the framework's own generated config keys.`);
-	if (POISONED_SECRET_NAMES.has(name)) throw new Error(`envSecret name "${name}" is reserved — ${[...POISONED_SECRET_NAMES].join(" and ")} are poisoned at project provision and cannot back a secret.`);
-	return secretSource({
-		[PRISMA_CLOUD_SECRET_SOURCE]: true,
-		name
-	});
-}
-/** True only for a payload that `envSecret` built — i.e. one carrying the brand. */
-function isEnvSecretPayload(payload) {
-	return typeof payload === "object" && payload !== null && blindCast(payload)[PRISMA_CLOUD_SECRET_SOURCE] === true;
-}
-/**
-* Reads the Prisma Cloud env-var name back out of an opaque secret source —
-* an `envSecret` leaf of an input binding (ADR-0042). A source not built by
-* `envSecret` (a raw `secretSource(...)` or another target's source) carries
-* no name — reject it here, with `where` naming the leaf's position, so a
-* foreign source fails early and clearly rather than producing a broken
-* deploy with an undefined name.
-*/
-function secretName(source, where) {
-	const payload = source.payload;
-	if (!isEnvSecretPayload(payload)) throw new Error(`${where} is bound to a secret source not created by envSecret() — bind secrets with envSecret('NAME') from @prisma/composer-prisma-cloud.`);
-	return payload.name;
-}
 //#endregion
-export { paramName as a, paramBindingFor as i, envSecret as n, secretName as o, isEnvParamSource as r, envParam as t };
+export { paramName as i, isEnvParamSource as n, paramBindingFor as r, envParam as t };
 
-//# sourceMappingURL=secret-BVGxqHxY-DYDfiULl.mjs.map
+//# sourceMappingURL=param-BTzY0ne5-CW6ojZ3E.mjs.map

package/dist/param-BTzY0ne5-CW6ojZ3E.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"param-BTzY0ne5-CW6ojZ3E.mjs","names":[],"sources":["../../../1-prisma-cloud/1-extensions/target/dist/param-BTzY0ne5.mjs"],"sourcesContent":["import { isParamSource, paramSource } from \"@internal/core\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/param.ts\n/**\n* Brands the payload `envParam` builds. Core's `paramSource()` is a public\n* SPI, so a user could bypass `envParam` and bind a raw `paramSource('x')`;\n* the brand lets `paramName` reject such a source (or another target's) with\n* a clear error instead of reading an absent `.name`.\n*/\nconst PRISMA_CLOUD_PARAM_SOURCE = blindCast(Symbol.for(\"prisma:prisma-cloud-param-source\"));\nconst RESERVED_PARAM_PREFIX = \"COMPOSER_\";\nconst POISONED_PARAM_NAMES = /* @__PURE__ */ new Set([\"DATABASE_URL\", \"DATABASE_URL_POOLED\"]);\n/**\n* Binds a param slot to a named Prisma Cloud platform env var — the non-secret\n* sibling of `envSecret` (spec: env-sourced config params). The platform\n* injects the value into the running instance per stage; the param's own\n* schema validates it at boot, unredacted. The name may not use the\n* framework's reserved `COMPOSER_` prefix or the poisoned\n* `DATABASE_URL(_POOLED)` keys — same parity as `envSecret`.\n*/\nfunction envParam(name) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(\"envParam() requires a non-empty platform env-var name, e.g. envParam('APP_ORIGIN').\");\n\tif (name.startsWith(RESERVED_PARAM_PREFIX)) throw new Error(`envParam name \"${name}\" may not start with \"${RESERVED_PARAM_PREFIX}\" — that prefix is reserved for the framework's own generated config keys.`);\n\tif (POISONED_PARAM_NAMES.has(name)) throw new Error(`envParam name \"${name}\" is reserved — ${[...POISONED_PARAM_NAMES].join(\" and \")} are poisoned at project provision and cannot back a param.`);\n\treturn paramSource({\n\t\t[PRISMA_CLOUD_PARAM_SOURCE]: true,\n\t\tname\n\t});\n}\n/** True only for a payload that `envParam` built — i.e. one carrying the brand. */\nfunction isEnvParamPayload(payload) {\n\treturn typeof payload === \"object\" && payload !== null && blindCast(payload)[PRISMA_CLOUD_PARAM_SOURCE] === true;\n}\n/** True iff a resolved param value is an env-sourced pointer this target built (as opposed to a literal, or a foreign/raw `ParamSource`). */\nfunction isEnvParamSource(value) {\n\treturn isParamSource(value) && isEnvParamPayload(value.payload);\n}\n/**\n* Reads the Prisma Cloud env-var name back out of a param binding's opaque\n* source. A source not built by `envParam` (a raw `paramSource(...)` or\n* another target's source) carries no name — reject it here. `paramName` runs\n* in preflight and at serialize before any value ever crosses the wire, so a\n* foreign source fails early and clearly rather than producing a broken\n* deploy with an undefined name.\n*/\nfunction paramName(binding) {\n\tconst { binding: bound } = binding;\n\tif (!isEnvParamSource(bound)) throw new Error(`param slot \"${binding.slot}\" of service \"${binding.serviceAddress}\" is bound to a source not created by envParam() — bind env-sourced params with envParam('NAME') from @prisma/composer-prisma-cloud.`);\n\treturn bound.payload.name;\n}\n/**\n* Finds the manifest entry for one service param slot. `serialize` calls this\n* only after confirming `buildConfig` resolved the slot to a `ParamSource`\n* (`isParamSource(value)`), so a miss here means `graph.params` and the\n* resolved `Config` have drifted — a Load invariant violation, surfaced\n* loudly rather than producing a pointer row with an undefined name.\n*/\nfunction paramBindingFor(bindings, serviceAddress, slot) {\n\tconst binding = bindings.find((b) => b.serviceAddress === serviceAddress && b.slot === slot);\n\tif (binding === void 0) throw new Error(`param slot \"${slot}\" of \"${serviceAddress}\" resolved to a source but has no bound entry in the manifest — Load should have recorded it.`);\n\treturn binding;\n}\n//#endregion\nexport { paramName as i, isEnvParamSource as n, paramBindingFor as r, envParam as t };\n\n//# sourceMappingURL=param-BTzY0ne5.mjs.map"],"mappings":";;;;;;;;;AASA,MAAM,4BAA4B,UAAU,OAAO,IAAI,kCAAkC,CAAC;AAC1F,MAAM,wBAAwB;AAC9B,MAAM,uCAAuC,IAAI,IAAI,CAAC,gBAAgB,qBAAqB,CAAC;;;;;;;;;AAS5F,SAAS,SAAS,MAAM;CACvB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,qFAAqF;CACxJ,IAAI,KAAK,WAAW,qBAAqB,GAAG,MAAM,IAAI,MAAM,kBAAkB,KAAK,wBAAwB,sBAAsB,2EAA2E;CAC5M,IAAI,qBAAqB,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,kBAAkB,KAAK,kBAAkB,CAAC,GAAG,oBAAoB,CAAC,CAAC,KAAK,OAAO,EAAE,4DAA4D;CACjM,OAAO,YAAY;GACjB,4BAA4B;EAC7B;CACD,CAAC;AACF;;AAEA,SAAS,kBAAkB,SAAS;CACnC,OAAO,OAAO,YAAY,YAAY,YAAY,QAAQ,UAAU,OAAO,CAAC,CAAC,+BAA+B;AAC7G;;AAEA,SAAS,iBAAiB,OAAO;CAChC,OAAO,cAAc,KAAK,KAAK,kBAAkB,MAAM,OAAO;AAC/D;;;;;;;;;AASA,SAAS,UAAU,SAAS;CAC3B,MAAM,EAAE,SAAS,UAAU;CAC3B,IAAI,CAAC,iBAAiB,KAAK,GAAG,MAAM,IAAI,MAAM,eAAe,QAAQ,KAAK,gBAAgB,QAAQ,eAAe,qIAAqI;CACtP,OAAO,MAAM,QAAQ;AACtB;;;;;;;;AAQA,SAAS,gBAAgB,UAAU,gBAAgB,MAAM;CACxD,MAAM,UAAU,SAAS,MAAM,MAAM,EAAE,mBAAmB,kBAAkB,EAAE,SAAS,IAAI;CAC3F,IAAI,YAAY,KAAK,GAAG,MAAM,IAAI,MAAM,eAAe,KAAK,QAAQ,eAAe,8FAA8F;CACjL,OAAO;AACR"}

package/dist/{preflight-names-CpJUd9ZA-BCU-W3cT.mjs → preflight-names-BPL-qsZF-BfoRgbgb.mjs}

@@ -1,6 +1,7 @@
-import { a as paramName, o as secretName, r as isEnvParamSource } from "./secret-BVGxqHxY-DYDfiULl.mjs";
+import { n as secretName } from "./secret-rz_ZqNeq-_xd97Jd9.mjs";
+import { i as paramName, n as isEnvParamSource } from "./param-BTzY0ne5-CW6ojZ3E.mjs";
 import { r as withConnectionRetry, t as normalizeSslMode } from "./pg-connection-CadPZuEK-CF3FsSQu.mjs";
-import { inputManifest, isSecretSource, paramManifest } from "@prisma/composer";
+import { paramManifest, provisionManifest } from "@prisma/composer";
 import { createManagementApiClient } from "@prisma/management-api-sdk";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
@@ -761,7 +762,7 @@ function mintKeyPair() {
 	};
 }
 //#endregion
-//#region ../../1-prisma-cloud/1-extensions/target/dist/preflight-names-CpJUd9ZA.mjs
+//#region ../../1-prisma-cloud/1-extensions/target/dist/preflight-names-BPL-qsZF.mjs
 const PRISMA_CLOUD_EXTENSION_ID = "@prisma/composer-prisma-cloud";
 var PrismaCloudContainer = class {
 	input;
@@ -1232,37 +1233,20 @@ function dedupedNames(entries) {
 	for (const entry of entries) if (!byName.has(entry.name)) byName.set(entry.name, entry);
 	return [...byName.values()];
 }
-/** Every `envSecret` leaf of one input binding: its platform name, found by the same dumb recursive descent the serializer uses (ADR-0042). */
-function collectSecretLeafNames(binding, serviceAddress, out) {
-	if (isSecretSource(binding)) {
-		out.push(secretName(binding, `an input-binding secret leaf of service "${serviceAddress}"`));
-		return;
-	}
-	if (typeof binding !== "object" || binding === null) return;
-	const members = Array.isArray(binding) ? binding : Object.values(binding);
-	for (const member of members) collectSecretLeafNames(member, serviceAddress, out);
-}
-/** Walks each service's input binding for `envSecret` leaves, and `graph.params` for env-sourced params (ADR-0042). */
+/** Walks `graph.secrets`/`graph.params` exactly as `runPreflight` did before this extraction. */
 function collectPreflightNames(graph) {
-	const secretEntries = [];
-	for (const { serviceAddress, binding } of inputManifest(graph)) {
-		const leafNames = [];
-		collectSecretLeafNames(binding, serviceAddress, leafNames);
-		for (const name of leafNames) secretEntries.push({
-			name,
-			serviceAddress
-		});
-	}
-	const envParams = dedupedNames(paramManifest(graph).filter((binding) => isEnvParamSource(binding.binding)).map((binding) => ({
-		name: paramName(binding),
-		serviceAddress: binding.serviceAddress
-	})));
 	return {
-		secrets: dedupedNames(secretEntries),
-		envParams
+		secrets: dedupedNames(provisionManifest(graph).map((binding) => ({
+			name: secretName(binding),
+			serviceAddress: binding.serviceAddress
+		}))),
+		envParams: dedupedNames(paramManifest(graph).filter((binding) => isEnvParamSource(binding.binding)).map((binding) => ({
+			name: paramName(binding),
+			serviceAddress: binding.serviceAddress
+		})))
 	};
 }
 //#endregion
 export { PrismaApiError as A, EnvironmentVariable as C, Bucket as D, packageComputeArtifact as E, callVoid as M, fromEnv as N, BucketKey as O, layer as P, Deployment as S, ServiceKeyProvider as T, Connection as _, PnMigrationProvider as a, COMPUTE_REGIONS as b, S3CredentialsProvider as c, deserialize as d, prismaCloudContainerOf as f, providers as g, Providers as h, PnMigration as i, call as j, ManagementClient as k, collectPreflightNames as l, mintKeyPair as m, PgWarm as n, PrismaCloudContainer as o, resolveTargetRef as p, PgWarmProvider as r, S3Credentials as s, PRISMA_CLOUD_EXTENSION_ID as t, containerDescriptor as u, Database as v, ServiceKey as w, ComputeService as x, Project as y };
 
-//# sourceMappingURL=preflight-names-CpJUd9ZA-BCU-W3cT.mjs.map
+//# sourceMappingURL=preflight-names-BPL-qsZF-BfoRgbgb.mjs.map