@prisma/composer 0.20.0-dev.7 → 0.20.0-dev.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prisma/composer",
-  "version": "0.20.0-dev.7",
+  "version": "0.20.0-dev.9",
   "type": "module",
   "description": "Prisma Composer — build a Prisma App by composing Modules. Core authoring, deploy pipeline, and the service-rpc/node/nextjs authoring surfaces. The `prisma-composer` CLI lives in @prisma/composer-cli.",
   "exports": {
@@ -40,15 +40,15 @@
     "@prisma/management-api-sdk": "^1.60.0"
   },
   "devDependencies": {
-    "@internal/assemble": "0.20.0-dev.7",
-    "@internal/cli": "0.20.0-dev.7",
-    "@internal/core": "0.20.0-dev.7",
-    "@internal/foundation": "0.20.0-dev.7",
-    "@internal/lowering": "0.20.0-dev.7",
-    "@internal/nextjs": "0.20.0-dev.7",
-    "@internal/node": "0.20.0-dev.7",
-    "@internal/service-rpc": "0.20.0-dev.7",
-    "@internal/tsdown-config": "0.20.0-dev.7",
+    "@internal/assemble": "0.20.0-dev.9",
+    "@internal/cli": "0.20.0-dev.9",
+    "@internal/core": "0.20.0-dev.9",
+    "@internal/foundation": "0.20.0-dev.9",
+    "@internal/lowering": "0.20.0-dev.9",
+    "@internal/nextjs": "0.20.0-dev.9",
+    "@internal/node": "0.20.0-dev.9",
+    "@internal/service-rpc": "0.20.0-dev.9",
+    "@internal/tsdown-config": "0.20.0-dev.9",
     "@types/node": "^26.0.1",
     "tsdown": "^0.22.7",
     "typescript": "^6.0.3"

package/skills/prisma-composer-core-concepts/SKILL.md

@@ -2,7 +2,7 @@
 name: prisma-composer-core-concepts
 metadata:
   library: "@prisma/composer"
-  library_version: "0.20.0-dev.7"
+  library_version: "0.20.0-dev.9"
   version: 2026.9.1
 description: >-
   Use when deploying or managing an app that uses Prisma Composer
@@ -369,12 +369,13 @@ that surprise:
    service it calls.
 5. Windows isn't supported yet.
 
-Local Postgres needs `@prisma/dev` in the devDependencies of the project where
-Composer runs (the root package in a monorepo). Prisma 8 does not ship it.
-Composer resolves the app's copy first, then checks relative to the exported
-`prisma/package.json` for installations that supply it there. If neither resolves,
-add `@prisma/dev`, not another copy of `prisma`; leave database bindings unchanged.
-Cloud deployment and local apps without Postgres do not need this runtime.
+Local Postgres runs on `@prisma/dev`, which `@prisma/composer-prisma-cloud`
+declares as its own dependency (`^0.25.2`) and resolves from its own package.
+Nothing needs adding to the app, and an app's own `@prisma/dev` (for example the
+`^0.20.0` alchemy pulls in, which crashes on any Postgres message over 64 KiB) is
+ignored. If the emulator reports that `@prisma/dev` did not resolve, the install
+is broken: reinstall dependencies rather than adding `@prisma/dev` or `prisma`.
+Cloud deployment and local apps without Postgres never load this runtime.
 
 ## Testing is an environment seam
 
@@ -421,7 +422,7 @@ provision exactly like your own:
 | `cron` from `/cron` | An always-on scheduler (it holds Compute's keep-awake guard) firing your schedule at your runner service; `input` on `cron()` binds the runner's input schema | nothing |
 | `storage` from `/storage` | An S3-backed blob store (own Postgres + minted credentials) | `store` |
 | `streams` from `/streams` | Durable append-only event streams over a `store` | `streams` |
-| `auth` from `/auth` | Signup, login, sessions, and JWT verification (Better Auth in one service, own database) | `api`, `session`, `admin` |
+| `auth` from `/auth` | Signup, login, sessions, and JWT verification (Better Auth in one service, own database). `auth({ signUp: 'closed' })` makes Better Auth refuse self-service sign-up; operator-created accounts go through `admin.createUser({ email, name, password?, emailVerified? })` from a service wired to `admin` (it throws on a duplicate email and sends no mail) | `api`, `session`, `admin` |
 | `email` from `/email` | Transactional email with a stored outbox (own service and database) | `send`, `outbox` |
 
 `bucket()` (imported alongside `rawPostgres`) is a raw S3-compatible bucket:
@@ -476,6 +477,15 @@ today the blocks above plus your own Modules are the whole set, so verify a
    contract columns compiles and deploys, then fails on the first timestamp
    read. Provide the global at the server entry
    (`import 'temporal-polyfill/global'`) or use string column types.
+10. **The auth module's `/api/auth/*` returns `403 MISSING_OR_NULL_ORIGIN`
+    to a Node script.** It is the browser surface: Better Auth origin-checks
+    any request carrying a cookie, an `Origin`/`Referer`, or a `Sec-Fetch-*`
+    header, and Node's built-in `fetch` sends `Sec-Fetch-Mode` on every
+    request (the same `curl` passes). Send an `Origin` equal to the module's
+    `baseUrl`, or, for provisioning, don't use that surface at all: call
+    `admin.createUser` from a service wired to the `admin` port. A deployed
+    stack's rpc ports are reachable only from inside its graph, so the app
+    exposes its own operator route that makes that call.
 
 ## What Composer doesn't do yet