alchemy 2.0.0-beta.65 → 2.0.0-beta.67

package/src/Prisma/Internal/ArchivePlatform.ts

@@ -0,0 +1,320 @@
+import * as Effect from "effect/Effect";
+import { createWriteStream } from "node:fs";
+import { lstat, opendir } from "node:fs/promises";
+import { posix } from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGzip } from "node:zlib";
+import { verifiedFileChunks, type VerifiedFile } from "./ArtifactFile.ts";
+
+/**
+ * Node/Bun boundary for filesystem operations that Effect's portable
+ * FileSystem service cannot currently express: incremental directory handles
+ * and streaming a verified file descriptor through gzip.
+ */
+
+export interface ArchiveTarFileEntry {
+  readonly type: "file";
+  readonly name: string;
+  readonly mode: number;
+  readonly file: VerifiedFile;
+}
+
+export interface ArchiveTarSymlinkEntry {
+  readonly type: "symlink";
+  readonly name: string;
+  readonly mode: number;
+  readonly linkname: string;
+}
+
+export type ArchiveTarEntry = ArchiveTarFileEntry | ArchiveTarSymlinkEntry;
+
+export interface SecureDirectoryEntry {
+  readonly name: string;
+  readonly type: "Directory" | "File" | "SymbolicLink" | "Other";
+}
+
+interface CloseableDirectoryHandle {
+  readonly close: () => void | Promise<void>;
+}
+
+export const closeDirectoryHandle = async (
+  handle: CloseableDirectoryHandle,
+) => {
+  try {
+    await handle.close();
+  } catch {
+    // Async directory iteration closes the handle when it exits. Ignore both
+    // Node's already-closed rejection and Bun's equivalent synchronous error.
+  }
+};
+
+const entryLimitError = (maxEntries: number) =>
+  new Error(
+    `Compute artifact exceeds the ${maxEntries} entry safety limit. Narrow the artifact directory or add ignore patterns.`,
+  );
+
+export const readDirectoryEntriesSecure = (options: {
+  readonly directory: string;
+  readonly relativePrefix: string;
+  readonly ignore: readonly RegExp[];
+  readonly entriesAlreadyObserved: number;
+  readonly maxEntries: number;
+}) =>
+  Effect.tryPromise({
+    try: async () => {
+      const before = await lstat(options.directory, { bigint: true });
+      if (!before.isDirectory() || before.isSymbolicLink()) {
+        throw new Error(
+          `Compute artifact directory changed before traversal: ${options.relativePrefix || "."}`,
+        );
+      }
+      const handle = await opendir(options.directory);
+      const entries: SecureDirectoryEntry[] = [];
+      let observedEntries = 0;
+      try {
+        for await (const entry of handle) {
+          if (entry.name.includes("\\")) {
+            throw new Error(
+              `Compute artifact entry contains an unsupported backslash: ${options.relativePrefix || "."}`,
+            );
+          }
+          const name = entry.name;
+          if (name.length === 0) continue;
+          const relativeName = options.relativePrefix
+            ? `${options.relativePrefix}/${name}`
+            : name;
+          observedEntries += 1;
+          if (
+            options.entriesAlreadyObserved + observedEntries >
+            options.maxEntries
+          ) {
+            throw entryLimitError(options.maxEntries);
+          }
+          if (options.ignore.some((pattern) => pattern.test(relativeName))) {
+            continue;
+          }
+          entries.push({
+            name,
+            type: entry.isSymbolicLink()
+              ? "SymbolicLink"
+              : entry.isDirectory()
+                ? "Directory"
+                : entry.isFile()
+                  ? "File"
+                  : "Other",
+          });
+        }
+      } finally {
+        await closeDirectoryHandle(handle);
+      }
+      const after = await lstat(options.directory, { bigint: true });
+      if (
+        !after.isDirectory() ||
+        after.isSymbolicLink() ||
+        before.dev !== after.dev ||
+        before.ino !== after.ino ||
+        before.mtimeNs !== after.mtimeNs ||
+        before.ctimeNs !== after.ctimeNs
+      ) {
+        throw new Error(
+          `Compute artifact directory changed during traversal: ${options.relativePrefix || "."}`,
+        );
+      }
+      return {
+        entries: entries.sort((a, b) =>
+          a.name < b.name ? -1 : a.name > b.name ? 1 : 0,
+        ),
+        observedEntries,
+      };
+    },
+    catch: (error) =>
+      error instanceof Error ? error : new Error(String(error)),
+  });
+
+export const writeCompressedArchiveSecure = (
+  archivePath: string,
+  entries: readonly ArchiveTarEntry[],
+  manifest: Uint8Array,
+  maxCompressedBytes: number,
+) =>
+  Effect.tryPromise({
+    try: (signal) => {
+      let compressedBytes = 0;
+      const compressedByteLimit = new Transform({
+        transform(chunk: Buffer, _encoding, callback) {
+          compressedBytes += chunk.byteLength;
+          if (compressedBytes > maxCompressedBytes) {
+            callback(
+              new Error(
+                `Prisma compute archive exceeds the ${maxCompressedBytes} byte compressed upload safety limit.`,
+              ),
+            );
+            return;
+          }
+          callback(null, chunk);
+        },
+      });
+      return pipeline(
+        Readable.from(tarChunks(entries, manifest), { objectMode: false }),
+        createGzip(),
+        compressedByteLimit,
+        createWriteStream(archivePath, { flags: "w", mode: 0o600 }),
+        { signal },
+      );
+    },
+    catch: (error) =>
+      error instanceof Error ? error : new Error(String(error)),
+  });
+
+export const isArchivedRegularFile = (
+  entries: readonly ArchiveTarEntry[],
+  entrypointName: string,
+) => {
+  const byName = new Map(entries.map((entry) => [entry.name, entry]));
+  const visited = new Set<string>();
+  let currentName = entrypointName;
+  while (!visited.has(currentName)) {
+    visited.add(currentName);
+    const entry = byName.get(currentName);
+    if (entry?.type === "file") return true;
+    if (entry?.type !== "symlink") return false;
+    const target = posix.normalize(
+      posix.join(posix.dirname(currentName), entry.linkname),
+    );
+    if (target === ".." || target.startsWith("../") || target.startsWith("/")) {
+      return false;
+    }
+    currentName = target;
+  }
+  return false;
+};
+
+async function* tarChunks(
+  entries: readonly ArchiveTarEntry[],
+  manifest: Uint8Array,
+): AsyncGenerator<Uint8Array> {
+  for (const entry of entries) {
+    if (entry.type === "symlink") {
+      yield createHeader({
+        name: entry.name,
+        mode: entry.mode,
+        size: 0,
+        type: "symlink",
+        linkname: entry.linkname,
+      });
+      continue;
+    }
+
+    yield createHeader({
+      name: entry.name,
+      mode: entry.mode,
+      size: entry.file.size,
+      type: "file",
+    });
+    let emitted = 0;
+    for await (const chunk of verifiedFileChunks(entry.file)) {
+      emitted += chunk.byteLength;
+      yield chunk;
+    }
+    if (emitted !== entry.file.size) {
+      throw new Error(
+        `Compute artifact file '${entry.name}' changed while the archive was being created.`,
+      );
+    }
+    const padding = paddingLength(entry.file.size);
+    if (padding > 0) yield new Uint8Array(padding);
+  }
+
+  yield createHeader({
+    name: "compute.manifest.json",
+    mode: 0o644,
+    size: manifest.byteLength,
+    type: "file",
+  });
+  yield manifest;
+  const manifestPadding = paddingLength(manifest.byteLength);
+  if (manifestPadding > 0) yield new Uint8Array(manifestPadding);
+  yield new Uint8Array(1024);
+}
+
+const createHeader = (entry: {
+  readonly name: string;
+  readonly mode: number;
+  readonly size: number;
+  readonly type: "file" | "symlink";
+  readonly linkname?: string;
+}) => {
+  const header = new Uint8Array(512);
+  const { name, prefix } = splitTarName(entry.name);
+  if (entry.linkname && byteLength(entry.linkname) > 100) {
+    throw new Error(
+      `Archive symlink target is too long for tar header: ${entry.linkname}`,
+    );
+  }
+
+  writeString(header, 0, 100, name);
+  writeOctal(header, 100, 8, entry.mode);
+  writeOctal(header, 108, 8, 0);
+  writeOctal(header, 116, 8, 0);
+  writeOctal(header, 124, 12, entry.size);
+  writeOctal(header, 136, 12, 0);
+  header.fill(0x20, 148, 156);
+  writeString(header, 156, 1, entry.type === "symlink" ? "2" : "0");
+  if (entry.linkname) writeString(header, 157, 100, entry.linkname);
+  writeString(header, 257, 6, "ustar");
+  writeString(header, 263, 2, "00");
+  writeString(header, 265, 32, "alchemy");
+  writeString(header, 297, 32, "alchemy");
+  if (prefix) writeString(header, 345, 155, prefix);
+
+  const checksum = header.reduce((sum, value) => sum + value, 0);
+  writeChecksum(header, checksum);
+  return header;
+};
+
+const splitTarName = (name: string): { name: string; prefix?: string } => {
+  if (byteLength(name) <= 100) return { name };
+  const slashIndexes = Array.from(name.matchAll(/\//g), (match) => match.index);
+  for (const index of slashIndexes.reverse()) {
+    if (index === undefined) continue;
+    const prefix = name.slice(0, index);
+    const suffix = name.slice(index + 1);
+    if (byteLength(prefix) <= 155 && byteLength(suffix) <= 100) {
+      return { name: suffix, prefix };
+    }
+  }
+  throw new Error(`Archive path is too long for tar header: ${name}`);
+};
+
+const byteLength = (value: string) => new TextEncoder().encode(value).length;
+
+const writeString = (
+  buffer: Uint8Array,
+  offset: number,
+  length: number,
+  value: string,
+) => {
+  const bytes = new TextEncoder().encode(value);
+  buffer.set(bytes.slice(0, length), offset);
+};
+
+const writeOctal = (
+  buffer: Uint8Array,
+  offset: number,
+  length: number,
+  value: number,
+) => {
+  const text = value
+    .toString(8)
+    .padStart(length - 1, "0")
+    .slice(0, length - 1);
+  writeString(buffer, offset, length, `${text}\0`);
+};
+
+const writeChecksum = (buffer: Uint8Array, checksum: number) => {
+  const text = checksum.toString(8).padStart(6, "0").slice(0, 6);
+  writeString(buffer, 148, 8, `${text}\0 `);
+};
+
+const paddingLength = (size: number) => (512 - (size % 512)) % 512;

package/src/Prisma/Internal/ArtifactFile.ts

@@ -0,0 +1,242 @@
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import { createHash } from "node:crypto";
+import { constants, type BigIntStats } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+
+const READ_CHUNK_BYTES = 64 * 1024;
+
+export interface VerifiedFile {
+  readonly _tag: "VerifiedFile" | "ArtifactFile";
+  readonly path: string;
+  readonly size: number;
+  readonly mode: number;
+  readonly identity: {
+    readonly dev: string;
+    readonly ino: string;
+    readonly size: string;
+    readonly mtimeNs: string;
+    readonly ctimeNs: string;
+  };
+}
+
+export interface ArtifactFile extends VerifiedFile {
+  readonly _tag: "ArtifactFile";
+  readonly sha256: string;
+  readonly cleanup: Effect.Effect<void>;
+}
+
+const toError = (message: string, cause: unknown) =>
+  new Error(message, { cause });
+
+const isSameIdentity = (
+  stat: BigIntStats,
+  identity: VerifiedFile["identity"],
+) =>
+  stat.isFile() &&
+  stat.dev.toString() === identity.dev &&
+  stat.ino.toString() === identity.ino &&
+  stat.size.toString() === identity.size &&
+  stat.mtimeNs.toString() === identity.mtimeNs &&
+  stat.ctimeNs.toString() === identity.ctimeNs;
+
+const identityFrom = (stat: BigIntStats): VerifiedFile["identity"] => ({
+  dev: stat.dev.toString(),
+  ino: stat.ino.toString(),
+  size: stat.size.toString(),
+  mtimeNs: stat.mtimeNs.toString(),
+  ctimeNs: stat.ctimeNs.toString(),
+});
+
+const validateLimit = (maxBytes: number) => {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new Error("Artifact maxBytes must be a positive safe integer.");
+  }
+};
+
+const validateStat = (
+  stat: BigIntStats,
+  maxBytes: number,
+  description: string,
+  allowEmpty: boolean,
+) => {
+  if (!stat.isFile()) {
+    throw new Error(`${description} must be a regular file.`);
+  }
+  if (!allowEmpty && stat.size <= 0n) {
+    throw new Error(`${description} must be non-empty.`);
+  }
+  if (
+    stat.size > BigInt(maxBytes) ||
+    stat.size > BigInt(Number.MAX_SAFE_INTEGER)
+  ) {
+    throw new Error(
+      `${description} exceeds the ${maxBytes} byte upload safety limit.`,
+    );
+  }
+};
+
+async function* readVerifiedChunks(
+  artifact: VerifiedFile,
+): AsyncGenerator<Uint8Array> {
+  const handle = await open(
+    artifact.path,
+    constants.O_RDONLY | constants.O_NOFOLLOW,
+  );
+  try {
+    const before = await handle.stat({ bigint: true });
+    if (!isSameIdentity(before, artifact.identity)) {
+      throw new Error(
+        "Prisma deployment artifact changed after it was validated; rebuild or reselect the artifact before deploying.",
+      );
+    }
+
+    let remaining = artifact.size;
+    while (remaining > 0) {
+      const buffer = Buffer.allocUnsafe(Math.min(READ_CHUNK_BYTES, remaining));
+      const { bytesRead } = await handle.read(
+        buffer,
+        0,
+        buffer.byteLength,
+        null,
+      );
+      if (bytesRead === 0) {
+        throw new Error(
+          "Prisma deployment artifact was truncated while it was being read.",
+        );
+      }
+      remaining -= bytesRead;
+      yield new Uint8Array(buffer.buffer, buffer.byteOffset, bytesRead);
+    }
+
+    const trailing = Buffer.allocUnsafe(1);
+    const { bytesRead: trailingBytes } = await handle.read(
+      trailing,
+      0,
+      trailing.byteLength,
+      null,
+    );
+    const after = await handle.stat({ bigint: true });
+    if (trailingBytes !== 0 || !isSameIdentity(after, artifact.identity)) {
+      throw new Error(
+        "Prisma deployment artifact changed while it was being read; rebuild or reselect the artifact before deploying.",
+      );
+    }
+  } finally {
+    await handle.close();
+  }
+}
+
+const inspectVerifiedFilePromise = async (
+  inputPath: string,
+  maxBytes: number,
+  options?: {
+    readonly allowEmpty?: boolean;
+    readonly description?: string;
+  },
+) => {
+  validateLimit(maxBytes);
+  const description = options?.description ?? "File";
+  const inputStat = await lstat(inputPath, { bigint: true });
+  if (inputStat.isSymbolicLink()) {
+    throw new Error(
+      `${description} must not be a symbolic link; provide the regular file directly.`,
+    );
+  }
+  validateStat(inputStat, maxBytes, description, options?.allowEmpty ?? false);
+  const canonicalPath = await realpath(inputPath);
+  const stat = await lstat(canonicalPath, { bigint: true });
+  validateStat(stat, maxBytes, description, options?.allowEmpty ?? false);
+  if (!isSameIdentity(stat, identityFrom(inputStat))) {
+    throw new Error(
+      `${description} changed while it was being validated; retry with a stable file.`,
+    );
+  }
+  return {
+    _tag: "VerifiedFile" as const,
+    path: canonicalPath,
+    size: Number(stat.size),
+    mode: Number(stat.mode),
+    identity: identityFrom(stat),
+  } satisfies VerifiedFile;
+};
+
+export const inspectVerifiedFile = (
+  inputPath: string,
+  maxBytes: number,
+  options?: {
+    readonly allowEmpty?: boolean;
+    readonly description?: string;
+  },
+) =>
+  Effect.tryPromise({
+    try: () => inspectVerifiedFilePromise(inputPath, maxBytes, options),
+    catch: (cause) =>
+      cause instanceof Error
+        ? cause
+        : toError("Failed to validate file.", cause),
+  });
+
+export const inspectArtifactFile = (
+  inputPath: string,
+  maxBytes: number,
+  options?: {
+    readonly cleanup?: Effect.Effect<void>;
+    readonly description?: string;
+  },
+) =>
+  Effect.tryPromise({
+    try: async (signal) => {
+      const description = options?.description ?? "Prisma deployment artifact";
+      const verified = await inspectVerifiedFilePromise(inputPath, maxBytes, {
+        description,
+      });
+      const hash = createHash("sha256");
+      for await (const chunk of readVerifiedChunks(verified)) {
+        if (signal.aborted) {
+          throw new Error("Prisma deployment artifact validation was aborted.");
+        }
+        hash.update(chunk);
+      }
+      return {
+        ...verified,
+        _tag: "ArtifactFile" as const,
+        sha256: hash.digest("hex"),
+        cleanup: options?.cleanup ?? Effect.void,
+      } satisfies ArtifactFile;
+    },
+    catch: (cause) =>
+      cause instanceof Error
+        ? cause
+        : toError("Failed to validate Prisma deployment artifact.", cause),
+  });
+
+export const artifactFileStream = (artifact: ArtifactFile) =>
+  Stream.fromAsyncIterable(readVerifiedChunks(artifact), (cause) =>
+    cause instanceof Error
+      ? cause
+      : toError("Failed to stream Prisma deployment artifact.", cause),
+  );
+
+export const verifiedFileChunks = (file: VerifiedFile) =>
+  readVerifiedChunks(file);
+
+export const readArtifactFile = (artifact: ArtifactFile) =>
+  Effect.gen(function* () {
+    const bytes = new Uint8Array(artifact.size);
+    let offset = 0;
+    yield* Stream.runForEach(artifactFileStream(artifact), (chunk) =>
+      Effect.sync(() => {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+      }),
+    );
+    if (offset !== artifact.size) {
+      return yield* Effect.fail(
+        new Error(
+          "Prisma deployment artifact length changed while it was being read.",
+        ),
+      );
+    }
+    return bytes;
+  });

package/src/Prisma/Internal/ArtifactUpload.ts

@@ -0,0 +1,86 @@
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import type * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { artifactFileStream, type ArtifactFile } from "./ArtifactFile.ts";
+import { PrismaUploadClient } from "./HttpClient.ts";
+
+const ARTIFACT_UPLOAD_TIMEOUT = Duration.minutes(5);
+const UPLOAD_ERROR_BODY_BYTES = 64 * 1024;
+
+export const executeArtifactUpload = (
+  uploadUrl: string,
+  artifact: Uint8Array | ArtifactFile,
+  contentType: string,
+) =>
+  Effect.gen(function* () {
+    // Prefer the Prisma-scoped upload client (node transport, provided by
+    // live wiring — presigned upload URLs need explicit Content-Length on
+    // file-backed bodies); fall back to the ambient client so tests can
+    // stub uploads through `HttpClient.HttpClient`.
+    const uploadClient = yield* Effect.serviceOption(PrismaUploadClient);
+    const http = Option.isSome(uploadClient)
+      ? uploadClient.value
+      : yield* HttpClient.HttpClient;
+    const request = HttpClientRequest.put(uploadUrl).pipe(
+      artifact instanceof Uint8Array
+        ? HttpClientRequest.bodyUint8Array(artifact, contentType)
+        : HttpClientRequest.bodyStream(artifactFileStream(artifact), {
+            contentType,
+            contentLength: artifact.size,
+          }),
+    );
+    const responseOption = yield* http.execute(request).pipe(
+      Effect.mapError(
+        () =>
+          new Error(
+            "Prisma artifact upload transport failed before a response was received.",
+          ),
+      ),
+      Effect.timeoutOption(ARTIFACT_UPLOAD_TIMEOUT),
+    );
+    if (Option.isNone(responseOption)) {
+      return yield* Effect.fail(
+        new Error("Prisma artifact upload timed out after 5 minutes."),
+      );
+    }
+    const response = responseOption.value;
+    if (response.status < 200 || response.status >= 300) {
+      const bodyBytesOption = yield* readResponsePrefixByteCount(
+        response,
+        UPLOAD_ERROR_BODY_BYTES,
+      ).pipe(
+        Effect.timeoutOption(Duration.seconds(2)),
+        Effect.catch(() => Effect.succeed(Option.none<number>())),
+      );
+      const diagnostic = Option.match(bodyBytesOption, {
+        onNone: () => "diagnostic body unavailable",
+        onSome: (bytes) => `diagnostic body prefix: ${bytes} bytes`,
+      });
+      return yield* Effect.fail(
+        new Error(
+          `Prisma artifact upload failed (HTTP ${response.status}; ${diagnostic}).`,
+        ),
+      );
+    }
+  });
+
+const readResponsePrefixByteCount = (
+  response: HttpClientResponse.HttpClientResponse,
+  limit: number,
+) =>
+  Effect.gen(function* () {
+    let bytes = 0;
+    yield* Stream.runForEachWhile(response.stream, (chunk) =>
+      Effect.sync(() => {
+        const remaining = limit - bytes;
+        if (remaining <= 0) return false;
+        bytes += Math.min(chunk.byteLength, remaining);
+        return bytes < limit;
+      }),
+    );
+    return bytes;
+  });

package/src/Prisma/Internal/BundlePaths.ts

@@ -0,0 +1,28 @@
+import * as Effect from "effect/Effect";
+
+/** Validate an untrusted bundler output path before writing it to disk. */
+export const normalizeBundleFilePath = (input: string) =>
+  Effect.gen(function* () {
+    const normalized = input.replaceAll("\\", "/");
+    if (
+      normalized.length === 0 ||
+      normalized.startsWith("/") ||
+      /^[a-zA-Z]:\//.test(normalized)
+    ) {
+      return yield* Effect.fail(
+        new Error(`Invalid Compute bundle output path: ${input}`),
+      );
+    }
+    const segments = normalized.split("/");
+    if (
+      segments.some(
+        (segment) =>
+          segment.length === 0 || segment === "." || segment === "..",
+      )
+    ) {
+      return yield* Effect.fail(
+        new Error(`Invalid Compute bundle output path: ${input}`),
+      );
+    }
+    return segments.join("/");
+  });

package/src/Prisma/Internal/CleanupFailure.ts

@@ -0,0 +1,17 @@
+/**
+ * Preserve both the reconcile failure and a subsequent cleanup failure.
+ *
+ * Cleanup failures are operationally important: suppressing one can leave an
+ * untracked cloud resource behind with no indication of how to remove it.
+ */
+export const aggregateCleanupFailure = (
+  resource: "App" | "deployment",
+  resourceId: string,
+  route: string,
+  originalError: unknown,
+  cleanupError: unknown,
+) =>
+  new AggregateError(
+    [originalError, cleanupError],
+    `Failed to clean up Prisma ${resource} '${resourceId}' after reconcile failed. The resource may be orphaned. Manual cleanup: DELETE ${route}.`,
+  );