
Security News
pnpm 11.10 Hardens Registry Authentication to Block Token Redirection
pnpm 11.10 hardens registry auth to block token redirection, tightens pack-app and deploy, and makes the Rust port (v12) installable.
@prisma-next/framework-components
Advanced tools
Framework component types, assembly logic, and stack creation for Prisma Next
Internal package. This package is an implementation detail of
prisma-nextand is published only to support its runtime. Its API is unstable and may change without notice. Do not depend on this package directly; installprisma-nextinstead.
Framework component types, authoring logic, control stack assembly, and emission SPI for Prisma Next.
./components): Base descriptor and instance interfaces for framework components (family, target, adapter, driver, extension), pack refs, and type renderer system./authoring): Declarative authoring contribution types, template resolution, and validation for type constructors and field presets./codec): The cross-family Codec base type that SQL Codec and Mongo MongoCodec extend./control): Assembly functions that combine component descriptors into a unified ControlStack with derived state (codec imports, renderers, authoring contributions)./emission): Types for the emission pipeline — TargetFamilyHook, ValidationContext, GenerateContractTypesOptions, TypeRenderEntry, TypeRenderer, ParameterizedCodecDescriptor, and related types./execution): Execution-plane stack and instance interfaces./runtime): Abstract RuntimeCore<TPlan, TExec, TMiddleware> base class, RuntimeMiddleware interface, and the canonical runWithMiddleware orchestrator helper. Family runtimes (@prisma-next/sql-runtime, @prisma-next/mongo-runtime) extend RuntimeCore directly per ADR 204.import { ComponentMetadata, FamilyDescriptor, normalizeRenderer } from '@prisma-next/framework-components/components';
import { AuthoringContributions, instantiateAuthoringTypeConstructor } from '@prisma-next/framework-components/authoring';
import type { Codec } from '@prisma-next/framework-components/codec';
import { createControlStack, ControlStack } from '@prisma-next/framework-components/control';
import type { EmissionSpi } from '@prisma-next/framework-components/emission';
import { RuntimeCore, runWithMiddleware, type RuntimeMiddleware } from '@prisma-next/framework-components/runtime';
Codec interfaceThe base Codec interface lands on the seam between query-time methods (per-row, IO-relevant) and build-time methods (per-contract-load):
encode(value): Promise<TWire> and decode(wire): Promise<TInput> are required and Promise-returning at the public boundary, regardless of whether the codec body is synchronous or asynchronous. Family factories (codec() for SQL, mongoCodec() for Mongo) accept either sync or async author functions and lift sync ones to Promise-shaped methods, so authors write whichever shape is natural per method without annotations.encodeJson, decodeJson, and the optional renderOutputType are synchronous so validateContract and client construction stay synchronous.There is no runtime / kind / equivalent async marker on the interface and no TRuntime generic. The runtime always awaits the query-time methods. See ADR 204 — Single-Path Async Codec Runtime for the full design.
ctx)Codecs receive a second ctx options argument; you may ignore it. The runtime allocates one CodecCallContext per execute() call and threads the same reference to every codec dispatch site as a non-optional argument — when no signal is supplied the runtime still threads an empty {}, never undefined. The framework CodecCallContext is signal-only:
export interface CodecCallContext {
readonly signal?: AbortSignal;
}
The internal Codec interface declares the parameter as required:
encode(value: TInput, ctx: CodecCallContext): Promise<TWire>;
decode(wire: TWire, ctx: CodecCallContext): Promise<TInput>;
Codec authors who write (value) => … continue to compile via TypeScript's bivariance for trailing parameters; nothing at the author surface changes.
Family layers extend the context where they have a per-call concept that doesn't generalise. SQL declares SqlCodecCallContext extends CodecCallContext { column?: SqlColumnRef } (see @prisma-next/sql-relational-core); Mongo continues to use the framework type directly. Codec authors that take a (value, ctx) author signature can forward ctx.signal to network SDKs:
// Sketch — actual factory lives in a family package (codec() / mongoCodec()).
encode: async (v: string, ctx) =>
kms.encrypt({ plaintext: v }, { signal: ctx?.signal });
Aborts surface to the caller as RUNTIME.ABORTED with details.phase ∈ { 'encode', 'decode', 'stream' }. Codec bodies that ignore the signal complete in the background (cooperative cancellation). The runtimeAborted(phase, cause?) envelope helper and the raceAgainstAbort(work, signal, phase) race helper are exported from @prisma-next/framework-components/runtime.
See ADR 207 — Codec call context: per-query AbortSignal and column metadata for the full design.
This package sits in the core layer — below the tooling layer where family-specific emitters and control implementations live. SPI interfaces like EmissionSpi define the contract between framework orchestration code (control-plane emission, CLI) and family-specific implementations (SQL emitter, Mongo emitter).
By placing these interfaces in the core layer rather than alongside their implementations:
@prisma-next/contract) remains a true leaf in the foundation layer with zero framework-domain dependencies.This is the dependency inversion principle applied to package layering. The same pattern applies to component descriptors, control-plane types, and execution-plane types in this package.
See ADR 185 — SPI types live at the lowest consuming layer.
This package is the canonical source for framework component types, assembly logic, and emission SPI types. New code should import directly from @prisma-next/framework-components.
FAQs
Framework component types, assembly logic, and stack creation for Prisma Next
The npm package @prisma-next/framework-components receives a total of 16,442 weekly downloads. As such, @prisma-next/framework-components popularity was classified as popular.
We found that @prisma-next/framework-components demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.10 hardens registry auth to block token redirection, tightens pack-app and deploy, and makes the Rust port (v12) installable.

Security News
/Research
Socket uncovered 17 malicious npm and PyPI packages typosquatting Paysafe, Skrill, and Neteller SDKs to steal developer secrets.

Security News
Node.js is debating whether AI-driven security report volume warrants moving more vulnerability reports into public workflows.