refactor: replace static buffer with handle-based DmmfBuffer API

Address review feedback from @jacek-prisma: replace the `static
DMMF_BUFFER: Mutex<Vec<u8>>` global state with a caller-owned
`DmmfBuffer` struct exported via `#[wasm_bindgen]`.

The new API:
- `get_dmmf_buffered(params)` → returns a `DmmfBuffer` handle
- `buffer.len()` → total byte count
- `buffer.read_chunk(offset, length)` → `Uint8Array` chunk
- `buffer.free()` → release WASM memory (auto-provided by wasm-bindgen)

Benefits:
- No implicit global state — each call returns an independent buffer
- Multiple concurrent buffers work correctly
- `FinalizationRegistry` provides automatic cleanup as safety net
- `Symbol.dispose` enables `using` syntax in modern JS/TS

Tested with Node.js integration test: 7/7 tests pass including
concurrent buffers, use-after-free detection, and OOB bounds checking.

Author: chris-tophers

prisma-schema-wasm/src/lib.rs

@@ -1,13 +1,6 @@
 use std::panic;
-use std::sync::Mutex;
 use wasm_bindgen::prelude::*;
 
-/// Global buffer for storing DMMF bytes when using the buffered API.
-/// This allows JS to read the DMMF in chunks via Uint8Array, bypassing
-/// V8's string length limit of ~536MB.
-/// See: https://github.com/prisma/prisma/issues/29111
-static DMMF_BUFFER: Mutex<Vec<u8>> = Mutex::new(Vec::new());
-
 #[wasm_bindgen]
 extern "C" {
     /// This function registers the reason for a Wasm panic via the
@@ -139,44 +132,69 @@ pub fn hover(schema_files: String, params: String) -> String {
     prisma_fmt::hover(schema_files, &params)
 }
 
-/// Serialize DMMF to an internal buffer and return the total byte count.
-/// Use `read_dmmf_chunk()` to read portions as Uint8Array, then `free_dmmf_buffer()` to release.
+/// Handle-based DMMF buffer that holds serialized DMMF JSON as bytes.
 ///
 /// This bypasses V8's string length limit (~536MB / 0x1fffffe8 chars) by keeping the
-/// serialized JSON as bytes in WASM linear memory. The JS side reads chunks as Uint8Array
-/// (which has no V8 string limit) and can use a streaming JSON parser.
+/// serialized JSON as bytes in WASM linear memory. The JS side reads chunks as `Uint8Array`
+/// (which has no V8 string limit) and can reassemble them with a streaming JSON parser.
+///
+/// Usage from JS:
+/// ```js
+/// const buffer = get_dmmf_buffered(params);
+/// const totalLen = buffer.len();
+/// const chunks = [];
+/// for (let offset = 0; offset < totalLen; offset += CHUNK_SIZE) {
+///     chunks.push(buffer.read_chunk(offset, CHUNK_SIZE));
+/// }
+/// buffer.free(); // release WASM memory
+/// ```
 ///
 /// See: https://github.com/prisma/prisma/issues/29111
 #[wasm_bindgen]
-pub fn get_dmmf_buffered(params: String) -> Result<usize, JsError> {
-    register_panic_hook();
-    let bytes = prisma_fmt::get_dmmf_bytes(params).map_err(|e| JsError::new(&e))?;
-    let len = bytes.len();
-    let mut buf = DMMF_BUFFER.lock().unwrap();
-    *buf = bytes;
-    Ok(len)
+pub struct DmmfBuffer {
+    data: Vec<u8>,
 }
 
-/// Read a chunk of the DMMF buffer as Uint8Array.
-/// `offset` is the byte offset, `length` is the number of bytes to read.
-/// Returns a Vec<u8> which wasm-bindgen converts to Uint8Array on the JS side.
 #[wasm_bindgen]
-pub fn read_dmmf_chunk(offset: usize, length: usize) -> Result<Vec<u8>, JsError> {
-    register_panic_hook();
-    let buf = DMMF_BUFFER.lock().unwrap();
-    if offset >= buf.len() {
-        return Err(JsError::new("Offset beyond buffer length"));
+impl DmmfBuffer {
+    /// Returns the total byte length of the serialized DMMF JSON.
+    pub fn len(&self) -> usize {
+        self.data.len()
+    }
+
+    /// Returns `true` if the buffer is empty.
+    pub fn is_empty(&self) -> bool {
+        self.data.is_empty()
+    }
+
+    /// Read a chunk of the buffer as `Uint8Array`.
+    /// `offset` is the byte offset, `length` is the max number of bytes to read.
+    /// Returns a `Vec<u8>` which wasm-bindgen converts to `Uint8Array` on the JS side.
+    pub fn read_chunk(&self, offset: usize, length: usize) -> Result<Vec<u8>, JsError> {
+        if offset >= self.data.len() {
+            return Err(JsError::new("Offset beyond buffer length"));
+        }
+        if length == 0 {
+            return Ok(Vec::new());
+        }
+        // Use saturating_add to avoid overflow on wasm32 (usize is 32-bit)
+        let end = std::cmp::min(offset.saturating_add(length), self.data.len());
+        Ok(self.data[offset..end].to_vec())
     }
-    let end = std::cmp::min(offset + length, buf.len());
-    Ok(buf[offset..end].to_vec())
 }
 
-/// Free the internal DMMF buffer. Call this after reading all chunks.
+/// Serialize DMMF to a caller-owned buffer and return it as a handle.
+/// Use `DmmfBuffer.read_chunk()` to read portions as `Uint8Array`, then
+/// `DmmfBuffer.free()` (auto-provided by wasm-bindgen) to release WASM memory.
+///
+/// This avoids implicit global state — each call returns an independent buffer.
+///
+/// See: https://github.com/prisma/prisma/issues/29111
 #[wasm_bindgen]
-pub fn free_dmmf_buffer() {
+pub fn get_dmmf_buffered(params: String) -> Result<DmmfBuffer, JsError> {
     register_panic_hook();
-    let mut buf = DMMF_BUFFER.lock().unwrap();
-    *buf = Vec::new();
+    let data = prisma_fmt::get_dmmf_bytes(params).map_err(|e| JsError::new(&e))?;
+    Ok(DmmfBuffer { data })
 }
 
 /// Trigger a panic inside the wasm module. This is only useful in development for testing panic