@prisma/composer-cli 0.25.0-dev.5 → 0.26.0-dev.1

package/dist/pipeline-DAYhea3J-BEnHHWp8.mjs

@@ -1,979 +0,0 @@
-import { a as configFileMissing, c as CliStructuredError, i as checkComposerConfig, l as InternalError, u as blindCast } from "./result-D9vIrN7i.mjs";
-import * as mod from "node:module";
-import * as fs from "node:fs";
-import { existsSync } from "node:fs";
-import * as path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-//#region ../../0-framework/1-core/core/dist/graph-BfKAg2Ap.mjs
-/** The reserved name of a resource's single anonymous output port. Rejected as a user-declared port name (node.ts). */
-const RESOURCE_OUT_PORT = "$out";
-/**
-* Thrown by Load when the graph is malformed. Structured at origin
-* (base-type rule 6): one type-level code covers every raise site until a
-* finer per-site taxonomy is carved out. The `name` stays
-* `CliStructuredError` — structural recognition depends on it.
-*/
-var LoadError = class extends CliStructuredError {
-	constructor(message) {
-		super("COMPOSE.GRAPH_INVALID", message);
-	}
-};
-/**
-* Core model: node types and the factories that construct them, plain frozen
-* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).
-*/
-const NODE = Symbol.for("prisma:node");
-blindCast(Symbol.for("prisma:secret-need"));
-const SECRET_SOURCE = blindCast(Symbol.for("prisma:secret-source"));
-/** True if `value` is a secret source (an `envSecret` result or a forwarded ctx.secrets ref). */
-function isSecretSource(value) {
-	return typeof value === "object" && value !== null && blindCast(value)[SECRET_SOURCE] === true;
-}
-blindCast(Symbol.for("prisma:provision-need"));
-const PARAM_SOURCE = blindCast(Symbol.for("prisma:param-source"));
-blindCast(Symbol.for("prisma:param-need"));
-/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */
-function isParamSource(value) {
-	return typeof value === "object" && value !== null && blindCast(value)[PARAM_SOURCE] === true;
-}
-/**
-* Core's grammar for every name that becomes a config-key segment —
-* addresses, input/param/secret names: ASCII letters and digits only.
-* Conservative by design so any target medium — POSIX env-var keys
-* included — can uppercase and "_"-join segments without escaping.
-*/
-function isConfigKeySegment(name) {
-	return /^[A-Za-z0-9]+$/.test(name);
-}
-/**
-* True if `value` was constructed by this module's factories. Checks the
-* brand only, never a prototype — a graph may mix nodes from a different
-* installed copy of core (dual-package hazard).
-*/
-function isNode(value) {
-	return typeof value === "object" && value !== null && value[NODE] === true;
-}
-/**
-* Stable topological sort: every edge's `from` precedes its `to` in the
-* result. Ties (nodes with no ordering constraint between them) keep their
-* relative order from `nodes` — so a graph already authored producer-first
-* comes out byte-identical to its pre-sort layout; only a graph that
-* genuinely needs reordering (e.g. a module wired via a forged ref pointing at a
-* not-yet-provisioned producer) actually moves. A Kahn's-algorithm variant
-* that always picks the ready node with the smallest original index. Edges
-* whose endpoint falls outside `nodes` (e.g. a service-root's input edges
-* targeting the root, which is appended separately) are ignored. Cycles
-* cannot reach here: `assertDependencyDag` already rejects them for
-* dependency edges, and input edges never cycle.
-*/
-function topoSort(nodes, edges) {
-	const byId = new Map(nodes.map((n) => [n.id, n]));
-	const indexOf = new Map(nodes.map((n, i) => [n.id, i]));
-	const indegree = new Map(nodes.map((n) => [n.id, 0]));
-	const successors = /* @__PURE__ */ new Map();
-	for (const edge of edges) {
-		if (!byId.has(edge.from) || !byId.has(edge.to)) continue;
-		const targets = successors.get(edge.from) ?? [];
-		targets.push(edge.to);
-		successors.set(edge.from, targets);
-		indegree.set(edge.to, (indegree.get(edge.to) ?? 0) + 1);
-	}
-	const ready = new Set(nodes.filter((n) => indegree.get(n.id) === 0).map((n) => n.id));
-	const order = [];
-	while (ready.size > 0) {
-		let next;
-		let bestIndex = Number.POSITIVE_INFINITY;
-		for (const id of ready) {
-			const index = indexOf.get(id) ?? Number.POSITIVE_INFINITY;
-			if (index < bestIndex) {
-				bestIndex = index;
-				next = id;
-			}
-		}
-		if (next === void 0) break;
-		ready.delete(next);
-		order.push(next);
-		for (const target of successors.get(next) ?? []) {
-			const remaining = (indegree.get(target) ?? 0) - 1;
-			indegree.set(target, remaining);
-			if (remaining === 0) ready.add(target);
-		}
-	}
-	if (order.length !== nodes.length) throw new InternalError(`topological sort processed ${order.length} of ${nodes.length} nodes — the graph contains a cycle that slipped past the DAG validation.`);
-	return order.map((id) => byId.get(id)).filter((n) => n !== void 0);
-}
-/**
-* The declared boundary ports of a module or service node at `id`: dep slots
-* as `in` ports (contractKind = the slot's `type`), exposed contracts as
-* `out` ports (contractKind = the contract's `kind`). A resource's one
-* `$out` port is recorded at its provision site instead (load-module.ts).
-*/
-function boundaryPortsOf(id, node) {
-	const ports = [];
-	const slots = node.kind === "module" ? node.deps : node.inputs;
-	for (const [name, slot] of Object.entries(slots)) {
-		const type = typeof slot === "object" && slot !== null && "type" in slot && typeof slot.type === "string" ? slot.type : void 0;
-		ports.push({
-			node: id,
-			direction: "in",
-			name,
-			contractKind: type
-		});
-	}
-	for (const [name, contract] of Object.entries(node.expose ?? {})) {
-		const kind = typeof contract === "object" && contract !== null && "kind" in contract && typeof contract.kind === "string" ? contract.kind : void 0;
-		ports.push({
-			node: id,
-			direction: "out",
-			name,
-			contractKind: kind
-		});
-	}
-	return ports;
-}
-function serviceInputs(service, serviceId) {
-	if (typeof service.inputs !== "object" || service.inputs === null) throw new LoadError(`Service "${serviceId}" has no inputs map.`);
-	const nodes = [];
-	const edges = [];
-	for (const [input, value] of Object.entries(service.inputs)) {
-		const kind = isNode(value) ? value.kind : void 0;
-		if (kind === "resource") throw new LoadError(`Input "${input}" of "${serviceId}" is a resource node — a resource is provisioned by the composing module, never created for a service that mentions it. Declare the input as a dependency (the pack's dependency factory) and wire the module-provisioned resource's ref into it.`);
-		if (kind !== "dependency") throw new LoadError(`Input "${input}" of "${serviceId}" is not a branded dependency end (construct it with the dependency() factory).`);
-		if (value.type.length === 0) throw new LoadError(`Input "${input}" of "${serviceId}" has an empty node type.`);
-		const id = `${serviceId}.${input}`;
-		nodes.push({
-			id,
-			parent: serviceId,
-			node: value
-		});
-		edges.push({
-			from: id,
-			to: serviceId,
-			input,
-			kind: "input"
-		});
-	}
-	return {
-		nodes,
-		edges
-	};
-}
-function loadService(root, rootId) {
-	for (const [input, value] of Object.entries(root.inputs)) if (isNode(value) && value.kind === "dependency") throw new LoadError(`Service "${rootId}" has an unwired dependency input "${input}" — this service is composed by a module; deploy the module instead of loading "${rootId}" directly.`);
-	if (root.inputSchema !== void 0) throw new LoadError(`Service "${rootId}" declares an input schema but is being loaded directly — a lone service has no enclosing scope to bind its input. Compose it inside a module whose provision() call binds \`input: { … }\` (ADR-0042).`);
-	const rootGraphNode = {
-		id: rootId,
-		parent: void 0,
-		node: root
-	};
-	const { nodes, edges } = serviceInputs(root, rootId);
-	return {
-		root: rootGraphNode,
-		nodes: [...topoSort(nodes, edges), rootGraphNode],
-		edges,
-		ports: boundaryPortsOf(rootId, root),
-		authoredEdges: [],
-		inputBindings: [],
-		params: []
-	};
-}
-/**
-* Brands a ref-port with the AUTHORED endpoint it stands for — which port of
-* which node the author wired, before any forwarding chain resolves. Read
-* only by `authoredSourceOf`; `__providerId` keeps carrying the resolved
-* producer for the flat (post-dereference) edges.
-*/
-const AUTHORED_PORT = Symbol("prisma:authored-port");
-/** The authored out-port brand carried by `ref`, if any. */
-function authoredPortOf(ref) {
-	if (typeof ref !== "object" || ref === null) return void 0;
-	const brand = blindCast(ref)[AUTHORED_PORT];
-	if (typeof brand !== "object" || brand === null) return void 0;
-	const { node, name } = blindCast(brand);
-	return typeof node === "string" && typeof name === "string" ? {
-		node,
-		name
-	} : void 0;
-}
-/**
-* Builds the ref a provision() call hands back: the id (so a producer with no
-* exposed ports — or an untyped slot — can still be wired wholesale) plus one
-* ref-port per exposed contract, each the contract's own runtime value (so
-* its `satisfies()` still works) tagged with the provider's id.
-*/
-function refFor(id, service) {
-	const ports = {};
-	for (const [port, contract] of Object.entries(service.expose ?? {})) ports[port] = {
-		...contract,
-		__providerId: id,
-		[AUTHORED_PORT]: {
-			node: id,
-			name: port
-		}
-	};
-	return blindCast({
-		id,
-		...ports
-	});
-}
-/**
-* The resource variant of refFor: a resource has exactly one port — the
-* contract it provides — flattened onto the ref itself, tagged with the
-* provider id. `id` and the authored brand are written last so a hostile
-* contract value cannot clobber them.
-*/
-function refForResource(id, resource) {
-	return blindCast({
-		...resource.provides,
-		__providerId: id,
-		id,
-		[AUTHORED_PORT]: {
-			node: id,
-			name: RESOURCE_OUT_PORT
-		}
-	});
-}
-/** A wired value's producer id: a ref-port's `__providerId`, or a bare ref's `id`. */
-function producerIdOf(ref) {
-	if (typeof ref !== "object" || ref === null) return void 0;
-	if ("__providerId" in ref && typeof ref.__providerId === "string") return ref.__providerId;
-	if ("id" in ref && typeof ref.id === "string") return ref.id;
-}
-/**
-* Brands each `ctx.inputs` entry with the input key it stands for (see
-* flatten): diagnostic only — usage attribution relies on the per-key object
-* identity the branding copy creates, never on reading this back.
-*/
-const MODULE_INPUT_KEY = Symbol("prisma:module-input-key");
-/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.secrets` forwarding channel. */
-const MODULE_SECRET_KEY = Symbol("prisma:module-secret-key");
-/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.params` forwarding channel. */
-const MODULE_PARAM_KEY = Symbol("prisma:module-param-key");
-/** Whether `ref` carries a callable `satisfies` that accepts `required` truthily. */
-function satisfiesRequired(ref, required) {
-	return typeof ref === "object" && ref !== null && "satisfies" in ref && typeof ref.satisfies === "function" && ref.satisfies(required);
-}
-/**
-* Checks one recorded `wiring` object against the Deps it was wired against:
-* every named input exists and is a dependency slot, every referenced
-* producer is a real (by-now-provisioned) address, and a wired ref whose
-* slot declares a required contract must satisfy() it — no producer-kind
-* branching, the contract alone determines validity, whether the producer is
-* a service port or a resource. Shared by both provisioned kinds so a
-* module-as-child gets exactly the checks a service gets, and run once per
-* entry against the one `byId` shared by the whole recursive flatten, so a
-* forwarded ref resolves through to its real producer address regardless of
-* which ancestor scope provisioned it.
-*/
-function validateWiring(pending, byId) {
-	const { deps, wiring, targetId, targetKind, enclosingModuleName } = pending;
-	for (const [input, ref] of Object.entries(wiring)) {
-		const declared = blindCast(deps[input]);
-		if (declared === void 0 || !isNode(declared) || declared.kind !== "dependency") throw new LoadError(`The deps for "${targetId}" name "${input}", which is not a dependency slot of that ${targetKind}.`);
-		const producerId = producerIdOf(ref);
-		const producer = producerId !== void 0 ? byId.get(producerId) : void 0;
-		if (producerId === void 0 || producer === void 0) throw new LoadError(`The deps for "${targetId}.${input}" reference "${String(producerId)}", which is not provisioned in module "${enclosingModuleName}".`);
-		const required = declared.required;
-		if (required !== void 0 && !satisfiesRequired(ref, required)) throw new LoadError(`The deps for "${targetId}.${input}" do not satisfy the slot's required contract.`);
-	}
-	for (const [input, rawValue] of Object.entries(deps)) {
-		const value = blindCast(rawValue);
-		if (!isNode(value) || wiring[input] !== void 0) continue;
-		if (value.kind === "dependency") throw new LoadError(`Dependency input "${input}" of provisioned ${targetKind} "${targetId}" is not wired to a producer (module "${enclosingModuleName}").`);
-	}
-}
-/**
-* Flattens a value into itself plus every nested object/array member value —
-* identity fodder for the ctx.secrets/ctx.params usage marking, which must
-* see a forwarded source wherever it sits inside an input binding (ADR-0042).
-* A secret/param source is an opaque leaf: it is pushed (a forwarded ref IS
-* such a source, so identity-matching still needs it) but never descended
-* into, so a ref buried in an unrelated source's payload is not falsely seen
-* as used. `seen` guards object cycles so a self-referential binding cannot
-* recurse forever.
-*/
-function deepValues(value, out, seen = /* @__PURE__ */ new WeakSet()) {
-	out.push(value);
-	if (typeof value !== "object" || value === null) return;
-	if (isSecretSource(value) || isParamSource(value)) return;
-	if (seen.has(value)) return;
-	seen.add(value);
-	const members = Array.isArray(value) ? value : Object.values(value);
-	for (const member of members) deepValues(member, out, seen);
-}
-/** The (unvalidated) edges a `wiring` object implies — one dependency edge per entry; `validateWiring` does the real checking. */
-function wiringEdges(wiring, targetId) {
-	return Object.entries(wiring).map(([input, ref]) => ({
-		from: producerIdOf(ref) ?? "",
-		to: targetId,
-		input,
-		kind: "dependency"
-	}));
-}
-/**
-* Checks the secrets wired into one provisioned child MODULE: every declared
-* forwarding slot is bound to a real secret source (an `envSecret` or a
-* forwarded ctx.secrets ref), and no wired key names a slot the module
-* doesn't declare — the secret analog of `validateWiring`'s per-input checks,
-* but resolved inline (a source carries its own name, so no whole-graph pass
-* is needed).
-*/
-function validateSecretBinding(child, id, secretWiring, enclosingModuleName) {
-	const { kind } = child;
-	for (const slot of Object.keys(child.secretSlots)) {
-		const bound = secretWiring[slot];
-		if (bound === void 0) throw new LoadError(`Secret slot "${slot}" of provisioned ${kind} "${id}" is not bound (module "${enclosingModuleName}") — bind it with envSecret('NAME') or forward ctx.secrets.`);
-		if (!isSecretSource(bound)) throw new LoadError(`Secret slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-secret value — use envSecret('NAME') or a forwarded ctx.secrets ref.`);
-	}
-	for (const slot of Object.keys(secretWiring)) if (!Object.hasOwn(child.secretSlots, slot)) throw new LoadError(`The secrets for "${id}" name "${slot}", which is not a secret slot of that ${kind} (module "${enclosingModuleName}").`);
-}
-/**
-* Checks the params wired into a provisioned SERVICE: unlike a secret slot, a
-* declared param is never required to be bound here — it may fall back to its
-* own `default` (checked later, at `buildConfig`) — so this only rejects a
-* wired key that names something other than a real declared param.
-*/
-function validateServiceParamBinding(child, id, paramWiring, enclosingModuleName) {
-	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.params, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param of that service (module "${enclosingModuleName}").`);
-}
-/**
-* Checks the params wired into a provisioned MODULE: every declared
-* param-forwarding slot must be bound to a real `ParamSource` — a slot has no
-* schema of its own, so (unlike a service param) it cannot fall back to a
-* literal or a default; the param analog of `validateSecretBinding`.
-*/
-function validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {
-	for (const slot of Object.keys(child.paramSlots)) {
-		const bound = paramWiring[slot];
-		if (bound === void 0) throw new LoadError(`Param slot "${slot}" of provisioned module "${id}" is not bound (module "${enclosingModuleName}") — bind it with a param source (e.g. envParam('NAME')) or forward ctx.params.`);
-		if (!isParamSource(bound)) throw new LoadError(`Param slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-source value — a module param-forwarding slot carries no schema to validate a literal against; use envParam('NAME') or a forwarded ctx.params ref.`);
-	}
-	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.paramSlots, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param slot of that module (module "${enclosingModuleName}").`);
-}
-/**
-* Recursively flattens one module's body into the shared graph state and
-* returns its resolved ModuleOutputs (one ref-port per expose key) for the
-* caller (the enclosing provision() call, or Load itself for the root) to
-* use. `address` is this module's OWN full address, or `undefined` for the root
-* scope — its direct children then get bare (unprefixed) addresses, keeping
-* a single-level module identical to before nesting existed. `wiring` supplies a
-* resolved producer ref-port for each of this module's OWN declared deps (empty
-* for the root, which may not declare any — see the root non-empty-deps
-* check in loadModule). `nodes`, `edges`, `pending`, and `byId` are shared
-* across the ENTIRE recursive flatten, not per scope — a nested module may
-* forward in a producer provisioned by an ancestor scope, and it is the
-* shared `byId` (keyed by full address) that lets that resolve.
-*
-* `selfId` is this module's own node id — the root's given id when `address`
-* is `undefined`, the full address otherwise. It anchors the authored view:
-* children carry it as their `parent`, and this module's own boundary ports
-* (and the authored edges touching them) are recorded against it.
-*/
-function flatten(moduleNode, address, selfId, wiring, secretWiring, paramWiring, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges) {
-	ports.push(...boundaryPortsOf(selfId, moduleNode));
-	const localIds = /* @__PURE__ */ new Set();
-	const used = /* @__PURE__ */ new Set();
-	const usedSecrets = /* @__PURE__ */ new Set();
-	const usedParams = /* @__PURE__ */ new Set();
-	const ctxInputs = {};
-	for (const key of Object.keys(moduleNode.deps)) {
-		const wired = wiring[key];
-		ctxInputs[key] = typeof wired === "object" && wired !== null ? {
-			...wired,
-			[MODULE_INPUT_KEY]: key
-		} : wired;
-	}
-	const markUsed = (values) => {
-		for (const value of values) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);
-	};
-	const authoredSourceOf = (value) => {
-		for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) return {
-			node: selfId,
-			direction: "in",
-			name: key
-		};
-		const brand = authoredPortOf(value);
-		return brand === void 0 ? void 0 : {
-			node: brand.node,
-			direction: "out",
-			name: brand.name
-		};
-	};
-	/** Records the authored edge each wiring entry declares: source port → the target's own `in` port. */
-	const recordAuthoredWiring = (targetId, targetWiring) => {
-		for (const [input, ref] of Object.entries(targetWiring)) {
-			const from = authoredSourceOf(ref);
-			if (from !== void 0) authoredEdges.push({
-				from,
-				to: {
-					node: targetId,
-					direction: "in",
-					name: input
-				}
-			});
-		}
-	};
-	const ctxSecrets = {};
-	for (const key of Object.keys(moduleNode.secretSlots)) {
-		const bound = secretWiring[key];
-		ctxSecrets[key] = typeof bound === "object" && bound !== null ? {
-			...bound,
-			[MODULE_SECRET_KEY]: key
-		} : bound;
-	}
-	const markSecretsUsed = (values) => {
-		for (const value of values) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);
-	};
-	const ctxParams = {};
-	for (const key of Object.keys(moduleNode.paramSlots)) {
-		const bound = paramWiring[key];
-		ctxParams[key] = typeof bound === "object" && bound !== null ? {
-			...bound,
-			[MODULE_PARAM_KEY]: key
-		} : bound;
-	}
-	const markParamsUsed = (values) => {
-		for (const value of values) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);
-	};
-	const provision = (child, opts) => {
-		const id = opts?.id ?? child.name;
-		const provisionWiring = opts?.deps;
-		const provisionSecrets = opts?.secrets;
-		const provisionInput = opts?.input;
-		const provisionParams = opts?.params;
-		if (typeof id !== "string" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module "${moduleNode.name}").`);
-		if (!isConfigKeySegment(id)) throw new LoadError(`provision() id "${id}" (module "${moduleNode.name}") must contain only ASCII letters and digits ([A-Za-z0-9]) — the id becomes an address segment, and addresses derive deterministic config keys (segments uppercased and joined with "_"). "${id}" would put "${id.toUpperCase()}" inside the derived key. ("_" collides with the key separator and "." with the address separator.)`);
-		if (localIds.has(id)) throw new LoadError(`Duplicate provision id "${id}" in module "${moduleNode.name}".`);
-		const untrusted = child;
-		if (!isNode(untrusted) || untrusted.kind !== "service" && untrusted.kind !== "resource" && untrusted.kind !== "module") throw new LoadError(`provision("${id}") expects a branded service, resource, or module node (construct it with the service()/resource()/module() factories or a pack's own).`);
-		localIds.add(id);
-		const fullAddress = address === void 0 ? id : `${address}.${id}`;
-		if (child.kind === "resource") {
-			if (provisionWiring !== void 0) throw new LoadError(`provision("${id}") received deps for a resource — a resource has no dependency slots to satisfy.`);
-			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a resource — a resource has no secret slots to satisfy.`);
-			if (provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding for a resource — a resource declares no input schema.`);
-			if (provisionParams !== void 0) throw new LoadError(`provision("${id}") received params for a resource — a resource has no params to satisfy.`);
-			if (child.type.length === 0) throw new LoadError(`provision("${id}") received a resource with an empty node type.`);
-			byId.set(fullAddress, child);
-			nodes.push({
-				id: fullAddress,
-				parent: selfId,
-				node: child
-			});
-			ports.push({
-				node: fullAddress,
-				direction: "out",
-				name: RESOURCE_OUT_PORT,
-				contractKind: child.provides.kind
-			});
-			return refForResource(fullAddress, child);
-		}
-		const localWiring = { ...provisionWiring ?? {} };
-		markUsed(Object.values(localWiring));
-		const localSecrets = { ...provisionSecrets ?? {} };
-		markSecretsUsed(Object.values(localSecrets));
-		const localParams = { ...provisionParams ?? {} };
-		markParamsUsed(Object.values(localParams));
-		if (child.kind === "service") {
-			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a service — a service takes its secrets as envSecret(...) leaves of its \`input\` binding (ADR-0042), not a secrets map.`);
-			if (child.inputSchema !== void 0 && provisionInput === void 0) throw new LoadError(`Input of provisioned service "${id}" is not bound (module "${moduleNode.name}") — the service declares an input schema; bind it with \`input: { … }\` on its provision() call.`);
-			if (child.inputSchema === void 0 && provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding, but the service declares no input schema (module "${moduleNode.name}").`);
-			if (provisionInput !== void 0) {
-				const leaves = [];
-				deepValues(provisionInput, leaves);
-				markSecretsUsed(leaves);
-				markParamsUsed(leaves);
-				inputBindings.push({
-					serviceAddress: fullAddress,
-					binding: blindCast(provisionInput)
-				});
-			}
-			validateServiceParamBinding(child, id, localParams, moduleNode.name);
-			for (const [slot, binding] of Object.entries(localParams)) paramBindings.push({
-				serviceAddress: fullAddress,
-				slot,
-				binding
-			});
-			const inputs = serviceInputs(child, fullAddress);
-			nodes.push(...inputs.nodes, {
-				id: fullAddress,
-				parent: selfId,
-				node: child
-			});
-			edges.push(...inputs.edges, ...wiringEdges(localWiring, fullAddress));
-			ports.push(...boundaryPortsOf(fullAddress, child));
-			recordAuthoredWiring(fullAddress, localWiring);
-			pending.push({
-				deps: child.inputs,
-				wiring: localWiring,
-				targetId: fullAddress,
-				targetKind: "service",
-				enclosingModuleName: moduleNode.name
-			});
-			byId.set(fullAddress, child);
-			return refFor(fullAddress, child);
-		}
-		if (provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding for a module — a module has no input schema; bind the input on the service that declares it.`);
-		validateSecretBinding(child, id, localSecrets, moduleNode.name);
-		validateParamNeedBinding(child, id, localParams, moduleNode.name);
-		edges.push(...wiringEdges(localWiring, fullAddress));
-		recordAuthoredWiring(fullAddress, localWiring);
-		pending.push({
-			deps: child.deps,
-			wiring: localWiring,
-			targetId: fullAddress,
-			targetKind: "module",
-			enclosingModuleName: moduleNode.name
-		});
-		const childOutputs = flatten(child, fullAddress, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges);
-		nodes.push({
-			id: fullAddress,
-			parent: selfId,
-			node: child
-		});
-		byId.set(fullAddress, child);
-		const brandedOutputs = {};
-		for (const [key, value] of Object.entries(childOutputs)) brandedOutputs[key] = typeof value === "object" && value !== null ? {
-			...value,
-			[AUTHORED_PORT]: {
-				node: fullAddress,
-				name: key
-			}
-		} : value;
-		return blindCast({
-			id: fullAddress,
-			...brandedOutputs
-		});
-	};
-	const ctx = blindCast({
-		inputs: ctxInputs,
-		secrets: ctxSecrets,
-		params: ctxParams,
-		provision: blindCast(provision)
-	});
-	const outputs = blindCast(moduleNode.body(ctx) ?? {});
-	markUsed(Object.values(outputs));
-	for (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares input "${key}" but never forwards it into a provision nor returns it as an output.`);
-	for (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares secret "${key}" but never forwards it into a provision.`);
-	for (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares param "${key}" but never forwards it into a provision.`);
-	for (const [key, contract] of Object.entries(moduleNode.expose)) {
-		const port = outputs[key];
-		if (port === void 0) throw new LoadError(`Module "${moduleNode.name}" declares expose "${key}" but its body did not return a port for it.`);
-		if (!satisfiesRequired(port, contract)) throw new LoadError(`Module "${moduleNode.name}"'s returned port for expose "${key}" does not satisfy its declared contract.`);
-		const from = authoredSourceOf(port);
-		if (from !== void 0) authoredEdges.push({
-			from,
-			to: {
-				node: selfId,
-				direction: "out",
-				name: key
-			}
-		});
-	}
-	return outputs;
-}
-function loadModule(root, opts) {
-	const rootId = opts?.id ?? root.name;
-	const rootDepKeys = Object.keys(root.deps);
-	if (rootDepKeys.length > 0) {
-		const names = rootDepKeys.map((k) => `"${k}"`).join(", ");
-		throw new LoadError(`Module "${root.name}" declares input${rootDepKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to wire them; compose "${root.name}" from another module that provisions and wires it instead.`);
-	}
-	const rootSecretKeys = Object.keys(root.secretSlots);
-	if (rootSecretKeys.length > 0) {
-		const names = rootSecretKeys.map((k) => `"${k}"`).join(", ");
-		throw new LoadError(`Module "${root.name}" declares secret${rootSecretKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds secrets with envSecret('NAME'), it does not declare secret slots of its own.`);
-	}
-	const rootParamKeys = Object.keys(root.paramSlots);
-	if (rootParamKeys.length > 0) {
-		const names = rootParamKeys.map((k) => `"${k}"`).join(", ");
-		throw new LoadError(`Module "${root.name}" declares param${rootParamKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds params directly on each provision() call, it does not declare param-forwarding slots of its own.`);
-	}
-	const nodes = [];
-	const edges = [];
-	const pending = [];
-	const inputBindings = [];
-	const paramBindings = [];
-	const byId = /* @__PURE__ */ new Map();
-	const ports = [];
-	const authoredEdges = [];
-	flatten(root, void 0, rootId, {}, {}, {}, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges);
-	for (const entry of pending) validateWiring(entry, byId);
-	assertDependencyDag(edges);
-	const rootGraphNode = {
-		id: rootId,
-		parent: void 0,
-		node: root
-	};
-	return {
-		root: rootGraphNode,
-		nodes: [...topoSort(nodes, edges), rootGraphNode],
-		edges,
-		ports,
-		authoredEdges,
-		inputBindings,
-		params: paramBindings
-	};
-}
-/**
-* The dependency edges must form a DAG — a cycle means neither producer can
-* deploy first. Resources take no wiring, so only service/module-to-service/module
-* edges can ever participate in a cycle; no special-casing needed.
-*/
-function assertDependencyDag(edges) {
-	const adjacency = /* @__PURE__ */ new Map();
-	for (const edge of edges) {
-		if (edge.kind !== "dependency") continue;
-		const targets = adjacency.get(edge.from) ?? [];
-		targets.push(edge.to);
-		adjacency.set(edge.from, targets);
-	}
-	const visiting = /* @__PURE__ */ new Set();
-	const done = /* @__PURE__ */ new Set();
-	const stack = [];
-	const visit = (id) => {
-		if (done.has(id)) return;
-		if (visiting.has(id)) throw new LoadError(`Dependency cycle: ${[...stack.slice(stack.indexOf(id)), id].join(" → ")} — no deploy order exists.`);
-		visiting.add(id);
-		stack.push(id);
-		for (const next of adjacency.get(id) ?? []) visit(next);
-		stack.pop();
-		visiting.delete(id);
-		done.add(id);
-	};
-	for (const id of adjacency.keys()) visit(id);
-}
-/**
-* Builds the in-memory graph from a root node. A service root walks its own
-* `inputs`; a module root executes its body (wiring, not user code — the
-* designed exception to imports-run-nothing) and recursively flattens every
-* module it provisions into one graph of hierarchical addresses. A malformed
-* graph is a `LoadError` that names its fix; the individual validation rules
-* live with `loadService` / `loadModule` and are covered by name in the Load
-* tests. Executes nothing of the user's own code beyond module bodies.
-*/
-function Load(root, opts) {
-	if (!isNode(root)) throw new LoadError("Load expects a branded service or module node (construct it with the service()/module() factories).");
-	if (root.kind === "module") return loadModule(root, opts);
-	if (root.kind === "service") return loadService(root, opts?.id ?? "root");
-	throw new LoadError("Load expects a service or module root (received another node kind).");
-}
-blindCast(Symbol.for("prisma:secret-box"));
-//#endregion
-//#region ../../0-framework/3-tooling/cli/dist/load-entry-BjRb7YB3.mjs
-/**
-* Synchronous Node resolve hook so that entry modules may import relative
-* files using the specifier forms TypeScript accepts by default —
-* extensionless `./service` and `./service.js` for a `.ts` source file —
-* without requiring `allowImportingTsExtensions` in every consumer's tsconfig.
-*
-* Resolution only; uses TypeScript's own documented mapping: for a specifier
-* Node could not resolve, strip any JS-family extension and probe the
-* corresponding TypeScript source; first candidate that exists on disk wins.
-* Format-specific rules: `.mjs` → `.mts`; `.cjs` → `.cts`; `.js` and
-* extensionless → `.ts`, `.mts`, `.tsx`, then `./index.ts`. Bare and package
-* specifiers are never touched. Existing `./x.ts` imports keep working —
-* Node resolves them before the hook fires (ADR-0005: no transform, no
-* guessing, deterministic TypeScript rule).
-*
-* Bun resolves `./x.js` and `./x` to `x.ts` natively, so the hook is a
-* no-op under Bun. Nothing is registered there.
-*/
-let registered = false;
-/**
-* Registers the resolve hook once (idempotent). Call at the start of
-* `loadEntry` so every module in the entry graph benefits, including those
-* imported lazily after the entry itself loads.
-*/
-function registerEntryResolution() {
-	if (registered || typeof process.versions.bun === "string") return;
-	if (typeof mod.registerHooks !== "function") return;
-	registered = true;
-	mod.registerHooks({ resolve(specifier, context, nextResolve) {
-		try {
-			return nextResolve(specifier, context);
-		} catch (error) {
-			if (!isRelativeSpecifier(specifier) || context.parentURL === void 0 || !isModuleNotFoundError(error)) throw error;
-			for (const candidate of sourceCandidates(new URL(specifier, context.parentURL))) if (existsSync(fileURLToPath(candidate))) return nextResolve(candidate.href, context);
-			throw error;
-		}
-	} });
-}
-/**
-* TypeScript's extension mapping: for a JS-family or extensionless URL,
-* produce the source candidates to probe. Format-specific: `.mjs` maps only
-* to `.mts`; `.cjs` maps only to `.cts`; `.js` and extensionless probe
-* `.ts`, `.mts`, `.tsx` (keeping `.tsx` so the JSX diagnostic fires), then
-* `./index.ts`.
-*/
-function sourceCandidates(resolved) {
-	const href = resolved.href;
-	if (href.endsWith(".mjs")) {
-		const base = href.slice(0, -4);
-		return [new URL(`${base}.mts`)];
-	}
-	if (href.endsWith(".cjs")) {
-		const base = href.slice(0, -4);
-		return [new URL(`${base}.cts`)];
-	}
-	const base = href.endsWith(".js") ? href.slice(0, -3) : href;
-	return [
-		new URL(`${base}.ts`),
-		new URL(`${base}.mts`),
-		new URL(`${base}.tsx`),
-		new URL(`${base}/index.ts`)
-	];
-}
-function isRelativeSpecifier(specifier) {
-	return specifier.startsWith("./") || specifier.startsWith("../");
-}
-function isModuleNotFoundError(error) {
-	if (!(error instanceof Error)) return false;
-	if (!("code" in error)) return false;
-	return error.code === "ERR_MODULE_NOT_FOUND";
-}
-/**
-* `loadEntry` imports a user's topology with the host runtime's own module
-* loader — under node (the CLI's shebang runtime), that loader strips
-* TypeScript types but has no JSX transform (ADR-0005: the framework
-* doesn't bundle or transform the app's code; deploy loading is no
-* exception). A `.tsx`/`.jsx` file anywhere in the topology's import graph
-* dies with node's raw `ERR_UNKNOWN_FILE_EXTENSION`, which names the file
-* but not the cause or the fix. This turns that one case into structured
-* error parts (summary/why/fix) that do — every other load failure (syntax
-* errors, missing files, non-JSX unknown extensions) is untouched.
-*/
-const UNKNOWN_EXTENSION_CODE = "ERR_UNKNOWN_FILE_EXTENSION";
-const JSX_EXTENSIONS = [".tsx", ".jsx"];
-function errorCode(error) {
-	return "code" in error && typeof error.code === "string" ? error.code : void 0;
-}
-function unknownExtensionPath(error) {
-	if (!(error instanceof Error)) return void 0;
-	if (errorCode(error) !== UNKNOWN_EXTENSION_CODE) return void 0;
-	return /Unknown file extension "\.\w+" for (.+)$/.exec(error.message)?.[1];
-}
-/**
-* Returns structured error parts when `error` is node's
-* `ERR_UNKNOWN_FILE_EXTENSION` for a `.tsx`/`.jsx` file — `undefined` for
-* every other error (including unknown-extension failures for some other
-* extension), so the caller can fall through to its normal rethrow.
-*/
-function explainJsxLoadError(error, entryPath) {
-	const offendingPath = unknownExtensionPath(error);
-	if (offendingPath === void 0) return void 0;
-	if (!JSX_EXTENSIONS.some((ext) => offendingPath.endsWith(ext))) return void 0;
-	return {
-		summary: `"${offendingPath}" can't be loaded.`,
-		why: `deploy loads "${entryPath}"'s topology with node's own module loader, which strips TypeScript types but has no JSX transform — so a .tsx/.jsx file can't sit anywhere in that import graph.`,
-		fix: "Precompile that file in your own build (transform the JSX away, keep the real npm packages external) and import the compiled output instead of the raw .tsx/.jsx — see examples/email/scripts/build.ts in the prisma/composer repo for a worked example."
-	};
-}
-/**
-* Pipeline step 1 (deploy-cli.md § The pipeline): import the entry module
-* (resolved against cwd) and require its default export to be a node — a
-* service or module, branded by core's factories. Whatever this module exports
-* IS the application; nothing else marks a root (ADR-0003).
-*/
-async function loadEntry(entryArg, cwd) {
-	registerEntryResolution();
-	const resolvedPath = path.resolve(cwd, entryArg);
-	let mod;
-	try {
-		mod = await import(pathToFileURL(resolvedPath).href);
-	} catch (error) {
-		const explained = explainJsxLoadError(error, resolvedPath);
-		if (explained !== void 0) throw new CliStructuredError("COMPOSE.ENTRY_UNLOADABLE", explained.summary, {
-			why: explained.why,
-			fix: explained.fix,
-			where: { path: resolvedPath },
-			cause: error
-		});
-		throw new CliStructuredError("COMPOSE.ENTRY_UNLOADABLE", `Failed to import entry module "${resolvedPath}": ${error instanceof Error ? error.message : String(error)}`, {
-			where: { path: resolvedPath },
-			cause: error
-		});
-	}
-	const root = blindCast(mod).default;
-	if (!isNode(root) || root.kind === "dependency" || root.kind === "resource") throw new CliStructuredError("COMPOSE.ENTRY_EXPORT_INVALID", `Entry module "${resolvedPath}" must default-export a node (a service or a module).`, {
-		fix: "Construct it with service() or module() from @prisma/composer.",
-		where: { path: resolvedPath }
-	});
-	return {
-		path: resolvedPath,
-		root: blindCast(root)
-	};
-}
-//#endregion
-//#region ../../0-framework/3-tooling/assemble/dist/index.mjs
-/**
-* A user-facing assembly failure, structured at origin (base-type rule 6):
-* a `CliStructuredError` whose code names which way assembly went wrong.
-* This package's second consumer is the programmatic deploy API, not just
-* the CLI — hosts branch on `error.code`, the CLI renders the envelope.
-*/
-var AssembleError = class extends CliStructuredError {
-	constructor(code, summary, options) {
-		super(code, summary, options);
-	}
-};
-/**
-* The registry route for one service's build: extension by
-* `build.extension`, node descriptor by `build.type`, kind must be "build".
-* The CLI's coverage validation reports the same misses earlier with the
-* config fix; these errors are the backstop for programmatic callers.
-*/
-function buildDescriptorAssemble(config, node, address, cwd) {
-	const { extension, type } = node.build;
-	const extensionDescriptor = config.extensions.find((candidate) => candidate.id === extension);
-	if (extensionDescriptor === void 0) throw new AssembleError("ASSEMBLE.EXTENSION_MISSING", `No extension "${extension}" is configured (needed by service "${node.name}"'s build).`, { fix: "Add it to `extensions` in the `composer` section of prisma.config.ts." });
-	const nodeDescriptor = extensionDescriptor.nodes[type];
-	if (nodeDescriptor === void 0) throw new AssembleError("ASSEMBLE.DESCRIPTOR_MISSING", `Extension "${extension}" has no descriptor for build type "${type}".`, { why: `Known types: ${Object.keys(extensionDescriptor.nodes).join(", ")}.` });
-	if (nodeDescriptor.kind !== "build") throw new AssembleError("ASSEMBLE.DESCRIPTOR_KIND_MISMATCH", `Extension "${extension}"'s descriptor for type "${type}" is a "${nodeDescriptor.kind}" descriptor.`, { why: "Assembling a service build needs a \"build\" descriptor." });
-	return nodeDescriptor.assemble({
-		build: node.build,
-		address,
-		cwd
-	});
-}
-async function assembleServices(graph, config, cwd, run) {
-	const runAssembler = run ?? ((node, address, nodeCwd) => buildDescriptorAssemble(config, node, address, nodeCwd));
-	const serviceNodes = graph.nodes.filter((n) => n.node.kind === "service");
-	if (serviceNodes.length === 0) throw new AssembleError("ASSEMBLE.SERVICE_MISSING", "The loaded graph has no service to assemble.");
-	const bundles = {};
-	for (const { id, node } of serviceNodes) try {
-		bundles[id] = await runAssembler(node, id, cwd);
-	} catch (error) {
-		if (CliStructuredError.is(error)) throw error;
-		throw new AssembleError("ASSEMBLE.BUILD_FAILED", error instanceof Error ? error.message : String(error), {
-			meta: { address: id },
-			cause: error
-		});
-	}
-	return { bundles };
-}
-//#endregion
-//#region ../../0-framework/3-tooling/cli/dist/pipeline-DAYhea3J.mjs
-function lookup(extensions, extension, type, expectedKind, what) {
-	const ext = extensions.get(extension);
-	if (ext === void 0) throw new CliStructuredError("CONFIG.EXTENSION_MISSING", `No extension "${extension}" is configured (needed by ${what}).`, {
-		fix: "Add it to `extensions` in the `composer` section of prisma.config.ts (import its /control entry and list its descriptor).",
-		meta: {
-			extension,
-			type
-		}
-	});
-	const descriptor = ext.nodes[type];
-	if (descriptor === void 0) throw new CliStructuredError("CONFIG.DESCRIPTOR_MISSING", `Extension "${extension}" has no descriptor for node type "${type}" (needed by ${what}).`, {
-		why: `Known types: ${Object.keys(ext.nodes).join(", ")}.`,
-		meta: {
-			extension,
-			type
-		}
-	});
-	if (descriptor.kind !== expectedKind) throw new CliStructuredError("CONFIG.DESCRIPTOR_KIND_MISMATCH", `Extension "${extension}"'s descriptor for node type "${type}" is a "${descriptor.kind}" descriptor — ${what} needs a "${expectedKind}" descriptor.`, { meta: {
-		extension,
-		type,
-		kind: descriptor.kind
-	} });
-}
-/** Throws a structured CONFIG.* error on the first uncovered `(extension, type)`; silent when the config covers the whole graph. */
-function validateRegistryCoverage(graph, config) {
-	const extensions = new Map(config.extensions.map((descriptor) => [descriptor.id, descriptor]));
-	for (const { id, node } of graph.nodes) {
-		if (node.kind === "resource") {
-			lookup(extensions, node.extension, node.type, "resource", `resource node "${id}"`);
-			continue;
-		}
-		if (node.kind !== "service") continue;
-		lookup(extensions, node.extension, node.type, "service", `service node "${id}"`);
-		lookup(extensions, node.build.extension, node.build.type, "build", `service node "${id}"'s build descriptor`);
-	}
-}
-/**
-* The shared prefix of `deploy`/`destroy`/`dev` (deploy-cli.md § The
-* pipeline; local-dev spec § 6): entry load, Load,
-* registry coverage validation, name resolution, assemble. Deploy and dev
-* diverge after this — deploy resolves containers/preflight/stack file
-* against the hosted providers, dev against the local ones — so everything
-* up to and including assemble lives here once, consumed verbatim by both
-* `run()` (main.ts) and `runDev()` (dev/run-dev.ts), so the two pipelines
-* cannot drift.
-*/
-function configError(findings, file) {
-	const [first] = findings;
-	return new CliStructuredError(first.code, first.summary, {
-		...first.why === void 0 ? {} : { why: first.why },
-		fix: first.fix,
-		where: { path: first.where ?? file },
-		meta: {
-			...first.field === void 0 ? {} : { field: first.field },
-			findings
-		}
-	});
-}
-/**
-* Refuses a caller's config with the same findings, in the same order, as the CLI's section validator.
-* The error is the first finding and carries all of them in `meta.findings`. Returns the config with `file` resolved against `cwd`.
-*/
-function checkConfigSource(source, cwd) {
-	const file = path.resolve(cwd, source.file);
-	if (!fs.existsSync(file)) throw configError([configFileMissing(file)], file);
-	const checked = checkComposerConfig(source.value, file);
-	if (!checked.ok) throw configError(checked.findings, file);
-	return {
-		value: checked.value,
-		file
-	};
-}
-/**
-* The pipeline's front — entry load and name resolution —
-* WITHOUT Load, coverage, or assemble. `log` needs only who the app is (its
-* config and resolved name) to reach the already-running local instance; it
-* neither builds nor provisions, so it must not require the user's built
-* output the way the full pipeline does.
-*/
-async function resolveAppIdentity(entry, overrideName, cwd, config) {
-	const { value } = checkConfigSource(config, cwd);
-	const entryModule = await loadEntry(entry, cwd);
-	const name = overrideName ?? entryModule.root.name;
-	if (name.length === 0) throw new CliStructuredError("COMPOSE.NAME_MISSING", "The root node has no name.", { fix: "Name it at authoring, or pass --name." });
-	return {
-		config: value,
-		name
-	};
-}
-/**
-* Runs entry load, Load, registry coverage, name resolution, and assemble — steps 1–5 of `run()`. `onAssembleError`, when
-* given, lets a caller decorate an assemble failure with command-specific
-* guidance (destroy's "build first" hint) without this shared step knowing
-* about any one command.
-*/
-async function runPipeline(entry, overrideName, cwd, source, deps = {}, onAssembleError) {
-	const configSource = checkConfigSource(source, cwd);
-	const config = configSource.value;
-	const entryModule = await loadEntry(entry, cwd);
-	const graph = Load(entryModule.root);
-	if (graph.root.node.kind !== "module") throw new CliStructuredError("COMPOSE.ROOT_NOT_MODULE", "The deploy root must be a module.", { fix: "Wrap your service, e.g. export default module('name', ({ provision }) => { provision(service); })." });
-	validateRegistryCoverage(graph, config);
-	const name = overrideName ?? entryModule.root.name;
-	if (name.length === 0) throw new CliStructuredError("COMPOSE.NAME_MISSING", "The root node has no name.", { fix: "Name it at authoring, or pass --name." });
-	let assembled;
-	try {
-		assembled = await assembleServices(graph, config, cwd, deps.runAssembler);
-	} catch (error) {
-		if (onAssembleError !== void 0 && error instanceof Error) throw onAssembleError(error);
-		throw error;
-	}
-	return {
-		configSource,
-		entryModule,
-		graph,
-		name,
-		assembled
-	};
-}
-//#endregion
-export { runPipeline as n, resolveAppIdentity as t };
-
-//# sourceMappingURL=pipeline-DAYhea3J-BEnHHWp8.mjs.map