@prisma/composer-cli 0.27.0 → 0.28.0

package/dist/{container-transport-HcvNOGZL-CHqecFc7.mjs → container-transport-HcvNOGZL-bjIRXsYK.mjs}

@@ -22,7 +22,7 @@ var AssembleError = class extends CliStructuredError {
 * The CLI's coverage validation reports the same misses earlier with the
 * config fix; these errors are the backstop for programmatic callers.
 */
-function buildDescriptorAssemble(config, node, address, cwd) {
+function buildDescriptorAssemble(config, node, address, cwd, report) {
 	const { extension, type } = node.build;
 	const extensionDescriptor = config.extensions.find((candidate) => candidate.id === extension);
 	if (extensionDescriptor === void 0) throw new AssembleError("ASSEMBLE.EXTENSION_MISSING", `No extension "${extension}" is configured (needed by service "${node.name}"'s build).`, { fix: "Add it to `extensions` in the `composer` section of prisma.config.ts." });
@@ -32,21 +32,36 @@ function buildDescriptorAssemble(config, node, address, cwd) {
 	return nodeDescriptor.assemble({
 		build: node.build,
 		address,
-		cwd
+		cwd,
+		report
 	});
 }
-async function assembleServices(graph, config, cwd, run) {
-	const runAssembler = run ?? ((node, address, nodeCwd) => buildDescriptorAssemble(config, node, address, nodeCwd));
+async function assembleServices(graph, config, cwd, run, onEvent) {
+	const runAssembler = run ?? ((node, address, nodeCwd, report) => buildDescriptorAssemble(config, node, address, nodeCwd, report));
 	const serviceNodes = graph.nodes.filter((n) => n.node.kind === "service");
 	if (serviceNodes.length === 0) throw new AssembleError("ASSEMBLE.SERVICE_MISSING", "The loaded graph has no service to assemble.");
 	const bundles = {};
-	for (const { id, node } of serviceNodes) try {
-		bundles[id] = await runAssembler(node, id, cwd);
-	} catch (error) {
-		if (CliStructuredError.is(error)) throw error;
-		throw new AssembleError("ASSEMBLE.BUILD_FAILED", error instanceof Error ? error.message : String(error), {
-			meta: { address: id },
-			cause: error
+	for (const { id, node } of serviceNodes) {
+		onEvent?.({
+			kind: "service-started",
+			address: id
+		});
+		const data = {};
+		let artifact;
+		try {
+			artifact = await runAssembler(node, id, cwd, (reported) => Object.assign(data, reported));
+		} catch (error) {
+			if (CliStructuredError.is(error)) throw error;
+			throw new AssembleError("ASSEMBLE.BUILD_FAILED", error instanceof Error ? error.message : String(error), {
+				meta: { address: id },
+				cause: error
+			});
+		}
+		bundles[id] = artifact;
+		onEvent?.({
+			kind: "service-assembled",
+			address: id,
+			data
 		});
 	}
 	return { bundles };
@@ -708,7 +723,7 @@ function Load(root, opts) {
 }
 blindCast(Symbol.for("prisma:secret-box"));
 //#endregion
-//#region ../../0-framework/3-tooling/cli/dist/pipeline-DYvl561J.mjs
+//#region ../../0-framework/3-tooling/cli/dist/pipeline-B-vJNch3.mjs
 /**
 * Synchronous Node resolve hook so that entry modules may import relative
 * files using the specifier forms TypeScript accepts by default —
@@ -939,9 +954,10 @@ async function runPipeline(entry, overrideName, cwd, source, deps = {}, onAssemb
 	validateRegistryCoverage(graph, config);
 	const name = overrideName ?? entryModule.root.name;
 	if (name.length === 0) throw new CliStructuredError("COMPOSE.NAME_MISSING", "The root node has no name.", { fix: "Name it at authoring, or pass --name." });
+	deps.onEvent?.({ kind: "loaded" });
 	let assembled;
 	try {
-		assembled = await assembleServices(graph, config, cwd, deps.runAssembler);
+		assembled = await assembleServices(graph, config, cwd, deps.runAssembler, deps.onEvent);
 	} catch (error) {
 		if (onAssembleError !== void 0 && error instanceof Error) throw onAssembleError(error);
 		throw error;
@@ -988,4 +1004,4 @@ function containerEnv(instances) {
 //#endregion
 export { envVarSafeExtensionId as n, runPipeline as r, containerEnv as t };
 
-//# sourceMappingURL=container-transport-HcvNOGZL-CHqecFc7.mjs.map
+//# sourceMappingURL=container-transport-HcvNOGZL-bjIRXsYK.mjs.map

package/dist/container-transport-HcvNOGZL-bjIRXsYK.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-transport-HcvNOGZL-bjIRXsYK.mjs","names":[],"sources":["../../../0-framework/3-tooling/assemble/dist/index.mjs","../../../0-framework/1-core/core/dist/graph-BfKAg2Ap.mjs","../../../0-framework/0-foundation/foundation/dist/secret-DoWGmN7m.mjs","../../../0-framework/1-core/core/dist/index.mjs","../../../0-framework/3-tooling/cli/dist/pipeline-B-vJNch3.mjs","../../../0-framework/1-core/core/dist/container-transport-HcvNOGZL.mjs"],"sourcesContent":["import { CliStructuredError } from \"@internal/foundation/errors\";\n//#region src/assemble-error.ts\n/**\n* A user-facing assembly failure, structured at origin (base-type rule 6):\n* a `CliStructuredError` whose code names which way assembly went wrong.\n* This package's second consumer is the programmatic deploy API, not just\n* the CLI — hosts branch on `error.code`, the CLI renders the envelope.\n*/\nvar AssembleError = class extends CliStructuredError {\n\tconstructor(code, summary, options) {\n\t\tsuper(code, summary, options);\n\t}\n};\n//#endregion\n//#region src/assemble-services.ts\n/**\n* The registry route for one service's build: extension by\n* `build.extension`, node descriptor by `build.type`, kind must be \"build\".\n* The CLI's coverage validation reports the same misses earlier with the\n* config fix; these errors are the backstop for programmatic callers.\n*/\nfunction buildDescriptorAssemble(config, node, address, cwd, report) {\n\tconst { extension, type } = node.build;\n\tconst extensionDescriptor = config.extensions.find((candidate) => candidate.id === extension);\n\tif (extensionDescriptor === void 0) throw new AssembleError(\"ASSEMBLE.EXTENSION_MISSING\", `No extension \"${extension}\" is configured (needed by service \"${node.name}\"'s build).`, { fix: \"Add it to `extensions` in the `composer` section of prisma.config.ts.\" });\n\tconst nodeDescriptor = extensionDescriptor.nodes[type];\n\tif (nodeDescriptor === void 0) throw new AssembleError(\"ASSEMBLE.DESCRIPTOR_MISSING\", `Extension \"${extension}\" has no descriptor for build type \"${type}\".`, { why: `Known types: ${Object.keys(extensionDescriptor.nodes).join(\", \")}.` });\n\tif (nodeDescriptor.kind !== \"build\") throw new AssembleError(\"ASSEMBLE.DESCRIPTOR_KIND_MISMATCH\", `Extension \"${extension}\"'s descriptor for type \"${type}\" is a \"${nodeDescriptor.kind}\" descriptor.`, { why: \"Assembling a service build needs a \\\"build\\\" descriptor.\" });\n\treturn nodeDescriptor.assemble({\n\t\tbuild: node.build,\n\t\taddress,\n\t\tcwd,\n\t\treport\n\t});\n}\nasync function assembleServices(graph, config, cwd, run, onEvent) {\n\tconst runAssembler = run ?? ((node, address, nodeCwd, report) => buildDescriptorAssemble(config, node, address, nodeCwd, report));\n\tconst serviceNodes = graph.nodes.filter((n) => n.node.kind === \"service\");\n\tif (serviceNodes.length === 0) throw new AssembleError(\"ASSEMBLE.SERVICE_MISSING\", \"The loaded graph has no service to assemble.\");\n\tconst bundles = {};\n\tfor (const { id, node } of serviceNodes) {\n\t\tonEvent?.({\n\t\t\tkind: \"service-started\",\n\t\t\taddress: id\n\t\t});\n\t\tconst data = {};\n\t\tlet artifact;\n\t\ttry {\n\t\t\tartifact = await runAssembler(node, id, cwd, (reported) => Object.assign(data, reported));\n\t\t} catch (error) {\n\t\t\tif (CliStructuredError.is(error)) throw error;\n\t\t\tthrow new AssembleError(\"ASSEMBLE.BUILD_FAILED\", error instanceof Error ? error.message : String(error), {\n\t\t\t\tmeta: { address: id },\n\t\t\t\tcause: error\n\t\t\t});\n\t\t}\n\t\tbundles[id] = artifact;\n\t\tonEvent?.({\n\t\t\tkind: \"service-assembled\",\n\t\t\taddress: id,\n\t\t\tdata\n\t\t});\n\t}\n\treturn { bundles };\n}\n//#endregion\nexport { AssembleError, assembleServices };\n\n//# sourceMappingURL=index.mjs.map","import { CliStructuredError, InternalError } from \"@internal/foundation/errors\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/graph-types.ts\n/** The reserved name of a resource's single anonymous output port. Rejected as a user-declared port name (node.ts). */\nconst RESOURCE_OUT_PORT = \"$out\";\n/**\n* Thrown by Load when the graph is malformed. Structured at origin\n* (base-type rule 6): one type-level code covers every raise site until a\n* finer per-site taxonomy is carved out. The `name` stays\n* `CliStructuredError` — structural recognition depends on it.\n*/\nvar LoadError = class extends CliStructuredError {\n\tconstructor(message) {\n\t\tsuper(\"COMPOSE.GRAPH_INVALID\", message);\n\t}\n};\n//#endregion\n//#region src/node.ts\n/**\n* Core model: node types and the factories that construct them, plain frozen\n* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).\n*/\nconst NODE = Symbol.for(\"prisma:node\");\nconst SECRET_NEED = blindCast(Symbol.for(\"prisma:secret-need\"));\nconst SECRET_SOURCE = blindCast(Symbol.for(\"prisma:secret-source\"));\n/** Declares a secret NEED. Nameless — the platform name is bound at the root via `envSecret`. */\nfunction secret() {\n\treturn Object.freeze({\n\t\t[SECRET_NEED]: true,\n\t\tkind: \"secret\"\n\t});\n}\n/** Builds an opaque secret source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envSecret`) calls. Core forwards the source and never inspects the payload. */\nfunction secretSource(payload) {\n\treturn Object.freeze({\n\t\t[SECRET_SOURCE]: true,\n\t\tpayload\n\t});\n}\n/** True if `value` is a secret source (an `envSecret` result or a forwarded ctx.secrets ref). */\nfunction isSecretSource(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[SECRET_SOURCE] === true;\n}\nconst PROVISION_NEED = blindCast(Symbol.for(\"prisma:provision-need\"));\n/** Builds an opaque provisioning need — the declaring package's own brand plus whatever payload its provisioner reads back. */\nfunction provisionNeed(brand, payload) {\n\treturn blindCast(Object.freeze({\n\t\t[PROVISION_NEED]: true,\n\t\tbrand,\n\t\tpayload\n\t}));\n}\n/** True if `value` is a provisioning need (a `provisionNeed()` result). */\nfunction isProvisionNeed(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[PROVISION_NEED] === true;\n}\nconst PARAM_SOURCE = blindCast(Symbol.for(\"prisma:param-source\"));\nconst PARAM_NEED = blindCast(Symbol.for(\"prisma:param-need\"));\n/** Builds an opaque param source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envParam`) calls. Core forwards the source and never inspects the payload. */\nfunction paramSource(payload) {\n\treturn Object.freeze({\n\t\t[PARAM_SOURCE]: true,\n\t\tpayload\n\t});\n}\n/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */\nfunction isParamSource(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[PARAM_SOURCE] === true;\n}\n/** Declares a module param-forwarding NEED. Nameless — bound to a `ParamSource` by an enclosing scope and forwarded into a child's real param. */\nfunction paramNeed() {\n\treturn Object.freeze({\n\t\t[PARAM_NEED]: true,\n\t\tkind: \"param\"\n\t});\n}\nfunction requireType(type, factory) {\n\tif (typeof type !== \"string\" || type.length === 0) throw new Error(`${factory}() requires a non-empty node type.`);\n}\nfunction requireName(name, factory) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(`${factory}() requires a non-empty name.`);\n}\nfunction requireExtension(extension, factory) {\n\tif (typeof extension !== \"string\" || extension.length === 0) throw new Error(`${factory}() requires a non-empty extension (the authoring extension's package name).`);\n}\n/**\n* Core's grammar for every name that becomes a config-key segment —\n* addresses, input/param/secret names: ASCII letters and digits only.\n* Conservative by design so any target medium — POSIX env-var keys\n* included — can uppercase and \"_\"-join segments without escaping.\n*/\nfunction isConfigKeySegment(name) {\n\treturn /^[A-Za-z0-9]+$/.test(name);\n}\nfunction requireConfigKeySegmentName(name, kind, factory) {\n\tif (!isConfigKeySegment(name)) throw new Error(`${factory}() ${kind} name \"${name}\" must contain only ASCII letters and digits ([A-Za-z0-9]) — declared names derive deterministic config keys, uppercased and joined with \"_\" (an input \"db\"'s param \"url\" becomes config key \"DB_URL\"), so an underscore inside a name collides with that separator and any other character has no place in a config key. \"${name}\" would put \"${name.toUpperCase()}\" inside the derived key.`);\n}\n/**\n* `$out` names a resource's single anonymous output on the wire (the\n* application topology's reserved port name), so no declared port — a dep\n* slot or an expose entry — may claim it. Input names are already confined\n* to [A-Za-z0-9] by the config-key rule; expose and module-dep names are\n* not, so the reservation is checked wherever a port name is declared.\n*/\nfunction requireNotReservedPortNames(names, factory) {\n\tfor (const name of names) if (name === \"$out\") throw new Error(`${factory}() declares a port named \"$out\" — that name is reserved for a resource's anonymous output; choose another name.`);\n}\nfunction requireConfigKeySegmentNames(names, kind, factory) {\n\tfor (const name of names) requireConfigKeySegmentName(name, kind, factory);\n}\nfunction freezeParams(params) {\n\tconst frozen = {};\n\tfor (const [name, param] of Object.entries(params)) frozen[name] = Object.freeze({ ...param });\n\treturn Object.freeze(frozen);\n}\n/** A frozen shallow copy that keeps the caller's declared type. */\nfunction frozenShallowCopy(obj) {\n\treturn blindCast(Object.freeze({ ...obj }));\n}\n/**\n* Seals a node instance after its constructor has assigned all fields — the\n* last statement of a concrete node class's constructor. A free function, not\n* a base-class method, so an instance stays structurally a plain frozen node.\n*/\nfunction freezeNode(node) {\n\tObject.freeze(node);\n\treturn node;\n}\n/**\n* Everything `resource()` establishes, minus the freeze — an extension\n* whose resource node carries extra fields extends this, assigns them, and\n* calls `freezeNode(this)` as its constructor's last statement.\n*/\nvar ResourceNodeBase = class {\n\t[NODE] = true;\n\tkind = \"resource\";\n\tname;\n\textension;\n\ttype;\n\tprovides;\n\tconstructor(def) {\n\t\trequireName(def.name, \"resource\");\n\t\trequireExtension(def.extension, \"resource\");\n\t\tconst provides = def.provides;\n\t\tif (typeof provides !== \"object\" || provides === null || typeof provides.kind !== \"string\" || provides.kind.length === 0 || typeof provides.satisfies !== \"function\") throw new Error(\"resource() requires `provides` — the Contract this resource offers (a non-empty `kind` plus its `satisfies()`).\");\n\t\tthis.name = def.name;\n\t\tthis.extension = def.extension;\n\t\tthis.type = provides.kind;\n\t\tthis.provides = provides;\n\t}\n};\n/** The core leaf: exactly the base, frozen. */\nvar FrozenResourceNode = class extends ResourceNodeBase {\n\tconstructor(def) {\n\t\tsuper(def);\n\t\tfreezeNode(this);\n\t}\n};\n/**\n* Constructs a branded, frozen Resource node — an identity plus the Contract\n* it provides; the routing `type` is the contract's `kind`. Pure — nothing\n* is provisioned until a module provisions it.\n*/\nfunction resource(def) {\n\treturn new FrozenResourceNode(def);\n}\n/**\n* Constructs a branded, frozen Service node — declarations only (inputs,\n* params, the input schema, build adapter, and the ports it exposes). Pure;\n* carries no runtime behavior.\n*/\nfunction service(def) {\n\trequireName(def.name, \"service\");\n\trequireExtension(def.extension, \"service\");\n\trequireType(def.type, \"service\");\n\trequireConfigKeySegmentNames(Object.keys(def.inputs), \"input\", \"service\");\n\trequireConfigKeySegmentNames(Object.keys(def.params), \"param\", \"service\");\n\tif (def.expose !== void 0) requireNotReservedPortNames(Object.keys(def.expose), \"service\");\n\tif (def.input !== void 0 && typeof def.input[\"~standard\"]?.validate !== \"function\") throw new Error(\"service() `input` must be a Standard Schema (an object with a \\\"~standard\\\".validate function) — see https://standardschema.dev (ADR-0042).\");\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"service\",\n\t\tname: def.name,\n\t\textension: def.extension,\n\t\ttype: def.type,\n\t\tinputs: frozenShallowCopy(def.inputs),\n\t\tparams: freezeParams(def.params),\n\t\tinputSchema: blindCast(def.input),\n\t\tbuild: Object.freeze({ ...def.build }),\n\t\texpose: def.expose !== void 0 ? frozenShallowCopy(def.expose) : void 0\n\t});\n}\n/**\n* Constructs a branded, frozen DependencyEnd. `required` (if given) is the\n* contract Load compares a wired ref against via `satisfies()`; an unnamed\n* end's diagnostic `name` falls back to its `type`.\n*/\nfunction dependency(def) {\n\trequireType(def.type, \"dependency\");\n\trequireConfigKeySegmentNames(Object.keys(def.connection.params), \"param\", \"dependency\");\n\tconst connection = Object.freeze({\n\t\tparams: freezeParams(def.connection.params),\n\t\thydrate: def.connection.hydrate\n\t});\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"dependency\",\n\t\tname: def.name !== void 0 && def.name.length > 0 ? def.name : def.type,\n\t\ttype: def.type,\n\t\tconnection,\n\t\trequired: def.required\n\t});\n}\n/**\n* Constructs a branded, frozen Module node. Construction is INERT — the body is\n* wiring, not user code, and runs only when the module is Loaded.\n*/\nfunction module(name, boundaryOrBody, maybeBody) {\n\trequireName(name, \"module\");\n\tconst closedRoot = typeof boundaryOrBody === \"function\";\n\tconst boundary = closedRoot ? {} : boundaryOrBody;\n\trequireNotReservedPortNames(Object.keys(boundary.deps ?? {}), \"module\");\n\trequireNotReservedPortNames(Object.keys(boundary.expose ?? {}), \"module\");\n\tconst deps = frozenShallowCopy(boundary.deps ?? {});\n\tconst secretSlots = frozenShallowCopy(boundary.secrets ?? {});\n\tconst paramSlots = frozenShallowCopy(boundary.params ?? {});\n\tconst expose = frozenShallowCopy(boundary.expose ?? {});\n\tconst body = closedRoot ? (ctx) => {\n\t\tboundaryOrBody(ctx);\n\t\treturn {};\n\t} : maybeBody;\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"module\",\n\t\tname,\n\t\tdeps,\n\t\tsecretSlots,\n\t\tparamSlots,\n\t\texpose,\n\t\tbody\n\t});\n}\n/**\n* True if `value` was constructed by this module's factories. Checks the\n* brand only, never a prototype — a graph may mix nodes from a different\n* installed copy of core (dual-package hazard).\n*/\nfunction isNode(value) {\n\treturn typeof value === \"object\" && value !== null && value[NODE] === true;\n}\n//#endregion\n//#region src/toposort.ts\n/**\n* Stable topological sort: every edge's `from` precedes its `to` in the\n* result. Ties (nodes with no ordering constraint between them) keep their\n* relative order from `nodes` — so a graph already authored producer-first\n* comes out byte-identical to its pre-sort layout; only a graph that\n* genuinely needs reordering (e.g. a module wired via a forged ref pointing at a\n* not-yet-provisioned producer) actually moves. A Kahn's-algorithm variant\n* that always picks the ready node with the smallest original index. Edges\n* whose endpoint falls outside `nodes` (e.g. a service-root's input edges\n* targeting the root, which is appended separately) are ignored. Cycles\n* cannot reach here: `assertDependencyDag` already rejects them for\n* dependency edges, and input edges never cycle.\n*/\nfunction topoSort(nodes, edges) {\n\tconst byId = new Map(nodes.map((n) => [n.id, n]));\n\tconst indexOf = new Map(nodes.map((n, i) => [n.id, i]));\n\tconst indegree = new Map(nodes.map((n) => [n.id, 0]));\n\tconst successors = /* @__PURE__ */ new Map();\n\tfor (const edge of edges) {\n\t\tif (!byId.has(edge.from) || !byId.has(edge.to)) continue;\n\t\tconst targets = successors.get(edge.from) ?? [];\n\t\ttargets.push(edge.to);\n\t\tsuccessors.set(edge.from, targets);\n\t\tindegree.set(edge.to, (indegree.get(edge.to) ?? 0) + 1);\n\t}\n\tconst ready = new Set(nodes.filter((n) => indegree.get(n.id) === 0).map((n) => n.id));\n\tconst order = [];\n\twhile (ready.size > 0) {\n\t\tlet next;\n\t\tlet bestIndex = Number.POSITIVE_INFINITY;\n\t\tfor (const id of ready) {\n\t\t\tconst index = indexOf.get(id) ?? Number.POSITIVE_INFINITY;\n\t\t\tif (index < bestIndex) {\n\t\t\t\tbestIndex = index;\n\t\t\t\tnext = id;\n\t\t\t}\n\t\t}\n\t\tif (next === void 0) break;\n\t\tready.delete(next);\n\t\torder.push(next);\n\t\tfor (const target of successors.get(next) ?? []) {\n\t\t\tconst remaining = (indegree.get(target) ?? 0) - 1;\n\t\t\tindegree.set(target, remaining);\n\t\t\tif (remaining === 0) ready.add(target);\n\t\t}\n\t}\n\tif (order.length !== nodes.length) throw new InternalError(`topological sort processed ${order.length} of ${nodes.length} nodes — the graph contains a cycle that slipped past the DAG validation.`);\n\treturn order.map((id) => byId.get(id)).filter((n) => n !== void 0);\n}\n//#endregion\n//#region src/load-service.ts\n/**\n* The declared boundary ports of a module or service node at `id`: dep slots\n* as `in` ports (contractKind = the slot's `type`), exposed contracts as\n* `out` ports (contractKind = the contract's `kind`). A resource's one\n* `$out` port is recorded at its provision site instead (load-module.ts).\n*/\nfunction boundaryPortsOf(id, node) {\n\tconst ports = [];\n\tconst slots = node.kind === \"module\" ? node.deps : node.inputs;\n\tfor (const [name, slot] of Object.entries(slots)) {\n\t\tconst type = typeof slot === \"object\" && slot !== null && \"type\" in slot && typeof slot.type === \"string\" ? slot.type : void 0;\n\t\tports.push({\n\t\t\tnode: id,\n\t\t\tdirection: \"in\",\n\t\t\tname,\n\t\t\tcontractKind: type\n\t\t});\n\t}\n\tfor (const [name, contract] of Object.entries(node.expose ?? {})) {\n\t\tconst kind = typeof contract === \"object\" && contract !== null && \"kind\" in contract && typeof contract.kind === \"string\" ? contract.kind : void 0;\n\t\tports.push({\n\t\t\tnode: id,\n\t\t\tdirection: \"out\",\n\t\t\tname,\n\t\t\tcontractKind: kind\n\t\t});\n\t}\n\treturn ports;\n}\nfunction serviceInputs(service, serviceId) {\n\tif (typeof service.inputs !== \"object\" || service.inputs === null) throw new LoadError(`Service \"${serviceId}\" has no inputs map.`);\n\tconst nodes = [];\n\tconst edges = [];\n\tfor (const [input, value] of Object.entries(service.inputs)) {\n\t\tconst kind = isNode(value) ? value.kind : void 0;\n\t\tif (kind === \"resource\") throw new LoadError(`Input \"${input}\" of \"${serviceId}\" is a resource node — a resource is provisioned by the composing module, never created for a service that mentions it. Declare the input as a dependency (the pack's dependency factory) and wire the module-provisioned resource's ref into it.`);\n\t\tif (kind !== \"dependency\") throw new LoadError(`Input \"${input}\" of \"${serviceId}\" is not a branded dependency end (construct it with the dependency() factory).`);\n\t\tif (value.type.length === 0) throw new LoadError(`Input \"${input}\" of \"${serviceId}\" has an empty node type.`);\n\t\tconst id = `${serviceId}.${input}`;\n\t\tnodes.push({\n\t\t\tid,\n\t\t\tparent: serviceId,\n\t\t\tnode: value\n\t\t});\n\t\tedges.push({\n\t\t\tfrom: id,\n\t\t\tto: serviceId,\n\t\t\tinput,\n\t\t\tkind: \"input\"\n\t\t});\n\t}\n\treturn {\n\t\tnodes,\n\t\tedges\n\t};\n}\nfunction loadService(root, rootId) {\n\tfor (const [input, value] of Object.entries(root.inputs)) if (isNode(value) && value.kind === \"dependency\") throw new LoadError(`Service \"${rootId}\" has an unwired dependency input \"${input}\" — this service is composed by a module; deploy the module instead of loading \"${rootId}\" directly.`);\n\tif (root.inputSchema !== void 0) throw new LoadError(`Service \"${rootId}\" declares an input schema but is being loaded directly — a lone service has no enclosing scope to bind its input. Compose it inside a module whose provision() call binds \\`input: { … }\\` (ADR-0042).`);\n\tconst rootGraphNode = {\n\t\tid: rootId,\n\t\tparent: void 0,\n\t\tnode: root\n\t};\n\tconst { nodes, edges } = serviceInputs(root, rootId);\n\treturn {\n\t\troot: rootGraphNode,\n\t\tnodes: [...topoSort(nodes, edges), rootGraphNode],\n\t\tedges,\n\t\tports: boundaryPortsOf(rootId, root),\n\t\tauthoredEdges: [],\n\t\tinputBindings: [],\n\t\tparams: []\n\t};\n}\n//#endregion\n//#region src/load-module.ts\n/**\n* Brands a ref-port with the AUTHORED endpoint it stands for — which port of\n* which node the author wired, before any forwarding chain resolves. Read\n* only by `authoredSourceOf`; `__providerId` keeps carrying the resolved\n* producer for the flat (post-dereference) edges.\n*/\nconst AUTHORED_PORT = Symbol(\"prisma:authored-port\");\n/** The authored out-port brand carried by `ref`, if any. */\nfunction authoredPortOf(ref) {\n\tif (typeof ref !== \"object\" || ref === null) return void 0;\n\tconst brand = blindCast(ref)[AUTHORED_PORT];\n\tif (typeof brand !== \"object\" || brand === null) return void 0;\n\tconst { node, name } = blindCast(brand);\n\treturn typeof node === \"string\" && typeof name === \"string\" ? {\n\t\tnode,\n\t\tname\n\t} : void 0;\n}\n/**\n* Builds the ref a provision() call hands back: the id (so a producer with no\n* exposed ports — or an untyped slot — can still be wired wholesale) plus one\n* ref-port per exposed contract, each the contract's own runtime value (so\n* its `satisfies()` still works) tagged with the provider's id.\n*/\nfunction refFor(id, service) {\n\tconst ports = {};\n\tfor (const [port, contract] of Object.entries(service.expose ?? {})) ports[port] = {\n\t\t...contract,\n\t\t__providerId: id,\n\t\t[AUTHORED_PORT]: {\n\t\t\tnode: id,\n\t\t\tname: port\n\t\t}\n\t};\n\treturn blindCast({\n\t\tid,\n\t\t...ports\n\t});\n}\n/**\n* The resource variant of refFor: a resource has exactly one port — the\n* contract it provides — flattened onto the ref itself, tagged with the\n* provider id. `id` and the authored brand are written last so a hostile\n* contract value cannot clobber them.\n*/\nfunction refForResource(id, resource) {\n\treturn blindCast({\n\t\t...resource.provides,\n\t\t__providerId: id,\n\t\tid,\n\t\t[AUTHORED_PORT]: {\n\t\t\tnode: id,\n\t\t\tname: RESOURCE_OUT_PORT\n\t\t}\n\t});\n}\n/** A wired value's producer id: a ref-port's `__providerId`, or a bare ref's `id`. */\nfunction producerIdOf(ref) {\n\tif (typeof ref !== \"object\" || ref === null) return void 0;\n\tif (\"__providerId\" in ref && typeof ref.__providerId === \"string\") return ref.__providerId;\n\tif (\"id\" in ref && typeof ref.id === \"string\") return ref.id;\n}\n/**\n* Brands each `ctx.inputs` entry with the input key it stands for (see\n* flatten): diagnostic only — usage attribution relies on the per-key object\n* identity the branding copy creates, never on reading this back.\n*/\nconst MODULE_INPUT_KEY = Symbol(\"prisma:module-input-key\");\n/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.secrets` forwarding channel. */\nconst MODULE_SECRET_KEY = Symbol(\"prisma:module-secret-key\");\n/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.params` forwarding channel. */\nconst MODULE_PARAM_KEY = Symbol(\"prisma:module-param-key\");\n/** Whether `ref` carries a callable `satisfies` that accepts `required` truthily. */\nfunction satisfiesRequired(ref, required) {\n\treturn typeof ref === \"object\" && ref !== null && \"satisfies\" in ref && typeof ref.satisfies === \"function\" && ref.satisfies(required);\n}\n/**\n* Checks one recorded `wiring` object against the Deps it was wired against:\n* every named input exists and is a dependency slot, every referenced\n* producer is a real (by-now-provisioned) address, and a wired ref whose\n* slot declares a required contract must satisfy() it — no producer-kind\n* branching, the contract alone determines validity, whether the producer is\n* a service port or a resource. Shared by both provisioned kinds so a\n* module-as-child gets exactly the checks a service gets, and run once per\n* entry against the one `byId` shared by the whole recursive flatten, so a\n* forwarded ref resolves through to its real producer address regardless of\n* which ancestor scope provisioned it.\n*/\nfunction validateWiring(pending, byId) {\n\tconst { deps, wiring, targetId, targetKind, enclosingModuleName } = pending;\n\tfor (const [input, ref] of Object.entries(wiring)) {\n\t\tconst declared = blindCast(deps[input]);\n\t\tif (declared === void 0 || !isNode(declared) || declared.kind !== \"dependency\") throw new LoadError(`The deps for \"${targetId}\" name \"${input}\", which is not a dependency slot of that ${targetKind}.`);\n\t\tconst producerId = producerIdOf(ref);\n\t\tconst producer = producerId !== void 0 ? byId.get(producerId) : void 0;\n\t\tif (producerId === void 0 || producer === void 0) throw new LoadError(`The deps for \"${targetId}.${input}\" reference \"${String(producerId)}\", which is not provisioned in module \"${enclosingModuleName}\".`);\n\t\tconst required = declared.required;\n\t\tif (required !== void 0 && !satisfiesRequired(ref, required)) throw new LoadError(`The deps for \"${targetId}.${input}\" do not satisfy the slot's required contract.`);\n\t}\n\tfor (const [input, rawValue] of Object.entries(deps)) {\n\t\tconst value = blindCast(rawValue);\n\t\tif (!isNode(value) || wiring[input] !== void 0) continue;\n\t\tif (value.kind === \"dependency\") throw new LoadError(`Dependency input \"${input}\" of provisioned ${targetKind} \"${targetId}\" is not wired to a producer (module \"${enclosingModuleName}\").`);\n\t}\n}\n/**\n* Flattens a value into itself plus every nested object/array member value —\n* identity fodder for the ctx.secrets/ctx.params usage marking, which must\n* see a forwarded source wherever it sits inside an input binding (ADR-0042).\n* A secret/param source is an opaque leaf: it is pushed (a forwarded ref IS\n* such a source, so identity-matching still needs it) but never descended\n* into, so a ref buried in an unrelated source's payload is not falsely seen\n* as used. `seen` guards object cycles so a self-referential binding cannot\n* recurse forever.\n*/\nfunction deepValues(value, out, seen = /* @__PURE__ */ new WeakSet()) {\n\tout.push(value);\n\tif (typeof value !== \"object\" || value === null) return;\n\tif (isSecretSource(value) || isParamSource(value)) return;\n\tif (seen.has(value)) return;\n\tseen.add(value);\n\tconst members = Array.isArray(value) ? value : Object.values(value);\n\tfor (const member of members) deepValues(member, out, seen);\n}\n/** The (unvalidated) edges a `wiring` object implies — one dependency edge per entry; `validateWiring` does the real checking. */\nfunction wiringEdges(wiring, targetId) {\n\treturn Object.entries(wiring).map(([input, ref]) => ({\n\t\tfrom: producerIdOf(ref) ?? \"\",\n\t\tto: targetId,\n\t\tinput,\n\t\tkind: \"dependency\"\n\t}));\n}\n/**\n* Checks the secrets wired into one provisioned child MODULE: every declared\n* forwarding slot is bound to a real secret source (an `envSecret` or a\n* forwarded ctx.secrets ref), and no wired key names a slot the module\n* doesn't declare — the secret analog of `validateWiring`'s per-input checks,\n* but resolved inline (a source carries its own name, so no whole-graph pass\n* is needed).\n*/\nfunction validateSecretBinding(child, id, secretWiring, enclosingModuleName) {\n\tconst { kind } = child;\n\tfor (const slot of Object.keys(child.secretSlots)) {\n\t\tconst bound = secretWiring[slot];\n\t\tif (bound === void 0) throw new LoadError(`Secret slot \"${slot}\" of provisioned ${kind} \"${id}\" is not bound (module \"${enclosingModuleName}\") — bind it with envSecret('NAME') or forward ctx.secrets.`);\n\t\tif (!isSecretSource(bound)) throw new LoadError(`Secret slot \"${slot}\" of \"${id}\" (module \"${enclosingModuleName}\") was wired with a non-secret value — use envSecret('NAME') or a forwarded ctx.secrets ref.`);\n\t}\n\tfor (const slot of Object.keys(secretWiring)) if (!Object.hasOwn(child.secretSlots, slot)) throw new LoadError(`The secrets for \"${id}\" name \"${slot}\", which is not a secret slot of that ${kind} (module \"${enclosingModuleName}\").`);\n}\n/**\n* Checks the params wired into a provisioned SERVICE: unlike a secret slot, a\n* declared param is never required to be bound here — it may fall back to its\n* own `default` (checked later, at `buildConfig`) — so this only rejects a\n* wired key that names something other than a real declared param.\n*/\nfunction validateServiceParamBinding(child, id, paramWiring, enclosingModuleName) {\n\tfor (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.params, slot)) throw new LoadError(`The params for \"${id}\" name \"${slot}\", which is not a param of that service (module \"${enclosingModuleName}\").`);\n}\n/**\n* Checks the params wired into a provisioned MODULE: every declared\n* param-forwarding slot must be bound to a real `ParamSource` — a slot has no\n* schema of its own, so (unlike a service param) it cannot fall back to a\n* literal or a default; the param analog of `validateSecretBinding`.\n*/\nfunction validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {\n\tfor (const slot of Object.keys(child.paramSlots)) {\n\t\tconst bound = paramWiring[slot];\n\t\tif (bound === void 0) throw new LoadError(`Param slot \"${slot}\" of provisioned module \"${id}\" is not bound (module \"${enclosingModuleName}\") — bind it with a param source (e.g. envParam('NAME')) or forward ctx.params.`);\n\t\tif (!isParamSource(bound)) throw new LoadError(`Param slot \"${slot}\" of \"${id}\" (module \"${enclosingModuleName}\") was wired with a non-source value — a module param-forwarding slot carries no schema to validate a literal against; use envParam('NAME') or a forwarded ctx.params ref.`);\n\t}\n\tfor (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.paramSlots, slot)) throw new LoadError(`The params for \"${id}\" name \"${slot}\", which is not a param slot of that module (module \"${enclosingModuleName}\").`);\n}\n/**\n* Recursively flattens one module's body into the shared graph state and\n* returns its resolved ModuleOutputs (one ref-port per expose key) for the\n* caller (the enclosing provision() call, or Load itself for the root) to\n* use. `address` is this module's OWN full address, or `undefined` for the root\n* scope — its direct children then get bare (unprefixed) addresses, keeping\n* a single-level module identical to before nesting existed. `wiring` supplies a\n* resolved producer ref-port for each of this module's OWN declared deps (empty\n* for the root, which may not declare any — see the root non-empty-deps\n* check in loadModule). `nodes`, `edges`, `pending`, and `byId` are shared\n* across the ENTIRE recursive flatten, not per scope — a nested module may\n* forward in a producer provisioned by an ancestor scope, and it is the\n* shared `byId` (keyed by full address) that lets that resolve.\n*\n* `selfId` is this module's own node id — the root's given id when `address`\n* is `undefined`, the full address otherwise. It anchors the authored view:\n* children carry it as their `parent`, and this module's own boundary ports\n* (and the authored edges touching them) are recorded against it.\n*/\nfunction flatten(moduleNode, address, selfId, wiring, secretWiring, paramWiring, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges) {\n\tports.push(...boundaryPortsOf(selfId, moduleNode));\n\tconst localIds = /* @__PURE__ */ new Set();\n\tconst used = /* @__PURE__ */ new Set();\n\tconst usedSecrets = /* @__PURE__ */ new Set();\n\tconst usedParams = /* @__PURE__ */ new Set();\n\tconst ctxInputs = {};\n\tfor (const key of Object.keys(moduleNode.deps)) {\n\t\tconst wired = wiring[key];\n\t\tctxInputs[key] = typeof wired === \"object\" && wired !== null ? {\n\t\t\t...wired,\n\t\t\t[MODULE_INPUT_KEY]: key\n\t\t} : wired;\n\t}\n\tconst markUsed = (values) => {\n\t\tfor (const value of values) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);\n\t};\n\tconst authoredSourceOf = (value) => {\n\t\tfor (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) return {\n\t\t\tnode: selfId,\n\t\t\tdirection: \"in\",\n\t\t\tname: key\n\t\t};\n\t\tconst brand = authoredPortOf(value);\n\t\treturn brand === void 0 ? void 0 : {\n\t\t\tnode: brand.node,\n\t\t\tdirection: \"out\",\n\t\t\tname: brand.name\n\t\t};\n\t};\n\t/** Records the authored edge each wiring entry declares: source port → the target's own `in` port. */\n\tconst recordAuthoredWiring = (targetId, targetWiring) => {\n\t\tfor (const [input, ref] of Object.entries(targetWiring)) {\n\t\t\tconst from = authoredSourceOf(ref);\n\t\t\tif (from !== void 0) authoredEdges.push({\n\t\t\t\tfrom,\n\t\t\t\tto: {\n\t\t\t\t\tnode: targetId,\n\t\t\t\t\tdirection: \"in\",\n\t\t\t\t\tname: input\n\t\t\t\t}\n\t\t\t});\n\t\t}\n\t};\n\tconst ctxSecrets = {};\n\tfor (const key of Object.keys(moduleNode.secretSlots)) {\n\t\tconst bound = secretWiring[key];\n\t\tctxSecrets[key] = typeof bound === \"object\" && bound !== null ? {\n\t\t\t...bound,\n\t\t\t[MODULE_SECRET_KEY]: key\n\t\t} : bound;\n\t}\n\tconst markSecretsUsed = (values) => {\n\t\tfor (const value of values) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);\n\t};\n\tconst ctxParams = {};\n\tfor (const key of Object.keys(moduleNode.paramSlots)) {\n\t\tconst bound = paramWiring[key];\n\t\tctxParams[key] = typeof bound === \"object\" && bound !== null ? {\n\t\t\t...bound,\n\t\t\t[MODULE_PARAM_KEY]: key\n\t\t} : bound;\n\t}\n\tconst markParamsUsed = (values) => {\n\t\tfor (const value of values) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);\n\t};\n\tconst provision = (child, opts) => {\n\t\tconst id = opts?.id ?? child.name;\n\t\tconst provisionWiring = opts?.deps;\n\t\tconst provisionSecrets = opts?.secrets;\n\t\tconst provisionInput = opts?.input;\n\t\tconst provisionParams = opts?.params;\n\t\tif (typeof id !== \"string\" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module \"${moduleNode.name}\").`);\n\t\tif (!isConfigKeySegment(id)) throw new LoadError(`provision() id \"${id}\" (module \"${moduleNode.name}\") must contain only ASCII letters and digits ([A-Za-z0-9]) — the id becomes an address segment, and addresses derive deterministic config keys (segments uppercased and joined with \"_\"). \"${id}\" would put \"${id.toUpperCase()}\" inside the derived key. (\"_\" collides with the key separator and \".\" with the address separator.)`);\n\t\tif (localIds.has(id)) throw new LoadError(`Duplicate provision id \"${id}\" in module \"${moduleNode.name}\".`);\n\t\tconst untrusted = child;\n\t\tif (!isNode(untrusted) || untrusted.kind !== \"service\" && untrusted.kind !== \"resource\" && untrusted.kind !== \"module\") throw new LoadError(`provision(\"${id}\") expects a branded service, resource, or module node (construct it with the service()/resource()/module() factories or a pack's own).`);\n\t\tlocalIds.add(id);\n\t\tconst fullAddress = address === void 0 ? id : `${address}.${id}`;\n\t\tif (child.kind === \"resource\") {\n\t\t\tif (provisionWiring !== void 0) throw new LoadError(`provision(\"${id}\") received deps for a resource — a resource has no dependency slots to satisfy.`);\n\t\t\tif (provisionSecrets !== void 0) throw new LoadError(`provision(\"${id}\") received secrets for a resource — a resource has no secret slots to satisfy.`);\n\t\t\tif (provisionInput !== void 0) throw new LoadError(`provision(\"${id}\") received an input binding for a resource — a resource declares no input schema.`);\n\t\t\tif (provisionParams !== void 0) throw new LoadError(`provision(\"${id}\") received params for a resource — a resource has no params to satisfy.`);\n\t\t\tif (child.type.length === 0) throw new LoadError(`provision(\"${id}\") received a resource with an empty node type.`);\n\t\t\tbyId.set(fullAddress, child);\n\t\t\tnodes.push({\n\t\t\t\tid: fullAddress,\n\t\t\t\tparent: selfId,\n\t\t\t\tnode: child\n\t\t\t});\n\t\t\tports.push({\n\t\t\t\tnode: fullAddress,\n\t\t\t\tdirection: \"out\",\n\t\t\t\tname: RESOURCE_OUT_PORT,\n\t\t\t\tcontractKind: child.provides.kind\n\t\t\t});\n\t\t\treturn refForResource(fullAddress, child);\n\t\t}\n\t\tconst localWiring = { ...provisionWiring ?? {} };\n\t\tmarkUsed(Object.values(localWiring));\n\t\tconst localSecrets = { ...provisionSecrets ?? {} };\n\t\tmarkSecretsUsed(Object.values(localSecrets));\n\t\tconst localParams = { ...provisionParams ?? {} };\n\t\tmarkParamsUsed(Object.values(localParams));\n\t\tif (child.kind === \"service\") {\n\t\t\tif (provisionSecrets !== void 0) throw new LoadError(`provision(\"${id}\") received secrets for a service — a service takes its secrets as envSecret(...) leaves of its \\`input\\` binding (ADR-0042), not a secrets map.`);\n\t\t\tif (child.inputSchema !== void 0 && provisionInput === void 0) throw new LoadError(`Input of provisioned service \"${id}\" is not bound (module \"${moduleNode.name}\") — the service declares an input schema; bind it with \\`input: { … }\\` on its provision() call.`);\n\t\t\tif (child.inputSchema === void 0 && provisionInput !== void 0) throw new LoadError(`provision(\"${id}\") received an input binding, but the service declares no input schema (module \"${moduleNode.name}\").`);\n\t\t\tif (provisionInput !== void 0) {\n\t\t\t\tconst leaves = [];\n\t\t\t\tdeepValues(provisionInput, leaves);\n\t\t\t\tmarkSecretsUsed(leaves);\n\t\t\t\tmarkParamsUsed(leaves);\n\t\t\t\tinputBindings.push({\n\t\t\t\t\tserviceAddress: fullAddress,\n\t\t\t\t\tbinding: blindCast(provisionInput)\n\t\t\t\t});\n\t\t\t}\n\t\t\tvalidateServiceParamBinding(child, id, localParams, moduleNode.name);\n\t\t\tfor (const [slot, binding] of Object.entries(localParams)) paramBindings.push({\n\t\t\t\tserviceAddress: fullAddress,\n\t\t\t\tslot,\n\t\t\t\tbinding\n\t\t\t});\n\t\t\tconst inputs = serviceInputs(child, fullAddress);\n\t\t\tnodes.push(...inputs.nodes, {\n\t\t\t\tid: fullAddress,\n\t\t\t\tparent: selfId,\n\t\t\t\tnode: child\n\t\t\t});\n\t\t\tedges.push(...inputs.edges, ...wiringEdges(localWiring, fullAddress));\n\t\t\tports.push(...boundaryPortsOf(fullAddress, child));\n\t\t\trecordAuthoredWiring(fullAddress, localWiring);\n\t\t\tpending.push({\n\t\t\t\tdeps: child.inputs,\n\t\t\t\twiring: localWiring,\n\t\t\t\ttargetId: fullAddress,\n\t\t\t\ttargetKind: \"service\",\n\t\t\t\tenclosingModuleName: moduleNode.name\n\t\t\t});\n\t\t\tbyId.set(fullAddress, child);\n\t\t\treturn refFor(fullAddress, child);\n\t\t}\n\t\tif (provisionInput !== void 0) throw new LoadError(`provision(\"${id}\") received an input binding for a module — a module has no input schema; bind the input on the service that declares it.`);\n\t\tvalidateSecretBinding(child, id, localSecrets, moduleNode.name);\n\t\tvalidateParamNeedBinding(child, id, localParams, moduleNode.name);\n\t\tedges.push(...wiringEdges(localWiring, fullAddress));\n\t\trecordAuthoredWiring(fullAddress, localWiring);\n\t\tpending.push({\n\t\t\tdeps: child.deps,\n\t\t\twiring: localWiring,\n\t\t\ttargetId: fullAddress,\n\t\t\ttargetKind: \"module\",\n\t\t\tenclosingModuleName: moduleNode.name\n\t\t});\n\t\tconst childOutputs = flatten(child, fullAddress, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges);\n\t\tnodes.push({\n\t\t\tid: fullAddress,\n\t\t\tparent: selfId,\n\t\t\tnode: child\n\t\t});\n\t\tbyId.set(fullAddress, child);\n\t\tconst brandedOutputs = {};\n\t\tfor (const [key, value] of Object.entries(childOutputs)) brandedOutputs[key] = typeof value === \"object\" && value !== null ? {\n\t\t\t...value,\n\t\t\t[AUTHORED_PORT]: {\n\t\t\t\tnode: fullAddress,\n\t\t\t\tname: key\n\t\t\t}\n\t\t} : value;\n\t\treturn blindCast({\n\t\t\tid: fullAddress,\n\t\t\t...brandedOutputs\n\t\t});\n\t};\n\tconst ctx = blindCast({\n\t\tinputs: ctxInputs,\n\t\tsecrets: ctxSecrets,\n\t\tparams: ctxParams,\n\t\tprovision: blindCast(provision)\n\t});\n\tconst outputs = blindCast(moduleNode.body(ctx) ?? {});\n\tmarkUsed(Object.values(outputs));\n\tfor (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares input \"${key}\" but never forwards it into a provision nor returns it as an output.`);\n\tfor (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares secret \"${key}\" but never forwards it into a provision.`);\n\tfor (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares param \"${key}\" but never forwards it into a provision.`);\n\tfor (const [key, contract] of Object.entries(moduleNode.expose)) {\n\t\tconst port = outputs[key];\n\t\tif (port === void 0) throw new LoadError(`Module \"${moduleNode.name}\" declares expose \"${key}\" but its body did not return a port for it.`);\n\t\tif (!satisfiesRequired(port, contract)) throw new LoadError(`Module \"${moduleNode.name}\"'s returned port for expose \"${key}\" does not satisfy its declared contract.`);\n\t\tconst from = authoredSourceOf(port);\n\t\tif (from !== void 0) authoredEdges.push({\n\t\t\tfrom,\n\t\t\tto: {\n\t\t\t\tnode: selfId,\n\t\t\t\tdirection: \"out\",\n\t\t\t\tname: key\n\t\t\t}\n\t\t});\n\t}\n\treturn outputs;\n}\nfunction loadModule(root, opts) {\n\tconst rootId = opts?.id ?? root.name;\n\tconst rootDepKeys = Object.keys(root.deps);\n\tif (rootDepKeys.length > 0) {\n\t\tconst names = rootDepKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares input${rootDepKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to wire them; compose \"${root.name}\" from another module that provisions and wires it instead.`);\n\t}\n\tconst rootSecretKeys = Object.keys(root.secretSlots);\n\tif (rootSecretKeys.length > 0) {\n\t\tconst names = rootSecretKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares secret${rootSecretKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds secrets with envSecret('NAME'), it does not declare secret slots of its own.`);\n\t}\n\tconst rootParamKeys = Object.keys(root.paramSlots);\n\tif (rootParamKeys.length > 0) {\n\t\tconst names = rootParamKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares param${rootParamKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds params directly on each provision() call, it does not declare param-forwarding slots of its own.`);\n\t}\n\tconst nodes = [];\n\tconst edges = [];\n\tconst pending = [];\n\tconst inputBindings = [];\n\tconst paramBindings = [];\n\tconst byId = /* @__PURE__ */ new Map();\n\tconst ports = [];\n\tconst authoredEdges = [];\n\tflatten(root, void 0, rootId, {}, {}, {}, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges);\n\tfor (const entry of pending) validateWiring(entry, byId);\n\tassertDependencyDag(edges);\n\tconst rootGraphNode = {\n\t\tid: rootId,\n\t\tparent: void 0,\n\t\tnode: root\n\t};\n\treturn {\n\t\troot: rootGraphNode,\n\t\tnodes: [...topoSort(nodes, edges), rootGraphNode],\n\t\tedges,\n\t\tports,\n\t\tauthoredEdges,\n\t\tinputBindings,\n\t\tparams: paramBindings\n\t};\n}\n/**\n* The dependency edges must form a DAG — a cycle means neither producer can\n* deploy first. Resources take no wiring, so only service/module-to-service/module\n* edges can ever participate in a cycle; no special-casing needed.\n*/\nfunction assertDependencyDag(edges) {\n\tconst adjacency = /* @__PURE__ */ new Map();\n\tfor (const edge of edges) {\n\t\tif (edge.kind !== \"dependency\") continue;\n\t\tconst targets = adjacency.get(edge.from) ?? [];\n\t\ttargets.push(edge.to);\n\t\tadjacency.set(edge.from, targets);\n\t}\n\tconst visiting = /* @__PURE__ */ new Set();\n\tconst done = /* @__PURE__ */ new Set();\n\tconst stack = [];\n\tconst visit = (id) => {\n\t\tif (done.has(id)) return;\n\t\tif (visiting.has(id)) throw new LoadError(`Dependency cycle: ${[...stack.slice(stack.indexOf(id)), id].join(\" → \")} — no deploy order exists.`);\n\t\tvisiting.add(id);\n\t\tstack.push(id);\n\t\tfor (const next of adjacency.get(id) ?? []) visit(next);\n\t\tstack.pop();\n\t\tvisiting.delete(id);\n\t\tdone.add(id);\n\t};\n\tfor (const id of adjacency.keys()) visit(id);\n}\n//#endregion\n//#region src/graph.ts\n/**\n* Builds the in-memory graph from a root node. A service root walks its own\n* `inputs`; a module root executes its body (wiring, not user code — the\n* designed exception to imports-run-nothing) and recursively flattens every\n* module it provisions into one graph of hierarchical addresses. A malformed\n* graph is a `LoadError` that names its fix; the individual validation rules\n* live with `loadService` / `loadModule` and are covered by name in the Load\n* tests. Executes nothing of the user's own code beyond module bodies.\n*/\nfunction Load(root, opts) {\n\tif (!isNode(root)) throw new LoadError(\"Load expects a branded service or module node (construct it with the service()/module() factories).\");\n\tif (root.kind === \"module\") return loadModule(root, opts);\n\tif (root.kind === \"service\") return loadService(root, opts?.id ?? \"root\");\n\tthrow new LoadError(\"Load expects a service or module root (received another node kind).\");\n}\n//#endregion\nexport { LoadError as _, isNode as a, isSecretSource as c, paramSource as d, provisionNeed as f, service as g, secretSource as h, freezeNode as i, module as l, secret as m, ResourceNodeBase as n, isParamSource as o, resource as p, dependency as r, isProvisionNeed as s, Load as t, paramNeed as u, RESOURCE_OUT_PORT as v };\n\n//# sourceMappingURL=graph-BfKAg2Ap.mjs.map","import { t as blindCast } from \"./casts-DpaahrlC.mjs\";\n//#region src/secret.ts\n/**\n* A value wrapper that redacts everywhere except the one explicit reader,\n* `expose()`. Sensitivity is carried by the TYPE (`SecretBox<T>`), not a flag a\n* sink must remember to check: `String(box)`, template interpolation,\n* `JSON.stringify`, and `console.log`/`util.inspect` all print `[REDACTED]`, so\n* a secret can't leak through an accidental log or serialization.\n*\n* Every box carries a brand property keyed by the registered symbol\n* `Symbol.for('prisma:secret-box')`, which is what `isSecretString` checks. A\n* symbol key is invisible to `JSON.stringify` and `Object.keys`, so the box's\n* public shape still matches the platform's own `secrecy` type\n* (pdp-control-plane).\n*/\nconst REDACTED = \"[REDACTED]\";\nconst SECRET_BOX = blindCast(Symbol.for(\"prisma:secret-box\"));\nvar SecretBox = class {\n\t[SECRET_BOX] = true;\n\t#value;\n\tconstructor(value) {\n\t\tthis.#value = value;\n\t}\n\t/** The sole explicit door to the wrapped value. */\n\texpose() {\n\t\treturn this.#value;\n\t}\n\ttoString() {\n\t\treturn REDACTED;\n\t}\n\ttoJSON() {\n\t\treturn REDACTED;\n\t}\n\tvalueOf() {\n\t\treturn REDACTED;\n\t}\n\t[Symbol.toPrimitive]() {\n\t\treturn REDACTED;\n\t}\n\t[Symbol.for(\"nodejs.util.inspect.custom\")]() {\n\t\treturn REDACTED;\n\t}\n};\n/**\n* True for a redacting secret box — what a schema's secret leaf checks\n* (ADR-0042). Reads the brand rather than `instanceof`, so a box from a\n* duplicated module copy in a bundle counts and a look-alike does not.\n*/\nfunction isSecretString(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[SECRET_BOX] === true;\n}\n//#endregion\nexport { isSecretString as n, SecretBox as t };\n\n//# sourceMappingURL=secret-DoWGmN7m.mjs.map","import { _ as LoadError, a as isNode, c as isSecretSource, d as paramSource, f as provisionNeed, g as service, h as secretSource, i as freezeNode, l as module, m as secret, n as ResourceNodeBase, o as isParamSource, p as resource, r as dependency, s as isProvisionNeed, t as Load, u as paramNeed, v as RESOURCE_OUT_PORT } from \"./graph-BfKAg2Ap.mjs\";\nimport { SecretBox, isSecretString } from \"@internal/foundation/secret\";\n//#region src/config.ts\n/**\n* A data-only descriptor of a param's schema for introspection — the\n* validator's vendor tag, never the schema's own `validate`. `configOf`\n* reports it where the old model reported `type: 'string' | 'number'`, so the\n* config surface stays enumerable without leaking a function. Nothing consumes\n* more than the vendor tag yet; a richer projection (e.g. a JSON-Schema export\n* when the vendor offers one) is an additive change if a consumer needs it.\n*/\nfunction projectSchema(schema) {\n\treturn { vendor: schema[\"~standard\"].vendor };\n}\n/**\n* Enumerates every config param the service declares: each input's connection\n* params, then the service's own params. Pure — reads `root.inputs`/`params`\n* directly, executes nothing but the (also pure) schema projection. Deliberately\n* does not go through `Load`: a service's connection-end inputs are legitimately\n* unwired from its own point of view (wiring is an enclosing module's concern),\n* and this introspects one service's declared shape regardless of how — or\n* whether — it composes into a larger graph.\n*/\nfunction configOf(root) {\n\tconst entries = [];\n\tfor (const [input, value] of Object.entries(root.inputs)) {\n\t\tif (typeof value !== \"object\" || value === null) continue;\n\t\tfor (const [name, param] of Object.entries(value.connection.params)) entries.push({\n\t\t\towner: { input },\n\t\t\tname,\n\t\t\tschema: projectSchema(param.schema),\n\t\t\toptional: param.optional === true,\n\t\t\tdefault: param.default\n\t\t});\n\t}\n\tfor (const [name, param] of Object.entries(root.params)) entries.push({\n\t\towner: \"service\",\n\t\tname,\n\t\tschema: projectSchema(param.schema),\n\t\toptional: param.optional === true,\n\t\tdefault: param.default\n\t});\n\treturn entries;\n}\n/**\n* The app's input manifest: every service input binding a `provision()` call\n* supplied (ADR-0042). Pure graph introspection, TARGET-AGNOSTIC — a deploy\n* target's recursive descent classifies the binding's leaves (its preflight\n* verifies each `envSecret` leaf's platform var exists before deploy; the\n* values are provisioned out-of-band).\n*/\nfunction inputManifest(graph) {\n\treturn graph.inputBindings;\n}\n/**\n* The app's param-binding manifest: every param a `provision()` call bound —\n* literal or an opaque, target-defined `ParamSource` — at the address that\n* declared it. The param sibling of `provisionManifest`, for a deploy\n* target's own preflight to consume. Pure graph introspection,\n* TARGET-AGNOSTIC; a param this manifest omits simply falls back to its own\n* `default` at `buildConfig`.\n*/\nfunction paramManifest(graph) {\n\treturn graph.params;\n}\nfunction scalarSchema(name, check) {\n\treturn { \"~standard\": {\n\t\tversion: 1,\n\t\tvendor: \"@prisma/composer\",\n\t\tvalidate: (value) => check(value) ? { value } : { issues: [{ message: `expected ${name}, got ${typeof value}` }] }\n\t} };\n}\nconst stringSchema = scalarSchema(\"string\", (v) => typeof v === \"string\");\nconst numberSchema = scalarSchema(\"number\", (v) => typeof v === \"number\" && Number.isFinite(v));\nfunction withFacets(schema, opts) {\n\treturn {\n\t\tschema,\n\t\t...opts.optional !== void 0 ? { optional: opts.optional } : {},\n\t\t...opts.default !== void 0 ? { default: opts.default } : {},\n\t\t...opts.provision !== void 0 ? { provision: opts.provision } : {}\n\t};\n}\n/** A string-valued param. */\nfunction string(opts = {}) {\n\treturn withFacets(stringSchema, opts);\n}\n/** A number-valued param. */\nfunction number(opts = {}) {\n\treturn withFacets(numberSchema, opts);\n}\n/** A param over any caller-supplied Standard Schema — a structured `jobs`, say. */\nfunction param(schema, opts = {}) {\n\treturn withFacets(schema, opts);\n}\n//#endregion\n//#region src/hydrate.ts\n/**\n* Given a service and a concrete typed Config, hydrate every input\n* (connection.hydrate with its typed value slice). A resource dep and a\n* connection dep hydrate through identical machinery — the loaded client is\n* indistinguishable. The service's own params ride alongside in\n* `config.service`; the node's `load()` merges the two.\n*/\nasync function hydrate(root, config) {\n\tconst deps = {};\n\tfor (const [name, inputNode] of Object.entries(root.inputs)) {\n\t\tconst values = config.inputs[name] ?? {};\n\t\tdeps[name] = await inputNode.connection.hydrate(values);\n\t}\n\treturn deps;\n}\n/**\n* Synchronous hydrate — what the node's `load()` uses so\n* `const { db } = service.load()` reads without `await`. Requires every\n* connection.hydrate to return synchronously; a Promise return is a loud error\n* naming the input (an async client factory must use the async `hydrate` path).\n*/\nfunction hydrateSync(root, config) {\n\tconst deps = {};\n\tfor (const [name, inputNode] of Object.entries(root.inputs)) {\n\t\tconst values = config.inputs[name] ?? {};\n\t\tconst client = inputNode.connection.hydrate(values);\n\t\tif (client instanceof Promise) throw new Error(`Connection hydrate for input \"${name}\" returned a Promise; load() requires a synchronous client factory.`);\n\t\tdeps[name] = client;\n\t}\n\treturn deps;\n}\n//#endregion\nexport { Load, LoadError, RESOURCE_OUT_PORT, ResourceNodeBase, SecretBox, configOf, dependency, freezeNode, hydrate, hydrateSync, inputManifest, isNode, isParamSource, isProvisionNeed, isSecretSource, isSecretString, module, number, param, paramManifest, paramNeed, paramSource, provisionNeed, resource, secret, secretSource, service, string };\n\n//# sourceMappingURL=index.mjs.map","import { n as configFileMissing, t as checkComposerConfig } from \"./composer-config-CY9fET8H.mjs\";\nimport * as mod from \"node:module\";\nimport * as fs from \"node:fs\";\nimport { existsSync } from \"node:fs\";\nimport { blindCast } from \"@internal/foundation/casts\";\nimport { CliStructuredError } from \"@internal/foundation/errors\";\nimport * as path from \"node:path\";\nimport { assembleServices } from \"@internal/assemble\";\nimport { Load, isNode } from \"@internal/core\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\n//#region src/entry-resolution.ts\n/**\n* Synchronous Node resolve hook so that entry modules may import relative\n* files using the specifier forms TypeScript accepts by default —\n* extensionless `./service` and `./service.js` for a `.ts` source file —\n* without requiring `allowImportingTsExtensions` in every consumer's tsconfig.\n*\n* Resolution only; uses TypeScript's own documented mapping: for a specifier\n* Node could not resolve, strip any JS-family extension and probe the\n* corresponding TypeScript source; first candidate that exists on disk wins.\n* Format-specific rules: `.mjs` → `.mts`; `.cjs` → `.cts`; `.js` and\n* extensionless → `.ts`, `.mts`, `.tsx`, then `./index.ts`. Bare and package\n* specifiers are never touched. Existing `./x.ts` imports keep working —\n* Node resolves them before the hook fires (ADR-0005: no transform, no\n* guessing, deterministic TypeScript rule).\n*\n* Bun resolves `./x.js` and `./x` to `x.ts` natively, so the hook is a\n* no-op under Bun. Nothing is registered there.\n*/\nlet registered = false;\n/**\n* Registers the resolve hook once (idempotent). Call at the start of\n* `loadEntry` so every module in the entry graph benefits, including those\n* imported lazily after the entry itself loads.\n*/\nfunction registerEntryResolution() {\n\tif (registered || typeof process.versions.bun === \"string\") return;\n\tif (typeof mod.registerHooks !== \"function\") return;\n\tregistered = true;\n\tmod.registerHooks({ resolve(specifier, context, nextResolve) {\n\t\ttry {\n\t\t\treturn nextResolve(specifier, context);\n\t\t} catch (error) {\n\t\t\tif (!isRelativeSpecifier(specifier) || context.parentURL === void 0 || !isModuleNotFoundError(error)) throw error;\n\t\t\tfor (const candidate of sourceCandidates(new URL(specifier, context.parentURL))) if (existsSync(fileURLToPath(candidate))) return nextResolve(candidate.href, context);\n\t\t\tthrow error;\n\t\t}\n\t} });\n}\n/**\n* TypeScript's extension mapping: for a JS-family or extensionless URL,\n* produce the source candidates to probe. Format-specific: `.mjs` maps only\n* to `.mts`; `.cjs` maps only to `.cts`; `.js` and extensionless probe\n* `.ts`, `.mts`, `.tsx` (keeping `.tsx` so the JSX diagnostic fires), then\n* `./index.ts`.\n*/\nfunction sourceCandidates(resolved) {\n\tconst href = resolved.href;\n\tif (href.endsWith(\".mjs\")) {\n\t\tconst base = href.slice(0, -4);\n\t\treturn [new URL(`${base}.mts`)];\n\t}\n\tif (href.endsWith(\".cjs\")) {\n\t\tconst base = href.slice(0, -4);\n\t\treturn [new URL(`${base}.cts`)];\n\t}\n\tconst base = href.endsWith(\".js\") ? href.slice(0, -3) : href;\n\treturn [\n\t\tnew URL(`${base}.ts`),\n\t\tnew URL(`${base}.mts`),\n\t\tnew URL(`${base}.tsx`),\n\t\tnew URL(`${base}/index.ts`)\n\t];\n}\nfunction isRelativeSpecifier(specifier) {\n\treturn specifier.startsWith(\"./\") || specifier.startsWith(\"../\");\n}\nfunction isModuleNotFoundError(error) {\n\tif (!(error instanceof Error)) return false;\n\tif (!(\"code\" in error)) return false;\n\treturn error.code === \"ERR_MODULE_NOT_FOUND\";\n}\n//#endregion\n//#region src/jsx-load-error.ts\n/**\n* `loadEntry` imports a user's topology with the host runtime's own module\n* loader — under node (the CLI's shebang runtime), that loader strips\n* TypeScript types but has no JSX transform (ADR-0005: the framework\n* doesn't bundle or transform the app's code; deploy loading is no\n* exception). A `.tsx`/`.jsx` file anywhere in the topology's import graph\n* dies with node's raw `ERR_UNKNOWN_FILE_EXTENSION`, which names the file\n* but not the cause or the fix. This turns that one case into structured\n* error parts (summary/why/fix) that do — every other load failure (syntax\n* errors, missing files, non-JSX unknown extensions) is untouched.\n*/\nconst UNKNOWN_EXTENSION_CODE = \"ERR_UNKNOWN_FILE_EXTENSION\";\nconst JSX_EXTENSIONS = [\".tsx\", \".jsx\"];\nfunction errorCode(error) {\n\treturn \"code\" in error && typeof error.code === \"string\" ? error.code : void 0;\n}\nfunction unknownExtensionPath(error) {\n\tif (!(error instanceof Error)) return void 0;\n\tif (errorCode(error) !== UNKNOWN_EXTENSION_CODE) return void 0;\n\treturn /Unknown file extension \"\\.\\w+\" for (.+)$/.exec(error.message)?.[1];\n}\n/**\n* Returns structured error parts when `error` is node's\n* `ERR_UNKNOWN_FILE_EXTENSION` for a `.tsx`/`.jsx` file — `undefined` for\n* every other error (including unknown-extension failures for some other\n* extension), so the caller can fall through to its normal rethrow.\n*/\nfunction explainJsxLoadError(error, entryPath) {\n\tconst offendingPath = unknownExtensionPath(error);\n\tif (offendingPath === void 0) return void 0;\n\tif (!JSX_EXTENSIONS.some((ext) => offendingPath.endsWith(ext))) return void 0;\n\treturn {\n\t\tsummary: `\"${offendingPath}\" can't be loaded.`,\n\t\twhy: `deploy loads \"${entryPath}\"'s topology with node's own module loader, which strips TypeScript types but has no JSX transform — so a .tsx/.jsx file can't sit anywhere in that import graph.`,\n\t\tfix: \"Precompile that file in your own build (transform the JSX away, keep the real npm packages external) and import the compiled output instead of the raw .tsx/.jsx — see examples/email/scripts/build.ts in the prisma/composer repo for a worked example.\"\n\t};\n}\n//#endregion\n//#region src/load-entry.ts\n/**\n* Pipeline step 1 (deploy-cli.md § The pipeline): import the entry module\n* (resolved against cwd) and require its default export to be a node — a\n* service or module, branded by core's factories. Whatever this module exports\n* IS the application; nothing else marks a root (ADR-0003).\n*/\nasync function loadEntry(entryArg, cwd) {\n\tregisterEntryResolution();\n\tconst resolvedPath = path.resolve(cwd, entryArg);\n\tlet mod;\n\ttry {\n\t\tmod = await import(pathToFileURL(resolvedPath).href);\n\t} catch (error) {\n\t\tconst explained = explainJsxLoadError(error, resolvedPath);\n\t\tif (explained !== void 0) throw new CliStructuredError(\"COMPOSE.ENTRY_UNLOADABLE\", explained.summary, {\n\t\t\twhy: explained.why,\n\t\t\tfix: explained.fix,\n\t\t\twhere: { path: resolvedPath },\n\t\t\tcause: error\n\t\t});\n\t\tthrow new CliStructuredError(\"COMPOSE.ENTRY_UNLOADABLE\", `Failed to import entry module \"${resolvedPath}\": ${error instanceof Error ? error.message : String(error)}`, {\n\t\t\twhere: { path: resolvedPath },\n\t\t\tcause: error\n\t\t});\n\t}\n\tconst root = blindCast(mod).default;\n\tif (!isNode(root) || root.kind === \"dependency\" || root.kind === \"resource\") throw new CliStructuredError(\"COMPOSE.ENTRY_EXPORT_INVALID\", `Entry module \"${resolvedPath}\" must default-export a node (a service or a module).`, {\n\t\tfix: \"Construct it with service() or module() from @prisma/composer.\",\n\t\twhere: { path: resolvedPath }\n\t});\n\treturn {\n\t\tpath: resolvedPath,\n\t\troot: blindCast(root)\n\t};\n}\n//#endregion\n//#region src/validate-coverage.ts\nfunction lookup(extensions, extension, type, expectedKind, what) {\n\tconst ext = extensions.get(extension);\n\tif (ext === void 0) throw new CliStructuredError(\"CONFIG.EXTENSION_MISSING\", `No extension \"${extension}\" is configured (needed by ${what}).`, {\n\t\tfix: \"Add it to `extensions` in the `composer` section of prisma.config.ts (import its /control entry and list its descriptor).\",\n\t\tmeta: {\n\t\t\textension,\n\t\t\ttype\n\t\t}\n\t});\n\tconst descriptor = ext.nodes[type];\n\tif (descriptor === void 0) throw new CliStructuredError(\"CONFIG.DESCRIPTOR_MISSING\", `Extension \"${extension}\" has no descriptor for node type \"${type}\" (needed by ${what}).`, {\n\t\twhy: `Known types: ${Object.keys(ext.nodes).join(\", \")}.`,\n\t\tmeta: {\n\t\t\textension,\n\t\t\ttype\n\t\t}\n\t});\n\tif (descriptor.kind !== expectedKind) throw new CliStructuredError(\"CONFIG.DESCRIPTOR_KIND_MISMATCH\", `Extension \"${extension}\"'s descriptor for node type \"${type}\" is a \"${descriptor.kind}\" descriptor — ${what} needs a \"${expectedKind}\" descriptor.`, { meta: {\n\t\textension,\n\t\ttype,\n\t\tkind: descriptor.kind\n\t} });\n}\n/** Throws a structured CONFIG.* error on the first uncovered `(extension, type)`; silent when the config covers the whole graph. */\nfunction validateRegistryCoverage(graph, config) {\n\tconst extensions = new Map(config.extensions.map((descriptor) => [descriptor.id, descriptor]));\n\tfor (const { id, node } of graph.nodes) {\n\t\tif (node.kind === \"resource\") {\n\t\t\tlookup(extensions, node.extension, node.type, \"resource\", `resource node \"${id}\"`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (node.kind !== \"service\") continue;\n\t\tlookup(extensions, node.extension, node.type, \"service\", `service node \"${id}\"`);\n\t\tlookup(extensions, node.build.extension, node.build.type, \"build\", `service node \"${id}\"'s build descriptor`);\n\t}\n}\n//#endregion\n//#region src/pipeline.ts\n/**\n* The shared prefix of `deploy`/`destroy`/`dev` (deploy-cli.md § The\n* pipeline; local-dev spec § 6): entry load, Load,\n* registry coverage validation, name resolution, assemble. Deploy and dev\n* diverge after this — deploy resolves containers/preflight/stack file\n* against the hosted providers, dev against the local ones — so everything\n* up to and including assemble lives here once, consumed verbatim by both\n* `run()` (main.ts) and `runDev()` (dev/run-dev.ts), so the two pipelines\n* cannot drift.\n*/\nfunction configError(findings, file) {\n\tconst [first] = findings;\n\treturn new CliStructuredError(first.code, first.summary, {\n\t\t...first.why === void 0 ? {} : { why: first.why },\n\t\tfix: first.fix,\n\t\twhere: { path: first.where ?? file },\n\t\tmeta: {\n\t\t\t...first.field === void 0 ? {} : { field: first.field },\n\t\t\tfindings\n\t\t}\n\t});\n}\n/**\n* Refuses a caller's config with the same findings, in the same order, as the CLI's section validator.\n* The error is the first finding and carries all of them in `meta.findings`. Returns the config with `file` resolved against `cwd`.\n*/\nfunction checkConfigSource(source, cwd) {\n\tconst file = path.resolve(cwd, source.file);\n\tif (!fs.existsSync(file)) throw configError([configFileMissing(file)], file);\n\tconst checked = checkComposerConfig(source.value, file);\n\tif (!checked.ok) throw configError(checked.findings, file);\n\treturn {\n\t\tvalue: checked.value,\n\t\tfile\n\t};\n}\n/**\n* The pipeline's front — entry load and name resolution —\n* WITHOUT Load, coverage, or assemble. `log` needs only who the app is (its\n* config and resolved name) to reach the already-running local instance; it\n* neither builds nor provisions, so it must not require the user's built\n* output the way the full pipeline does.\n*/\nasync function resolveAppIdentity(entry, overrideName, cwd, config) {\n\tconst { value } = checkConfigSource(config, cwd);\n\tconst entryModule = await loadEntry(entry, cwd);\n\tconst name = overrideName ?? entryModule.root.name;\n\tif (name.length === 0) throw new CliStructuredError(\"COMPOSE.NAME_MISSING\", \"The root node has no name.\", { fix: \"Name it at authoring, or pass --name.\" });\n\treturn {\n\t\tconfig: value,\n\t\tname\n\t};\n}\n/**\n* Runs entry load, Load, registry coverage, name resolution, and assemble — steps 1–5 of `run()`. `onAssembleError`, when\n* given, lets a caller decorate an assemble failure with command-specific\n* guidance (destroy's \"build first\" hint) without this shared step knowing\n* about any one command.\n*/\nasync function runPipeline(entry, overrideName, cwd, source, deps = {}, onAssembleError) {\n\tconst configSource = checkConfigSource(source, cwd);\n\tconst config = configSource.value;\n\tconst entryModule = await loadEntry(entry, cwd);\n\tconst graph = Load(entryModule.root);\n\tif (graph.root.node.kind !== \"module\") throw new CliStructuredError(\"COMPOSE.ROOT_NOT_MODULE\", \"The deploy root must be a module.\", { fix: \"Wrap your service, e.g. export default module('name', ({ provision }) => { provision(service); }).\" });\n\tvalidateRegistryCoverage(graph, config);\n\tconst name = overrideName ?? entryModule.root.name;\n\tif (name.length === 0) throw new CliStructuredError(\"COMPOSE.NAME_MISSING\", \"The root node has no name.\", { fix: \"Name it at authoring, or pass --name.\" });\n\tdeps.onEvent?.({ kind: \"loaded\" });\n\tlet assembled;\n\ttry {\n\t\tassembled = await assembleServices(graph, config, cwd, deps.runAssembler, deps.onEvent);\n\t} catch (error) {\n\t\tif (onAssembleError !== void 0 && error instanceof Error) throw onAssembleError(error);\n\t\tthrow error;\n\t}\n\treturn {\n\t\tconfigSource,\n\t\tentryModule,\n\t\tgraph,\n\t\tname,\n\t\tassembled\n\t};\n}\n//#endregion\nexport { runPipeline as n, resolveAppIdentity as t };\n\n//# sourceMappingURL=pipeline-B-vJNch3.mjs.map","//#region src/container-transport.ts\n/** '@prisma/composer-prisma-cloud' → 'PRISMA_COMPOSER_PRISMA_CLOUD': uppercased, every non-alphanumeric run replaced by one underscore. */\nfunction envVarSafeExtensionId(extensionId) {\n\treturn extensionId.toUpperCase().replace(/[^A-Z0-9]+/g, \"_\").replace(/^_+|_+$/g, \"\");\n}\n/** '@prisma/composer-prisma-cloud' → 'PRISMA_COMPOSER_CONTAINER_PRISMA_COMPOSER_PRISMA_CLOUD' */\nfunction containerEnvVarName(extensionId) {\n\treturn `PRISMA_COMPOSER_CONTAINER_${envVarSafeExtensionId(extensionId)}`;\n}\nfunction collisionError(a, b, varName) {\n\treturn /* @__PURE__ */ new Error(`Extension ids \"${a}\" and \"${b}\" both map to the container transport variable \"${varName}\" — rename one of the extensions.`);\n}\nfunction emptySerializeError(extensionId) {\n\treturn /* @__PURE__ */ new Error(`Extension \"${extensionId}\"'s container instance serialized to an empty string — ContainerInstance.serialize() must return a non-empty string.`);\n}\n/** The env entries the CLI sets on the alchemy process: `{ [containerEnvVarName(id)]: instance.serialize() }` for every resolved instance. */\nfunction containerEnv(instances) {\n\tconst env = {};\n\tconst ownerByVarName = /* @__PURE__ */ new Map();\n\tfor (const [extensionId, instance] of instances) {\n\t\tconst varName = containerEnvVarName(extensionId);\n\t\tconst owner = ownerByVarName.get(varName);\n\t\tif (owner !== void 0) throw collisionError(owner, extensionId, varName);\n\t\townerByVarName.set(varName, extensionId);\n\t\tconst serialized = instance.serialize();\n\t\tif (serialized.length === 0) throw emptySerializeError(extensionId);\n\t\tenv[varName] = serialized;\n\t}\n\treturn env;\n}\n/**\n* The alchemy-process side: for each extension with a container descriptor\n* whose var is present in `env`, call its deserialize. Absent var → no entry.\n*/\nfunction deserializeContainers(extensions, env) {\n\tconst instances = /* @__PURE__ */ new Map();\n\tfor (const extension of extensions) {\n\t\tconst descriptor = extension.container;\n\t\tif (descriptor === void 0) continue;\n\t\tconst serialized = env[containerEnvVarName(extension.id)];\n\t\tif (serialized === void 0) continue;\n\t\tinstances.set(extension.id, descriptor.deserialize(serialized));\n\t}\n\treturn instances;\n}\n//#endregion\nexport { envVarSafeExtensionId as i, containerEnvVarName as n, deserializeContainers as r, containerEnv as t };\n\n//# sourceMappingURL=container-transport-HcvNOGZL.mjs.map"],"mappings":";;;;;;;;;;;;;AAQA,IAAI,gBAAgB,cAAc,mBAAmB;CACpD,YAAY,MAAM,SAAS,SAAS;EACnC,MAAM,MAAM,SAAS,OAAO;CAC7B;AACD;;;;;;;AASA,SAAS,wBAAwB,QAAQ,MAAM,SAAS,KAAK,QAAQ;CACpE,MAAM,EAAE,WAAW,SAAS,KAAK;CACjC,MAAM,sBAAsB,OAAO,WAAW,MAAM,cAAc,UAAU,OAAO,SAAS;CAC5F,IAAI,wBAAwB,KAAK,GAAG,MAAM,IAAI,cAAc,8BAA8B,iBAAiB,UAAU,sCAAsC,KAAK,KAAK,cAAc,EAAE,KAAK,wEAAwE,CAAC;CACnQ,MAAM,iBAAiB,oBAAoB,MAAM;CACjD,IAAI,mBAAmB,KAAK,GAAG,MAAM,IAAI,cAAc,+BAA+B,cAAc,UAAU,sCAAsC,KAAK,KAAK,EAAE,KAAK,gBAAgB,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,GAAG,CAAC;CAC3O,IAAI,eAAe,SAAS,SAAS,MAAM,IAAI,cAAc,qCAAqC,cAAc,UAAU,2BAA2B,KAAK,UAAU,eAAe,KAAK,gBAAgB,EAAE,KAAK,2DAA2D,CAAC;CAC3Q,OAAO,eAAe,SAAS;EAC9B,OAAO,KAAK;EACZ;EACA;EACA;CACD,CAAC;AACF;AACA,eAAe,iBAAiB,OAAO,QAAQ,KAAK,KAAK,SAAS;CACjE,MAAM,eAAe,SAAS,MAAM,SAAS,SAAS,WAAW,wBAAwB,QAAQ,MAAM,SAAS,SAAS,MAAM;CAC/H,MAAM,eAAe,MAAM,MAAM,QAAQ,MAAM,EAAE,KAAK,SAAS,SAAS;CACxE,IAAI,aAAa,WAAW,GAAG,MAAM,IAAI,cAAc,4BAA4B,8CAA8C;CACjI,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,EAAE,IAAI,UAAU,cAAc;EACxC,UAAU;GACT,MAAM;GACN,SAAS;EACV,CAAC;EACD,MAAM,OAAO,CAAC;EACd,IAAI;EACJ,IAAI;GACH,WAAW,MAAM,aAAa,MAAM,IAAI,MAAM,aAAa,OAAO,OAAO,MAAM,QAAQ,CAAC;EACzF,SAAS,OAAO;GACf,IAAI,mBAAmB,GAAG,KAAK,GAAG,MAAM;GACxC,MAAM,IAAI,cAAc,yBAAyB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;IACxG,MAAM,EAAE,SAAS,GAAG;IACpB,OAAO;GACR,CAAC;EACF;EACA,QAAQ,MAAM;EACd,UAAU;GACT,MAAM;GACN,SAAS;GACT;EACD,CAAC;CACF;CACA,OAAO,EAAE,QAAQ;AAClB;;;;AC5DA,MAAM,oBAAoB;;;;;;;AAO1B,IAAI,YAAY,cAAc,mBAAmB;CAChD,YAAY,SAAS;EACpB,MAAM,yBAAyB,OAAO;CACvC;AACD;;;;;AAOA,MAAM,OAAO,OAAO,IAAI,aAAa;AACjB,UAAU,OAAO,IAAI,oBAAoB,CAAC;AAC9D,MAAM,gBAAgB,UAAU,OAAO,IAAI,sBAAsB,CAAC;;AAgBlE,SAAS,eAAe,OAAO;CAC9B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,mBAAmB;AAC3F;AACuB,UAAU,OAAO,IAAI,uBAAuB,CAAC;AAapE,MAAM,eAAe,UAAU,OAAO,IAAI,qBAAqB,CAAC;AAC7C,UAAU,OAAO,IAAI,mBAAmB,CAAC;;AAS5D,SAAS,cAAc,OAAO;CAC7B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,kBAAkB;AAC1F;;;;;;;AAuBA,SAAS,mBAAmB,MAAM;CACjC,OAAO,iBAAiB,KAAK,IAAI;AAClC;;;;;;AA0JA,SAAS,OAAO,OAAO;CACtB,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,UAAU;AACvE;;;;;;;;;;;;;;AAgBA,SAAS,SAAS,OAAO,OAAO;CAC/B,MAAM,OAAO,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CAChD,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CACtD,MAAM,WAAW,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CACpD,MAAM,6BAA6B,IAAI,IAAI;CAC3C,KAAK,MAAM,QAAQ,OAAO;EACzB,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,EAAE,GAAG;EAChD,MAAM,UAAU,WAAW,IAAI,KAAK,IAAI,KAAK,CAAC;EAC9C,QAAQ,KAAK,KAAK,EAAE;EACpB,WAAW,IAAI,KAAK,MAAM,OAAO;EACjC,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,EAAE,KAAK,KAAK,CAAC;CACvD;CACA,MAAM,QAAQ,IAAI,IAAI,MAAM,QAAQ,MAAM,SAAS,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC;CACpF,MAAM,QAAQ,CAAC;CACf,OAAO,MAAM,OAAO,GAAG;EACtB,IAAI;EACJ,IAAI,YAAY,OAAO;EACvB,KAAK,MAAM,MAAM,OAAO;GACvB,MAAM,QAAQ,QAAQ,IAAI,EAAE,KAAK,OAAO;GACxC,IAAI,QAAQ,WAAW;IACtB,YAAY;IACZ,OAAO;GACR;EACD;EACA,IAAI,SAAS,KAAK,GAAG;EACrB,MAAM,OAAO,IAAI;EACjB,MAAM,KAAK,IAAI;EACf,KAAK,MAAM,UAAU,WAAW,IAAI,IAAI,KAAK,CAAC,GAAG;GAChD,MAAM,aAAa,SAAS,IAAI,MAAM,KAAK,KAAK;GAChD,SAAS,IAAI,QAAQ,SAAS;GAC9B,IAAI,cAAc,GAAG,MAAM,IAAI,MAAM;EACtC;CACD;CACA,IAAI,MAAM,WAAW,MAAM,QAAQ,MAAM,IAAI,cAAc,8BAA8B,MAAM,OAAO,MAAM,MAAM,OAAO,0EAA0E;CACnM,OAAO,MAAM,KAAK,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,KAAK,CAAC;AAClE;;;;;;;AASA,SAAS,gBAAgB,IAAI,MAAM;CAClC,MAAM,QAAQ,CAAC;CACf,MAAM,QAAQ,KAAK,SAAS,WAAW,KAAK,OAAO,KAAK;CACxD,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,GAAG;EACjD,MAAM,OAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,UAAU,QAAQ,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,KAAK;EAC7H,MAAM,KAAK;GACV,MAAM;GACN,WAAW;GACX;GACA,cAAc;EACf,CAAC;CACF;CACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,GAAG;EACjE,MAAM,OAAO,OAAO,aAAa,YAAY,aAAa,QAAQ,UAAU,YAAY,OAAO,SAAS,SAAS,WAAW,SAAS,OAAO,KAAK;EACjJ,MAAM,KAAK;GACV,MAAM;GACN,WAAW;GACX;GACA,cAAc;EACf,CAAC;CACF;CACA,OAAO;AACR;AACA,SAAS,cAAc,SAAS,WAAW;CAC1C,IAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,WAAW,MAAM,MAAM,IAAI,UAAU,YAAY,UAAU,qBAAqB;CAClI,MAAM,QAAQ,CAAC;CACf,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,QAAQ,MAAM,GAAG;EAC5D,MAAM,OAAO,OAAO,KAAK,IAAI,MAAM,OAAO,KAAK;EAC/C,IAAI,SAAS,YAAY,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,kPAAkP;EACjU,IAAI,SAAS,cAAc,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,gFAAgF;EACjK,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,0BAA0B;EAC7G,MAAM,KAAK,GAAG,UAAU,GAAG;EAC3B,MAAM,KAAK;GACV;GACA,QAAQ;GACR,MAAM;EACP,CAAC;EACD,MAAM,KAAK;GACV,MAAM;GACN,IAAI;GACJ;GACA,MAAM;EACP,CAAC;CACF;CACA,OAAO;EACN;EACA;CACD;AACD;AACA,SAAS,YAAY,MAAM,QAAQ;CAClC,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG,IAAI,OAAO,KAAK,KAAK,MAAM,SAAS,cAAc,MAAM,IAAI,UAAU,YAAY,OAAO,qCAAqC,MAAM,kFAAkF,OAAO,YAAY;CACnS,IAAI,KAAK,gBAAgB,KAAK,GAAG,MAAM,IAAI,UAAU,YAAY,OAAO,wMAAwM;CAChR,MAAM,gBAAgB;EACrB,IAAI;EACJ,QAAQ,KAAK;EACb,MAAM;CACP;CACA,MAAM,EAAE,OAAO,UAAU,cAAc,MAAM,MAAM;CACnD,OAAO;EACN,MAAM;EACN,OAAO,CAAC,GAAG,SAAS,OAAO,KAAK,GAAG,aAAa;EAChD;EACA,OAAO,gBAAgB,QAAQ,IAAI;EACnC,eAAe,CAAC;EAChB,eAAe,CAAC;EAChB,QAAQ,CAAC;CACV;AACD;;;;;;;AASA,MAAM,gBAAgB,OAAO,sBAAsB;;AAEnD,SAAS,eAAe,KAAK;CAC5B,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO,KAAK;CACzD,MAAM,QAAQ,UAAU,GAAG,CAAC,CAAC;CAC7B,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO,KAAK;CAC7D,MAAM,EAAE,MAAM,SAAS,UAAU,KAAK;CACtC,OAAO,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;EAC7D;EACA;CACD,IAAI,KAAK;AACV;;;;;;;AAOA,SAAS,OAAO,IAAI,SAAS;CAC5B,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,GAAG,MAAM,QAAQ;EAClF,GAAG;EACH,cAAc;GACb,gBAAgB;GAChB,MAAM;GACN,MAAM;EACP;CACD;CACA,OAAO,UAAU;EAChB;EACA,GAAG;CACJ,CAAC;AACF;;;;;;;AAOA,SAAS,eAAe,IAAI,UAAU;CACrC,OAAO,UAAU;EAChB,GAAG,SAAS;EACZ,cAAc;EACd;GACC,gBAAgB;GAChB,MAAM;GACN,MAAM;EACP;CACD,CAAC;AACF;;AAEA,SAAS,aAAa,KAAK;CAC1B,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO,KAAK;CACzD,IAAI,kBAAkB,OAAO,OAAO,IAAI,iBAAiB,UAAU,OAAO,IAAI;CAC9E,IAAI,QAAQ,OAAO,OAAO,IAAI,OAAO,UAAU,OAAO,IAAI;AAC3D;;;;;;AAMA,MAAM,mBAAmB,OAAO,yBAAyB;;AAEzD,MAAM,oBAAoB,OAAO,0BAA0B;;AAE3D,MAAM,mBAAmB,OAAO,yBAAyB;;AAEzD,SAAS,kBAAkB,KAAK,UAAU;CACzC,OAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,eAAe,OAAO,OAAO,IAAI,cAAc,cAAc,IAAI,UAAU,QAAQ;AACtI;;;;;;;;;;;;;AAaA,SAAS,eAAe,SAAS,MAAM;CACtC,MAAM,EAAE,MAAM,QAAQ,UAAU,YAAY,wBAAwB;CACpE,KAAK,MAAM,CAAC,OAAO,QAAQ,OAAO,QAAQ,MAAM,GAAG;EAClD,MAAM,WAAW,UAAU,KAAK,MAAM;EACtC,IAAI,aAAa,KAAK,KAAK,CAAC,OAAO,QAAQ,KAAK,SAAS,SAAS,cAAc,MAAM,IAAI,UAAU,iBAAiB,SAAS,UAAU,MAAM,4CAA4C,WAAW,EAAE;EACvM,MAAM,aAAa,aAAa,GAAG;EACnC,MAAM,WAAW,eAAe,KAAK,IAAI,KAAK,IAAI,UAAU,IAAI,KAAK;EACrE,IAAI,eAAe,KAAK,KAAK,aAAa,KAAK,GAAG,MAAM,IAAI,UAAU,iBAAiB,SAAS,GAAG,MAAM,eAAe,OAAO,UAAU,EAAE,yCAAyC,oBAAoB,GAAG;EAC3M,MAAM,WAAW,SAAS;EAC1B,IAAI,aAAa,KAAK,KAAK,CAAC,kBAAkB,KAAK,QAAQ,GAAG,MAAM,IAAI,UAAU,iBAAiB,SAAS,GAAG,MAAM,+CAA+C;CACrK;CACA,KAAK,MAAM,CAAC,OAAO,aAAa,OAAO,QAAQ,IAAI,GAAG;EACrD,MAAM,QAAQ,UAAU,QAAQ;EAChC,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,WAAW,KAAK,GAAG;EAChD,IAAI,MAAM,SAAS,cAAc,MAAM,IAAI,UAAU,qBAAqB,MAAM,mBAAmB,WAAW,IAAI,SAAS,wCAAwC,oBAAoB,IAAI;CAC5L;AACD;;;;;;;;;;;AAWA,SAAS,WAAW,OAAO,KAAK,uBAAuB,IAAI,QAAQ,GAAG;CACrE,IAAI,KAAK,KAAK;CACd,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;CACjD,IAAI,eAAe,KAAK,KAAK,cAAc,KAAK,GAAG;CACnD,IAAI,KAAK,IAAI,KAAK,GAAG;CACrB,KAAK,IAAI,KAAK;CACd,MAAM,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,OAAO,OAAO,KAAK;CAClE,KAAK,MAAM,UAAU,SAAS,WAAW,QAAQ,KAAK,IAAI;AAC3D;;AAEA,SAAS,YAAY,QAAQ,UAAU;CACtC,OAAO,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU;EACpD,MAAM,aAAa,GAAG,KAAK;EAC3B,IAAI;EACJ;EACA,MAAM;CACP,EAAE;AACH;;;;;;;;;AASA,SAAS,sBAAsB,OAAO,IAAI,cAAc,qBAAqB;CAC5E,MAAM,EAAE,SAAS;CACjB,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,WAAW,GAAG;EAClD,MAAM,QAAQ,aAAa;EAC3B,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,UAAU,gBAAgB,KAAK,mBAAmB,KAAK,IAAI,GAAG,0BAA0B,oBAAoB,4DAA4D;EACxM,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM,IAAI,UAAU,gBAAgB,KAAK,QAAQ,GAAG,aAAa,oBAAoB,6FAA6F;CAC/M;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,aAAa,IAAI,GAAG,MAAM,IAAI,UAAU,oBAAoB,GAAG,UAAU,KAAK,wCAAwC,KAAK,YAAY,oBAAoB,IAAI;AACvO;;;;;;;AAOA,SAAS,4BAA4B,OAAO,IAAI,aAAa,qBAAqB;CACjF,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,QAAQ,IAAI,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,UAAU,KAAK,mDAAmD,oBAAoB,IAAI;AAC1N;;;;;;;AAOA,SAAS,yBAAyB,OAAO,IAAI,aAAa,qBAAqB;CAC9E,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,UAAU,GAAG;EACjD,MAAM,QAAQ,YAAY;EAC1B,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,UAAU,eAAe,KAAK,2BAA2B,GAAG,0BAA0B,oBAAoB,gFAAgF;EAC1N,IAAI,CAAC,cAAc,KAAK,GAAG,MAAM,IAAI,UAAU,eAAe,KAAK,QAAQ,GAAG,aAAa,oBAAoB,2KAA2K;CAC3R;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,YAAY,IAAI,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,UAAU,KAAK,uDAAuD,oBAAoB,IAAI;AAClO;;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,QAAQ,YAAY,SAAS,QAAQ,QAAQ,cAAc,aAAa,OAAO,OAAO,SAAS,eAAe,eAAe,MAAM,OAAO,eAAe;CACjK,MAAM,KAAK,GAAG,gBAAgB,QAAQ,UAAU,CAAC;CACjD,MAAM,2BAA2B,IAAI,IAAI;CACzC,MAAM,uBAAuB,IAAI,IAAI;CACrC,MAAM,8BAA8B,IAAI,IAAI;CAC5C,MAAM,6BAA6B,IAAI,IAAI;CAC3C,MAAM,YAAY,CAAC;CACnB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,IAAI,GAAG;EAC/C,MAAM,QAAQ,OAAO;EACrB,UAAU,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC9D,GAAG;IACF,mBAAmB;EACrB,IAAI;CACL;CACA,MAAM,YAAY,WAAW;EAC5B,KAAK,MAAM,SAAS,QAAQ,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAAG,IAAI,UAAU,UAAU,MAAM,KAAK,IAAI,GAAG;CACjH;CACA,MAAM,oBAAoB,UAAU;EACnC,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAAG,IAAI,UAAU,UAAU,MAAM,OAAO;GAC9E,MAAM;GACN,WAAW;GACX,MAAM;EACP;EACA,MAAM,QAAQ,eAAe,KAAK;EAClC,OAAO,UAAU,KAAK,IAAI,KAAK,IAAI;GAClC,MAAM,MAAM;GACZ,WAAW;GACX,MAAM,MAAM;EACb;CACD;;CAEA,MAAM,wBAAwB,UAAU,iBAAiB;EACxD,KAAK,MAAM,CAAC,OAAO,QAAQ,OAAO,QAAQ,YAAY,GAAG;GACxD,MAAM,OAAO,iBAAiB,GAAG;GACjC,IAAI,SAAS,KAAK,GAAG,cAAc,KAAK;IACvC;IACA,IAAI;KACH,MAAM;KACN,WAAW;KACX,MAAM;IACP;GACD,CAAC;EACF;CACD;CACA,MAAM,aAAa,CAAC;CACpB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,WAAW,GAAG;EACtD,MAAM,QAAQ,aAAa;EAC3B,WAAW,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC/D,GAAG;IACF,oBAAoB;EACtB,IAAI;CACL;CACA,MAAM,mBAAmB,WAAW;EACnC,KAAK,MAAM,SAAS,QAAQ,KAAK,MAAM,OAAO,OAAO,KAAK,UAAU,GAAG,IAAI,UAAU,WAAW,MAAM,YAAY,IAAI,GAAG;CAC1H;CACA,MAAM,YAAY,CAAC;CACnB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,GAAG;EACrD,MAAM,QAAQ,YAAY;EAC1B,UAAU,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC9D,GAAG;IACF,mBAAmB;EACrB,IAAI;CACL;CACA,MAAM,kBAAkB,WAAW;EAClC,KAAK,MAAM,SAAS,QAAQ,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAAG,IAAI,UAAU,UAAU,MAAM,WAAW,IAAI,GAAG;CACvH;CACA,MAAM,aAAa,OAAO,SAAS;EAClC,MAAM,KAAK,MAAM,MAAM,MAAM;EAC7B,MAAM,kBAAkB,MAAM;EAC9B,MAAM,mBAAmB,MAAM;EAC/B,MAAM,iBAAiB,MAAM;EAC7B,MAAM,kBAAkB,MAAM;EAC9B,IAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG,MAAM,IAAI,UAAU,gDAAgD,WAAW,KAAK,IAAI;EACvI,IAAI,CAAC,mBAAmB,EAAE,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,aAAa,WAAW,KAAK,8LAA8L,GAAG,eAAe,GAAG,YAAY,EAAE,oGAAoG;EACza,IAAI,SAAS,IAAI,EAAE,GAAG,MAAM,IAAI,UAAU,2BAA2B,GAAG,eAAe,WAAW,KAAK,GAAG;EAC1G,MAAM,YAAY;EAClB,IAAI,CAAC,OAAO,SAAS,KAAK,UAAU,SAAS,aAAa,UAAU,SAAS,cAAc,UAAU,SAAS,UAAU,MAAM,IAAI,UAAU,cAAc,GAAG,wIAAwI;EACrS,SAAS,IAAI,EAAE;EACf,MAAM,cAAc,YAAY,KAAK,IAAI,KAAK,GAAG,QAAQ,GAAG;EAC5D,IAAI,MAAM,SAAS,YAAY;GAC9B,IAAI,oBAAoB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,iFAAiF;GACtJ,IAAI,qBAAqB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,gFAAgF;GACtJ,IAAI,mBAAmB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,mFAAmF;GACvJ,IAAI,oBAAoB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,yEAAyE;GAC9I,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,gDAAgD;GAClH,KAAK,IAAI,aAAa,KAAK;GAC3B,MAAM,KAAK;IACV,IAAI;IACJ,QAAQ;IACR,MAAM;GACP,CAAC;GACD,MAAM,KAAK;IACV,MAAM;IACN,WAAW;IACX,MAAM;IACN,cAAc,MAAM,SAAS;GAC9B,CAAC;GACD,OAAO,eAAe,aAAa,KAAK;EACzC;EACA,MAAM,cAAc,EAAE,GAAG,mBAAmB,CAAC,EAAE;EAC/C,SAAS,OAAO,OAAO,WAAW,CAAC;EACnC,MAAM,eAAe,EAAE,GAAG,oBAAoB,CAAC,EAAE;EACjD,gBAAgB,OAAO,OAAO,YAAY,CAAC;EAC3C,MAAM,cAAc,EAAE,GAAG,mBAAmB,CAAC,EAAE;EAC/C,eAAe,OAAO,OAAO,WAAW,CAAC;EACzC,IAAI,MAAM,SAAS,WAAW;GAC7B,IAAI,qBAAqB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,iJAAiJ;GACvN,IAAI,MAAM,gBAAgB,KAAK,KAAK,mBAAmB,KAAK,GAAG,MAAM,IAAI,UAAU,iCAAiC,GAAG,0BAA0B,WAAW,KAAK,kGAAkG;GACnQ,IAAI,MAAM,gBAAgB,KAAK,KAAK,mBAAmB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,kFAAkF,WAAW,KAAK,IAAI;GAC1M,IAAI,mBAAmB,KAAK,GAAG;IAC9B,MAAM,SAAS,CAAC;IAChB,WAAW,gBAAgB,MAAM;IACjC,gBAAgB,MAAM;IACtB,eAAe,MAAM;IACrB,cAAc,KAAK;KAClB,gBAAgB;KAChB,SAAS,UAAU,cAAc;IAClC,CAAC;GACF;GACA,4BAA4B,OAAO,IAAI,aAAa,WAAW,IAAI;GACnE,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,WAAW,GAAG,cAAc,KAAK;IAC7E,gBAAgB;IAChB;IACA;GACD,CAAC;GACD,MAAM,SAAS,cAAc,OAAO,WAAW;GAC/C,MAAM,KAAK,GAAG,OAAO,OAAO;IAC3B,IAAI;IACJ,QAAQ;IACR,MAAM;GACP,CAAC;GACD,MAAM,KAAK,GAAG,OAAO,OAAO,GAAG,YAAY,aAAa,WAAW,CAAC;GACpE,MAAM,KAAK,GAAG,gBAAgB,aAAa,KAAK,CAAC;GACjD,qBAAqB,aAAa,WAAW;GAC7C,QAAQ,KAAK;IACZ,MAAM,MAAM;IACZ,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,qBAAqB,WAAW;GACjC,CAAC;GACD,KAAK,IAAI,aAAa,KAAK;GAC3B,OAAO,OAAO,aAAa,KAAK;EACjC;EACA,IAAI,mBAAmB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,0HAA0H;EAC9L,sBAAsB,OAAO,IAAI,cAAc,WAAW,IAAI;EAC9D,yBAAyB,OAAO,IAAI,aAAa,WAAW,IAAI;EAChE,MAAM,KAAK,GAAG,YAAY,aAAa,WAAW,CAAC;EACnD,qBAAqB,aAAa,WAAW;EAC7C,QAAQ,KAAK;GACZ,MAAM,MAAM;GACZ,QAAQ;GACR,UAAU;GACV,YAAY;GACZ,qBAAqB,WAAW;EACjC,CAAC;EACD,MAAM,eAAe,QAAQ,OAAO,aAAa,aAAa,aAAa,cAAc,aAAa,OAAO,OAAO,SAAS,eAAe,eAAe,MAAM,OAAO,aAAa;EACrL,MAAM,KAAK;GACV,IAAI;GACJ,QAAQ;GACR,MAAM;EACP,CAAC;EACD,KAAK,IAAI,aAAa,KAAK;EAC3B,MAAM,iBAAiB,CAAC;EACxB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,YAAY,GAAG,eAAe,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC5H,GAAG;IACF,gBAAgB;IAChB,MAAM;IACN,MAAM;GACP;EACD,IAAI;EACJ,OAAO,UAAU;GAChB,IAAI;GACJ,GAAG;EACJ,CAAC;CACF;CACA,MAAM,MAAM,UAAU;EACrB,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,WAAW,UAAU,SAAS;CAC/B,CAAC;CACD,MAAM,UAAU,UAAU,WAAW,KAAK,GAAG,KAAK,CAAC,CAAC;CACpD,SAAS,OAAO,OAAO,OAAO,CAAC;CAC/B,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,oBAAoB,IAAI,sEAAsE;CACjN,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,qBAAqB,IAAI,0CAA0C;CACpM,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,oBAAoB,IAAI,0CAA0C;CACjM,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,WAAW,MAAM,GAAG;EAChE,MAAM,OAAO,QAAQ;EACrB,IAAI,SAAS,KAAK,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,qBAAqB,IAAI,6CAA6C;EAC1I,IAAI,CAAC,kBAAkB,MAAM,QAAQ,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,gCAAgC,IAAI,0CAA0C;EACrK,MAAM,OAAO,iBAAiB,IAAI;EAClC,IAAI,SAAS,KAAK,GAAG,cAAc,KAAK;GACvC;GACA,IAAI;IACH,MAAM;IACN,WAAW;IACX,MAAM;GACP;EACD,CAAC;CACF;CACA,OAAO;AACR;AACA,SAAS,WAAW,MAAM,MAAM;CAC/B,MAAM,SAAS,MAAM,MAAM,KAAK;CAChC,MAAM,cAAc,OAAO,KAAK,KAAK,IAAI;CACzC,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,QAAQ,YAAY,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACxD,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,kBAAkB,YAAY,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,4FAA4F,KAAK,KAAK,4DAA4D;CACzQ;CACA,MAAM,iBAAiB,OAAO,KAAK,KAAK,WAAW;CACnD,IAAI,eAAe,SAAS,GAAG;EAC9B,MAAM,QAAQ,eAAe,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EAC3D,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,mBAAmB,eAAe,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,6KAA6K;CACxR;CACA,MAAM,gBAAgB,OAAO,KAAK,KAAK,UAAU;CACjD,IAAI,cAAc,SAAS,GAAG;EAC7B,MAAM,QAAQ,cAAc,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EAC1D,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,kBAAkB,cAAc,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,iMAAiM;CAC1S;CACA,MAAM,QAAQ,CAAC;CACf,MAAM,QAAQ,CAAC;CACf,MAAM,UAAU,CAAC;CACjB,MAAM,gBAAgB,CAAC;CACvB,MAAM,gBAAgB,CAAC;CACvB,MAAM,uBAAuB,IAAI,IAAI;CACrC,MAAM,QAAQ,CAAC;CACf,MAAM,gBAAgB,CAAC;CACvB,QAAQ,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,OAAO,SAAS,eAAe,eAAe,MAAM,OAAO,aAAa;CACzH,KAAK,MAAM,SAAS,SAAS,eAAe,OAAO,IAAI;CACvD,oBAAoB,KAAK;CACzB,MAAM,gBAAgB;EACrB,IAAI;EACJ,QAAQ,KAAK;EACb,MAAM;CACP;CACA,OAAO;EACN,MAAM;EACN,OAAO,CAAC,GAAG,SAAS,OAAO,KAAK,GAAG,aAAa;EAChD;EACA;EACA;EACA;EACA,QAAQ;CACT;AACD;;;;;;AAMA,SAAS,oBAAoB,OAAO;CACnC,MAAM,4BAA4B,IAAI,IAAI;CAC1C,KAAK,MAAM,QAAQ,OAAO;EACzB,IAAI,KAAK,SAAS,cAAc;EAChC,MAAM,UAAU,UAAU,IAAI,KAAK,IAAI,KAAK,CAAC;EAC7C,QAAQ,KAAK,KAAK,EAAE;EACpB,UAAU,IAAI,KAAK,MAAM,OAAO;CACjC;CACA,MAAM,2BAA2B,IAAI,IAAI;CACzC,MAAM,uBAAuB,IAAI,IAAI;CACrC,MAAM,QAAQ,CAAC;CACf,MAAM,SAAS,OAAO;EACrB,IAAI,KAAK,IAAI,EAAE,GAAG;EAClB,IAAI,SAAS,IAAI,EAAE,GAAG,MAAM,IAAI,UAAU,qBAAqB,CAAC,GAAG,MAAM,MAAM,MAAM,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,2BAA2B;EAC9I,SAAS,IAAI,EAAE;EACf,MAAM,KAAK,EAAE;EACb,KAAK,MAAM,QAAQ,UAAU,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI;EACtD,MAAM,IAAI;EACV,SAAS,OAAO,EAAE;EAClB,KAAK,IAAI,EAAE;CACZ;CACA,KAAK,MAAM,MAAM,UAAU,KAAK,GAAG,MAAM,EAAE;AAC5C;;;;;;;;;;AAYA,SAAS,KAAK,MAAM,MAAM;CACzB,IAAI,CAAC,OAAO,IAAI,GAAG,MAAM,IAAI,UAAU,qGAAqG;CAC5I,IAAI,KAAK,SAAS,UAAU,OAAO,WAAW,MAAM,IAAI;CACxD,IAAI,KAAK,SAAS,WAAW,OAAO,YAAY,MAAM,MAAM,MAAM,MAAM;CACxE,MAAM,IAAI,UAAU,qEAAqE;AAC1F;AC90BmB,UAAU,OAAO,IAAI,mBAAmB,CAAC;;;;;;;;;;;;;;;;;;;;;AEa5D,IAAI,aAAa;;;;;;AAMjB,SAAS,0BAA0B;CAClC,IAAI,cAAc,OAAO,QAAQ,SAAS,QAAQ,UAAU;CAC5D,IAAI,OAAO,IAAI,kBAAkB,YAAY;CAC7C,aAAa;CACb,IAAI,cAAc,EAAE,QAAQ,WAAW,SAAS,aAAa;EAC5D,IAAI;GACH,OAAO,YAAY,WAAW,OAAO;EACtC,SAAS,OAAO;GACf,IAAI,CAAC,oBAAoB,SAAS,KAAK,QAAQ,cAAc,KAAK,KAAK,CAAC,sBAAsB,KAAK,GAAG,MAAM;GAC5G,KAAK,MAAM,aAAa,iBAAiB,IAAI,IAAI,WAAW,QAAQ,SAAS,CAAC,GAAG,IAAI,WAAW,cAAc,SAAS,CAAC,GAAG,OAAO,YAAY,UAAU,MAAM,OAAO;GACrK,MAAM;EACP;CACD,EAAE,CAAC;AACJ;;;;;;;;AAQA,SAAS,iBAAiB,UAAU;CACnC,MAAM,OAAO,SAAS;CACtB,IAAI,KAAK,SAAS,MAAM,GAAG;EAC1B,MAAM,OAAO,KAAK,MAAM,GAAG,EAAE;EAC7B,OAAO,CAAC,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC;CAC/B;CACA,IAAI,KAAK,SAAS,MAAM,GAAG;EAC1B,MAAM,OAAO,KAAK,MAAM,GAAG,EAAE;EAC7B,OAAO,CAAC,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC;CAC/B;CACA,MAAM,OAAO,KAAK,SAAS,KAAK,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;CACxD,OAAO;EACN,IAAI,IAAI,GAAG,KAAK,IAAI;EACpB,IAAI,IAAI,GAAG,KAAK,KAAK;EACrB,IAAI,IAAI,GAAG,KAAK,KAAK;EACrB,IAAI,IAAI,GAAG,KAAK,UAAU;CAC3B;AACD;AACA,SAAS,oBAAoB,WAAW;CACvC,OAAO,UAAU,WAAW,IAAI,KAAK,UAAU,WAAW,KAAK;AAChE;AACA,SAAS,sBAAsB,OAAO;CACrC,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,IAAI,EAAE,UAAU,QAAQ,OAAO;CAC/B,OAAO,MAAM,SAAS;AACvB;;;;;;;;;;;;AAcA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB,CAAC,QAAQ,MAAM;AACtC,SAAS,UAAU,OAAO;CACzB,OAAO,UAAU,SAAS,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,KAAK;AAC9E;AACA,SAAS,qBAAqB,OAAO;CACpC,IAAI,EAAE,iBAAiB,QAAQ,OAAO,KAAK;CAC3C,IAAI,UAAU,KAAK,MAAM,wBAAwB,OAAO,KAAK;CAC7D,OAAO,2CAA2C,KAAK,MAAM,OAAO,CAAC,GAAG;AACzE;;;;;;;AAOA,SAAS,oBAAoB,OAAO,WAAW;CAC9C,MAAM,gBAAgB,qBAAqB,KAAK;CAChD,IAAI,kBAAkB,KAAK,GAAG,OAAO,KAAK;CAC1C,IAAI,CAAC,eAAe,MAAM,QAAQ,cAAc,SAAS,GAAG,CAAC,GAAG,OAAO,KAAK;CAC5E,OAAO;EACN,SAAS,IAAI,cAAc;EAC3B,KAAK,iBAAiB,UAAU;EAChC,KAAK;CACN;AACD;;;;;;;AASA,eAAe,UAAU,UAAU,KAAK;CACvC,wBAAwB;CACxB,MAAM,eAAe,KAAK,QAAQ,KAAK,QAAQ;CAC/C,IAAI;CACJ,IAAI;EACH,MAAM,MAAM,OAAO,cAAc,YAAY,CAAC,CAAC;CAChD,SAAS,OAAO;EACf,MAAM,YAAY,oBAAoB,OAAO,YAAY;EACzD,IAAI,cAAc,KAAK,GAAG,MAAM,IAAI,mBAAmB,4BAA4B,UAAU,SAAS;GACrG,KAAK,UAAU;GACf,KAAK,UAAU;GACf,OAAO,EAAE,MAAM,aAAa;GAC5B,OAAO;EACR,CAAC;EACD,MAAM,IAAI,mBAAmB,4BAA4B,kCAAkC,aAAa,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KAAK;GACtK,OAAO,EAAE,MAAM,aAAa;GAC5B,OAAO;EACR,CAAC;CACF;CACA,MAAM,OAAO,UAAU,GAAG,CAAC,CAAC;CAC5B,IAAI,CAAC,OAAO,IAAI,KAAK,KAAK,SAAS,gBAAgB,KAAK,SAAS,YAAY,MAAM,IAAI,mBAAmB,gCAAgC,iBAAiB,aAAa,wDAAwD;EAC/N,KAAK;EACL,OAAO,EAAE,MAAM,aAAa;CAC7B,CAAC;CACD,OAAO;EACN,MAAM;EACN,MAAM,UAAU,IAAI;CACrB;AACD;AAGA,SAAS,OAAO,YAAY,WAAW,MAAM,cAAc,MAAM;CAChE,MAAM,MAAM,WAAW,IAAI,SAAS;CACpC,IAAI,QAAQ,KAAK,GAAG,MAAM,IAAI,mBAAmB,4BAA4B,iBAAiB,UAAU,6BAA6B,KAAK,KAAK;EAC9I,KAAK;EACL,MAAM;GACL;GACA;EACD;CACD,CAAC;CACD,MAAM,aAAa,IAAI,MAAM;CAC7B,IAAI,eAAe,KAAK,GAAG,MAAM,IAAI,mBAAmB,6BAA6B,cAAc,UAAU,qCAAqC,KAAK,eAAe,KAAK,KAAK;EAC/K,KAAK,gBAAgB,OAAO,KAAK,IAAI,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE;EACvD,MAAM;GACL;GACA;EACD;CACD,CAAC;CACD,IAAI,WAAW,SAAS,cAAc,MAAM,IAAI,mBAAmB,mCAAmC,cAAc,UAAU,gCAAgC,KAAK,UAAU,WAAW,KAAK,iBAAiB,KAAK,YAAY,aAAa,gBAAgB,EAAE,MAAM;EACnQ;EACA;EACA,MAAM,WAAW;CAClB,EAAE,CAAC;AACJ;;AAEA,SAAS,yBAAyB,OAAO,QAAQ;CAChD,MAAM,aAAa,IAAI,IAAI,OAAO,WAAW,KAAK,eAAe,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC;CAC7F,KAAK,MAAM,EAAE,IAAI,UAAU,MAAM,OAAO;EACvC,IAAI,KAAK,SAAS,YAAY;GAC7B,OAAO,YAAY,KAAK,WAAW,KAAK,MAAM,YAAY,kBAAkB,GAAG,EAAE;GACjF;EACD;EACA,IAAI,KAAK,SAAS,WAAW;EAC7B,OAAO,YAAY,KAAK,WAAW,KAAK,MAAM,WAAW,iBAAiB,GAAG,EAAE;EAC/E,OAAO,YAAY,KAAK,MAAM,WAAW,KAAK,MAAM,MAAM,SAAS,iBAAiB,GAAG,qBAAqB;CAC7G;AACD;;;;;;;;;;;AAaA,SAAS,YAAY,UAAU,MAAM;CACpC,MAAM,CAAC,SAAS;CAChB,OAAO,IAAI,mBAAmB,MAAM,MAAM,MAAM,SAAS;EACxD,GAAG,MAAM,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;EAChD,KAAK,MAAM;EACX,OAAO,EAAE,MAAM,MAAM,SAAS,KAAK;EACnC,MAAM;GACL,GAAG,MAAM,UAAU,KAAK,IAAI,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;GACtD;EACD;CACD,CAAC;AACF;;;;;AAKA,SAAS,kBAAkB,QAAQ,KAAK;CACvC,MAAM,OAAO,KAAK,QAAQ,KAAK,OAAO,IAAI;CAC1C,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG,MAAM,YAAY,CAAC,kBAAkB,IAAI,CAAC,GAAG,IAAI;CAC3E,MAAM,UAAU,oBAAoB,OAAO,OAAO,IAAI;CACtD,IAAI,CAAC,QAAQ,IAAI,MAAM,YAAY,QAAQ,UAAU,IAAI;CACzD,OAAO;EACN,OAAO,QAAQ;EACf;CACD;AACD;;;;;;;AAwBA,eAAe,YAAY,OAAO,cAAc,KAAK,QAAQ,OAAO,CAAC,GAAG,iBAAiB;CACxF,MAAM,eAAe,kBAAkB,QAAQ,GAAG;CAClD,MAAM,SAAS,aAAa;CAC5B,MAAM,cAAc,MAAM,UAAU,OAAO,GAAG;CAC9C,MAAM,QAAQ,KAAK,YAAY,IAAI;CACnC,IAAI,MAAM,KAAK,KAAK,SAAS,UAAU,MAAM,IAAI,mBAAmB,2BAA2B,qCAAqC,EAAE,KAAK,qGAAqG,CAAC;CACjP,yBAAyB,OAAO,MAAM;CACtC,MAAM,OAAO,gBAAgB,YAAY,KAAK;CAC9C,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,mBAAmB,wBAAwB,8BAA8B,EAAE,KAAK,wCAAwC,CAAC;CAC1J,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;CACjC,IAAI;CACJ,IAAI;EACH,YAAY,MAAM,iBAAiB,OAAO,QAAQ,KAAK,KAAK,cAAc,KAAK,OAAO;CACvF,SAAS,OAAO;EACf,IAAI,oBAAoB,KAAK,KAAK,iBAAiB,OAAO,MAAM,gBAAgB,KAAK;EACrF,MAAM;CACP;CACA,OAAO;EACN;EACA;EACA;EACA;EACA;CACD;AACD;;;;ACvRA,SAAS,sBAAsB,aAAa;CAC3C,OAAO,YAAY,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG,CAAC,CAAC,QAAQ,YAAY,EAAE;AACpF;;AAEA,SAAS,oBAAoB,aAAa;CACzC,OAAO,6BAA6B,sBAAsB,WAAW;AACtE;AACA,SAAS,eAAe,GAAG,GAAG,SAAS;CACtC,uBAAuB,IAAI,MAAM,kBAAkB,EAAE,SAAS,EAAE,kDAAkD,QAAQ,kCAAkC;AAC7J;AACA,SAAS,oBAAoB,aAAa;CACzC,uBAAuB,IAAI,MAAM,cAAc,YAAY,qHAAqH;AACjL;;AAEA,SAAS,aAAa,WAAW;CAChC,MAAM,MAAM,CAAC;CACb,MAAM,iCAAiC,IAAI,IAAI;CAC/C,KAAK,MAAM,CAAC,aAAa,aAAa,WAAW;EAChD,MAAM,UAAU,oBAAoB,WAAW;EAC/C,MAAM,QAAQ,eAAe,IAAI,OAAO;EACxC,IAAI,UAAU,KAAK,GAAG,MAAM,eAAe,OAAO,aAAa,OAAO;EACtE,eAAe,IAAI,SAAS,WAAW;EACvC,MAAM,aAAa,SAAS,UAAU;EACtC,IAAI,WAAW,WAAW,GAAG,MAAM,oBAAoB,WAAW;EAClE,IAAI,WAAW;CAChB;CACA,OAAO;AACR"}

package/dist/{execute-deploy-destroy-c0eko3AO-9npuGXd3.mjs → execute-deploy-destroy-1Nn5Pz26-BqJhnlfK.mjs}

@@ -1,6 +1,6 @@
 import { a as CliStructuredError, c as okVoid, o as notOk, r as noComposerExportMessage, s as ok, u as blindCast } from "./composer-config-CY9fET8H-KpGjlYgO.mjs";
-import { n as alchemyInvocation, r as spawnAlchemy, s as toStructured } from "./run-alchemy-BEvB2sYQ-BgV2deuO.mjs";
-import { n as envVarSafeExtensionId, r as runPipeline, t as containerEnv } from "./container-transport-HcvNOGZL-CHqecFc7.mjs";
+import { n as alchemyInvocation, r as spawnAlchemy, s as toStructured } from "./run-alchemy-BEvB2sYQ-BePRE5k2.mjs";
+import { n as envVarSafeExtensionId, r as runPipeline, t as containerEnv } from "./container-transport-HcvNOGZL-bjIRXsYK.mjs";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { randomUUID } from "node:crypto";
@@ -130,7 +130,7 @@ function preflightEnv(payloads) {
 	return env;
 }
 //#endregion
-//#region ../../0-framework/3-tooling/cli/dist/execute-deploy-destroy-c0eko3AO.mjs
+//#region ../../0-framework/3-tooling/cli/dist/execute-deploy-destroy-1Nn5Pz26.mjs
 /** Pipeline step 6: writes a regenerated-every-run, independently runnable stack module at `.prisma-composer/alchemy.run.ts`. */
 const GENERATED_DIR = ".prisma-composer";
 const GENERATED_FILE = "alchemy.run.ts";
@@ -213,6 +213,54 @@ function hasNoLocalDeployState(cwd) {
 	const stateDir = path.join(cwd, ALCHEMY_STATE_DIR);
 	return !(fs.existsSync(stateDir) && fs.readdirSync(stateDir).length > 0);
 }
+/**
+* Times each deploy step for the host's `onEvent`. A step still open when the
+* run fails is closed as failed, innermost first. A host `onEvent` that throws
+* is the host's bug and cannot fail the deploy.
+*/
+function deploySteps(onEvent) {
+	const open = /* @__PURE__ */ new Map();
+	const keyOf = (step) => step.name === "assemble-service" ? `${step.name}:${step.address}` : step.name;
+	const emit = (event) => {
+		try {
+			onEvent?.(event);
+		} catch {}
+	};
+	const finish = (step, outcome, data) => {
+		const entry = open.get(keyOf(step));
+		if (entry === void 0) return;
+		open.delete(keyOf(step));
+		const durationMs = Math.round(performance.now() - entry.startedAt);
+		emit({
+			kind: "step-finished",
+			step,
+			outcome,
+			durationMs,
+			data
+		});
+	};
+	return {
+		start(step) {
+			open.set(keyOf(step), {
+				step,
+				startedAt: performance.now()
+			});
+			emit({
+				kind: "step-started",
+				step
+			});
+		},
+		finish(step, data) {
+			finish(step, "ok", data);
+		},
+		fail(step) {
+			finish(step, "failed");
+		},
+		failOpen() {
+			for (const { step } of [...open.values()].reverse()) finish(step, "failed");
+		}
+	};
+}
 async function executeDeploy(input, deps, cwd) {
 	const outcome = await runStackPipeline("deploy", {
 		entry: input.entry,
@@ -222,17 +270,10 @@ async function executeDeploy(input, deps, cwd) {
 		cwd,
 		onEvent: void 0,
 		deps,
-		reportId: input.reportId
+		reportId: input.reportId,
+		reportPath: resolveRunReportPath(input.reportPath, process.env[RUN_REPORT_FILE_ENV], cwd),
+		steps: deploySteps(input.onEvent)
 	});
-	const reportPath = resolveRunReportPath(input.reportPath, process.env[RUN_REPORT_FILE_ENV], cwd);
-	if (reportPath !== void 0) writeRunReport(reportPath, toRunReport({
-		summary: outcome.ok ? outcome.value : void 0,
-		stage: input.stage,
-		failure: outcome.ok ? void 0 : {
-			code: outcome.failure.code,
-			message: outcome.failure.message
-		}
-	}));
 	if (!outcome.ok) return outcome;
 	return ok({ summary: outcome.value });
 }
@@ -245,7 +286,9 @@ async function executeDestroy(input, deps, cwd) {
 		cwd,
 		onEvent: input.onEvent,
 		deps,
-		reportId: void 0
+		reportId: void 0,
+		reportPath: void 0,
+		steps: deploySteps(void 0)
 	});
 	if (!outcome.ok) return outcome;
 	return okVoid();
@@ -328,7 +371,8 @@ async function finishReporters(reporters, outcome) {
 /**
 * Owns the reporting sessions around the pipeline: the inner run opens them
 * once it knows which extensions are configured, and this closes them on
-* every exit path — a returned failure, a success, or a thrown defect.
+* every exit path — a returned failure, a success, or a thrown defect — as
+* the `record` step, which also writes the run report.
 * Nothing here can change what the pipeline returns.
 */
 async function runStackPipeline(action, opts) {
@@ -337,14 +381,19 @@ async function runStackPipeline(action, opts) {
 	try {
 		outcome = await runStackPipelineInner(action, opts, reporters);
 	} catch (error) {
+		opts.steps.failOpen();
+		opts.steps.start({ name: "record" });
 		await finishReporters(reporters, {
 			ok: false,
 			cancelled: false,
 			code: "DEPLOY.UNEXPECTED",
 			message: error instanceof Error ? error.message : String(error)
 		});
+		opts.steps.finish({ name: "record" });
 		throw error;
 	}
+	if (!outcome.ok) opts.steps.failOpen();
+	opts.steps.start({ name: "record" });
 	await finishReporters(reporters, outcome.ok ? {
 		ok: true,
 		cancelled: false,
@@ -355,13 +404,23 @@ async function runStackPipeline(action, opts) {
 		code: outcome.failure.code,
 		message: outcome.failure.message
 	});
+	if (opts.reportPath === void 0 || writeRunReport(opts.reportPath, toRunReport({
+		summary: outcome.ok ? outcome.value : void 0,
+		stage: opts.stage,
+		failure: outcome.ok ? void 0 : {
+			code: outcome.failure.code,
+			message: outcome.failure.message
+		}
+	}))) opts.steps.finish({ name: "record" });
+	else opts.steps.fail({ name: "record" });
 	return outcome;
 }
 /** The pipeline both actions share: validate, resolve containers, preflight,
 * write the stack file, run alchemy against it, then the destroy-only
 * teardown/removal suffix. The value is only ever a summary for deploy. */
 async function runStackPipelineInner(action, opts, reporters) {
-	const { entry, config: composerConfig, name, stage, cwd, onEvent, deps } = opts;
+	const { entry, config: composerConfig, name, stage, cwd, onEvent, deps, steps } = opts;
+	steps.start({ name: "prepare" });
 	if (stage !== void 0) try {
 		validateStageName(stage);
 	} catch (error) {
@@ -378,13 +437,37 @@ async function runStackPipelineInner(action, opts, reporters) {
 	const preflightPayloads = /* @__PURE__ */ new Map();
 	let preflightTransportEnv = {};
 	try {
-		pipeline = await runPipeline(entry, name, cwd, composerConfig, { runAssembler: deps.runAssembler }, action === "destroy" ? (error) => new CliStructuredError("DEPLOY.BUILD_REQUIRED", error.message, {
+		pipeline = await runPipeline(entry, name, cwd, composerConfig, {
+			runAssembler: deps.runAssembler,
+			onEvent: (event) => {
+				switch (event.kind) {
+					case "loaded":
+						steps.finish({ name: "prepare" });
+						steps.start({ name: "assemble" });
+						return;
+					case "service-started":
+						steps.start({
+							name: "assemble-service",
+							address: event.address
+						});
+						return;
+					case "service-assembled":
+						steps.finish({
+							name: "assemble-service",
+							address: event.address
+						}, event.data);
+						return;
+				}
+			}
+		}, action === "destroy" ? (error) => new CliStructuredError("DEPLOY.BUILD_REQUIRED", error.message, {
 			why: "destroy evaluates the same stack program as deploy, which packages the built artifacts — so the app must be built first.",
 			fix: "Run the build, then retry the destroy.",
 			cause: error
 		}) : void 0);
+		steps.finish({ name: "assemble" });
 		const { graph, name: resolvedName } = pipeline;
 		const config = pipeline.configSource.value;
+		steps.start({ name: "connect" });
 		if (action === "deploy") reporters.push(...await beginReporters(config.extensions, {
 			appName: resolvedName,
 			graph,
@@ -417,7 +500,13 @@ async function runStackPipelineInner(action, opts, reporters) {
 		const pinnedStage = containers.get(config.state.extension)?.alchemyStage ?? stage;
 		if (pinnedStage === void 0) throw new CliStructuredError("DEPLOY.SCOPE_MISSING", "The configured deploy target supplied no deploy scope (its container defines no alchemyStage), so Alchemy has no stage to run under.", { fix: action === "deploy" ? "Pass --stage <name> to choose the deploy scope explicitly." : "Destroying production needs a target whose container supplies the production deploy scope." });
 		alchemyStage = pinnedStage;
+		steps.finish({ name: "connect" });
 		if (action === "deploy") {
+			steps.start({ name: "preflight" });
+			const counts = {};
+			const report = (reported) => {
+				for (const [key, value] of Object.entries(reported)) counts[key] = (counts[key] ?? 0) + value;
+			};
 			for (const extension of config.extensions) {
 				if (extension.preflight === void 0) continue;
 				try {
@@ -425,7 +514,8 @@ async function runStackPipelineInner(action, opts, reporters) {
 						graph,
 						container: containers.get(extension.id),
 						stage,
-						credentials: deps.credentials
+						credentials: deps.credentials,
+						report
 					});
 					if (payload !== void 0) preflightPayloads.set(extension.id, payload);
 				} catch (error) {
@@ -437,6 +527,7 @@ async function runStackPipelineInner(action, opts, reporters) {
 			} catch (error) {
 				throw toStructured("DEPLOY.PREFLIGHT_FAILED", error);
 			}
+			steps.finish({ name: "preflight" }, counts);
 		}
 		for (const extension of config.extensions) preflightTransportEnv[preflightEnvVarName(extension.id)] ??= "";
 	} catch (error) {
@@ -458,6 +549,7 @@ async function runStackPipelineInner(action, opts, reporters) {
 			return notOk(toStructured("DEPLOY.STACK_WRITE_FAILED", error));
 		}
 		const reproduceCommand = `alchemy ${action} ${GENERATED_STACK_RELATIVE_PATH} --yes --stage ${alchemyStage}`;
+		steps.start({ name: "apply" });
 		let outcome;
 		try {
 			outcome = await (deps.alchemy ?? spawnAlchemy)(alchemyInvocation({
@@ -509,6 +601,7 @@ async function runStackPipelineInner(action, opts, reporters) {
 				}
 			} }));
 		}
+		steps.finish({ name: "apply" });
 		try {
 			if (action === "destroy") {
 				for (const extension of pipeline.configSource.value.extensions) {
@@ -549,4 +642,4 @@ async function runStackPipelineInner(action, opts, reporters) {
 //#endregion
 export { executeDeploy, executeDestroy };
 
-//# sourceMappingURL=execute-deploy-destroy-c0eko3AO-9npuGXd3.mjs.map
+//# sourceMappingURL=execute-deploy-destroy-1Nn5Pz26-BqJhnlfK.mjs.map