@prisma/composer-cli 0.6.0-dev.21

package/dist/family-DkH0si4D-CN5QubKS.d.mts

@@ -0,0 +1,1294 @@
+import { CommandFamily } from "@prisma/cli-engine";
+import * as Layer from "effect/Layer";
+import { Input, StackServices } from "alchemy";
+import * as Effect from "effect/Effect";
+import { State } from "alchemy/State/State";
+//#region ../../0-framework/0-foundation/foundation/dist/errors.d.mts
+//#region src/structured-error.d.ts
+interface StructuredError extends Error {
+  readonly code: `${string}.${string}`;
+  readonly why?: string;
+  readonly fix?: string;
+  readonly where?: {
+    readonly path?: string;
+    readonly line?: number;
+  };
+  readonly severity?: 'error' | 'warn' | 'info';
+  readonly meta?: Record<string, unknown>;
+  readonly docsUrl?: string;
+}
+//#endregion
+//#region src/cli-structured-error.d.ts
+/**
+ * CLI error envelope for output formatting.
+ * This is the serialized form of a CliStructuredError.
+ */
+interface CliErrorEnvelope {
+  readonly ok: false;
+  readonly code: string;
+  readonly severity: 'error' | 'warn' | 'info';
+  readonly summary: string;
+  readonly why?: string;
+  readonly fix?: string;
+  readonly where?: {
+    readonly path?: string;
+    readonly line?: number;
+  };
+  readonly meta?: Record<string, unknown>;
+  readonly docsUrl?: string;
+}
+/**
+ * Structured CLI error that contains all information needed for error envelopes.
+ * Call sites throw these errors with full context.
+ *
+ * A `CliStructuredError` is a `StructuredError` (see
+ * `./structured-error.ts`): `code` is a dotted
+ * `NAMESPACE.SUBCODE` string, and the namespace prefix is the error's
+ * category — there is no separate `domain` field. See ADR 239 in
+ * prisma/prisma and composer's ADR-0044 for the namespace taxonomy.
+ */
+declare class CliStructuredError extends Error implements StructuredError {
+  readonly code: `${string}.${string}`;
+  readonly severity: 'error' | 'warn' | 'info';
+  readonly why?: string;
+  readonly fix?: string;
+  readonly where?: {
+    readonly path?: string;
+    readonly line?: number;
+  };
+  readonly meta?: Record<string, unknown>;
+  readonly docsUrl?: string;
+  constructor(code: `${string}.${string}`, summary: string, options?: {
+    readonly severity?: 'error' | 'warn' | 'info';
+    readonly why?: string;
+    readonly fix?: string;
+    readonly where?: {
+      readonly path?: string;
+      readonly line?: number;
+    };
+    readonly meta?: Record<string, unknown>;
+    readonly docsUrl?: string;
+    readonly cause?: unknown;
+  });
+  /**
+   * Converts this error to a CLI error envelope for output formatting.
+   */
+  toEnvelope(): CliErrorEnvelope;
+  /**
+   * Type guard to check if an error is a CliStructuredError.
+   * Uses duck-typing to work across module boundaries where instanceof may fail.
+   */
+  static is(error: unknown): error is CliStructuredError;
+}
+//#endregion
+//#region ../../../node_modules/@standard-schema/spec/dist/index.d.ts
+/** The Standard Typed interface. This is a base type extended by other specs. */
+interface StandardTypedV1<Input = unknown, Output = Input> {
+  /** The Standard properties. */
+  readonly "~standard": StandardTypedV1.Props<Input, Output>;
+}
+declare namespace StandardTypedV1 {
+  /** The Standard Typed properties interface. */
+  interface Props<Input = unknown, Output = Input> {
+    /** The version number of the standard. */
+    readonly version: 1;
+    /** The vendor name of the schema library. */
+    readonly vendor: string;
+    /** Inferred types associated with the schema. */
+    readonly types?: Types<Input, Output> | undefined;
+  }
+  /** The Standard Typed types interface. */
+  interface Types<Input = unknown, Output = Input> {
+    /** The input type of the schema. */
+    readonly input: Input;
+    /** The output type of the schema. */
+    readonly output: Output;
+  }
+  /** Infers the input type of a Standard Typed. */
+  type InferInput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["input"];
+  /** Infers the output type of a Standard Typed. */
+  type InferOutput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["output"];
+}
+/** The Standard Schema interface. */
+interface StandardSchemaV1<Input = unknown, Output = Input> {
+  /** The Standard Schema properties. */
+  readonly "~standard": StandardSchemaV1.Props<Input, Output>;
+}
+declare namespace StandardSchemaV1 {
+  /** The Standard Schema properties interface. */
+  interface Props<Input = unknown, Output = Input> extends StandardTypedV1.Props<Input, Output> {
+    /** Validates unknown input values. */
+    readonly validate: (value: unknown, options?: StandardSchemaV1.Options | undefined) => Result<Output> | Promise<Result<Output>>;
+  }
+  /** The result interface of the validate function. */
+  type Result<Output> = SuccessResult<Output> | FailureResult;
+  /** The result interface if validation succeeds. */
+  interface SuccessResult<Output> {
+    /** The typed output value. */
+    readonly value: Output;
+    /** A falsy value for `issues` indicates success. */
+    readonly issues?: undefined;
+  }
+  interface Options {
+    /** Explicit support for additional vendor-specific parameters, if needed. */
+    readonly libraryOptions?: Record<string, unknown> | undefined;
+  }
+  /** The result interface if validation fails. */
+  interface FailureResult {
+    /** The issues of failed validation. */
+    readonly issues: ReadonlyArray<Issue>;
+  }
+  /** The issue interface of the failure output. */
+  interface Issue {
+    /** The error message of the issue. */
+    readonly message: string;
+    /** The path of the issue, if any. */
+    readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
+  }
+  /** The path segment interface of the issue. */
+  interface PathSegment {
+    /** The key representing a path segment. */
+    readonly key: PropertyKey;
+  }
+  /** The Standard types interface. */
+  interface Types<Input = unknown, Output = Input> extends StandardTypedV1.Types<Input, Output> {}
+  /** Infers the input type of a Standard. */
+  type InferInput<Schema extends StandardTypedV1> = StandardTypedV1.InferInput<Schema>;
+  /** Infers the output type of a Standard. */
+  type InferOutput<Schema extends StandardTypedV1> = StandardTypedV1.InferOutput<Schema>;
+}
+//#endregion
+//#region ../../0-framework/1-core/core/dist/graph-types-N6brq1zY.d.mts
+//#region src/config.d.ts
+/**
+ * A declared config param — pure data: a caller-owned Standard Schema
+ * (ADR-0018) plus a few framework facets. The framework carries the schema,
+ * infers the value type from it, and validates with it, without ever
+ * enumerating permitted shapes. Turning a value into stored config and back is
+ * the deploy target's job, not the param's (ADR-0019) — the same split RPC
+ * uses: schema on the declaration, wire owned by the mover.
+ */
+interface ConfigParam<S extends StandardSchemaV1 = StandardSchemaV1> {
+  readonly schema: S;
+  readonly optional?: boolean;
+  readonly default?: StandardSchemaV1.InferOutput<S>;
+  /**
+   * A framework-minted value (ADR-0031): core resolves `provision.brand`
+   * against the consumer extension's `provisions` registry and mints this
+   * param's value per dependency edge. Opaque — core forwards the need and
+   * never reads its payload.
+   */
+  readonly provision?: ProvisionNeed;
+}
+type Params = Record<string, ConfigParam>;
+/** What implementations receive — undefined only for optional params with no default. */
+type Values<P extends Params> = { readonly [K in keyof P]: P[K]['optional'] extends true ? undefined extends P[K]['default'] ? StandardSchemaV1.InferOutput<P[K]['schema']> | undefined : StandardSchemaV1.InferOutput<P[K]['schema']> : StandardSchemaV1.InferOutput<P[K]['schema']>; };
+/**
+ * The connection face of a dependency: declared params (data) and how
+ * validated values become a client (the hydrate behavior slot). Both P and C
+ * are INFERRED — the declaration types hydrate's input; the factory types the
+ * loaded dep.
+ */
+interface Connection<P extends Params = Params, C = unknown> {
+  readonly params: P;
+  hydrate(values: Values<P>): C | Promise<C>;
+}
+/**
+ * The resolved, typed configuration of one service — what crosses the
+ * core→pack boundary. Core builds it at deploy (leaf values are provisioning
+ * refs, so the env writes depend on the resources/producer — the ordering
+ * edges); the pack serializes it, and at boot reconstructs the identical
+ * structure with concrete values. Both forms conform to the shape from
+ * configOf. Core never stringifies.
+ */
+interface Config {
+  readonly service: Readonly<Record<string, unknown>>;
+  readonly inputs: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+}
+//#endregion
+//#region src/contract.d.ts
+/**
+ * A Contract is the declared interface of a service-to-service dependency: a
+ * protocol brand (`kind`) plus an opaque comparison type (`Cmp`) the core
+ * never inspects. Wiring compatibility is plain TypeScript assignability on
+ * `Cmp`, checked at `ModuleBuilder.provision`'s call site (node.ts); `satisfies`
+ * is its runtime mirror, called at Load (graph.ts). Correctness comes from
+ * the kind's builder shaping `Cmp` so assignability means the right thing —
+ * see @prisma/composer/service-rpc's `contract()`/`rpc()`.
+ */
+interface Contract<Kind extends string, Cmp> {
+  readonly kind: Kind;
+  readonly __cmp: Cmp;
+  satisfies(required: Contract<Kind, unknown>): boolean;
+}
+//#endregion
+//#region src/node.d.ts
+declare const NODE: unique symbol;
+declare const SECRET_NEED: unique symbol;
+declare const SECRET_SOURCE: unique symbol;
+/** A declared secret input slot — nameless; the root binds it and the topology forwards it in. */
+interface SecretNeed {
+  readonly [SECRET_NEED]: true;
+  readonly kind: 'secret';
+}
+/** A module's secret-forwarding slots: name → the need it declares. */
+type Secrets = Record<string, SecretNeed>;
+/** The wiring value bound to a secret slot: a target-defined payload core forwards but never inspects. A target (e.g. @prisma/composer-prisma-cloud's `envSecret`) builds one via `secretSource()`. */
+interface SecretSource<T = unknown> {
+  readonly [SECRET_SOURCE]: true;
+  /** Target-defined. Core never reads this; the target that authored the source reads it back. */
+  readonly payload: T;
+}
+/** What `provision(moduleChild, { secrets })` supplies: one source per declared secret slot. */
+type SecretBindings<S extends Secrets> = { [K in keyof S]: SecretSource; };
+declare const PROVISION_NEED: unique symbol;
+/** A param value the framework mints. Opaque to core: it forwards the payload to the resolved provisioner and never reads it (ADR-0031). */
+interface ProvisionNeed<T = unknown> {
+  readonly [PROVISION_NEED]: true;
+  /** Selects the provisioner in an extension's `provisions` registry. */
+  readonly brand: symbol;
+  /** Provisioner-defined; core never reads it. */
+  readonly payload: T;
+}
+declare const PARAM_SOURCE: unique symbol;
+declare const PARAM_NEED: unique symbol;
+/** The wiring value bound to a param at provision time: a target-defined payload core forwards but never inspects. A target (e.g. @prisma/composer-prisma-cloud's `envParam`) builds one via `paramSource()`. */
+interface ParamSource<T = unknown> {
+  readonly [PARAM_SOURCE]: true;
+  /** Target-defined. Core never reads this; the target that authored the source reads it back. */
+  readonly payload: T;
+}
+/** A module's declared param-forwarding slot — nameless, schema-less; the root (or an ancestor module) binds a `ParamSource` and the topology forwards it into a child's real, schema-bearing param. */
+interface ParamNeed {
+  readonly [PARAM_NEED]: true;
+  readonly kind: 'param';
+}
+/** A module's param-forwarding slots: name → the need it declares. */
+type ParamNeeds = Record<string, ParamNeed>;
+/** What `provision(service, { params })` accepts per declared param: a literal (schema-validated when config is built) or an opaque `ParamSource`, taking precedence over `param.default`. Every entry is optional — an unbound param falls back to its `default`. */
+type ParamBindings<P extends Params> = { readonly [K in keyof P]?: StandardSchemaV1.InferOutput<P[K]['schema']> | ParamSource; };
+/** What `provision(moduleChild, { params })` accepts per declared `ParamNeed`: a `ParamSource` only — a need carries no schema to validate a literal against. */
+type ParamNeedBindings<PN extends ParamNeeds> = { readonly [K in keyof PN]?: ParamSource; };
+/**
+ * What `provision(service, { input })` accepts (ADR-0042): a plain object
+ * mirroring the service's input schema, whose leaves are literals,
+ * `envParam(...)` sources, or `envSecret(...)` sources. Deliberately a
+ * best-effort structural type: the framework never introspects a Standard
+ * Schema, so the binding's exact shape cannot be derived from it — deploy-time
+ * validation of the resolved binding is the real check.
+ */
+type InputBinding = string | number | boolean | null | ParamSource | SecretSource | readonly InputBinding[] | {
+  readonly [key: string]: InputBinding;
+};
+/** Opaque `Contract<any, any>` bound shared by every node/port type that doesn't care which contract. */
+type AnyContract = Contract<any, any>;
+/** How a service's app becomes a runnable artifact — the build descriptor's routing key (`extension`/`type`) plus paths resolved relative to the authoring module. */
+interface BuildAdapter {
+  /** The extension package that provides the build descriptor, e.g. "@prisma/composer/node". */
+  readonly extension: string;
+  /** The build descriptor's node ID within its extension, e.g. "node" · "nextjs". */
+  readonly type: string;
+  /** The authoring module's `import.meta.url` — every other path on this descriptor resolves relative to `dirname(module)`. */
+  readonly module: string;
+  /** The app's built runnable, resolved relative to `dirname(module)` and interpreted by the type's build descriptor (e.g. "node": a server file; "nextjs": located in the standalone tree). */
+  readonly entry: string;
+}
+/**
+ * A Resource's identity: the one place a piece of infrastructure exists.
+ * Provisioned by a module, never embedded in a service's deps. `provides`
+ * is the Contract the resource offers; `type` is derived from `provides.kind`.
+ */
+interface ResourceNode<C extends AnyContract = AnyContract> {
+  readonly [NODE]: true;
+  readonly kind: 'resource';
+  /** Human-readable, given at authoring — logs/diagnostics only; identity remains the deploy address (ADR-0006). */
+  readonly name: string;
+  /** The extension package that authored this node, e.g. "@prisma/composer-prisma-cloud" — the registry key at deploy. */
+  readonly extension: string;
+  readonly type: C['kind'];
+  /** The Contract this resource provides — the resource's single port. */
+  readonly provides: C;
+}
+/**
+ * A Service: inputs + its own declared params + how it is built. Inspectable,
+ * inert until run, and carries NO runtime behavior — an extension's factory
+ * wraps it into a runnable/loadable shape (see RunnableServiceNode).
+ */
+interface ServiceNode<D extends Deps = Deps, P extends Params = Params, E extends Expose = Expose, I extends StandardSchemaV1 | undefined = StandardSchemaV1 | undefined> {
+  readonly [NODE]: true;
+  readonly kind: 'service';
+  /** Human-readable, given at authoring — logs/diagnostics only; identity remains the deploy address (ADR-0006). */
+  readonly name: string;
+  /** The extension package that authored this node, e.g. "@prisma/composer-prisma-cloud" — the registry key at deploy. */
+  readonly extension: string;
+  readonly type: string;
+  readonly inputs: D;
+  /** Extension-reserved config declarations (e.g. compute's `port`) — never user-authored (ADR-0042). */
+  readonly params: P;
+  /** The service's whole incoming configuration as ONE Standard Schema (authored as `input`, ADR-0042), or `undefined` when it takes none. The framework never introspects it — it only calls `~standard.validate`. Named `inputSchema` on the node so the data field does not collide with the `input()` accessor. */
+  readonly inputSchema: I;
+  /** How the app's entry is built + assembled. */
+  readonly build: BuildAdapter;
+  /** Named output ports this service exposes — the Contracts a consumer's `rpc(contract)` can require. `undefined` when the service exposes nothing. */
+  readonly expose: E | undefined;
+}
+/**
+ * A service's dependency slot. At Load the enclosing module wires a
+ * producer's ref into it; at run it hydrates a client via Connection. `Req`
+ * is the required contract (`unknown` for an untyped end like `http()`).
+ */
+interface DependencyEnd<C = unknown, Req = unknown> {
+  readonly [NODE]: true;
+  readonly kind: 'dependency';
+  /** Human-readable, given at authoring — logs/diagnostics only. */
+  readonly name: string;
+  readonly type: string;
+  readonly connection: Connection<Params, C>;
+  /** The required contract, or `undefined` for an untyped end (e.g. `http()`). */
+  readonly required: Req | undefined;
+}
+/** A Module: the same Deps/Expose boundary a service has, around transparent wiring instead of a black-box body — its `body` runs at Load, not at authoring. */
+interface ModuleNode<D extends Deps = Deps, E extends Expose = Expose, S extends Secrets = Secrets, PN extends ParamNeeds = ParamNeeds> {
+  readonly [NODE]: true;
+  readonly kind: 'module';
+  /** Human-readable, given at authoring — logs/diagnostics only. */
+  readonly name: string;
+  readonly deps: D;
+  /** Declared secret input slots (authored as `secrets`) — forwarded to internals via `ctx.secrets` (ADR-0029). */
+  readonly secretSlots: S;
+  /** Declared param-forwarding slots (authored as `params`) — forwarded to internals via `ctx.params`, the same rail secrets ride on. */
+  readonly paramSlots: PN;
+  readonly expose: E;
+  body(ctx: ModuleContext<D, S, PN>): ModuleOutputs<E> | void;
+}
+/**
+ * What a module's body receives: its declared inputs as forwardable wiring
+ * values, plus `provision` to register the owned services/modules it wires them into.
+ */
+interface ModuleContext<D extends Deps, S extends Secrets = Secrets, PN extends ParamNeeds = ParamNeeds> {
+  /** The module's declared inputs as wiring values — pass them into provision(). */
+  readonly inputs: { [K in keyof D]: InputRef<D[K]>; };
+  /** The module's declared secret slots as forwardable sources — pass them into a child's `secrets` (ADR-0029). */
+  readonly secrets: { readonly [K in keyof S]: SecretSource; };
+  /** The module's declared param-forwarding slots as forwardable sources — pass them into a child's `params`. */
+  readonly params: { readonly [K in keyof PN]: ParamSource; };
+  /** Registers an owned child (service or module) under a stable id. */
+  readonly provision: ModuleBuilder['provision'];
+}
+/**
+ * A module's forwarded-input value: the same ref-port shape a producer's
+ * output carries, so it flows down a nested `provision()` call indistinguishably
+ * from a sibling's exposed port.
+ */
+type InputRef<DE> = DE extends DependencyEnd<any, infer Req extends AnyContract> ? RefPort<Req> : never;
+/** One ref-port per declared expose key, contract-checked against `E` (mirrors `Wiring`'s `NoInfer` use). */
+type ModuleOutputs<E extends Expose> = { [P in keyof E]: RefPort<NoInfer<E[P]>>; };
+/**
+ * A provisioned producer's port as a wiring-time value: its contract, tagged
+ * with which provider produced it (`__providerId`, read by Load to resolve the edge).
+ */
+type RefPort<C extends AnyContract> = C & {
+  readonly __providerId: string;
+};
+/**
+ * What `provision(id, service)` hands back: a stable id plus one ref-port per
+ * exposed contract. `provision(id, resource)` returns the same shape with the
+ * resource's one port flattened onto the ref itself.
+ */
+type ProvisionedRef<E extends Expose = Record<never, never>> = {
+  readonly id: string;
+} & { readonly [P in keyof E]: RefPort<E[P]>; };
+/** A DependencyEnd's required contract (unknown for an untyped end). */
+type ReqOf<DE> = DE extends DependencyEnd<any, infer Req> ? Req : never;
+/**
+ * The producers that satisfy a node's declared dependency slots — one ref per
+ * slot, checked against its required contract. A slot also accepts
+ * `InputRef<D[K]>` so a module body can forward its own `ctx.inputs` straight
+ * into a nested `provision()` call — the same value shape a producer's own
+ * exposed port carries.
+ */
+type DepBindings<D extends Deps> = { [K in keyof D]: NoInfer<ReqOf<D[K]>> | InputRef<D[K]>; };
+/**
+ * A SERVICE provision's trailing options: an explicit `id` (default: the
+ * node's own `name`); `deps` required exactly when the node declares
+ * dependency slots (`[keyof D] extends [never]` is the "no slots" test);
+ * `input` required exactly when the node declares an input schema (ADR-0042).
+ * `params` is always optional — it binds only extension-reserved params (e.g.
+ * compute's `port`), which fall back to their own defaults.
+ */
+type ServiceProvisionArgs<D extends Deps, I extends StandardSchemaV1 | undefined, PB> = [keyof D] extends [never] ? I extends undefined ? [opts?: {
+  id?: string;
+  params?: PB;
+}] : [opts: {
+  id?: string;
+  input: InputBinding;
+  params?: PB;
+}] : I extends undefined ? [opts: {
+  id?: string;
+  deps: DepBindings<D>;
+  params?: PB;
+}] : [opts: {
+  id?: string;
+  deps: DepBindings<D>;
+  input: InputBinding;
+  params?: PB;
+}];
+/**
+ * A child-MODULE provision's trailing options: `deps`/`secrets` required
+ * exactly when the module declares the slots; a declared param-forwarding
+ * slot may be bound to a `ParamSource`.
+ */
+type ModuleProvisionArgs<D extends Deps, S extends Secrets, PB> = [keyof D] extends [never] ? [keyof S] extends [never] ? [opts?: {
+  id?: string;
+  params?: PB;
+}] : [opts: {
+  id?: string;
+  secrets: SecretBindings<S>;
+  params?: PB;
+}] : [keyof S] extends [never] ? [opts: {
+  id?: string;
+  deps: DepBindings<D>;
+  params?: PB;
+}] : [opts: {
+  id?: string;
+  deps: DepBindings<D>;
+  secrets: SecretBindings<S>;
+  params?: PB;
+}];
+interface ModuleBuilder {
+  /** Provisions an owned resource; its id defaults to the node's `name`. */
+  provision<C extends AnyContract>(resource: ResourceNode<C>, opts?: {
+    id?: string;
+  }): {
+    readonly id: string;
+  } & RefPort<C>;
+  /** Registers an owned service; its id defaults to the node's `name`; `deps`/`input` are required iff it declares them; a reserved param may be bound (literal or `ParamSource`), overriding its default. */
+  provision<D extends Deps, P extends Params, E extends Expose, I extends StandardSchemaV1 | undefined>(service: ServiceNode<D, P, E, I>, ...args: ServiceProvisionArgs<D, I, ParamBindings<P>>): ProvisionedRef<E>;
+  /**
+   * The service call with `deps`/`input` spelled out. `ServiceProvisionArgs`
+   * above cannot resolve while `D`/`I` are still unbound type parameters — a
+   * generic wrapper like `cron()` provisioning a caller-supplied service — so
+   * that call site resolves to this concrete overload instead.
+   */
+  provision<D extends Deps, P extends Params, E extends Expose, I extends StandardSchemaV1 | undefined>(service: ServiceNode<D, P, E, I>, opts: {
+    id?: string;
+    deps: DepBindings<D>;
+    input?: InputBinding;
+    params?: ParamBindings<P>;
+  }): ProvisionedRef<E>;
+  /** Registers an owned child module; its id defaults to the node's `name`; `deps`/`secrets` are required iff it declares them; a declared param-forwarding slot may be bound to a `ParamSource`. */
+  provision<D extends Deps, E extends Expose, S extends Secrets, PN extends ParamNeeds>(child: ModuleNode<D, E, S, PN>, ...args: ModuleProvisionArgs<D, S, ParamNeedBindings<PN>>): ProvisionedRef<E>;
+  /** The child-module call with `deps`/`secrets` spelled out — the same generic-wrapper escape as the service overload above. */
+  provision<D extends Deps, E extends Expose, S extends Secrets, PN extends ParamNeeds>(child: ModuleNode<D, E, S, PN>, opts: {
+    id?: string;
+    deps: DepBindings<D>;
+    secrets?: SecretBindings<S>;
+    params?: ParamNeedBindings<PN>;
+  }): ProvisionedRef<E>;
+}
+/** Dependency map: name → the slot the service declares. Only declarations are admitted, never a concrete ResourceNode. */
+type Deps = Record<string, DependencyEnd<any, any>>;
+/** Output-port map: name → the Contract a service exposes for others to depend on. */
+type Expose = Readonly<Record<string, AnyContract>>;
+//#endregion
+//#region src/graph-types.d.ts
+/** Path-derived: root-scope children are bare ids ("auth", "db"); a nested module's own children dot-join under its address ("auth.db"). */
+type NodeId = string;
+interface GraphNode {
+  readonly id: NodeId;
+  readonly node: ServiceNode | ResourceNode | DependencyEnd | ModuleNode;
+}
+/**
+ * `input`: a service consumes its own declared dependency slot — from the
+ * slot node to the service. `dependency`: a service consumes a provisioned
+ * producer (a service or a resource — the one wiring mechanism) — from the
+ * producer to the consumer, labeled with the consumer's input name (from the
+ * module wiring).
+ */
+interface Edge {
+  readonly from: NodeId;
+  readonly to: NodeId;
+  readonly input: string;
+  readonly kind: 'input' | 'dependency';
+}
+/**
+ * A service's provision-time input binding (ADR-0042): the plain object a
+ * `provision(service, { input })` call supplied, recorded at that service's
+ * address. Core never walks it beyond usage tracking; the deploy target's
+ * recursive descent classifies its leaves (literals, `envParam`, `envSecret`).
+ */
+interface ServiceInputBinding {
+  /** The graph address of the service that declares the input schema. */
+  readonly serviceAddress: NodeId;
+  /** The binding object supplied at provision. */
+  readonly binding: InputBinding;
+}
+/**
+ * A resolved param binding: a `provision()` call bound a service's param
+ * slot to either a literal value or an opaque `ParamSource` — the non-secret
+ * sibling of `SecretBinding`. Unlike a secret, a param binding is not
+ * required for every declared param (a param may fall back to its own
+ * `default`), so this list only carries the ones a `provision()` call
+ * actually bound.
+ */
+interface ParamBinding {
+  /** The graph address of the service that declares the param. */
+  readonly serviceAddress: NodeId;
+  /** The param name on that service. */
+  readonly slot: string;
+  /** A literal value (schema-validated by `buildConfig`) or an opaque `ParamSource` (the deploy target reads its own payload back) — check with `isParamSource`. Core never inspects a `ParamSource`'s payload. */
+  readonly binding: unknown;
+}
+interface Graph {
+  readonly root: GraphNode;
+  /** Root + one per input, topo-ordered (deps first). */
+  readonly nodes: readonly GraphNode[];
+  readonly edges: readonly Edge[];
+  /** Every service input binding a `provision()` call supplied (ADR-0042). */
+  readonly inputBindings: readonly ServiceInputBinding[];
+  /** Every service param bound at provision — literal or source; unbound params are absent here and fall back to their `default` (see `buildConfig`). */
+  readonly params: readonly ParamBinding[];
+}
+//#endregion
+//#region ../../0-framework/3-tooling/cli/dist/load-entry-yXw6cagY.d.mts
+/**
+ * WHAT to converge. Deliberately not a command line: which alchemy binary to
+ * run is a question about this machine's installed tree, and answering it
+ * eagerly would make an injected adapter — a test's fake child — fail in a
+ * directory that has no alchemy installed, before the fake ever ran. The
+ * adapter resolves the binary, because the adapter is what starts a child.
+ *
+ * `env` carries only the ADDITIONS to the invoking environment — the container
+ * transport vars and the result-file pointer — never a whole environment: the
+ * engine merges additions over the invocation environment and applies its own
+ * credential vars last.
+ */
+interface AlchemyInvocation {
+  readonly action: 'deploy' | 'destroy';
+  readonly stackFileRelativePath: string;
+  readonly cwd: string;
+  readonly stage: string;
+  readonly env: Readonly<Record<string, string | undefined>>;
+}
+/**
+ * How the converge child ended, verbatim. A signal-killed child carries
+ * `signal` and a null `exitCode`; callers branch on `signal` first, because a
+ * signal-killed child is an abort, not a failure. Structurally the engine's
+ * `ChildResult`, declared here so the control surface does not depend on the
+ * engine.
+ */
+interface AlchemyOutcome {
+  readonly exitCode: number | null;
+  readonly signal: string | null;
+}
+/** Starts the converge and resolves when it ends. The CLI supplies one backed
+ *  by `ctx.spawn`; hosts get `spawnAlchemy`. */
+type RunAlchemy = (invocation: AlchemyInvocation) => Promise<AlchemyOutcome>;
+//#endregion
+//#region ../../0-framework/0-foundation/foundation/dist/result.d.mts
+//#region src/result.d.ts
+/**
+ * Represents a successful result containing a value.
+ */
+interface Ok<T> {
+  readonly ok: true;
+  readonly value: T;
+  assertOk(): T;
+  assertNotOk(): never;
+}
+/**
+ * Represents an unsuccessful result containing failure details.
+ */
+interface NotOk<F> {
+  readonly ok: false;
+  readonly failure: F;
+  assertOk(): never;
+  assertNotOk(): F;
+}
+/**
+ * A discriminated union representing either success (Ok) or failure (NotOk).
+ *
+ * @typeParam T - The success value type
+ * @typeParam F - The failure details type
+ */
+type Result$1<T, F> = Ok<T> | NotOk<F>;
+//#endregion
+//#region ../../0-framework/1-core/core/dist/app-config-aIrriqVU.d.mts
+//#region src/container-transport.d.ts
+/**
+ * Carries resolved containers from the CLI process into the alchemy process
+ * (ADR-0037). A deploy runs as two processes: the CLI resolves each
+ * extension's containers, then spawns `alchemy`, which re-imports the config
+ * from scratch and needs those containers back — and env vars are the only
+ * channel between the two. So the CLI writes each instance's `serialize()`
+ * output into one env var per extension, and in the alchemy process
+ * `deserializeContainers` reads each var back through the same extension's
+ * descriptor. The framework owns the vars; it never reads their contents.
+ */
+/** The key an extension resolves a container from: which app, which stage. */
+interface LocateContainerInput {
+  /** The application name (root node's name, or `--name`). */
+  readonly appName: string;
+  /** The USER-FACING stage name — `--stage <name>` as the user typed it (git-ref validated), or `undefined` for the default (production) stage. Alchemy's stage is the container's `alchemyStage` when supplied, with this value as the explicit-user-stage fallback; when neither exists, the CLI fails before Alchemy runs. */
+  readonly stage: string | undefined;
+}
+/**
+ * One resolved container. The framework sees only this interface; the
+ * extension that produced the instance narrows it back to its own concrete
+ * type wherever the framework hands it back (ADR-0037).
+ */
+interface ContainerInstance {
+  readonly input: LocateContainerInput;
+  /** The exact string the CLI hands `alchemy` as its stage — the deploy-state scope. Distinct from `input.stage`, the user-facing name: for Prisma Cloud this is the resolved Branch id (stable across renames, machine-independent). Framework-visible like `input` — NOT part of the `serialize()` payload, which stays extension-owned. */
+  readonly alchemyStage?: string | undefined;
+  /** Serialize to a non-empty string for the process transport above. The format is the extension's own; only its `deserialize` reads it. */
+  serialize(): string;
+}
+/**
+ * What the caller has already authenticated, handed to one container
+ * lifecycle call. A caller that holds neither omits the argument, and the
+ * extension falls back to whatever credential protocol it defines for
+ * itself (for Prisma Cloud, its env vars — which is how the alchemy child
+ * process still resolves containers).
+ *
+ * `C` is the extension's own platform-client type, left as a type parameter
+ * because this shared-plane module must not import a platform SDK; the
+ * framework only carries the value, never calls it. The framework stores the
+ * erased `C = unknown` form and the extension recovers its concrete client
+ * through the same method bivariance that erases `I` below.
+ */
+interface ContainerCredentials<C = unknown> {
+  /** The workspace the container lives in. `undefined` when the caller has no workspace to name — the extension decides whether it can proceed. */
+  readonly workspaceId: string | undefined;
+  /** An already-authenticated platform API client. Present means the extension must not build its own from the environment. */
+  readonly client?: C | undefined;
+}
+/**
+ * The platform containers an app deploys into, as one lifecycle. `I` is
+ * the extension's own instance type — the same descriptor produces and
+ * consumes it, so the extension gets full typing internally while the
+ * framework stores the erased form; `C` erases the same way. METHOD SYNTAX
+ * REQUIRED on all four members: the erased assignment into
+ * ExtensionDescriptor compiles only through method bivariance;
+ * property-arrow members are checked contravariantly and the assignment
+ * fails (same rule as ServiceLowering<P, S> — ADR-0033).
+ */
+interface ContainerDescriptor<I extends ContainerInstance = ContainerInstance, C = unknown> {
+  /** Resolve the container for (appName, stage), creating anything absent. Called by `deploy`. */
+  ensure(input: LocateContainerInput, credentials?: ContainerCredentials<C>): Promise<I>;
+  /** Find the container for (appName, stage); `undefined` when nothing exists. Called by `destroy` — never creates. */
+  locate(input: LocateContainerInput, credentials?: ContainerCredentials<C>): Promise<I | undefined>;
+  /** Remove the container after a successful destroy, after every extension's `teardown` has run. Failure policy is the extension's. */
+  remove(instance: I, credentials?: ContainerCredentials<C>): Promise<void>;
+  /** Reconstruct an instance from its own `serialize()` output — the far end of the framework's parent→child transport. */
+  deserialize(serialized: string): I;
+}
+//#endregion
+//#region src/control/deploy.d.ts
+/** The Layer shape every Alchemy state store must satisfy — what `LowerOptions.state` and `PrismaAppConfig.state` both traffic in. */
+type AlchemyStateLayer = Layer.Layer<State, never, StackServices>;
+/**
+ * An extension's application-level descriptor: shared infrastructure that runs
+ * once per lowering, before any node. Its outputs reach the extension's own
+ * SPI calls via LowerContext.application.
+ */
+interface ApplicationDescriptor {
+  provision(ctx: LowerContext): Effect.Effect<unknown, unknown, unknown>;
+}
+/**
+ * One provisioned param need, resolved against the CONSUMER extension's
+ * `provisions` registry (ADR-0031). `edgeId` — `${consumerAddress}.${input}`
+ * — is the mint's stable resource key, so a provisioner's own resource ids
+ * derive from it and stay stable across redeploys.
+ */
+interface ProvisionEdge {
+  readonly edgeId: string;
+  readonly consumerAddress: string;
+  readonly providerAddress: string;
+  readonly input: string;
+  /** Opaque; forwarded from the param's declared need. Core never reads its payload. */
+  readonly need: ProvisionNeed;
+}
+/** One extension-registered provisioner, keyed by a need's brand (ADR-0031). */
+interface ProvisionerDescriptor {
+  /** Mints one stable value for one provisioned edge; yields the platform resource, returns an opaque ref core forwards into config. */
+  provision(edge: ProvisionEdge): Effect.Effect<unknown, unknown, unknown>;
+}
+/**
+ * The phased service SPI. `P` and `S` are the descriptor's OWN intra-node
+ * handoff types — provision's product consumed by serialize/deploy, and
+ * serialize's product consumed by deploy. Core threads them through without
+ * inspection; only the descriptor that writes them reads them.
+ *
+ * Method syntax (not property-arrow) is required: the heterogeneous
+ * descriptor registry (`NodeDescriptor`) assigns concrete descriptors to
+ * this interface's `unknown` defaults through TypeScript's method
+ * bivariance — a property-arrow form is checked contravariantly and breaks
+ * that assignment.
+ */
+interface ServiceLowering<P = unknown, S = unknown> {
+  /** Makes the platform-specific thing that will host the service — identity-bearing infrastructure only, no code runs. */
+  provision(ctx: LowerContext): Effect.Effect<P, unknown, unknown>;
+  /**
+   * Encodes the typed Config into the service's runtime environment. Boot-side
+   * deserialize reverses it through the same serializer. Returns the env-var
+   * records so `deploy` can reference them.
+   */
+  serialize(ctx: LowerContext, provisioned: P, config: Config): Effect.Effect<S, unknown, unknown>;
+  /**
+   * Prints the bootstrap and assembles the deployable artifact from the
+   * app-built bundle. Must be byte-deterministic: an unchanged service noops
+   * on redeploy.
+   */
+  package(ctx: LowerContext, input: PackageInput): Effect.Effect<Artifact, unknown, unknown>;
+  /** Ships the packaged artifact into the provisioned thing and runs it. Returns the node's outputs for dependents, plus the entities it became on the deployment target. */
+  deploy(ctx: LowerContext, provisioned: P, artifact: Artifact, serialized: S): Effect.Effect<LoweredResult, unknown, unknown>;
+}
+/** Input to an extension's package() step: the built bundle and the node's graph address. */
+interface PackageInput {
+  /** The build descriptor's normalized output: the bundle dir + the app's runnable. */
+  readonly assembled: Bundle;
+  /** The node's graph address — baked into the printed bootstrap. */
+  readonly address: string;
+}
+/** One node's realization. Runs inside the Alchemy stack effect. */
+type Lowering = (ctx: LowerContext) => Effect.Effect<LoweredResult, unknown, unknown>;
+interface LowerContext {
+  readonly id: NodeId;
+  /**
+   * The node's deployment address: its full, dot-joined hierarchical
+   * position in the graph (e.g. "auth.api"). The config-key namespace and
+   * the bootstrap parameter.
+   */
+  readonly address: string;
+  readonly node: ServiceNode | ResourceNode;
+  readonly graph: Graph;
+  readonly opts: LowerOptions;
+  /**
+   * The owning extension's application hook product; `undefined` when the
+   * extension declares no hook. Core never reads it; the extension narrows
+   * it with its own type guard.
+   */
+  readonly application: unknown;
+  /**
+   * The owning extension's resolved container, deserialized from the
+   * framework transport; core never reads it — the extension narrows it
+   * with its own type guard. `undefined` when the extension declares no
+   * container descriptor.
+   */
+  readonly container: ContainerInstance | undefined;
+  /** Already-lowered deps (topo order). */
+  readonly lowered: ReadonlyMap<NodeId, Outputs>;
+  /** Every provisioned param value minted this lowering, keyed by edge id (ADR-0031). */
+  readonly provisioned: ReadonlyMap<string, unknown>;
+}
+/**
+ * The values a node provides to its dependents — what a consumer's declared
+ * connection params resolve against (buildConfig reads them by param name).
+ * Name-keyed and unknown-valued of necessity: core cannot know extension
+ * types, and which producer feeds which consumer is decided by the user's
+ * graph at runtime. The connection declaration is the contract.
+ */
+type Outputs = Readonly<Record<string, unknown>>;
+/**
+ * One thing a node became on the deployment target, RESOLVED — what the report
+ * consumer sees. The descriptor names it; core never infers meaning from it.
+ * `url` is present ONLY when the descriptor declares the address publicly
+ * reachable — a connection string is never a `url`.
+ *
+ * A descriptor constructing one holds `svc.id` / `deployment.deployedUrl` —
+ * `Output<T>` references, not values, because the stack effect runs before
+ * Alchemy applies anything. So construction sites traffic in
+ * `Input<DeployedEntity>` (Alchemy's own idiom for "this shape, fields possibly
+ * unresolved"); apply resolves it before any reader sees it.
+ */
+interface DeployedEntity {
+  readonly kind: string;
+  readonly id: string;
+  readonly url?: string;
+  readonly details?: Readonly<Record<string, string>>;
+}
+/**
+ * What a node's final lowering phase produces: outputs for dependents,
+ * entities for reporting.
+ *
+ * `entities` is REQUIRED, not optional. "This node became nothing reportable
+ * on the deployment target" is a claim, and an optional field lets a
+ * descriptor make it by saying nothing at all — no error, no type complaint,
+ * no failing test. That is the shared bag's sin in miniature (ADR-0033): a
+ * claim made anonymously, with nothing recording that a claim was made. `[]`
+ * costs one token and puts the assertion on the record where a reviewer can
+ * see it.
+ */
+interface LoweredResult {
+  readonly outputs: Outputs;
+  readonly entities: readonly Input<DeployedEntity>[];
+}
+/** What one graph node became — in-process only (it holds the node itself, so it never crosses the stack boundary). */
+interface DeployedNode {
+  readonly address: string;
+  readonly node: ServiceNode | ResourceNode;
+  readonly entities: readonly DeployedEntity[];
+}
+/** The result of the Deploy operation: the app and every node it deployed, in topo order. */
+interface DeploymentResult {
+  readonly app: string;
+  readonly nodes: readonly DeployedNode[];
+}
+interface LowerOptions {
+  /** Stack + root node id. */
+  readonly name: string;
+  readonly bundles: Record<string, Bundle>;
+  readonly stage?: string;
+  /** Alchemy state store for the stack. Defaults to the config's own state layer. */
+  readonly state?: AlchemyStateLayer;
+  /** Explicit provider set for the stack. Defaults to the config's own merged `providers()` (`mergedProviders`) — the same override precedence as `state`. The dev stack module passes `localTargetProviders(...)` here (ADR-0041); `lower()` itself learns nothing about the local target. */
+  readonly providers?: Layer.Layer<never>;
+  /**
+   * Invoked once per deploy, during apply, with the Deploy operation's result
+   * — the app and every node it deployed, resolved, in topo order.
+   * Presentation belongs to the caller (the CLI wires its renderer here);
+   * core never formats. Absent means no report is assembled and no Action is
+   * declared at all.
+   */
+  readonly report?: (result: DeploymentResult) => void;
+}
+/** A build descriptor's normalized output: the produced bundle dir plus the app's runnable entry within it. */
+interface Bundle {
+  readonly dir: string;
+  readonly entry: string;
+  /**
+   * Absolute paths to the USER-BUILT inputs this bundle was assembled from
+   * (ADR-0041). `prisma-composer dev`'s watch loop watches exactly these — a
+   * file entry as a file, a directory entry recursively — and re-runs
+   * assemble on a change. Optional so a build adapter that predates this
+   * field still compiles; a bundle without it is simply not watched.
+   */
+  readonly watch?: readonly string[];
+}
+/** Shared input shape for every extension's build descriptor. */
+interface AssembleInput {
+  readonly build: BuildAdapter;
+  /** The service's graph address (e.g. "storefront.web"). Unique per service, so the assembler uses it to name this service's own working directory: `<cwd>/.prisma-composer/artifacts/<address>/`. */
+  readonly address: string;
+  /** The directory the deploy command was run from. The assembler puts its working directory under it (`<cwd>/.prisma-composer/`), the same place the CLI writes its other generated files. */
+  readonly cwd: string;
+}
+/** package()'s product. */
+interface Artifact {
+  readonly path: string;
+  readonly sha256: string;
+}
+//#endregion
+//#region src/control/app-config.d.ts
+/**
+ * One extension's control-plane registry: everything the deploy pipeline may
+ * look up for a node whose `extension` field names this package. `nodes` is
+ * keyed by the node's within-extension ID (`node.type` / `build.type`).
+ */
+interface ExtensionDescriptor {
+  /** The extension's package name, e.g. "@prisma/composer-prisma-cloud" — what a node's `extension` field is matched against. */
+  readonly id: string;
+  /** ONE registry per extension, keyed by node ID. */
+  readonly nodes: Record<string, NodeDescriptor>;
+  /** Param provisioners this extension supplies, keyed by need brand (ADR-0031). Core resolves a param's ProvisionNeed against the CONSUMER extension's map. */
+  readonly provisions?: ReadonlyMap<symbol, ProvisionerDescriptor>;
+  /** Once-per-lowering hook — the application's shared infrastructure (e.g. prisma-cloud's Project). */
+  readonly application?: ApplicationDescriptor;
+  /** The extension's Alchemy providers — merged across all configured extensions (config order). */
+  readonly providers?: () => Layer.Layer<never>;
+  /**
+   * Deploy-time prerequisite check — the CLI runs it once, after the app's
+   * Project/Branch are resolved and BEFORE any stack file is written or Alchemy
+   * runs. A target uses it to verify platform prerequisites (e.g. that every
+   * secret env var in the provision manifest exists for the resolved stage) and
+   * throws to abort the deploy. Async: it talks to the platform (ADR-0029).
+   *
+   * METHOD SYNTAX REQUIRED, for the same reason ContainerDescriptor's members
+   * need it: the framework hands over the erased `PreflightInput<unknown>`,
+   * and an extension that types the input against its own client type only
+   * assigns here through method bivariance.
+   */
+  preflight?(input: PreflightInput): Promise<void>;
+  /**
+   * Destroy-time cleanup — the CLI runs it once, after `alchemy destroy`
+   * succeeds and BEFORE the stage's Project/Branch are removed. A target uses
+   * it to remove infrastructure it owns outside the stack (e.g. the deploy
+   * state store, which the destroy above was still reading). Throwing aborts
+   * the destroy before the containers go; a target that would rather warn than
+   * fail the command handles that itself. Async: it talks to the platform.
+   */
+  readonly teardown?: (input: TeardownInput) => Promise<void>;
+  /**
+   * The extension's container lifecycle, when its platform has containers
+   * (ADR-0038). The CLI resolves containers after assembly and before any
+   * stack file or Alchemy run (deploy ensures, destroy locates); the
+   * resolved instance reaches the alchemy process through the env transport
+   * in container-transport.ts.
+   */
+  readonly container?: ContainerDescriptor;
+  /**
+   * The extension's LOCAL TARGET counterpart (ADR-0041; naming, operator
+   * 2026-07-23 — "dev" names the user-facing feature only, the seam takes
+   * the concept's real noun) — a LAZY reference: an async thunk, never the
+   * descriptor object itself. This keeps the production control entry's
+   * static import graph free of local-target implementation code (operator
+   * directive) — the thunk is one line, dynamically importing the
+   * extension's own local-target entry by bare specifier
+   * (e.g. `() => import('@prisma/composer-prisma-cloud/local-target').then((m) => m.localTargetDescriptor())`),
+   * so nothing local-target-flavored is bundled into, or loaded by, any
+   * deploy path.
+   */
+  readonly localTarget?: () => Promise<LocalTargetDescriptor>;
+}
+/**
+ * The deploy's one state store. It names its owning extension so core knows
+ * whose resolved container to pass into `create` (ADR-0038).
+ */
+interface StateDescriptor {
+  /** The owning extension's id — matched against `ExtensionDescriptor.id`. */
+  readonly extension: string;
+  /** Build the state layer. `container` is the owning extension's resolved instance; `undefined` when it declared no container descriptor. */
+  create(container: ContainerInstance | undefined): AlchemyStateLayer;
+}
+/** The resolved deploy context handed to an extension's `preflight` hook. `C` erases to `unknown` at the framework boundary — see ContainerCredentials. */
+interface PreflightInput<C = unknown> {
+  /** The loaded application graph — the manifest of prerequisites is read from it (`provisionManifest`). */
+  readonly graph: Graph;
+  /** The calling extension's own resolved container; `undefined` when it declares no container descriptor. Narrow with the extension's guard. */
+  readonly container: ContainerInstance | undefined;
+  /** The stage name (`--stage`), or `undefined` for the default stage — for diagnostics/scope. */
+  readonly stage: string | undefined;
+  /** What the caller has already authenticated, for the platform calls preflight makes. Absent means the extension falls back to its own credential protocol. */
+  readonly credentials?: ContainerCredentials<C> | undefined;
+}
+/** The resolved destroy context handed to an extension's `teardown` hook. */
+interface TeardownInput {
+  /** The calling extension's own resolved container; `undefined` when it declares no container descriptor. Narrow with the extension's guard. */
+  readonly container: ContainerInstance | undefined;
+  /** The stage name (`--stage`), or `undefined` for the default stage — for diagnostics/scope. */
+  readonly stage: string | undefined;
+}
+/** The extension's LOCAL TARGET counterpart (ADR-0041) — the local-target variant OF ExtensionDescriptor, hence the full qualifier. An extension without one is not local-target-capable (cannot back the "dev" feature). */
+interface LocalTargetDescriptor {
+  /** Local providers for the SAME resource types this extension's lowering emits. Receives the app identity — unlike deploy's env-arg-free `providers()`, local providers are emulator clients and must know which app they provision for. */
+  providers(input: LocalTargetProvidersInput): Layer.Layer<never>;
+  /** A stable local identity — resolved without any platform call. */
+  readonly container: ContainerDescriptor;
+  /** Value sourcing (secrets/env-params) — runs where deploy's preflight runs. */
+  preflight?(input: PreflightInput): Promise<void>;
+  /** Ensure the emulator daemons this topology's node kinds need are running (idempotent; they persist across sessions). */
+  emulators?(input: LocalTargetEmulatorsInput): Promise<void>;
+  /** The dev session's view of the running app. Core renders it and never learns an emulator's API. */
+  attach(input: LocalTargetAttachInput): Promise<LocalTargetAttachment>;
+  /** `--fresh`: remove every local trace of the dev instance — emulator instances, state, data. */
+  teardown?(input: TeardownInput): Promise<void>;
+}
+interface LocalTargetProvidersInput {
+  /** This extension's resolved local-target container (its `input.appName` is the emulator app namespace). */
+  readonly container: ContainerInstance | undefined;
+  /** Absolute path of the dev state directory (`<cwd>/.prisma-composer/dev`). */
+  readonly devDir: string;
+}
+interface LocalTargetEmulatorsInput {
+  /** The loaded application graph — inspected for which node kinds need an emulator. */
+  readonly graph: Graph;
+  readonly container: ContainerInstance | undefined;
+  /** Absolute path of the dev state directory (`<cwd>/.prisma-composer/dev`). */
+  readonly devDir: string;
+}
+interface LocalTargetAttachInput {
+  readonly container: ContainerInstance | undefined;
+  readonly devDir: string;
+}
+interface LocalTargetAttachment {
+  /** Start every stopped service from its last deployment (the session-resume signal — a no-op converge cannot start anything). */
+  startServices(): Promise<void>;
+  /** Every service's local endpoint, for the front door. */
+  endpoints(): Promise<readonly {
+    readonly address: string;
+    readonly url: string;
+  }[]>;
+  /** Merged, line-oriented log stream across the app's services (including services that appear after later converges). `opts.tail` is how many trailing lines of existing history to emit before live output (default 0 — live only). Ends when `signal` aborts. */
+  logs(signal: AbortSignal, opts?: {
+    readonly tail?: number;
+  }): AsyncIterable<{
+    readonly service: string;
+    readonly line: string;
+  }>;
+  /** Stop the app's service instances (emulators and data persist). */
+  stopServices(): Promise<void>;
+}
+/**
+ * What one registry entry can do. The `kind` discriminant is checked at every
+ * lookup site against what the site needs — a resource node looked up against
+ * a `service` descriptor is an error naming (extension, type, expected kind).
+ */
+type NodeDescriptor = ({
+  readonly kind: 'resource';
+} & Lowering) | ({
+  readonly kind: 'service';
+} & ServiceLowering) | {
+  readonly kind: 'build';
+  assemble(input: AssembleInput): Promise<Bundle>;
+};
+/**
+ * The config file's default export. `extensions` lists every extension the
+ * app deploys through; `state` is the ONE state store per deploy — explicit,
+ * platform-agnostic, never defaulted by an extension.
+ */
+interface PrismaAppConfig {
+  readonly extensions: ExtensionDescriptor[];
+  readonly state: StateDescriptor;
+}
+//#endregion
+//#region ../../0-framework/3-tooling/assemble/dist/index.d.mts
+/** Assembles one service node — the seam tests substitute to avoid a real build. */
+type RunAssembler = (node: ServiceNode, address: string, cwd: string) => Promise<Bundle>;
+//#endregion
+//#region ../../0-framework/3-tooling/cli/dist/log-DRnnWupy.d.mts
+//#region src/deployment-summary.d.ts
+/** The serializable projection of DeploymentResult — what CAN cross the process
+ * boundary. Writer (report hook) and reader (deploy operation) share this shape. */
+interface DeployedNodeSummary {
+  readonly address: string;
+  readonly entities: readonly DeployedEntity[];
+}
+interface DeploymentSummary {
+  readonly app: string;
+  readonly nodes: readonly DeployedNodeSummary[];
+}
+//#endregion
+//#region src/operations/shared.d.ts
+/** A running service's dotted address plus its local URL — what `dev` reports
+ * as the front door and `log` reports as the tailable services. */
+interface ServiceEndpoint {
+  readonly address: string;
+  readonly url: string;
+}
+/**
+ * The operations' in-package injection seam — lets the CLI's own tests drive
+ * them without a real wrapper build, config evaluation, or alchemy process.
+ * Threaded through the *WithDeps variants, never part of the published
+ * surface: the fields mirror internal types.
+ */
+interface OperationDeps {
+  readonly runAssembler?: RunAssembler | undefined;
+  /**
+   * Starts the converge child. The CLI passes one backed by the engine's
+   * `ctx.spawn`, so the terminal reaches the child natively and the engine
+   * owns signal policy; hosts get the default `spawnAlchemy`.
+   */
+  readonly alchemy?: RunAlchemy | undefined;
+  readonly config?: PrismaAppConfig | undefined;
+  /** Names the config file explicitly instead of walking up from the entry. */
+  readonly configPath?: string | undefined;
+  /**
+   * How the in-process leg authenticates: the caller's already-authenticated
+   * API client and the workspace it acts in. Supplied by the CLI from the
+   * engine's credential read, so no code below this point reads the
+   * environment for token material. Absent for hosts that have not adopted
+   * the seam — the container descriptors then fall back to the environment
+   * protocol, as the spawned child does.
+   *
+   * Read by `deploy` and `destroy` only, because they are the operations that
+   * reach a PLATFORM container. `dev` and `log` resolve local targets, whose
+   * container is "a stable local identity — resolved without any platform
+   * call", and both commands are credential-free by contract: there is no
+   * authenticated call on those paths for this to reach.
+   */
+  readonly credentials?: ContainerCredentials | undefined;
+}
+//#endregion
+//#region src/operations/deploy.d.ts
+interface DeployInput {
+  /** Path to the entry module, resolved against `cwd` — same contract as `prisma-composer deploy <entry>`. */
+  readonly entry: string;
+  /** Override the root node's name (the `--name` flag's slot). */
+  readonly name?: string | undefined;
+  /** Target stage. ABSENT = production — bare deploy targets production (main.ts effectiveStage). */
+  readonly stage?: string | undefined;
+  /** Defaults to process.cwd(); the directory `.prisma-composer/` and `.alchemy` state live under. */
+  readonly cwd?: string | undefined;
+}
+interface DeploySuccess {
+  /** Parsed from the alchemy child's result file. Undefined when the child
+   * did not write one (injected fake alchemy, or a report-less apply). */
+  readonly summary: DeploymentSummary | undefined;
+}
+/** In-package variant threading the injection seam (the CLI's RunDeps, unit
+ * tests). Deliberately NOT re-exported through `./control` — the seam mirrors
+ * internal types and is not part of the published surface. */
+declare function deployWithDeps(input: DeployInput, deps: OperationDeps): Promise<Result$1<DeploySuccess, CliStructuredError>>;
+//#endregion
+//#region src/operations/destroy.d.ts
+/** Destroy must name its target explicitly — no silent default to production. Encoded, not re-derived from flags. */
+type DestroyTarget = {
+  readonly kind: 'production';
+} | {
+  readonly kind: 'stage';
+  readonly stage: string;
+};
+type DestroyEvent =
+/** Emitted before the pipeline when `<cwd>/.alchemy` is missing/empty. */
+{
+  readonly kind: 'no-local-deploy-state';
+  readonly cwd: string;
+};
+interface DestroyInput {
+  readonly entry: string;
+  readonly name?: string | undefined;
+  readonly target: DestroyTarget;
+  readonly cwd?: string | undefined;
+  /** Mid-operation notifications, in real time. Rendering is the host's. */
+  readonly onEvent?: ((event: DestroyEvent) => void) | undefined;
+}
+/** In-package variant threading the injection seam (the CLI's RunDeps, unit
+ * tests). Deliberately NOT re-exported through `./control` — the seam mirrors
+ * internal types and is not part of the published surface. */
+declare function destroyWithDeps(input: DestroyInput, deps: OperationDeps): Promise<Result$1<void, CliStructuredError>>;
+//#endregion
+//#region src/operations/dev.d.ts
+type DevEvent =
+/** Initial front door + after each successful re-converge. */
+{
+  readonly kind: 'ready';
+  readonly endpoints: readonly ServiceEndpoint[];
+} | {
+  readonly kind: 'unwatchable';
+  readonly address: string;
+} | {
+  readonly kind: 'rebuild-failed';
+  readonly message: string;
+} |
+/** The file watcher itself errored (EMFILE, a vanished directory); the session keeps running. */
+{
+  readonly kind: 'watch-error';
+  readonly message: string;
+} |
+/** The app keeps running, still watching. */
+{
+  readonly kind: 'converge-failed';
+  readonly stackFilePath: string;
+  readonly reproduceCommand: string;
+  readonly cwd: string;
+} | {
+  readonly kind: 'stopping';
+} |
+/** One service refused to stop during stop(); teardown continues and `stopped` still follows. */
+{
+  readonly kind: 'stop-error';
+  readonly message: string;
+} | {
+  readonly kind: 'stopped';
+};
+interface DevInput {
+  readonly entry: string;
+  readonly name?: string | undefined;
+  readonly fresh?: boolean | undefined;
+  readonly cwd?: string | undefined;
+  readonly onEvent?: ((event: DevEvent) => void) | undefined;
+}
+/** A running dev session. The operation NEVER touches process signal handlers —
+ * the host owns signals (and must evict alchemy's import-time SIGINT/SIGTERM
+ * listeners before installing its own; see run-dev.ts). */
+interface DevSession {
+  /** The initial front door, already merged across attachments. */
+  readonly endpoints: readonly ServiceEndpoint[];
+  /** Stop the watch loop and the app's services (emulators and data stay up).
+   * Idempotent; emits 'stopping'/'stopped'; resolves `closed`. */
+  stop(): Promise<void>;
+  /** Settles when the session has fully stopped (via stop()). */
+  readonly closed: Promise<void>;
+}
+/** In-package variant threading the injection seam (the CLI's RunDeps, unit
+ * tests). Deliberately NOT re-exported through `./control` — the seam mirrors
+ * internal types and is not part of the published surface. */
+declare function devWithDeps(input: DevInput, deps: OperationDeps): Promise<Result$1<DevSession, CliStructuredError>>;
+//#endregion
+//#region src/pipeline.d.ts
+interface AppIdentity {
+  readonly configPath: string;
+  readonly config: PrismaAppConfig;
+  readonly name: string;
+}
+//#endregion
+//#region src/operations/log.d.ts
+interface LogLine {
+  readonly service: string;
+  readonly line: string;
+}
+type LogEvent =
+/** One attachment's stream died; the others continue. */
+{
+  readonly kind: 'stream-failed';
+  readonly message: string;
+} |
+/** The consumer fell behind and the bounded merge queue overflowed:
+ * `count` oldest lines were dropped since the last delivered line. */
+{
+  readonly kind: 'lines-dropped';
+  readonly count: number;
+};
+/** The log operation's in-package injection seam (the CLI's LogRunDeps, unit
+ * tests) — threaded through logWithDeps, never part of the published surface. */
+interface LogDeps {
+  /** Substituted for the c12 evaluation of the discovered config file (discovery still runs). */
+  readonly config?: PrismaAppConfig | undefined;
+  /** Overrides the identity resolution (config + name) — lets tests skip a real entry module. */
+  readonly identity?: AppIdentity | undefined;
+  /** Names the config file explicitly instead of walking up from the entry. */
+  readonly configPath?: string | undefined;
+}
+interface LogInput {
+  readonly entry: string;
+  readonly name?: string | undefined;
+  /** Restrict to one service's dotted address; validated against running services. */
+  readonly address?: string | undefined;
+  /** Trailing history lines before live output. Defaults to 0 (live only) —
+   * the attachment contract's default; the CLI's user-facing default of 20 stays in main.ts. */
+  readonly tail?: number | undefined;
+  readonly cwd?: string | undefined;
+  /** Ends the stream when aborted. The host owns SIGINT/SIGTERM → abort. */
+  readonly signal?: AbortSignal | undefined;
+  readonly onEvent?: ((event: LogEvent) => void) | undefined;
+}
+interface LogAttached {
+  /** For the adapter's empty-services notice. */
+  readonly appName: string;
+  /** Every running service. EMPTY means nothing is running — a valid, non-failure state;
+   * `lines` is then an already-finished iterable. */
+  readonly services: readonly ServiceEndpoint[];
+  /** Merged, address-filtered stream; ends on signal abort or when every source ends. */
+  readonly lines: AsyncIterable<LogLine>;
+}
+/** In-package variant threading the injection seam (the CLI's LogRunDeps,
+ * unit tests). Deliberately NOT re-exported through `./control` — the seam
+ * mirrors internal types and is not part of the published surface. */
+declare function logWithDeps(input: LogInput, deps: LogDeps): Promise<Result$1<LogAttached, CliStructuredError>>;
+//#endregion
+//#region ../../0-framework/3-tooling/cli/dist/family-DkH0si4D.d.mts
+//#region src/family/family.d.ts
+/**
+ * The control-plane operations the family's handlers call. These are the
+ * deps-taking variants, not the bare ones: a handler must inject the converge
+ * spawn adapter (so the ENGINE starts the child and owns signal policy) and
+ * the credentials the in-process leg authenticates with. A double that
+ * honours `deps.alchemy` therefore exercises the real settlement path
+ * against a scripted fake child.
+ */
+interface ComposerOperations {
+  readonly deploy: typeof deployWithDeps;
+  readonly destroy: typeof destroyWithDeps;
+  readonly dev: typeof devWithDeps;
+  readonly log: typeof logWithDeps;
+}
+declare const realOperations: ComposerOperations;
+interface CreateComposerFamilyOptions {
+  /** Defaults to the real control operations. */
+  readonly operations?: ComposerOperations | undefined;
+}
+declare function createComposerFamily(options?: CreateComposerFamilyOptions): CommandFamily;
+//#endregion
+export { Result$1 as _, DeployInput as a, DestroyInput as c, LogAttached as d, LogDeps as f, ServiceEndpoint as g, OperationDeps as h, realOperations as i, DevInput as l, LogLine as m, CreateComposerFamilyOptions as n, DeploySuccess as o, LogInput as p, createComposerFamily as r, DestroyEvent as s, ComposerOperations as t, DevSession as u, CliStructuredError as v };
+//# sourceMappingURL=family-DkH0si4D-CN5QubKS.d.mts.map