@prisma/composer 0.1.0-dev.1

package/dist/bin.mjs

@@ -0,0 +1,1229 @@
+#!/usr/bin/env node
+import { Cli, Command, Option, UsageError } from "clipanion";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import * as Layer from "effect/Layer";
+import { createManagementApiClient } from "@prisma/management-api-sdk";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Config from "effect/Config";
+import * as Data from "effect/Data";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy";
+import * as Schedule from "effect/Schedule";
+import * as c12 from "c12";
+import { pathToFileURL } from "node:url";
+//#region ../../0-framework/3-tooling/assemble/dist/index.mjs
+/**
+* A user-facing assembly failure with a message that already names the fix
+* (mirrors @internal/cli's CliError contract). This package must not import
+* CliError — its second consumer is the future programmatic deploy API, not
+* just the CLI — so it throws its own typed error; the CLI maps it (or lets
+* it propagate, since bin.ts already treats every Error uniformly: print the
+* message, exit nonzero).
+*/
+var AssembleError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "AssembleError";
+	}
+};
+/**
+* The registry route for one service's build: extension by
+* `build.extension`, node descriptor by `build.type`, kind must be "build".
+* The CLI's coverage validation reports the same misses earlier with the
+* config fix; these errors are the backstop for programmatic callers.
+*/
+function buildDescriptorAssemble(config, node, address, cwd) {
+	const { extension, type } = node.build;
+	const extensionDescriptor = config.extensions.find((candidate) => candidate.id === extension);
+	if (extensionDescriptor === void 0) throw new AssembleError(`No extension "${extension}" is configured (needed by service "${node.name}"'s build) — add it to prisma-composer.config.ts's \`extensions\`.`);
+	const nodeDescriptor = extensionDescriptor.nodes[type];
+	if (nodeDescriptor === void 0) throw new AssembleError(`Extension "${extension}" has no descriptor for build type "${type}" (known: ${Object.keys(extensionDescriptor.nodes).join(", ")}).`);
+	if (nodeDescriptor.kind !== "build") throw new AssembleError(`Extension "${extension}"'s descriptor for type "${type}" is a "${nodeDescriptor.kind}" descriptor — assembling a service build needs a "build" descriptor.`);
+	return nodeDescriptor.assemble({
+		build: node.build,
+		address,
+		cwd
+	});
+}
+async function assembleServices(graph, config, cwd, run) {
+	const runAssembler = run ?? ((node, address, nodeCwd) => buildDescriptorAssemble(config, node, address, nodeCwd));
+	const serviceNodes = graph.nodes.filter((n) => n.node.kind === "service");
+	if (serviceNodes.length === 0) throw new AssembleError("The loaded graph has no service to assemble.");
+	const bundles = {};
+	for (const { id, node } of serviceNodes) bundles[id] = await runAssembler(node, id, cwd);
+	return { bundles };
+}
+//#endregion
+//#region ../../0-framework/0-foundation/foundation/dist/casts.mjs
+/**
+* **Last-resort escape hatch for unsafe type assertions. Not a sanctioned tool to reach for.**
+*
+* Before reaching for `blindCast`, **rewrite the surrounding code so the cast becomes
+* unnecessary**: tighten an input type, add a runtime check that narrows via a type
+* predicate, restructure a generic so the compiler can see the relationship you're
+* asserting, or use {@link castAs} when the value already satisfies the target type.
+* Only when no rewrite is feasible does `blindCast` become the right answer — and at
+* that point, the `Reason` literal you supply must articulate the compromise in
+* language a reviewer can evaluate.
+*
+* The reviewer **will** validate the `Reason`. If it doesn't hold up under scrutiny,
+* that is not a signal to soften the reason; it is a signal to go back and solve the
+* underlying type-system problem properly. An unconvincing justification is rework,
+* not a free pass.
+*
+* `blindCast` is the auditable form of `as Foo` / `as unknown as Foo`: it bypasses
+* the compiler's checks (the input type is `unknown`, the output type is whatever the
+* caller asks for), but it forces the unsafety to be named at the call site instead of
+* smuggled in via a bare `as`. The `Reason` type parameter exists only at compile
+* time — it is not present in the emitted JavaScript — but it is grep-able and
+* visible to future readers.
+*
+* @example
+* ```typescript
+* const stringValue = blindCast<
+*   string,
+*   "JSON.parse returns `unknown`; this field is documented to be a string in the API contract"
+* >(parsed[key]);
+* ```
+*
+* @typeParam TargetType - The type the caller is asserting the input has.
+* @typeParam _Reason - A string literal describing why bypassing the type system is necessary here.
+*                     Only meaningful at compile time. The reviewer evaluates whether it justifies the unsafety.
+*/
+function blindCast(input) {
+	return input;
+}
+//#endregion
+//#region ../../0-framework/1-core/core/dist/graph-BmrUEdo9.mjs
+/** Thrown by Load when the graph is malformed. */
+var LoadError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "LoadError";
+	}
+};
+/**
+* Core model: node types and the factories that construct them, plain frozen
+* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).
+*/
+const NODE = Symbol.for("prisma:node");
+const SECRET_SOURCE = blindCast(Symbol.for("prisma:secret-source"));
+/** True if `value` is a secret source (an `envSecret` result or a forwarded ctx.secrets ref). */
+function isSecretSource(value) {
+	return typeof value === "object" && value !== null && blindCast(value)[SECRET_SOURCE] === true;
+}
+const PARAM_SOURCE = blindCast(Symbol.for("prisma:param-source"));
+/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */
+function isParamSource(value) {
+	return typeof value === "object" && value !== null && blindCast(value)[PARAM_SOURCE] === true;
+}
+/**
+* True if `value` was constructed by this module's factories. Checks the
+* brand only, never a prototype — a graph may mix nodes from a different
+* installed copy of core (dual-package hazard).
+*/
+function isNode(value) {
+	return typeof value === "object" && value !== null && value[NODE] === true;
+}
+/**
+* Stable topological sort: every edge's `from` precedes its `to` in the
+* result. Ties (nodes with no ordering constraint between them) keep their
+* relative order from `nodes` — so a graph already authored producer-first
+* comes out byte-identical to its pre-sort layout; only a graph that
+* genuinely needs reordering (e.g. a module wired via a forged ref pointing at a
+* not-yet-provisioned producer) actually moves. A Kahn's-algorithm variant
+* that always picks the ready node with the smallest original index. Edges
+* whose endpoint falls outside `nodes` (e.g. a service-root's input edges
+* targeting the root, which is appended separately) are ignored. Cycles
+* cannot reach here: `assertDependencyDag` already rejects them for
+* dependency edges, and input edges never cycle.
+*/
+function topoSort(nodes, edges) {
+	const byId = new Map(nodes.map((n) => [n.id, n]));
+	const indexOf = new Map(nodes.map((n, i) => [n.id, i]));
+	const indegree = new Map(nodes.map((n) => [n.id, 0]));
+	const successors = /* @__PURE__ */ new Map();
+	for (const edge of edges) {
+		if (!byId.has(edge.from) || !byId.has(edge.to)) continue;
+		const targets = successors.get(edge.from) ?? [];
+		targets.push(edge.to);
+		successors.set(edge.from, targets);
+		indegree.set(edge.to, (indegree.get(edge.to) ?? 0) + 1);
+	}
+	const ready = new Set(nodes.filter((n) => indegree.get(n.id) === 0).map((n) => n.id));
+	const order = [];
+	while (ready.size > 0) {
+		let next;
+		let bestIndex = Number.POSITIVE_INFINITY;
+		for (const id of ready) {
+			const index = indexOf.get(id) ?? Number.POSITIVE_INFINITY;
+			if (index < bestIndex) {
+				bestIndex = index;
+				next = id;
+			}
+		}
+		if (next === void 0) break;
+		ready.delete(next);
+		order.push(next);
+		for (const target of successors.get(next) ?? []) {
+			const remaining = (indegree.get(target) ?? 0) - 1;
+			indegree.set(target, remaining);
+			if (remaining === 0) ready.add(target);
+		}
+	}
+	if (order.length !== nodes.length) throw new LoadError(`topological sort processed ${order.length} of ${nodes.length} nodes — the graph contains a cycle that slipped past the DAG validation.`);
+	return order.map((id) => byId.get(id)).filter((n) => n !== void 0);
+}
+function serviceInputs(service, serviceId) {
+	if (typeof service.inputs !== "object" || service.inputs === null) throw new LoadError(`Service "${serviceId}" has no inputs map.`);
+	const nodes = [];
+	const edges = [];
+	for (const [input, value] of Object.entries(service.inputs)) {
+		const kind = isNode(value) ? value.kind : void 0;
+		if (kind === "resource") throw new LoadError(`Input "${input}" of "${serviceId}" is a resource node — a resource is provisioned by the composing module, never created for a service that mentions it. Declare the input as a dependency (the pack's dependency factory) and wire the module-provisioned resource's ref into it.`);
+		if (kind !== "dependency") throw new LoadError(`Input "${input}" of "${serviceId}" is not a branded dependency end (construct it with the dependency() factory).`);
+		if (value.type.length === 0) throw new LoadError(`Input "${input}" of "${serviceId}" has an empty node type.`);
+		const id = `${serviceId}.${input}`;
+		nodes.push({
+			id,
+			node: value
+		});
+		edges.push({
+			from: id,
+			to: serviceId,
+			input,
+			kind: "input"
+		});
+	}
+	return {
+		nodes,
+		edges
+	};
+}
+function loadService(root, rootId) {
+	for (const [input, value] of Object.entries(root.inputs)) if (isNode(value) && value.kind === "dependency") throw new LoadError(`Service "${rootId}" has an unwired dependency input "${input}" — this service is composed by a module; deploy the module instead of loading "${rootId}" directly.`);
+	const secretSlots = Object.keys(root.secretSlots);
+	if (secretSlots.length > 0) {
+		const names = secretSlots.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Service "${rootId}" declares secret slot${secretSlots.length > 1 ? "s" : ""} ${names} but is being loaded directly — a lone service has no enclosing scope to bind them. Compose it inside a module that binds each with envSecret('NAME').`);
+	}
+	const rootGraphNode = {
+		id: rootId,
+		node: root
+	};
+	const { nodes, edges } = serviceInputs(root, rootId);
+	return {
+		root: rootGraphNode,
+		nodes: [...topoSort(nodes, edges), rootGraphNode],
+		edges,
+		secrets: [],
+		params: []
+	};
+}
+/**
+* Builds the ref a provision() call hands back: the id (so a producer with no
+* exposed ports — or an untyped slot — can still be wired wholesale) plus one
+* ref-port per exposed contract, each the contract's own runtime value (so
+* its `satisfies()` still works) tagged with the provider's id.
+*/
+function refFor(id, service) {
+	const ports = {};
+	for (const [port, contract] of Object.entries(service.expose ?? {})) ports[port] = {
+		...contract,
+		__providerId: id
+	};
+	return blindCast({
+		id,
+		...ports
+	});
+}
+/**
+* The resource variant of refFor: a resource has exactly one port — the
+* contract it provides — flattened onto the ref itself, tagged with the
+* provider id. `id` is written last so a hostile contract value cannot
+* clobber it.
+*/
+function refForResource(id, resource) {
+	return blindCast({
+		...resource.provides,
+		__providerId: id,
+		id
+	});
+}
+/** A wired value's producer id: a ref-port's `__providerId`, or a bare ref's `id`. */
+function producerIdOf(ref) {
+	if (typeof ref !== "object" || ref === null) return void 0;
+	if ("__providerId" in ref && typeof ref.__providerId === "string") return ref.__providerId;
+	if ("id" in ref && typeof ref.id === "string") return ref.id;
+}
+/**
+* Brands each `ctx.inputs` entry with the input key it stands for (see
+* flatten): diagnostic only — usage attribution relies on the per-key object
+* identity the branding copy creates, never on reading this back.
+*/
+const MODULE_INPUT_KEY = Symbol("prisma:module-input-key");
+/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.secrets` forwarding channel. */
+const MODULE_SECRET_KEY = Symbol("prisma:module-secret-key");
+/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.params` forwarding channel. */
+const MODULE_PARAM_KEY = Symbol("prisma:module-param-key");
+/** Whether `ref` carries a callable `satisfies` that accepts `required` truthily. */
+function satisfiesRequired(ref, required) {
+	return typeof ref === "object" && ref !== null && "satisfies" in ref && typeof ref.satisfies === "function" && ref.satisfies(required);
+}
+/**
+* Checks one recorded `wiring` object against the Deps it was wired against:
+* every named input exists and is a dependency slot, every referenced
+* producer is a real (by-now-provisioned) address, and a wired ref whose
+* slot declares a required contract must satisfy() it — no producer-kind
+* branching, the contract alone determines validity, whether the producer is
+* a service port or a resource. Shared by both provisioned kinds so a
+* module-as-child gets exactly the checks a service gets, and run once per
+* entry against the one `byId` shared by the whole recursive flatten, so a
+* forwarded ref resolves through to its real producer address regardless of
+* which ancestor scope provisioned it.
+*/
+function validateWiring(pending, byId) {
+	const { deps, wiring, targetId, targetKind, enclosingModuleName } = pending;
+	for (const [input, ref] of Object.entries(wiring)) {
+		const declared = blindCast(deps[input]);
+		if (declared === void 0 || !isNode(declared) || declared.kind !== "dependency") throw new LoadError(`The deps for "${targetId}" name "${input}", which is not a dependency slot of that ${targetKind}.`);
+		const producerId = producerIdOf(ref);
+		const producer = producerId !== void 0 ? byId.get(producerId) : void 0;
+		if (producerId === void 0 || producer === void 0) throw new LoadError(`The deps for "${targetId}.${input}" reference "${String(producerId)}", which is not provisioned in module "${enclosingModuleName}".`);
+		const required = declared.required;
+		if (required !== void 0 && !satisfiesRequired(ref, required)) throw new LoadError(`The deps for "${targetId}.${input}" do not satisfy the slot's required contract.`);
+	}
+	for (const [input, rawValue] of Object.entries(deps)) {
+		const value = blindCast(rawValue);
+		if (!isNode(value) || wiring[input] !== void 0) continue;
+		if (value.kind === "dependency") throw new LoadError(`Dependency input "${input}" of provisioned ${targetKind} "${targetId}" is not wired to a producer (module "${enclosingModuleName}").`);
+	}
+}
+/** The (unvalidated) edges a `wiring` object implies — one dependency edge per entry; `validateWiring` does the real checking. */
+function wiringEdges(wiring, targetId) {
+	return Object.entries(wiring).map(([input, ref]) => ({
+		from: producerIdOf(ref) ?? "",
+		to: targetId,
+		input,
+		kind: "dependency"
+	}));
+}
+/**
+* Checks the secrets wired into one provisioned child: every declared slot is
+* bound to a real secret source (an `envSecret` or a forwarded ctx.secrets
+* ref), and no wired key names a slot the child doesn't declare — the secret
+* analog of `validateWiring`'s per-input checks, but resolved inline (a source
+* carries its own name, so no whole-graph pass is needed).
+*/
+function validateSecretBinding(child, id, secretWiring, enclosingModuleName) {
+	const { kind } = child;
+	for (const slot of Object.keys(child.secretSlots)) {
+		const bound = secretWiring[slot];
+		if (bound === void 0) throw new LoadError(`Secret slot "${slot}" of provisioned ${kind} "${id}" is not bound (module "${enclosingModuleName}") — bind it with envSecret('NAME') or forward ctx.secrets.`);
+		if (!isSecretSource(bound)) throw new LoadError(`Secret slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-secret value — use envSecret('NAME') or a forwarded ctx.secrets ref.`);
+	}
+	for (const slot of Object.keys(secretWiring)) if (!Object.hasOwn(child.secretSlots, slot)) throw new LoadError(`The secrets for "${id}" name "${slot}", which is not a secret slot of that ${kind} (module "${enclosingModuleName}").`);
+}
+/**
+* Checks the params wired into a provisioned SERVICE: unlike a secret slot, a
+* declared param is never required to be bound here — it may fall back to its
+* own `default` (checked later, at `buildConfig`) — so this only rejects a
+* wired key that names something other than a real declared param.
+*/
+function validateServiceParamBinding(child, id, paramWiring, enclosingModuleName) {
+	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.params, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param of that service (module "${enclosingModuleName}").`);
+}
+/**
+* Checks the params wired into a provisioned MODULE: every declared
+* param-forwarding slot must be bound to a real `ParamSource` — a slot has no
+* schema of its own, so (unlike a service param) it cannot fall back to a
+* literal or a default; the param analog of `validateSecretBinding`.
+*/
+function validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {
+	for (const slot of Object.keys(child.paramSlots)) {
+		const bound = paramWiring[slot];
+		if (bound === void 0) throw new LoadError(`Param slot "${slot}" of provisioned module "${id}" is not bound (module "${enclosingModuleName}") — bind it with a param source (e.g. envParam('NAME')) or forward ctx.params.`);
+		if (!isParamSource(bound)) throw new LoadError(`Param slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-source value — a module param-forwarding slot carries no schema to validate a literal against; use envParam('NAME') or a forwarded ctx.params ref.`);
+	}
+	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.paramSlots, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param slot of that module (module "${enclosingModuleName}").`);
+}
+/**
+* Recursively flattens one module's body into the shared graph state and
+* returns its resolved ModuleOutputs (one ref-port per expose key) for the
+* caller (the enclosing provision() call, or Load itself for the root) to
+* use. `address` is this module's OWN full address, or `undefined` for the root
+* scope — its direct children then get bare (unprefixed) addresses, keeping
+* a single-level module identical to before nesting existed. `wiring` supplies a
+* resolved producer ref-port for each of this module's OWN declared deps (empty
+* for the root, which may not declare any — see the root non-empty-deps
+* check in loadModule). `nodes`, `edges`, `pending`, and `byId` are shared
+* across the ENTIRE recursive flatten, not per scope — a nested module may
+* forward in a producer provisioned by an ancestor scope, and it is the
+* shared `byId` (keyed by full address) that lets that resolve.
+*/
+function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes, edges, pending, secretBindings, paramBindings, byId) {
+	const localIds = /* @__PURE__ */ new Set();
+	const used = /* @__PURE__ */ new Set();
+	const usedSecrets = /* @__PURE__ */ new Set();
+	const usedParams = /* @__PURE__ */ new Set();
+	const ctxInputs = {};
+	for (const key of Object.keys(moduleNode.deps)) {
+		const wired = wiring[key];
+		ctxInputs[key] = typeof wired === "object" && wired !== null ? {
+			...wired,
+			[MODULE_INPUT_KEY]: key
+		} : wired;
+	}
+	const markUsed = (values) => {
+		for (const value of Object.values(values)) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);
+	};
+	const ctxSecrets = {};
+	for (const key of Object.keys(moduleNode.secretSlots)) {
+		const bound = secretWiring[key];
+		ctxSecrets[key] = typeof bound === "object" && bound !== null ? {
+			...bound,
+			[MODULE_SECRET_KEY]: key
+		} : bound;
+	}
+	const markSecretsUsed = (values) => {
+		for (const value of Object.values(values)) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);
+	};
+	const ctxParams = {};
+	for (const key of Object.keys(moduleNode.paramSlots)) {
+		const bound = paramWiring[key];
+		ctxParams[key] = typeof bound === "object" && bound !== null ? {
+			...bound,
+			[MODULE_PARAM_KEY]: key
+		} : bound;
+	}
+	const markParamsUsed = (values) => {
+		for (const value of Object.values(values)) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);
+	};
+	const provision = (child, opts) => {
+		const id = opts?.id ?? child.name;
+		const provisionWiring = opts?.deps;
+		const provisionSecrets = opts?.secrets;
+		const provisionParams = opts?.params;
+		if (typeof id !== "string" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module "${moduleNode.name}").`);
+		if (id.includes("_") || id.includes(".")) throw new LoadError(`provision() id "${id}" (module "${moduleNode.name}") may not contain "_" or "." — "_" is the config-key separator and "." the node-id path separator; either inside an id collides with the joined form of other names.`);
+		if (localIds.has(id)) throw new LoadError(`Duplicate provision id "${id}" in module "${moduleNode.name}".`);
+		const untrusted = child;
+		if (!isNode(untrusted) || untrusted.kind !== "service" && untrusted.kind !== "resource" && untrusted.kind !== "module") throw new LoadError(`provision("${id}") expects a branded service, resource, or module node (construct it with the service()/resource()/module() factories or a pack's own).`);
+		localIds.add(id);
+		const fullAddress = address === void 0 ? id : `${address}.${id}`;
+		if (child.kind === "resource") {
+			if (provisionWiring !== void 0) throw new LoadError(`provision("${id}") received deps for a resource — a resource has no dependency slots to satisfy.`);
+			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a resource — a resource has no secret slots to satisfy.`);
+			if (provisionParams !== void 0) throw new LoadError(`provision("${id}") received params for a resource — a resource has no params to satisfy.`);
+			if (child.type.length === 0) throw new LoadError(`provision("${id}") received a resource with an empty node type.`);
+			byId.set(fullAddress, child);
+			nodes.push({
+				id: fullAddress,
+				node: child
+			});
+			return refForResource(fullAddress, child);
+		}
+		const localWiring = { ...provisionWiring ?? {} };
+		markUsed(localWiring);
+		const localSecrets = { ...provisionSecrets ?? {} };
+		markSecretsUsed(localSecrets);
+		validateSecretBinding(child, id, localSecrets, moduleNode.name);
+		const localParams = { ...provisionParams ?? {} };
+		markParamsUsed(localParams);
+		if (child.kind === "service") {
+			for (const slot of Object.keys(child.secretSlots)) {
+				const bound = localSecrets[slot];
+				if (isSecretSource(bound)) secretBindings.push({
+					serviceAddress: fullAddress,
+					slot,
+					source: bound
+				});
+			}
+			validateServiceParamBinding(child, id, localParams, moduleNode.name);
+			for (const [slot, binding] of Object.entries(localParams)) paramBindings.push({
+				serviceAddress: fullAddress,
+				slot,
+				binding
+			});
+			const inputs = serviceInputs(child, fullAddress);
+			nodes.push(...inputs.nodes, {
+				id: fullAddress,
+				node: child
+			});
+			edges.push(...inputs.edges, ...wiringEdges(localWiring, fullAddress));
+			pending.push({
+				deps: child.inputs,
+				wiring: localWiring,
+				targetId: fullAddress,
+				targetKind: "service",
+				enclosingModuleName: moduleNode.name
+			});
+			byId.set(fullAddress, child);
+			return refFor(fullAddress, child);
+		}
+		validateParamNeedBinding(child, id, localParams, moduleNode.name);
+		edges.push(...wiringEdges(localWiring, fullAddress));
+		pending.push({
+			deps: child.deps,
+			wiring: localWiring,
+			targetId: fullAddress,
+			targetKind: "module",
+			enclosingModuleName: moduleNode.name
+		});
+		const childOutputs = flatten(child, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, secretBindings, paramBindings, byId);
+		nodes.push({
+			id: fullAddress,
+			node: child
+		});
+		byId.set(fullAddress, child);
+		return blindCast({
+			id: fullAddress,
+			...childOutputs
+		});
+	};
+	const ctx = blindCast({
+		inputs: ctxInputs,
+		secrets: ctxSecrets,
+		params: ctxParams,
+		provision: blindCast(provision)
+	});
+	const outputs = blindCast(moduleNode.body(ctx) ?? {});
+	markUsed(outputs);
+	for (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares input "${key}" but never forwards it into a provision nor returns it as an output.`);
+	for (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares secret "${key}" but never forwards it into a provision.`);
+	for (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares param "${key}" but never forwards it into a provision.`);
+	for (const [key, contract] of Object.entries(moduleNode.expose)) {
+		const port = outputs[key];
+		if (port === void 0) throw new LoadError(`Module "${moduleNode.name}" declares expose "${key}" but its body did not return a port for it.`);
+		if (!satisfiesRequired(port, contract)) throw new LoadError(`Module "${moduleNode.name}"'s returned port for expose "${key}" does not satisfy its declared contract.`);
+	}
+	return outputs;
+}
+function loadModule(root, opts) {
+	const rootId = opts?.id ?? root.name;
+	const rootDepKeys = Object.keys(root.deps);
+	if (rootDepKeys.length > 0) {
+		const names = rootDepKeys.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Module "${root.name}" declares input${rootDepKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to wire them; compose "${root.name}" from another module that provisions and wires it instead.`);
+	}
+	const rootSecretKeys = Object.keys(root.secretSlots);
+	if (rootSecretKeys.length > 0) {
+		const names = rootSecretKeys.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Module "${root.name}" declares secret${rootSecretKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds secrets with envSecret('NAME'), it does not declare secret slots of its own.`);
+	}
+	const rootParamKeys = Object.keys(root.paramSlots);
+	if (rootParamKeys.length > 0) {
+		const names = rootParamKeys.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Module "${root.name}" declares param${rootParamKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds params directly on each provision() call, it does not declare param-forwarding slots of its own.`);
+	}
+	const nodes = [];
+	const edges = [];
+	const pending = [];
+	const secretBindings = [];
+	const paramBindings = [];
+	const byId = /* @__PURE__ */ new Map();
+	flatten(root, void 0, {}, {}, {}, nodes, edges, pending, secretBindings, paramBindings, byId);
+	for (const entry of pending) validateWiring(entry, byId);
+	assertDependencyDag(edges);
+	const rootGraphNode = {
+		id: rootId,
+		node: root
+	};
+	return {
+		root: rootGraphNode,
+		nodes: [...topoSort(nodes, edges), rootGraphNode],
+		edges,
+		secrets: secretBindings,
+		params: paramBindings
+	};
+}
+/**
+* The dependency edges must form a DAG — a cycle means neither producer can
+* deploy first. Resources take no wiring, so only service/module-to-service/module
+* edges can ever participate in a cycle; no special-casing needed.
+*/
+function assertDependencyDag(edges) {
+	const adjacency = /* @__PURE__ */ new Map();
+	for (const edge of edges) {
+		if (edge.kind !== "dependency") continue;
+		const targets = adjacency.get(edge.from) ?? [];
+		targets.push(edge.to);
+		adjacency.set(edge.from, targets);
+	}
+	const visiting = /* @__PURE__ */ new Set();
+	const done = /* @__PURE__ */ new Set();
+	const stack = [];
+	const visit = (id) => {
+		if (done.has(id)) return;
+		if (visiting.has(id)) throw new LoadError(`Dependency cycle: ${[...stack.slice(stack.indexOf(id)), id].join(" → ")} — no deploy order exists.`);
+		visiting.add(id);
+		stack.push(id);
+		for (const next of adjacency.get(id) ?? []) visit(next);
+		stack.pop();
+		visiting.delete(id);
+		done.add(id);
+	};
+	for (const id of adjacency.keys()) visit(id);
+}
+/**
+* Builds the in-memory graph from a root node. A service root walks its own
+* `inputs`; a module root executes its body (wiring, not user code — the
+* designed exception to imports-run-nothing) and recursively flattens every
+* module it provisions into one graph of hierarchical addresses. A malformed
+* graph is a `LoadError` that names its fix; the individual validation rules
+* live with `loadService` / `loadModule` and are covered by name in the Load
+* tests. Executes nothing of the user's own code beyond module bodies.
+*/
+function Load(root, opts) {
+	if (!isNode(root)) throw new LoadError("Load expects a branded service or module node (construct it with the service()/module() factories).");
+	if (root.kind === "module") return loadModule(root, opts);
+	if (root.kind === "service") return loadService(root, opts?.id ?? "root");
+	throw new LoadError("Load expects a service or module root (received another node kind).");
+}
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CxGdfSAP.mjs
+/**
+* The Prisma service token used to authenticate Management API calls. Kept
+* as a Redacted value so it never lands in logs or error output.
+*/
+var PrismaCredentials = class extends Context.Service()("PrismaCredentials") {};
+/** Resolve the token from the `PRISMA_SERVICE_TOKEN` environment variable. */
+const fromEnv = () => Layer.effect(PrismaCredentials, Effect.gen(function* () {
+	return { token: yield* Config.redacted("PRISMA_SERVICE_TOKEN") };
+}));
+/**
+* The typed Prisma Management API client, built once from the resolved
+* credentials. Providers yield this in their outer Effect and call it inside
+* `reconcile` / `delete`.
+*/
+var ManagementClient = class extends Context.Service()("PrismaManagementClient") {};
+const layer = () => Layer.effect(ManagementClient, Effect.gen(function* () {
+	const { token } = yield* PrismaCredentials;
+	return createManagementApiClient({ token: Redacted.value(token) });
+}));
+/** A non-2xx response from the Management API (or a transport failure). */
+var PrismaApiError = class extends Data.TaggedError("PrismaApiError") {};
+const attempt = (f) => Effect.tryPromise({
+	try: f,
+	catch: (cause) => new PrismaApiError({
+		status: 0,
+		message: String(cause)
+	})
+});
+const fail = (r) => Effect.fail(new PrismaApiError({
+	status: r.response.status,
+	message: JSON.stringify(r.error)
+}));
+/** Unwrap `data`, failing on any API error. Preserves the SDK's response type. */
+const call = (f) => attempt(f).pipe(Effect.flatMap((r) => r.error !== void 0 || r.data === void 0 ? fail(r) : Effect.succeed(r.data)));
+/** Fire-and-forget a call, tolerating a 404 (already deleted). */
+const callVoid = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
+Schedule.both(Schedule.exponential("2 seconds", 2), Schedule.during("5 minutes"));
+Resource("Prisma.ComputeService");
+Resource("Prisma.Deployment");
+Resource("Prisma.EnvironmentVariable");
+Resource("PrismaCloud.ServiceKey");
+Resource("Prisma.Connection");
+Resource("Prisma.Database");
+Resource("Prisma.Project");
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/index.mjs
+/** Raised with `ensure: false` when the app's Project (or a named stage's Branch) doesn't exist. */
+var ContainerNotFoundError = class extends Data.TaggedError("ContainerNotFoundError") {};
+const listAllProjects = (client) => Effect.gen(function* () {
+	const projects = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {} : { cursor };
+		const page = yield* call(() => client.GET("/v1/projects", { params: { query } }));
+		projects.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return projects;
+});
+/**
+* Workspace ids circulate in two shapes: `wksp_`-prefixed and bare. Compare
+* bare-to-bare so a `wksp_`-prefixed API id still matches a bare configured
+* one (the same normalization `state/bootstrap.ts` applies to the same
+* `/v1/projects` listing).
+*/
+const bareWorkspaceId = (id) => id.startsWith("wksp_") ? id.slice(5) : id;
+/**
+* Finds the app's Project by name in the workspace — PDP allows duplicate
+* project names, so more than one can match; the oldest wins. Creates one
+* if none match, unless `ensure` is `false` (find-only — `destroy`), in
+* which case an absent Project fails with `ContainerNotFoundError`. No
+* ownership marker and no `--project` override (both deferred — see
+* ADR-0019).
+*/
+const resolveProject = (client, workspaceId, appName, ensure) => Effect.gen(function* () {
+	const oldest = (yield* listAllProjects(client)).filter((p) => bareWorkspaceId(p.workspace.id) === bareWorkspaceId(workspaceId) && p.name === appName).sort((a, b) => a.createdAt.localeCompare(b.createdAt))[0];
+	if (oldest !== void 0) return oldest.id;
+	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({ appName }));
+	return (yield* call(() => client.POST("/v1/projects", { body: {
+		name: appName,
+		workspaceId
+	} }))).data.id;
+});
+const findBranchId = (client, projectId, gitName) => call(() => client.GET("/v1/projects/{projectId}/branches", { params: {
+	path: { projectId },
+	query: { gitName }
+} })).pipe(Effect.map((page) => page.data[0]?.id));
+/**
+* Finds the stage's Branch by its exact `gitName`, creating it if absent
+* unless `ensure` is `false` (find-only — `destroy`), in which case an
+* absent Branch fails with `ContainerNotFoundError`. The Management API has
+* no server-side "create-or-return" idempotency (`POST
+* /v1/projects/:id/branches` 409s on a duplicate `gitName`, with no request
+* field to make that a no-op), so idempotency is client-side: observe
+* first, and on a racing 409 from create, re-observe rather than fail.
+*/
+const resolveBranch = (client, projectId, gitName, appName, ensure) => Effect.gen(function* () {
+	const existing = yield* findBranchId(client, projectId, gitName);
+	if (existing !== void 0) return existing;
+	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({
+		appName,
+		stage: gitName
+	}));
+	return yield* call(() => client.POST("/v1/projects/{projectId}/branches", {
+		params: { path: { projectId } },
+		body: { gitName }
+	})).pipe(Effect.map((r) => r.data.id), Effect.catch((err) => err.status === 409 ? findBranchId(client, projectId, gitName).pipe(Effect.flatMap((id) => id === void 0 ? Effect.fail(err) : Effect.succeed(id))) : Effect.fail(err)));
+});
+/**
+* Resolves the two containers a stage's deploy runs into (ADR-0019): the
+* app's **Project**, found-or-created by name, and — for a named stage
+* only — its **Branch**, found-or-created by `gitName`. The default stage
+* (no `stage`) creates no Branch; `branchId` is omitted. With `ensure:
+* false` (`destroy`), nothing is created — an absent Project or Branch
+* fails with `ContainerNotFoundError` instead.
+*/
+const resolveContainer = (opts) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	const ensure = opts.ensure ?? true;
+	const projectId = yield* resolveProject(client, opts.workspaceId, opts.appName, ensure);
+	if (opts.stage === void 0) return { projectId };
+	return {
+		projectId,
+		branchId: yield* resolveBranch(client, projectId, opts.stage, opts.appName, ensure)
+	};
+});
+/**
+* Soft-deletes a Branch. Tolerates a 404 (already gone). The API refuses if
+* the Branch still has live members or is the production/default Branch —
+* that surfaces as a `PrismaApiError`.
+*/
+const deleteBranch = (branchId) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	yield* callVoid(() => client.DELETE("/v1/branches/{branchId}", { params: { path: { branchId } } }));
+});
+/**
+* Deletes a Project. Tolerates a 404 (already gone). The API refuses with a
+* 400 if the Project still has live dependencies (e.g. another stage's
+* Branch/resources) — that surfaces as a `PrismaApiError`.
+*/
+const deleteProject = (projectId) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	yield* callVoid(() => client.DELETE("/v1/projects/{id}", { params: { path: { id: projectId } } }));
+});
+Provider.ProviderCollection()("Prisma");
+//#endregion
+//#region ../../0-framework/3-tooling/cli/dist/cli-BeT-XTbX.mjs
+/**
+* A user-facing failure with a message that already names the fix (deploy-cli.md
+* § Error surface). `bin.ts` catches this — and any other Error, including
+* core's LoadError/LowerError — uniformly: print the message, exit nonzero.
+*/
+var CliError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "CliError";
+	}
+};
+/**
+* Pipeline pre-stack step: resolves the app's Project + (named stage) Branch
+* via `@internal/lowering`'s `resolveContainer`, before the generated stack file
+* runs — `deploy` creates-if-absent, `destroy` finds only.
+*/
+/** Validates `stage` as a git ref name via `git check-ref-format` — no silent normalization. */
+function validateStageName(stage) {
+	const result = spawnSync("git", ["check-ref-format", `refs/heads/${stage}`], { stdio: "ignore" });
+	if (result.error) throw new CliError(`git is required to validate --stage "${stage}" (git check-ref-format): ${result.error.message}.`);
+	if (result.status !== 0) throw new CliError(`Invalid --stage "${stage}": must be a valid git ref name (git check-ref-format rejected "refs/heads/${stage}").`);
+}
+async function ensureContainers(input, deps) {
+	const env = input.env ?? process.env;
+	const workspaceId = env["PRISMA_WORKSPACE_ID"];
+	if (workspaceId === void 0 || workspaceId.length === 0) throw new CliError("environment variable PRISMA_WORKSPACE_ID is required.");
+	if (deps?.client === void 0 && (env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw new CliError("environment variable PRISMA_SERVICE_TOKEN is required.");
+	if (input.stage !== void 0) validateStageName(input.stage);
+	const program = resolveContainer({
+		workspaceId,
+		appName: input.appName,
+		...input.stage !== void 0 ? { stage: input.stage } : {},
+		ensure: input.command === "deploy"
+	}).pipe(Effect.map((c) => ({
+		ok: true,
+		container: c
+	})), Effect.catchTag("ContainerNotFoundError", (e) => Effect.succeed({
+		ok: false,
+		message: `Nothing deployed for ${e.appName}${e.stage ? `/${e.stage}` : ""} — deploy it first.`
+	})), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
+		ok: false,
+		message: `Prisma Management API error resolving containers: ${e.message}.`
+	})));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (!outcome.ok) throw new CliError(outcome.message);
+	return outcome.container;
+}
+/**
+* Soft-deletes a named stage's Branch after a successful `alchemy destroy`
+* has removed its members (spec §10) — the Management API refuses to delete
+* a Branch that still has live members.
+*/
+async function deleteStageBranch(input, deps) {
+	const env = input.env ?? process.env;
+	if (deps?.client === void 0 && (env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw new CliError("environment variable PRISMA_SERVICE_TOKEN is required.");
+	const program = deleteBranch(input.branchId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
+		ok: false,
+		message: `Failed to delete the stage Branch: ${e.message}.`
+	})));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (!outcome.ok) throw new CliError(outcome.message);
+}
+/**
+* Best-effort cleanup after a successful `--production` destroy: removes
+* the app's Project so hand-run stacks don't accumulate as empty Projects
+* (they eventually hit the workspace's plan limit). Unlike `deleteStageBranch`,
+* this never throws: the destroy itself already succeeded, and the API's own
+* 400 ("still has dependencies") is the only check that matters — failing
+* the command over a cleanup step would be worse than leaving a Project shell.
+*/
+async function deleteAppProject(input, deps) {
+	const env = input.env ?? process.env;
+	if (deps?.client === void 0 && (env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) {
+		console.warn(`Skipped removing the Project (${input.projectId}): PRISMA_SERVICE_TOKEN is not set.`);
+		return;
+	}
+	const program = deleteProject(input.projectId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
+		ok: false,
+		error: e
+	})));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (outcome.ok) {
+		console.log(`Removed the Project (${input.projectId}) — nothing was left in it.`);
+		return;
+	}
+	if (outcome.error.status === 400) {
+		console.log(`Kept the Project (${input.projectId}) — it still has another stage's resources.`);
+		return;
+	}
+	console.warn(`Could not remove the Project (${input.projectId}) after destroy: ${outcome.error.message}.`);
+}
+/** Pipeline step 6: writes a regenerated-every-run, independently runnable stack module at `.prisma-composer/alchemy.run.ts`. */
+const GENERATED_DIR = ".prisma-composer";
+const GENERATED_FILE = "alchemy.run.ts";
+/** A relative import specifier from `.prisma-composer/alchemy.run.ts` to `target` (posix separators). */
+function relativeImportSpecifier(generatedDir, target) {
+	const rel = path.relative(generatedDir, target).split(path.sep).join("/");
+	return rel.startsWith(".") ? rel : `./${rel}`;
+}
+function quote(value) {
+	return JSON.stringify(value);
+}
+function renderBundle(bundle) {
+	return `{ dir: ${quote(bundle.dir)}, entry: ${quote(bundle.entry)} }`;
+}
+function renderOptions(input) {
+	const lines = [];
+	lines.push(`  name: ${quote(input.name)},`);
+	lines.push("  bundles: {");
+	for (const [id, bundle] of Object.entries(input.assembled.bundles)) lines.push(`    ${quote(id)}: ${renderBundle(bundle)},`);
+	lines.push("  },");
+	lines.push("  report: deploymentReport,");
+	return lines.join("\n");
+}
+/** Renders the stack module's source (tests assert on it without touching disk) — uses `//` headers, not a block comment, since a cwd path with a star-slash could close one early. */
+function renderStackFile(input) {
+	const generatedDir = path.join(input.cwd, GENERATED_DIR);
+	const appImport = relativeImportSpecifier(generatedDir, input.entryPath);
+	const configImport = relativeImportSpecifier(generatedDir, input.configPath);
+	return `// Generated by \`prisma-composer deploy\`/\`prisma-composer destroy\` — overwritten on every
+// run; do not edit by hand. Independently runnable from ${quote(input.cwd)}:
+//
+//   alchemy deploy ${GENERATED_DIR}/${GENERATED_FILE}
+//
+// bisects a CLI bug from an Alchemy bug (deploy-cli.md § Implementation decisions).
+import { lower } from '@prisma/composer/deploy';
+import { deploymentReport } from '@prisma/composer/report';
+import config from ${quote(configImport)};
+import app from ${quote(appImport)};
+
+export default lower(app, config, {
+${renderOptions(input)}
+});
+`;
+}
+/** Writes the stack file, returning its absolute path. */
+function writeStackFile(input) {
+	const generatedDir = path.join(input.cwd, GENERATED_DIR);
+	fs.mkdirSync(generatedDir, { recursive: true });
+	const filePath = path.join(generatedDir, GENERATED_FILE);
+	fs.writeFileSync(filePath, renderStackFile(input));
+	return filePath;
+}
+const GENERATED_STACK_RELATIVE_PATH = path.join(GENERATED_DIR, GENERATED_FILE);
+/**
+* Pipeline step: find and load `prisma-composer.config.ts` (ADR-0017) — the ONE
+* file that imports control-plane code. Discovery is the standard walk-up
+* from the deploy entry's directory (mirrors prisma-next's config-loader);
+* loading is c12 with that explicit path (rc/global/package.json lookups
+* disabled), so the config file's own static imports resolve from the app
+* root by whatever package manager runs — no specifier construction, no
+* anchoring. The loaded shape is validated field-by-field with CliErrors
+* naming the field.
+*/
+const CONFIG_FILENAME = "prisma-composer.config.ts";
+/** Walks UP from the entry file's directory looking for the literal CONFIG_FILENAME; undefined when the walk hits the filesystem root. */
+function findConfigPathForEntry(entryPath) {
+	let current = path.dirname(path.resolve(entryPath));
+	while (true) {
+		const candidate = path.join(current, CONFIG_FILENAME);
+		if (fs.existsSync(candidate)) return candidate;
+		const parent = path.dirname(current);
+		if (parent === current) return void 0;
+		current = parent;
+	}
+}
+function missingConfigError(entryPath) {
+	return new CliError(`No ${CONFIG_FILENAME} found walking up from "${path.dirname(path.resolve(entryPath))}" — the deploy needs the app's config file. Create one next to (or above) the entry, default-exporting defineConfig({ extensions: [...], state: ... }) from '@prisma/composer/config'.`);
+}
+function fieldError(field, requirement) {
+	return new CliError(`${CONFIG_FILENAME}: \`${field}\` ${requirement} — see defineConfig() in '@prisma/composer/config'.`);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+/**
+* Field-by-field validation of the loaded default export — deliberately no
+* schema library: each check is a CliError naming the offending field.
+* Returns the same object, typed.
+*/
+function validateConfigShape(loaded, configPath) {
+	if (!isRecord(loaded) || Object.keys(loaded).length === 0) throw new CliError(`"${configPath}" exported no config — it must default-export defineConfig({ extensions: [...], state: ... }) from '@prisma/composer/config'.`);
+	const extensions = loaded["extensions"];
+	if (!Array.isArray(extensions)) throw fieldError("extensions", "must be an array");
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, entry] of extensions.entries()) {
+		if (!isRecord(entry)) throw fieldError(`extensions[${index}]`, "must be an extension descriptor object");
+		const id = entry["id"];
+		if (typeof id !== "string" || id.length === 0) throw fieldError(`extensions[${index}].id`, "must be a non-empty string (the extension package name)");
+		if (!isRecord(entry["nodes"])) throw fieldError(`extensions[${index}].nodes`, "must be an object (the node-ID → control registry)");
+		if (seen.has(id)) throw new CliError(`${CONFIG_FILENAME}: extension "${id}" is listed more than once in \`extensions\`.`);
+		seen.add(id);
+	}
+	if (typeof loaded["state"] !== "function") throw fieldError("state", "must be a function returning the deploy state layer (e.g. () => prismaState())");
+	return blindCast(loaded);
+}
+/**
+* Loads + validates the config at `configPath` via c12 (explicit file; rc /
+* global-rc / package.json lookups disabled — discovery already happened in
+* findConfigPathForEntry).
+*/
+async function loadAppConfig(configPath) {
+	const result = await c12.loadConfig({
+		name: "prisma-composer",
+		configFile: configPath,
+		cwd: path.dirname(configPath),
+		rcFile: false,
+		globalRc: false,
+		packageJson: false
+	});
+	const loadedFile = result.configFile;
+	if (typeof loadedFile !== "string" || fs.realpathSync(loadedFile) !== fs.realpathSync(configPath)) throw new CliError(`Config loading resolved "${String(loadedFile)}" instead of the discovered "${configPath}" — refusing to deploy against a different file.`);
+	return {
+		path: configPath,
+		config: validateConfigShape(result.config, configPath)
+	};
+}
+/**
+* Pipeline step 1 (deploy-cli.md § The pipeline): import the entry module
+* (resolved against cwd) and require its default export to be a node — a
+* service or module, branded by core's factories. Whatever this module exports
+* IS the application; nothing else marks a root (ADR-0003).
+*/
+async function loadEntry(entryArg, cwd) {
+	const resolvedPath = path.resolve(cwd, entryArg);
+	const root = (await import(pathToFileURL(resolvedPath).href)).default;
+	if (!isNode(root) || root.kind === "dependency" || root.kind === "resource") throw new CliError(`Entry module "${resolvedPath}" must default-export a node (a service or a module) — construct it with service() or module() from @prisma/composer.`);
+	return {
+		path: resolvedPath,
+		root: blindCast(root)
+	};
+}
+/**
+* Pipeline step 7 (deploy-cli.md § The pipeline; design-notes.md's "Driving
+* Alchemy" call): shell out to the generated stack file. Resolves the
+* workspace's own installed `alchemy` bin (walking up `node_modules/.bin`
+* from the generated file's package dir) rather than going through
+* `bunx`/`npx`, so this works the same under node and bun — the resolved
+* bin's own launcher (`alchemy/bin/cli.js`) does its own node/bun dispatch
+* from there, driven by the env it inherits.
+*/
+/** Walks up from `startDir` looking for `node_modules/.bin/alchemy`. */
+function resolveAlchemyBin(startDir) {
+	let dir = startDir;
+	while (true) {
+		const candidate = path.join(dir, "node_modules", ".bin", "alchemy");
+		if (fs.existsSync(candidate)) return candidate;
+		const parent = path.dirname(dir);
+		if (parent === dir) throw new CliError(`Could not find an installed \`alchemy\` bin above "${startDir}" — add "alchemy" as a dependency of your app.`);
+		dir = parent;
+	}
+}
+/** Runs `alchemy deploy|destroy <stack file> --yes [--stage <stage>]`, inheriting stdio + env, plus the resolved Project/Branch ids. */
+function runAlchemy(input) {
+	const bin = resolveAlchemyBin(input.cwd);
+	const args = [
+		input.command,
+		input.stackFileRelativePath,
+		"--yes"
+	];
+	if (input.stage !== void 0) args.push("--stage", input.stage);
+	const result = spawnSync(bin, args, {
+		cwd: input.cwd,
+		stdio: "inherit",
+		env: {
+			...input.env ?? process.env,
+			PRISMA_PROJECT_ID: input.projectId,
+			...input.branchId !== void 0 ? { PRISMA_BRANCH_ID: input.branchId } : {}
+		}
+	});
+	if (result.error !== void 0) throw result.error;
+	return result.status ?? 1;
+}
+function lookup(extensions, extension, type, expectedKind, what) {
+	const ext = extensions.get(extension);
+	if (ext === void 0) throw new CliError(`No extension "${extension}" is configured (needed by ${what}) — add it to ${CONFIG_FILENAME}'s \`extensions\` (import its /control entry and list its descriptor).`);
+	const descriptor = ext.nodes[type];
+	if (descriptor === void 0) throw new CliError(`Extension "${extension}" has no descriptor for node type "${type}" (needed by ${what}; known: ${Object.keys(ext.nodes).join(", ")}).`);
+	if (descriptor.kind !== expectedKind) throw new CliError(`Extension "${extension}"'s descriptor for node type "${type}" is a "${descriptor.kind}" descriptor — ${what} needs a "${expectedKind}" descriptor.`);
+}
+/** Throws a CliError on the first uncovered `(extension, type)`; silent when the config covers the whole graph. */
+function validateRegistryCoverage(graph, config) {
+	const extensions = new Map(config.extensions.map((descriptor) => [descriptor.id, descriptor]));
+	for (const { id, node } of graph.nodes) {
+		if (node.kind === "resource") {
+			lookup(extensions, node.extension, node.type, "resource", `resource node "${id}"`);
+			continue;
+		}
+		if (node.kind !== "service") continue;
+		lookup(extensions, node.extension, node.type, "service", `service node "${id}"`);
+		lookup(extensions, node.build.extension, node.build.type, "build", `service node "${id}"'s build descriptor`);
+	}
+}
+/**
+* Argument parsing (clipanion — prisma-next's CLI idiom, see
+* prisma-next/packages/1-framework/3-tooling/cli/src/migration-cli.ts) +
+* orchestration of deploy-cli.md § The pipeline.
+*/
+const BINARY_NAME = "prisma-composer";
+/** The <entry>/--name/--stage surface shared by deploy and destroy; execute() is unused — run() drives the pipeline directly so error handling stays under this module's control. */
+var DeployCliCommand = class extends Command {
+	entry = Option.String({ name: "entry" });
+	name = Option.String("--name", { description: "Override the root node's name — the deploy's application name." });
+	stage = Option.String("--stage", { description: "Alchemy stage to target." });
+	production = Option.Boolean("--production", false, { description: "destroy: tear down the project-level production environment (required to destroy production)." });
+	async execute() {
+		return 0;
+	}
+};
+var DeployCommand = class extends DeployCliCommand {
+	static paths = [["deploy"]];
+	static usage = Command.Usage({
+		description: "Deploy the application whose root node is <entry>'s default export.",
+		examples: [["Deploy an app", "$0 deploy src/service.ts"]]
+	});
+	action = "deploy";
+};
+var DestroyCommand = class extends DeployCliCommand {
+	static paths = [["destroy"]];
+	static usage = Command.Usage({
+		description: "Tear down the application whose root node is <entry>'s default export — same derivation as deploy, Alchemy destroy.",
+		examples: [["Destroy an app", "$0 destroy src/service.ts"]]
+	});
+	action = "destroy";
+};
+function buildCli() {
+	return Cli.from([DeployCommand, DestroyCommand], {
+		binaryName: BINARY_NAME,
+		binaryLabel: "The prisma-composer deploy CLI"
+	});
+}
+/** Thrown internally when the user explicitly asked for `--help`/`-h` — run() prints it to stdout and exits 0; not a usage error. */
+var HelpRequested = class extends Error {};
+/** Duck-typed: clipanion's UnknownSyntaxError isn't re-exported, so match its name + clipanion.type discriminator (mirrors prisma-next's migration-cli.ts). */
+function isUnknownSyntaxError(error) {
+	if (!(error instanceof Error) || error.name !== "UnknownSyntaxError") return false;
+	const meta = error.clipanion;
+	return typeof meta === "object" && meta !== null && meta.type === "none";
+}
+/** Exported for direct testing (main.test.ts) — not part of the package's public barrel (see index.ts). */
+function parseArgs(argv) {
+	const cli = buildCli();
+	let command;
+	try {
+		command = cli.process([...argv]);
+	} catch (error) {
+		if (isUnknownSyntaxError(error) || error instanceof UsageError) throw new UsageError(cli.usage(null, { detailed: true }));
+		throw error;
+	}
+	if (command instanceof DeployCommand || command instanceof DestroyCommand) return {
+		command: command.action,
+		entry: command.entry,
+		name: command.name,
+		stage: command.stage,
+		production: command.production
+	};
+	if (argv.includes("--help") || argv.includes("-h")) throw new HelpRequested(cli.usage(null, { detailed: true }));
+	throw new UsageError(cli.usage(null, { detailed: true }));
+}
+/** Destroy must name its target explicitly — no silent default to production (spec §10). */
+function effectiveStage(args) {
+	if (args.command === "deploy") {
+		if (args.production) throw new CliError("--production is only valid with `destroy`; `deploy` targets production by default (omit --stage).");
+		return args.stage;
+	}
+	if (args.stage !== void 0 && args.production) throw new CliError("Pass either --stage <name> or --production to `destroy`, not both.");
+	if (args.stage === void 0 && !args.production) throw new CliError("`destroy` requires an explicit target: --stage <name> to tear down a branch environment, or --production to tear down the production environment.");
+	return args.production ? void 0 : args.stage;
+}
+const ALCHEMY_STATE_DIR = ".alchemy";
+/** Warns (doesn't fail) when destroy finds no local deploy state under cwd — likely wrong directory or nothing deployed yet. */
+function warnIfNoLocalDeployState(cwd) {
+	const stateDir = path.join(cwd, ALCHEMY_STATE_DIR);
+	if (!(fs.existsSync(stateDir) && fs.readdirSync(stateDir).length > 0)) console.warn(`\nNo prior deploy state under ${cwd} — if you deployed from a different directory, run destroy from there; otherwise this is a no-op.`);
+}
+/** Runs the full pipeline; returns the process exit code. */
+async function run(argv, deps = {}) {
+	let args;
+	try {
+		args = parseArgs(argv);
+	} catch (error) {
+		if (error instanceof HelpRequested) {
+			console.log(error.message);
+			return 0;
+		}
+		throw error;
+	}
+	const stage = effectiveStage(args);
+	const cwd = process.cwd();
+	if (args.command === "destroy") warnIfNoLocalDeployState(cwd);
+	const resolvedEntryPath = path.resolve(cwd, args.entry);
+	const configPath = findConfigPathForEntry(resolvedEntryPath);
+	if (configPath === void 0) throw missingConfigError(resolvedEntryPath);
+	const config = deps.config ?? (await loadAppConfig(configPath)).config;
+	const entryModule = await loadEntry(args.entry, cwd);
+	const graph = Load(entryModule.root);
+	if (graph.root.node.kind !== "module") throw new CliError("The deploy root must be a module — wrap your service, e.g. export default module('name', ({ provision }) => { provision(service); }).");
+	validateRegistryCoverage(graph, config);
+	const name = args.name ?? entryModule.root.name;
+	if (name.length === 0) throw new CliError("The root node has no name — name it at authoring, or pass --name.");
+	let assembled;
+	try {
+		assembled = await assembleServices(graph, config, cwd, deps.runAssembler);
+	} catch (error) {
+		if (args.command === "destroy" && error instanceof Error) throw new CliError(`${error.message}\n\ndestroy evaluates the same stack program as deploy, which packages the built artifacts — so the app must be built first. Run the build, then retry the destroy.`);
+		throw error;
+	}
+	const { projectId, branchId } = await (deps.ensureContainers ?? ensureContainers)({
+		command: args.command,
+		appName: name,
+		stage
+	});
+	if (args.command === "deploy") for (const extension of config.extensions) {
+		if (extension.preflight === void 0) continue;
+		try {
+			await extension.preflight({
+				graph,
+				projectId,
+				branchId,
+				stage
+			});
+		} catch (error) {
+			throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
+		}
+	}
+	const stackPath = writeStackFile({
+		entryPath: entryModule.path,
+		cwd,
+		configPath,
+		name,
+		assembled
+	});
+	try {
+		const status = (deps.alchemy ?? runAlchemy)({
+			command: args.command,
+			stackFileRelativePath: GENERATED_STACK_RELATIVE_PATH,
+			cwd,
+			stage,
+			projectId,
+			...branchId !== void 0 ? { branchId } : {}
+		});
+		if (status !== 0) {
+			console.error(`\nGenerated stack file: ${stackPath}`);
+			console.error(`Run \`alchemy ${args.command} ${GENERATED_STACK_RELATIVE_PATH} --yes\` from ${cwd} to reproduce this directly.`);
+			return status;
+		}
+		if (args.command === "destroy") for (const extension of config.extensions) {
+			if (extension.teardown === void 0) continue;
+			try {
+				await extension.teardown({
+					projectId,
+					branchId,
+					stage
+				});
+			} catch (error) {
+				throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
+			}
+		}
+		if (args.command === "destroy" && branchId !== void 0) await (deps.deleteBranch ?? ((input) => deleteStageBranch(input)))({ branchId });
+		else if (args.command === "destroy") await (deps.deleteProject ?? ((input) => deleteAppProject(input)))({ projectId });
+		return status;
+	} catch (error) {
+		console.error(`\nGenerated stack file: ${stackPath}`);
+		throw error;
+	}
+}
+/**
+* Run the `prisma-composer` CLI end to end: dispatch `argv`, map errors to exit
+* codes. Shared by this package's `bin` and the unscoped `prisma-composer` launcher.
+*/
+async function cli(argv = process.argv.slice(2)) {
+	try {
+		process.exitCode = await run(argv);
+	} catch (error) {
+		if (error instanceof UsageError) {
+			console.error(error.message);
+			process.exitCode = 1;
+			return;
+		}
+		console.error(`Error: ${error instanceof Error ? error.message : String(error)}`);
+		process.exitCode = 1;
+	}
+}
+//#endregion
+//#region ../../0-framework/3-tooling/cli/dist/bin.mjs
+cli();
+//#endregion
+export {};
+
+//# sourceMappingURL=bin.mjs.map