@prisma/composer 0.1.0-dev.1

package/dist/config-ad92ubCB-D0-dZUgA.d.mts

@@ -0,0 +1,568 @@
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region ../../0-framework/0-foundation/foundation/dist/secret.d.mts
+//#region src/secret.d.ts
+/**
+ * A value wrapper that redacts everywhere except the one explicit reader,
+ * `expose()`. Sensitivity is carried by the TYPE (`SecretBox<T>`), not a flag a
+ * sink must remember to check: `String(box)`, template interpolation,
+ * `JSON.stringify`, and `console.log`/`util.inspect` all print `[REDACTED]`, so
+ * a secret can't leak through an accidental log or serialization.
+ *
+ * Shape matches the platform's own `secrecy` type (pdp-control-plane). The class
+ * is nominal enough on its own — no phantom brand.
+ */
+declare class SecretBox<T> {
+  #private;
+  constructor(value: T);
+  /** The sole explicit door to the wrapped value. */
+  expose(): T;
+  toString(): string;
+  toJSON(): string;
+  valueOf(): string;
+  [Symbol.toPrimitive](): string;
+}
+/** The common case: a secret string. */
+type SecretString = SecretBox<string>;
+//#endregion
+//#region ../../0-framework/1-core/core/dist/config-ad92ubCB.d.mts
+//#region src/contract.d.ts
+/**
+ * A Contract is the declared interface of a service-to-service dependency: a
+ * protocol brand (`kind`) plus an opaque comparison type (`Cmp`) the core
+ * never inspects. Wiring compatibility is plain TypeScript assignability on
+ * `Cmp`, checked at `ModuleBuilder.provision`'s call site (node.ts); `satisfies`
+ * is its runtime mirror, called at Load (graph.ts). Correctness comes from
+ * the kind's builder shaping `Cmp` so assignability means the right thing —
+ * see @prisma/composer/rpc's `contract()`/`rpc()`.
+ */
+interface Contract<Kind extends string, Cmp> {
+  readonly kind: Kind;
+  readonly __cmp: Cmp;
+  satisfies(required: Contract<Kind, unknown>): boolean;
+}
+//#endregion
+//#region src/node.d.ts
+declare const NODE: unique symbol;
+declare const SECRET_NEED: unique symbol;
+declare const SECRET_SOURCE: unique symbol;
+/** A declared secret input slot — nameless; the root binds it and the topology forwards it in. */
+interface SecretNeed {
+  readonly [SECRET_NEED]: true;
+  readonly kind: 'secret';
+}
+/** A service/module's secret slots: name → the need it declares. */
+type Secrets = Record<string, SecretNeed>;
+/** The wiring value bound to a secret slot: a target-defined payload core forwards but never inspects. A target (e.g. @prisma/composer-prisma-cloud's `envSecret`) builds one via `secretSource()`. */
+interface SecretSource<T = unknown> {
+  readonly [SECRET_SOURCE]: true;
+  /** Target-defined. Core never reads this; the target that authored the source reads it back. */
+  readonly payload: T;
+}
+/** What `provision(node, { secrets })` supplies: one source per declared secret slot. */
+type SecretBindings<S extends Secrets> = { [K in keyof S]: SecretSource; };
+/** What `secrets()` returns: one redacting SecretBox per declared slot. */
+type SecretValues<S extends Secrets> = { readonly [K in keyof S]: SecretString; };
+/** Declares a secret NEED. Nameless — the platform name is bound at the root via `envSecret`. */
+declare function secret(): SecretNeed;
+/** Builds an opaque secret source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envSecret`) calls. Core forwards the source and never inspects the payload. */
+declare function secretSource<T>(payload: T): SecretSource<T>;
+/** True if `value` is a secret source (an `envSecret` result or a forwarded ctx.secrets ref). */
+declare function isSecretSource(value: unknown): value is SecretSource;
+declare const PROVISION_NEED: unique symbol;
+/** A param value the framework mints. Opaque to core: it forwards the payload to the resolved provisioner and never reads it (ADR-0031). */
+interface ProvisionNeed<T = unknown> {
+  readonly [PROVISION_NEED]: true;
+  /** Selects the provisioner in an extension's `provisions` registry. */
+  readonly brand: symbol;
+  /** Provisioner-defined; core never reads it. */
+  readonly payload: T;
+}
+/** Builds an opaque provisioning need — the declaring package's own brand plus whatever payload its provisioner reads back. */
+declare function provisionNeed<T = undefined>(brand: symbol, payload?: T): ProvisionNeed<T>;
+/** True if `value` is a provisioning need (a `provisionNeed()` result). */
+declare function isProvisionNeed(value: unknown): value is ProvisionNeed;
+declare const PARAM_SOURCE: unique symbol;
+declare const PARAM_NEED: unique symbol;
+/** The wiring value bound to a param at provision time: a target-defined payload core forwards but never inspects. A target (e.g. @prisma/composer-prisma-cloud's `envParam`) builds one via `paramSource()`. */
+interface ParamSource<T = unknown> {
+  readonly [PARAM_SOURCE]: true;
+  /** Target-defined. Core never reads this; the target that authored the source reads it back. */
+  readonly payload: T;
+}
+/** Builds an opaque param source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envParam`) calls. Core forwards the source and never inspects the payload. */
+declare function paramSource<T>(payload: T): ParamSource<T>;
+/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */
+declare function isParamSource(value: unknown): value is ParamSource;
+/** A module's declared param-forwarding slot — nameless, schema-less; the root (or an ancestor module) binds a `ParamSource` and the topology forwards it into a child's real, schema-bearing param. */
+interface ParamNeed {
+  readonly [PARAM_NEED]: true;
+  readonly kind: 'param';
+}
+/** A module's param-forwarding slots: name → the need it declares. */
+type ParamNeeds = Record<string, ParamNeed>;
+/** Declares a module param-forwarding NEED. Nameless — bound to a `ParamSource` by an enclosing scope and forwarded into a child's real param. */
+declare function paramNeed(): ParamNeed;
+/** What `provision(service, { params })` accepts per declared param: a literal (schema-validated when config is built) or an opaque `ParamSource`, taking precedence over `param.default`. Every entry is optional — an unbound param falls back to its `default`. */
+type ParamBindings<P extends Params> = { readonly [K in keyof P]?: StandardSchemaV1.InferOutput<P[K]['schema']> | ParamSource; };
+/** What `provision(moduleChild, { params })` accepts per declared `ParamNeed`: a `ParamSource` only — a need carries no schema to validate a literal against. */
+type ParamNeedBindings<PN extends ParamNeeds> = { readonly [K in keyof PN]?: ParamSource; };
+/** Opaque `Contract<any, any>` bound shared by every node/port type that doesn't care which contract. */
+type AnyContract = Contract<any, any>;
+/** How a service's app becomes a runnable artifact — the build descriptor's routing key (`extension`/`type`) plus paths resolved relative to the authoring module. */
+interface BuildAdapter {
+  /** The extension package that provides the build descriptor, e.g. "@prisma/composer/node". */
+  readonly extension: string;
+  /** The build descriptor's node ID within its extension, e.g. "node" · "nextjs". */
+  readonly type: string;
+  /** The authoring module's `import.meta.url` — every other path on this descriptor resolves relative to `dirname(module)`. */
+  readonly module: string;
+  /** The app's built runnable, resolved relative to `dirname(module)` and interpreted by the type's build descriptor (e.g. "node": a server file; "nextjs": located in the standalone tree). */
+  readonly entry: string;
+}
+/**
+ * A Resource's identity: the one place a piece of infrastructure exists.
+ * Provisioned by a module, never embedded in a service's deps. `provides`
+ * is the Contract the resource offers; `type` is derived from `provides.kind`.
+ */
+interface ResourceNode<C extends AnyContract = AnyContract> {
+  readonly [NODE]: true;
+  readonly kind: 'resource';
+  /** Human-readable, given at authoring — logs/diagnostics only; identity remains the deploy address (ADR-0006). */
+  readonly name: string;
+  /** The extension package that authored this node, e.g. "@prisma/composer-prisma-cloud" — the registry key at deploy. */
+  readonly extension: string;
+  readonly type: C['kind'];
+  /** The Contract this resource provides — the resource's single port. */
+  readonly provides: C;
+}
+/**
+ * A Service: inputs + its own declared params + how it is built. Inspectable,
+ * inert until run, and carries NO runtime behavior — an extension's factory
+ * wraps it into a runnable/loadable shape (see RunnableServiceNode).
+ */
+interface ServiceNode<D extends Deps = Deps, P extends Params = Params, E extends Expose = Expose, S extends Secrets = Secrets> {
+  readonly [NODE]: true;
+  readonly kind: 'service';
+  /** Human-readable, given at authoring — logs/diagnostics only; identity remains the deploy address (ADR-0006). */
+  readonly name: string;
+  /** The extension package that authored this node, e.g. "@prisma/composer-prisma-cloud" — the registry key at deploy. */
+  readonly extension: string;
+  readonly type: string;
+  readonly inputs: D;
+  /** Service-level config declarations (e.g. port). */
+  readonly params: P;
+  /** Declared secret input slots (authored as `secrets`) — bound at the root via `envSecret`, read via the `secrets()` accessor (ADR-0029). Named `secretSlots` on the node so the data field does not collide with that accessor. */
+  readonly secretSlots: S;
+  /** How the app's entry is built + assembled. */
+  readonly build: BuildAdapter;
+  /** Named output ports this service exposes — the Contracts a consumer's `rpc(contract)` can require. `undefined` when the service exposes nothing. */
+  readonly expose: E | undefined;
+}
+/**
+ * The extension's runnable/loadable service node. `run` boots the app after
+ * deserializing its Config; `load`/`config` then read deps/params back out
+ * (kept separate per ADR-0021 so a same-named dep and param never collide).
+ */
+interface RunnableServiceNode<D extends Deps = Deps, P extends Params = Params, E extends Expose = Expose, S extends Secrets = Secrets> extends ServiceNode<D, P, E, S> {
+  run(address: string, boot: () => Promise<unknown>): Promise<unknown>;
+  load(): HydratedDeps<D>;
+  config(): Values<P>;
+  /** The service's secrets, each a redacting SecretBox — a third accessor beside load()/config() (ADR-0021). */
+  secrets(): SecretValues<S>;
+}
+/**
+ * A service's dependency slot. At Load the enclosing module wires a
+ * producer's ref into it; at run it hydrates a client via Connection. `Req`
+ * is the required contract (`unknown` for an untyped end like `http()`).
+ */
+interface DependencyEnd<C = unknown, Req = unknown> {
+  readonly [NODE]: true;
+  readonly kind: 'dependency';
+  /** Human-readable, given at authoring — logs/diagnostics only. */
+  readonly name: string;
+  readonly type: string;
+  readonly connection: Connection<Params, C>;
+  /** The required contract, or `undefined` for an untyped end (e.g. `http()`). */
+  readonly required: Req | undefined;
+}
+/** A Module: the same Deps/Expose boundary a service has, around transparent wiring instead of a black-box body — its `body` runs at Load, not at authoring. */
+interface ModuleNode<D extends Deps = Deps, E extends Expose = Expose, S extends Secrets = Secrets, PN extends ParamNeeds = ParamNeeds> {
+  readonly [NODE]: true;
+  readonly kind: 'module';
+  /** Human-readable, given at authoring — logs/diagnostics only. */
+  readonly name: string;
+  readonly deps: D;
+  /** Declared secret input slots (authored as `secrets`) — forwarded to internals via `ctx.secrets` (ADR-0029). */
+  readonly secretSlots: S;
+  /** Declared param-forwarding slots (authored as `params`) — forwarded to internals via `ctx.params`, the same rail secrets ride on. */
+  readonly paramSlots: PN;
+  readonly expose: E;
+  body(ctx: ModuleContext<D, S, PN>): ModuleOutputs<E> | void;
+}
+/**
+ * What a module's body receives: its declared inputs as forwardable wiring
+ * values, plus `provision` to register the owned services/modules it wires them into.
+ */
+interface ModuleContext<D extends Deps, S extends Secrets = Secrets, PN extends ParamNeeds = ParamNeeds> {
+  /** The module's declared inputs as wiring values — pass them into provision(). */
+  readonly inputs: { [K in keyof D]: InputRef<D[K]>; };
+  /** The module's declared secret slots as forwardable sources — pass them into a child's `secrets` (ADR-0029). */
+  readonly secrets: { readonly [K in keyof S]: SecretSource; };
+  /** The module's declared param-forwarding slots as forwardable sources — pass them into a child's `params`. */
+  readonly params: { readonly [K in keyof PN]: ParamSource; };
+  /** Registers an owned child (service or module) under a stable id. */
+  readonly provision: ModuleBuilder['provision'];
+}
+/**
+ * A module's forwarded-input value: the same ref-port shape a producer's
+ * output carries, so it flows down a nested `provision()` call indistinguishably
+ * from a sibling's exposed port.
+ */
+type InputRef<DE> = DE extends DependencyEnd<any, infer Req extends AnyContract> ? RefPort<Req> : never;
+/** One ref-port per declared expose key, contract-checked against `E` (mirrors `Wiring`'s `NoInfer` use). */
+type ModuleOutputs<E extends Expose> = { [P in keyof E]: RefPort<NoInfer<E[P]>>; };
+/**
+ * A provisioned producer's port as a wiring-time value: its contract, tagged
+ * with which provider produced it (`__providerId`, read by Load to resolve the edge).
+ */
+type RefPort<C extends AnyContract> = C & {
+  readonly __providerId: string;
+};
+/**
+ * What `provision(id, service)` hands back: a stable id plus one ref-port per
+ * exposed contract. `provision(id, resource)` returns the same shape with the
+ * resource's one port flattened onto the ref itself.
+ */
+type ProvisionedRef<E extends Expose = Record<never, never>> = {
+  readonly id: string;
+} & { readonly [P in keyof E]: RefPort<E[P]>; };
+/** A DependencyEnd's required contract (unknown for an untyped end). */
+type ReqOf<DE> = DE extends DependencyEnd<any, infer Req> ? Req : never;
+/**
+ * The producers that satisfy a node's declared dependency slots — one ref per
+ * slot, checked against its required contract. A slot also accepts
+ * `InputRef<D[K]>` so a module body can forward its own `ctx.inputs` straight
+ * into a nested `provision()` call — the same value shape a producer's own
+ * exposed port carries.
+ */
+type DepBindings<D extends Deps> = { [K in keyof D]: NoInfer<ReqOf<D[K]>> | InputRef<D[K]>; };
+/**
+ * `provision`'s trailing options: an explicit `id` (default: the node's own
+ * `name`) plus, for a node that declares dependency slots, the `deps` that
+ * satisfy them. `deps` is required exactly when the node has slots —
+ * `[keyof D] extends [never]` is the "no slots" test — so a dependency can
+ * never be left unwired at compile time. The whole object is therefore
+ * optional for a slot-less node and required for one with slots. `params` is
+ * always optional — a bound value overrides `param.default`, but a param may
+ * fall back to its default (or be `optional`) instead, unlike `deps`/`secrets`.
+ * `PB` is the params-binding map appropriate to the target: `ParamBindings<P>`
+ * for a service's real, schema-bearing params; `ParamNeedBindings<PN>` for a
+ * child module's nameless forwarding slots.
+ */
+type ProvisionArgs<D extends Deps, S extends Secrets, PB> = [keyof D] extends [never] ? [keyof S] extends [never] ? [opts?: {
+  id?: string;
+  params?: PB;
+}] : [opts: {
+  id?: string;
+  secrets: SecretBindings<S>;
+  params?: PB;
+}] : [keyof S] extends [never] ? [opts: {
+  id?: string;
+  deps: DepBindings<D>;
+  params?: PB;
+}] : [opts: {
+  id?: string;
+  deps: DepBindings<D>;
+  secrets: SecretBindings<S>;
+  params?: PB;
+}];
+interface ModuleBuilder {
+  /** Provisions an owned resource; its id defaults to the node's `name`. */
+  provision<C extends AnyContract>(resource: ResourceNode<C>, opts?: {
+    id?: string;
+  }): {
+    readonly id: string;
+  } & RefPort<C>;
+  /** Registers an owned service; its id defaults to the node's `name`; `deps`/`secrets` are required iff it declares them; a declared param may be bound (literal or `ParamSource`), overriding its default. */
+  provision<D extends Deps, P extends Params, E extends Expose, S extends Secrets>(service: ServiceNode<D, P, E, S>, ...args: ProvisionArgs<D, S, ParamBindings<P>>): ProvisionedRef<E>;
+  /**
+   * The service call with `deps`/`secrets` spelled out. `ProvisionArgs` above
+   * cannot resolve while `D`/`S` are still unbound type parameters — a generic
+   * wrapper like `cron()` provisioning a caller-supplied service — so that call
+   * site resolves to this concrete overload instead.
+   */
+  provision<D extends Deps, P extends Params, E extends Expose, S extends Secrets>(service: ServiceNode<D, P, E, S>, opts: {
+    id?: string;
+    deps: DepBindings<D>;
+    secrets?: SecretBindings<S>;
+    params?: ParamBindings<P>;
+  }): ProvisionedRef<E>;
+  /** Registers an owned child module; its id defaults to the node's `name`; `deps`/`secrets` are required iff it declares them; a declared param-forwarding slot may be bound to a `ParamSource`. */
+  provision<D extends Deps, E extends Expose, S extends Secrets, PN extends ParamNeeds>(child: ModuleNode<D, E, S, PN>, ...args: ProvisionArgs<D, S, ParamNeedBindings<PN>>): ProvisionedRef<E>;
+  /** The child-module call with `deps`/`secrets` spelled out — the same generic-wrapper escape as the service overload above. */
+  provision<D extends Deps, E extends Expose, S extends Secrets, PN extends ParamNeeds>(child: ModuleNode<D, E, S, PN>, opts: {
+    id?: string;
+    deps: DepBindings<D>;
+    secrets?: SecretBindings<S>;
+    params?: ParamNeedBindings<PN>;
+  }): ProvisionedRef<E>;
+}
+/** Dependency map: name → the slot the service declares. Only declarations are admitted, never a concrete ResourceNode. */
+type Deps = Record<string, DependencyEnd<any, any>>;
+/** Output-port map: name → the Contract a service exposes for others to depend on. */
+type Expose = Readonly<Record<string, AnyContract>>;
+type Hydrated<N> = N extends DependencyEnd<infer C, any> ? C : never;
+type HydratedDeps<D extends Deps> = { readonly [K in keyof D]: Hydrated<D[K]>; };
+/**
+ * Seals a node instance after its constructor has assigned all fields — the
+ * last statement of a concrete node class's constructor. A free function, not
+ * a base-class method, so an instance stays structurally a plain frozen node.
+ */
+declare function freezeNode<T extends object>(node: T): T;
+/**
+ * Everything `resource()` establishes, minus the freeze — an extension
+ * whose resource node carries extra fields extends this, assigns them, and
+ * calls `freezeNode(this)` as its constructor's last statement.
+ */
+declare abstract class ResourceNodeBase<C extends AnyContract = AnyContract> implements ResourceNode<C> {
+  readonly [NODE]: true;
+  readonly kind: "resource";
+  readonly name: string;
+  readonly extension: string;
+  readonly type: C['kind'];
+  readonly provides: C;
+  constructor(def: {
+    name: string;
+    extension: string;
+    provides: C;
+  });
+}
+/**
+ * Constructs a branded, frozen Resource node — an identity plus the Contract
+ * it provides; the routing `type` is the contract's `kind`. Pure — nothing
+ * is provisioned until a module provisions it.
+ */
+declare function resource<C extends AnyContract>(def: {
+  name: string;
+  extension: string;
+  provides: C;
+}): ResourceNode<C>;
+/**
+ * Constructs a branded, frozen Service node — declarations only (inputs,
+ * params, build adapter, and the ports it exposes). Pure; carries no runtime behavior.
+ */
+declare function service<D extends Deps, P extends Params, E extends Expose = Record<never, never>, S extends Secrets = Record<never, never>>(def: {
+  name: string;
+  extension: string;
+  type: string;
+  inputs: D;
+  params: P;
+  secrets?: S;
+  build: BuildAdapter;
+  expose?: E;
+}): ServiceNode<D, P, E, S>;
+/**
+ * Constructs a branded, frozen DependencyEnd. `required` (if given) is the
+ * contract Load compares a wired ref against via `satisfies()`; an unnamed
+ * end's diagnostic `name` falls back to its `type`.
+ */
+declare function dependency<P extends Params, C, Req = unknown>(def: {
+  name?: string;
+  type: string;
+  connection: Connection<P, C>;
+  required?: Req;
+}): DependencyEnd<C, Req>;
+/**
+ * A closed root: no `deps`, no `expose`, nothing wiring in or out. The body
+ * only provisions and needs no return. Omitting the boundary argument IS the
+ * closed-root shape — `module(name, body)` instead of `module(name, {}, () =>
+ * ({}))`.
+ */
+declare function module(name: string, body: (ctx: ModuleContext<Record<never, never>, Record<never, never>, Record<never, never>>) => void): ModuleNode<Record<never, never>, Record<never, never>, Record<never, never>, Record<never, never>>;
+/**
+ * A module with a boundary: `deps` and/or `expose` declare what wires in and
+ * out, the same way a service does. The body returns one port per `expose` key.
+ */
+declare function module<D extends Deps = Record<never, never>, E extends Expose = Record<never, never>, S extends Secrets = Record<never, never>, PN extends ParamNeeds = Record<never, never>>(name: string, boundary: {
+  deps?: D;
+  secrets?: S;
+  params?: PN;
+  expose?: E;
+}, body: (ctx: ModuleContext<D, S, PN>) => ModuleOutputs<E> | void): ModuleNode<D, E, S, PN>;
+/**
+ * True if `value` was constructed by this module's factories. Checks the
+ * brand only, never a prototype — a graph may mix nodes from a different
+ * installed copy of core (dual-package hazard).
+ */
+declare function isNode(value: unknown): value is ServiceNode | ResourceNode | DependencyEnd | ModuleNode;
+//#endregion
+//#region src/graph-types.d.ts
+/** Path-derived: root-scope children are bare ids ("auth", "db"); a nested module's own children dot-join under its address ("auth.db"). */
+type NodeId = string;
+interface GraphNode {
+  readonly id: NodeId;
+  readonly node: ServiceNode | ResourceNode | DependencyEnd | ModuleNode;
+}
+/**
+ * `input`: a service consumes its own declared dependency slot — from the
+ * slot node to the service. `dependency`: a service consumes a provisioned
+ * producer (a service or a resource — the one wiring mechanism) — from the
+ * producer to the consumer, labeled with the consumer's input name (from the
+ * module wiring).
+ */
+interface Edge {
+  readonly from: NodeId;
+  readonly to: NodeId;
+  readonly input: string;
+  readonly kind: 'input' | 'dependency';
+}
+/**
+ * A resolved secret binding: the root bound a service's secret slot to an
+ * opaque, target-defined source, and the wiring forwarded it to that service's
+ * address (ADR-0029). Core never inspects the source; the deploy target reads
+ * its own payload. A target's serializer keys the pointer row off this; the
+ * preflight manifest aggregates the sources.
+ */
+interface SecretBinding {
+  /** The graph address of the service that declares the secret slot. */
+  readonly serviceAddress: NodeId;
+  /** The secret slot key on that service. */
+  readonly slot: string;
+  /** The opaque source the root bound the slot to. Core never inspects it; the deploy target reads back its own payload. */
+  readonly source: SecretSource;
+}
+/**
+ * A resolved param binding: a `provision()` call bound a service's param
+ * slot to either a literal value or an opaque `ParamSource` — the non-secret
+ * sibling of `SecretBinding`. Unlike a secret, a param binding is not
+ * required for every declared param (a param may fall back to its own
+ * `default`), so this list only carries the ones a `provision()` call
+ * actually bound.
+ */
+interface ParamBinding {
+  /** The graph address of the service that declares the param. */
+  readonly serviceAddress: NodeId;
+  /** The param name on that service. */
+  readonly slot: string;
+  /** A literal value (schema-validated by `buildConfig`) or an opaque `ParamSource` (the deploy target reads its own payload back) — check with `isParamSource`. Core never inspects a `ParamSource`'s payload. */
+  readonly binding: unknown;
+}
+interface Graph {
+  readonly root: GraphNode;
+  /** Root + one per input, topo-ordered (deps first). */
+  readonly nodes: readonly GraphNode[];
+  readonly edges: readonly Edge[];
+  /** Every service secret slot resolved to its root-bound opaque source. */
+  readonly secrets: readonly SecretBinding[];
+  /** Every service param bound at provision — literal or source; unbound params are absent here and fall back to their `default` (see `buildConfig`). */
+  readonly params: readonly ParamBinding[];
+}
+/** Thrown by Load when the graph is malformed. */
+declare class LoadError extends Error {
+  constructor(message: string);
+}
+//#endregion
+//#region src/config.d.ts
+/**
+ * A declared config param — pure data: a caller-owned Standard Schema
+ * (ADR-0018) plus a few framework facets. The framework carries the schema,
+ * infers the value type from it, and validates with it, without ever
+ * enumerating permitted shapes. Turning a value into stored config and back is
+ * the deploy target's job, not the param's (ADR-0019) — the same split RPC
+ * uses: schema on the declaration, wire owned by the mover.
+ */
+interface ConfigParam<S extends StandardSchemaV1 = StandardSchemaV1> {
+  readonly schema: S;
+  readonly optional?: boolean;
+  readonly default?: StandardSchemaV1.InferOutput<S>;
+  /**
+   * A framework-minted value (ADR-0031): core resolves `provision.brand`
+   * against the consumer extension's `provisions` registry and mints this
+   * param's value per dependency edge. Opaque — core forwards the need and
+   * never reads its payload.
+   */
+  readonly provision?: ProvisionNeed;
+}
+type Params = Record<string, ConfigParam>;
+/** What implementations receive — undefined only for optional params with no default. */
+type Values<P extends Params> = { readonly [K in keyof P]: P[K]['optional'] extends true ? undefined extends P[K]['default'] ? StandardSchemaV1.InferOutput<P[K]['schema']> | undefined : StandardSchemaV1.InferOutput<P[K]['schema']> : StandardSchemaV1.InferOutput<P[K]['schema']>; };
+/**
+ * The connection face of a dependency: declared params (data) and how
+ * validated values become a client (the hydrate behavior slot). Both P and C
+ * are INFERRED — the declaration types hydrate's input; the factory types the
+ * loaded dep.
+ */
+interface Connection<P extends Params = Params, C = unknown> {
+  readonly params: P;
+  hydrate(values: Values<P>): C | Promise<C>;
+}
+/**
+ * The enumerable config surface of a service — derivable from the graph
+ * alone, nothing booted, no platform keys. The introspection artifact (values
+ * absent). `schema` is a data-only projection of the param's Standard Schema
+ * (JSON Schema when the vendor supports the optional conversion, a `{ vendor }`
+ * tag otherwise) — never the param's functions. Physical locations are the
+ * target pack's business. Secrets are not here — they live on their own slot.
+ */
+interface ConfigDeclaration {
+  readonly owner: 'service' | {
+    readonly input: string;
+  };
+  readonly name: string;
+  readonly schema: Readonly<Record<string, unknown>>;
+  readonly optional: boolean;
+  readonly default: unknown;
+}
+/**
+ * The resolved, typed configuration of one service — what crosses the
+ * core→pack boundary. Core builds it at deploy (leaf values are provisioning
+ * refs, so the env writes depend on the resources/producer — the ordering
+ * edges); the pack serializes it, and at boot reconstructs the identical
+ * structure with concrete values. Both forms conform to the shape from
+ * configOf. Core never stringifies.
+ */
+interface Config {
+  readonly service: Readonly<Record<string, unknown>>;
+  readonly inputs: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+}
+/**
+ * Enumerates every config param the service declares: each input's connection
+ * params, then the service's own params. Pure — reads `root.inputs`/`params`
+ * directly, executes nothing but the (also pure) schema projection. Deliberately
+ * does not go through `Load`: a service's connection-end inputs are legitimately
+ * unwired from its own point of view (wiring is an enclosing module's concern),
+ * and this introspects one service's declared shape regardless of how — or
+ * whether — it composes into a larger graph.
+ */
+declare function configOf(root: ServiceNode): readonly ConfigDeclaration[];
+/**
+ * The app's provision manifest: every secret binding the root resolved across
+ * the graph (ADR-0029) — an opaque, target-defined source per service secret
+ * slot; a deploy target's preflight reads its own payload. Pure graph
+ * introspection, TARGET-AGNOSTIC — the target consumes it to verify each secret
+ * exists on the platform before deploy. The values are provisioned out-of-band.
+ */
+declare function provisionManifest(graph: Graph): readonly SecretBinding[];
+/**
+ * The app's param-binding manifest: every param a `provision()` call bound —
+ * literal or an opaque, target-defined `ParamSource` — at the address that
+ * declared it. The param sibling of `provisionManifest`, for a deploy
+ * target's own preflight to consume (D2). Pure graph introspection,
+ * TARGET-AGNOSTIC; a param this manifest omits simply falls back to its own
+ * `default` at `buildConfig`.
+ */
+declare function paramManifest(graph: Graph): readonly ParamBinding[];
+interface ParamOptions<T> {
+  readonly optional?: boolean;
+  readonly default?: T;
+  readonly provision?: ProvisionNeed;
+}
+/** A string-valued param. */
+declare function string(opts?: ParamOptions<string>): ConfigParam<StandardSchemaV1<string, string>>;
+/** A number-valued param. */
+declare function number(opts?: ParamOptions<number>): ConfigParam<StandardSchemaV1<number, number>>;
+/** A param over any caller-supplied Standard Schema — a structured `jobs`, say. */
+declare function param<S extends StandardSchemaV1>(schema: S, opts?: ParamOptions<StandardSchemaV1.InferOutput<S>>): ConfigParam<S>;
+//#endregion
+export { paramManifest as $, ProvisionedRef as A, Secrets as B, ParamBindings as C, ParamSource as D, ParamNeeds as E, SecretBinding as F, freezeNode as G, Values as H, SecretBindings as I, isProvisionNeed as J, isNode as K, SecretNeed as L, ResourceNode as M, ResourceNodeBase as N, Params as O, RunnableServiceNode as P, param as Q, SecretSource as R, ParamBinding as S, ParamNeedBindings as T, configOf as U, ServiceNode as V, dependency as W, module as X, isSecretSource as Y, number as Z, ModuleBuilder as _, Connection as a, secret as at, ModuleOutputs as b, Deps as c, string as ct, Graph as d, paramNeed as et, GraphNode as f, LoadError as g, InputRef as h, ConfigParam as i, resource as it, RefPort as j, ProvisionNeed as k, Edge as l, SecretBox as lt, HydratedDeps as m, Config as n, provisionManifest as nt, Contract as o, secretSource as ot, Hydrated as p, isParamSource as q, ConfigDeclaration as r, provisionNeed as rt, DependencyEnd as s, service as st, BuildAdapter as t, paramSource as tt, Expose as u, SecretString as ut, ModuleContext as v, ParamNeed as w, NodeId as x, ModuleNode as y, SecretValues as z };
+//# sourceMappingURL=config-ad92ubCB-D0-dZUgA.d.mts.map

package/dist/config.d.mts

@@ -0,0 +1,3 @@
+import { C as TeardownInput, T as defineConfig, h as NodeDescriptor, l as ExtensionDescriptor, v as PreflightInput, y as PrismaAppConfig } from "./app-config-CpWN1ZfP-CZ1c6Eqk.mjs";
+import "./config-D-h0FACe.mjs";
+export { ExtensionDescriptor, NodeDescriptor, PreflightInput, PrismaAppConfig, TeardownInput, defineConfig };

package/dist/config.mjs

@@ -0,0 +1,9 @@
+//#region ../../0-framework/1-core/core/dist/config.mjs
+/** Typed identity — exists so `prisma-composer.config.ts` gets checked against PrismaAppConfig where it is written. */
+function defineConfig(config) {
+	return config;
+}
+//#endregion
+export { defineConfig };
+
+//# sourceMappingURL=config.mjs.map

package/dist/config.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.mjs","names":[],"sources":["../../../0-framework/1-core/core/dist/config.mjs"],"sourcesContent":["//#region src/app-config.ts\n/** Typed identity — exists so `prisma-composer.config.ts` gets checked against PrismaAppConfig where it is written. */\nfunction defineConfig(config) {\n\treturn config;\n}\n//#endregion\nexport { defineConfig };\n\n//# sourceMappingURL=config.mjs.map"],"mappings":";;AAEA,SAAS,aAAa,QAAQ;CAC7B,OAAO;AACR"}

package/dist/deploy-D-h0FACe.d.mts

@@ -0,0 +1 @@
+import "./app-config-CpWN1ZfP-CZ1c6Eqk.mjs";

package/dist/deploy.d.mts

@@ -0,0 +1,3 @@
+import { A as resolveStateLayer, D as lower, E as joinDeployment, O as lowering, S as ServiceLowering, _ as PackageInput, a as Bundle, b as ProvisionEdge, c as DeploymentResult, d as LowerError, f as LowerOptions, g as Outputs, i as AssembleInput, k as mergedProviders, m as Lowering, n as ApplicationDescriptor, o as DeployedEntity, p as LoweredResult, r as Artifact, s as DeployedNode, t as AlchemyStateLayer, u as LowerContext, w as buildConfig, x as ProvisionerDescriptor } from "./app-config-CpWN1ZfP-CZ1c6Eqk.mjs";
+import "./deploy-D-h0FACe.mjs";
+export { AlchemyStateLayer, ApplicationDescriptor, Artifact, AssembleInput, Bundle, DeployedEntity, DeployedNode, DeploymentResult, LowerContext, LowerError, LowerOptions, LoweredResult, Lowering, Outputs, PackageInput, ProvisionEdge, ProvisionerDescriptor, ServiceLowering, buildConfig, joinDeployment, lower, lowering, mergedProviders, resolveStateLayer };