@prisma/composer 0.1.0-dev.1

package/dist/deploy.mjs

@@ -0,0 +1,305 @@
+import { s as isParamSource, t as Load } from "./graph-BmrUEdo9-6Oq1hSmS.mjs";
+import * as Alchemy from "alchemy";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+//#region ../../0-framework/1-core/core/dist/deploy.mjs
+var LowerError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "LowerError";
+	}
+};
+/**
+* Resolves one SERVICE-OWN param to its config value. The full resolution
+* order across both value channels:
+*
+* 1. A param claiming BOTH a provision-time binding and a `provision` need
+*    (ADR-0031) is a loud error — two sources for one value.
+* 2. A provision-time binding (a schema-validated literal, or an opaque
+*    `ParamSource` the target resolves at boot per ADR-0019) beats the
+*    declared `default`.
+* 3. A framework-minted `provision` need is resolved per dependency EDGE
+*    against the consumer extension's registry — that path fills CONNECTION
+*    params in `buildConfig`'s inputs loop, never this function. A
+*    service-own param has no edge to mint against, so an unbound need here
+*    falls through like any unbound param.
+* 4. The `default`, else absent (only legal when `optional`), else a loud
+*    error naming the param, the service, and the fix.
+*/
+function resolveParam(node, serviceId, name, param, bound) {
+	if (bound !== void 0) {
+		if (param.provision !== void 0) throw new LowerError(`Param "${name}" of "${serviceId}" (service "${node.name}") has two sources claiming one value: a provision-time binding (${isParamSource(bound) ? "a param source" : "a literal value"}) AND a framework provision need ("${String(param.provision.brand)}") on its declaration — remove the binding or drop the \`provision\` facet.`);
+		if (isParamSource(bound)) return bound;
+		const result = param.schema["~standard"].validate(bound);
+		if (result instanceof Promise) throw new LowerError(`Param "${name}" of "${serviceId}" (service "${node.name}") uses an async Standard Schema — a provision-time literal value requires a synchronous validator.`);
+		if (result.issues !== void 0) {
+			const messages = result.issues.map((issue) => issue.message).join("; ");
+			throw new LowerError(`Param "${name}" of "${serviceId}" (service "${node.name}") received an invalid provision-time value: ${messages}`);
+		}
+		return result.value;
+	}
+	if (param.default !== void 0) return param.default;
+	if (param.optional === true) return void 0;
+	throw new LowerError(`Param "${name}" of "${serviceId}" (service "${node.name}") has no default, is not optional, and was not bound at provision — bind it with a literal value or a param source (e.g. envParam('NAME')) on its provision() call, or give it a default.`);
+}
+/**
+* Assembles a service's typed Config. Connection params come from the
+* dependency edge's lowered outputs — or, for a param carrying a `provision`
+* need (ADR-0031), from `provisioned` (keyed by edge id): the framework mints
+* it, the producer hands nothing over. The service's own params resolve via
+* `resolveParam` (provision-time binding, then default, then loud
+* unbound-required failure).
+*
+* This is also where the connection contract is enforced: a producer that fails to
+* supply a required param its consumer's connection declares fails the deploy
+* here, naming the edge, rather than reaching the consumer as `undefined`.
+*/
+function buildConfig(node, id, graph, lowered, provisioned) {
+	const inputs = {};
+	for (const [inputName, inputNode] of Object.entries(node.inputs)) {
+		const edge = graph.edges.find((e) => e.to === id && e.input === inputName && e.kind === "dependency");
+		const producedOutputs = edge !== void 0 ? lowered.get(edge.from) ?? {} : {};
+		const values = {};
+		for (const [name, param] of Object.entries(inputNode.connection.params)) {
+			if (param.provision !== void 0) {
+				values[name] = provisioned.get(`${id}.${inputName}`);
+				continue;
+			}
+			const value = producedOutputs[name];
+			if (value === void 0 && param.optional !== true && edge !== void 0) throw new LowerError(`Connection input "${id}.${inputName}" declares param "${name}", but its producer "${edge.from}" did not supply it — the producer's outputs carry [${Object.keys(producedOutputs).join(", ") || "nothing"}]. Add "${name}" to the outputs the producer returns from its lowering, or declare the param optional on the connection.`);
+			values[name] = value;
+		}
+		inputs[inputName] = values;
+	}
+	const boundParams = new Map(graph.params.filter((binding) => binding.serviceAddress === id).map((b) => [b.slot, b.binding]));
+	const service = {};
+	for (const [name, param] of Object.entries(node.params)) {
+		const value = resolveParam(node, id, name, param, boundParams.get(name));
+		if (value !== void 0) service[name] = value;
+	}
+	return {
+		service,
+		inputs
+	};
+}
+/**
+* Joins resolved report entries back to their graph nodes — the last step of a
+* deploy report, run inside the Action with apply's resolved values.
+*
+* The entries cross Alchemy's action-input boundary, so they carry addresses
+* and plain entities only; the graph is held by closure on this side. That
+* split is why this join exists at all, and it is what keeps functions and
+* Standard Schemas (which a node carries, and which the plan's input hash
+* would have to serialize) out of the input.
+*
+* Skips an address the graph no longer holds: entries are data, the graph is
+* truth.
+*/
+function joinDeployment(graph, entries) {
+	const nodes = [];
+	for (const entry of entries) {
+		const node = graph.nodes.find((n) => n.id === entry.address)?.node;
+		if (node === void 0 || node.kind !== "service" && node.kind !== "resource") continue;
+		nodes.push({
+			address: entry.address,
+			node,
+			entities: entry.entities
+		});
+	}
+	return nodes;
+}
+function missingBundleError(id) {
+	return new LowerError(`No bundle provided for service "${id}" (opts.bundles["${id}"] is required).`);
+}
+function duplicateExtensionError(id) {
+	return new LowerError(`Extension "${id}" is listed more than once in \`extensions\` — each extension id must be unique.`);
+}
+/** Registries as extension id → descriptor. Fails on a duplicate id — the CLI validates config, but lowering() is the programmatic escape hatch that doesn't. */
+function extensionsById(config) {
+	const map = /* @__PURE__ */ new Map();
+	for (const extension of config.extensions) {
+		if (map.has(extension.id)) return Effect.fail(duplicateExtensionError(extension.id));
+		map.set(extension.id, extension);
+	}
+	return Effect.succeed(map);
+}
+function unknownExtensionError(extension, id) {
+	return new LowerError(`No extension "${extension}" is configured (needed by node "${id}") — add it to prisma-composer.config.ts's \`extensions\` (import its /control entry and list its descriptor).`);
+}
+function unknownNodeTypeError(extension, type) {
+	return new LowerError(`Extension "${extension.id}" has no descriptor for node type "${type}" (known: ${Object.keys(extension.nodes).join(", ")}).`);
+}
+/** A provisioned param's need brand isn't registered by the consumer's extension (ADR-0031). */
+function unknownProvisionerError(extension, brand, edgeId) {
+	const known = extension.provisions !== void 0 && extension.provisions.size > 0 ? Array.from(extension.provisions.keys(), String).join(", ") : "(none registered)";
+	return new LowerError(`Extension "${extension.id}" has no provisioner for need "${String(brand)}" (needed by edge "${edgeId}") (known: ${known}).`);
+}
+/** A provisioned edge whose consumer and provider nodes belong to different extensions (ADR-0031). */
+function crossExtensionProvisionError(edgeId) {
+	return new LowerError(`Provisioned edge "${edgeId}" spans two extensions — cross-extension provisioned edges aren't supported yet.`);
+}
+/**
+* More than one provisioned param on one connection (ADR-0031). One edge mints
+* ONE value, keyed by edge id, so a second need on the same connection would
+* silently receive the first's value under the first's brand.
+*/
+function multipleProvisionedParamsError(edgeId, names) {
+	return new LowerError(`Connection input "${edgeId}" declares more than one provisioned param (${names.join(", ")}) — only one provisioned param per connection is supported.`);
+}
+function wrongKindError(extension, type, expected, got) {
+	return new LowerError(`Extension "${extension}"'s descriptor for node type "${type}" is a "${got}" descriptor — this node needs a "${expected}" descriptor.`);
+}
+/** Looks up one node's descriptor: extension by `node.extension`, then descriptor by `node.type`, then the kind check. */
+function descriptorFor(extensions, node, id) {
+	const extension = extensions.get(node.extension);
+	if (extension === void 0) return Effect.fail(unknownExtensionError(node.extension, id));
+	const descriptor = extension.nodes[node.type];
+	if (descriptor === void 0) return Effect.fail(unknownNodeTypeError(extension, node.type));
+	if (descriptor.kind !== node.kind) return Effect.fail(wrongKindError(node.extension, node.type, node.kind, descriptor.kind));
+	return Effect.succeed(descriptor);
+}
+/**
+* The state-layer precedence a deploy resolves to: an explicit opts.state
+* always wins; failing that, the config's own (required) state. A pure
+* function so the precedence is testable without booting Alchemy.
+*/
+function resolveStateLayer(opts, config) {
+	return opts.state ?? config.state();
+}
+/**
+* All configured extensions' providers merged, config array order — an
+* extension without `providers` is skipped; no used-extensions-only
+* filtering (ADR-0017's pinned providers rule).
+*/
+function mergedProviders(config) {
+	const [first, ...rest] = config.extensions.flatMap((extension) => extension.providers !== void 0 ? [extension.providers()] : []);
+	return first === void 0 ? Layer.empty : Layer.mergeAll(first, ...rest);
+}
+/**
+* Composable form for mixed stacks: hand-wired Alchemy resources alongside Prisma App nodes in one stack effect.
+* Fails with LowerError or whatever an extension's lowering raises — the error type is open.
+*/
+function lowering(root, config, opts) {
+	return Effect.gen(function* () {
+		const graph = Load(root, { id: opts.name });
+		const extensions = yield* extensionsById(config);
+		const lowered = /* @__PURE__ */ new Map();
+		const entries = [];
+		const provisioned = /* @__PURE__ */ new Map();
+		const applications = /* @__PURE__ */ new Map();
+		for (const descriptor of config.extensions) {
+			if (descriptor.application === void 0) continue;
+			const appCtx = {
+				id: graph.root.id,
+				address: "",
+				node: graph.root.node,
+				graph,
+				opts,
+				application: void 0,
+				lowered,
+				provisioned
+			};
+			applications.set(descriptor.id, yield* descriptor.application.provision(appCtx));
+		}
+		for (const edge of graph.edges) {
+			if (edge.kind !== "dependency") continue;
+			const consumer = graph.nodes.find((n) => n.id === edge.to)?.node;
+			if (consumer === void 0 || consumer.kind !== "service") continue;
+			const slot = consumer.inputs[edge.input];
+			if (slot === void 0) continue;
+			const provisionedParams = Object.entries(slot.connection.params).filter(([, param]) => param.provision !== void 0);
+			if (provisionedParams.length === 0) continue;
+			const edgeId = `${edge.to}.${edge.input}`;
+			if (provisionedParams.length > 1) return yield* Effect.fail(multipleProvisionedParamsError(edgeId, provisionedParams.map(([name]) => name)));
+			const need = provisionedParams[0]?.[1].provision;
+			if (need === void 0) continue;
+			const provider = graph.nodes.find((n) => n.id === edge.from)?.node;
+			if (provider === void 0 || provider.kind !== "service" && provider.kind !== "resource") continue;
+			if (consumer.extension !== provider.extension) return yield* Effect.fail(crossExtensionProvisionError(edgeId));
+			const extension = extensions.get(consumer.extension);
+			if (extension === void 0) return yield* Effect.fail(unknownExtensionError(consumer.extension, edge.to));
+			const provisioner = extension.provisions?.get(need.brand);
+			if (provisioner === void 0) return yield* Effect.fail(unknownProvisionerError(extension, need.brand, edgeId));
+			const ref = yield* provisioner.provision({
+				edgeId,
+				consumerAddress: edge.to,
+				providerAddress: edge.from,
+				input: edge.input,
+				need
+			});
+			provisioned.set(edgeId, ref);
+		}
+		for (const { id, node } of graph.nodes) {
+			if (node.kind === "module") continue;
+			if (node.kind === "dependency") continue;
+			const ctx = {
+				id,
+				address: id,
+				node,
+				graph,
+				opts,
+				application: applications.get(node.extension),
+				lowered,
+				provisioned
+			};
+			const descriptor = yield* descriptorFor(extensions, node, id);
+			if (descriptor.kind === "resource") {
+				const result = yield* descriptor(ctx);
+				lowered.set(id, result.outputs);
+				entries.push({
+					address: id,
+					entities: result.entities
+				});
+				continue;
+			}
+			if (descriptor.kind !== "service") return yield* Effect.fail(wrongKindError(node.extension, node.type, node.kind, descriptor.kind));
+			const service = node;
+			const provisionedNode = yield* descriptor.provision(ctx);
+			const typedConfig = buildConfig(service, id, graph, lowered, provisioned);
+			const serialized = yield* descriptor.serialize(ctx, provisionedNode, typedConfig);
+			const bundle = opts.bundles[id];
+			if (bundle === void 0) return yield* Effect.fail(missingBundleError(id));
+			const artifact = yield* descriptor.package(ctx, {
+				assembled: {
+					dir: bundle.dir,
+					entry: bundle.entry
+				},
+				address: id
+			});
+			const result = yield* descriptor.deploy(ctx, provisionedNode, artifact, serialized);
+			lowered.set(id, result.outputs);
+			entries.push({
+				address: id,
+				entities: result.entities
+			});
+		}
+		if (opts.report !== void 0) {
+			const report = opts.report;
+			yield* Alchemy.Action("composer-deployment-report", (input) => Effect.sync(() => {
+				report({
+					app: opts.name,
+					nodes: joinDeployment(graph, input.entries)
+				});
+			}))({
+				nonce: Date.now(),
+				entries
+			});
+		}
+	});
+}
+/**
+* The whole-stack wrapper: Load → route each node through the config's
+* extension registries → an Alchemy Stack (the default export the alchemy
+* CLI consumes).
+*/
+function lower(root, config, opts) {
+	const stackEffect = Effect.orDie(lowering(root, config, opts));
+	return Alchemy.Stack(opts.name, {
+		providers: mergedProviders(config),
+		state: resolveStateLayer(opts, config)
+	}, stackEffect);
+}
+//#endregion
+export { LowerError, buildConfig, joinDeployment, lower, lowering, mergedProviders, resolveStateLayer };
+
+//# sourceMappingURL=deploy.mjs.map

package/dist/deploy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../../0-framework/1-core/core/dist/deploy.mjs"],"sourcesContent":["import { o as isParamSource, t as Load } from \"./graph-BmrUEdo9.mjs\";\nimport * as Alchemy from \"alchemy\";\nimport * as Effect from \"effect/Effect\";\nimport * as Layer from \"effect/Layer\";\n//#region src/deploy.ts\nvar LowerError = class extends Error {\n\tconstructor(message) {\n\t\tsuper(message);\n\t\tthis.name = \"LowerError\";\n\t}\n};\n/**\n* Resolves one SERVICE-OWN param to its config value. The full resolution\n* order across both value channels:\n*\n* 1. A param claiming BOTH a provision-time binding and a `provision` need\n*    (ADR-0031) is a loud error — two sources for one value.\n* 2. A provision-time binding (a schema-validated literal, or an opaque\n*    `ParamSource` the target resolves at boot per ADR-0019) beats the\n*    declared `default`.\n* 3. A framework-minted `provision` need is resolved per dependency EDGE\n*    against the consumer extension's registry — that path fills CONNECTION\n*    params in `buildConfig`'s inputs loop, never this function. A\n*    service-own param has no edge to mint against, so an unbound need here\n*    falls through like any unbound param.\n* 4. The `default`, else absent (only legal when `optional`), else a loud\n*    error naming the param, the service, and the fix.\n*/\nfunction resolveParam(node, serviceId, name, param, bound) {\n\tif (bound !== void 0) {\n\t\tif (param.provision !== void 0) throw new LowerError(`Param \"${name}\" of \"${serviceId}\" (service \"${node.name}\") has two sources claiming one value: a provision-time binding (${isParamSource(bound) ? \"a param source\" : \"a literal value\"}) AND a framework provision need (\"${String(param.provision.brand)}\") on its declaration — remove the binding or drop the \\`provision\\` facet.`);\n\t\tif (isParamSource(bound)) return bound;\n\t\tconst result = param.schema[\"~standard\"].validate(bound);\n\t\tif (result instanceof Promise) throw new LowerError(`Param \"${name}\" of \"${serviceId}\" (service \"${node.name}\") uses an async Standard Schema — a provision-time literal value requires a synchronous validator.`);\n\t\tif (result.issues !== void 0) {\n\t\t\tconst messages = result.issues.map((issue) => issue.message).join(\"; \");\n\t\t\tthrow new LowerError(`Param \"${name}\" of \"${serviceId}\" (service \"${node.name}\") received an invalid provision-time value: ${messages}`);\n\t\t}\n\t\treturn result.value;\n\t}\n\tif (param.default !== void 0) return param.default;\n\tif (param.optional === true) return void 0;\n\tthrow new LowerError(`Param \"${name}\" of \"${serviceId}\" (service \"${node.name}\") has no default, is not optional, and was not bound at provision — bind it with a literal value or a param source (e.g. envParam('NAME')) on its provision() call, or give it a default.`);\n}\n/**\n* Assembles a service's typed Config. Connection params come from the\n* dependency edge's lowered outputs — or, for a param carrying a `provision`\n* need (ADR-0031), from `provisioned` (keyed by edge id): the framework mints\n* it, the producer hands nothing over. The service's own params resolve via\n* `resolveParam` (provision-time binding, then default, then loud\n* unbound-required failure).\n*\n* This is also where the connection contract is enforced: a producer that fails to\n* supply a required param its consumer's connection declares fails the deploy\n* here, naming the edge, rather than reaching the consumer as `undefined`.\n*/\nfunction buildConfig(node, id, graph, lowered, provisioned) {\n\tconst inputs = {};\n\tfor (const [inputName, inputNode] of Object.entries(node.inputs)) {\n\t\tconst edge = graph.edges.find((e) => e.to === id && e.input === inputName && e.kind === \"dependency\");\n\t\tconst producedOutputs = edge !== void 0 ? lowered.get(edge.from) ?? {} : {};\n\t\tconst values = {};\n\t\tfor (const [name, param] of Object.entries(inputNode.connection.params)) {\n\t\t\tif (param.provision !== void 0) {\n\t\t\t\tvalues[name] = provisioned.get(`${id}.${inputName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst value = producedOutputs[name];\n\t\t\tif (value === void 0 && param.optional !== true && edge !== void 0) throw new LowerError(`Connection input \"${id}.${inputName}\" declares param \"${name}\", but its producer \"${edge.from}\" did not supply it — the producer's outputs carry [${Object.keys(producedOutputs).join(\", \") || \"nothing\"}]. Add \"${name}\" to the outputs the producer returns from its lowering, or declare the param optional on the connection.`);\n\t\t\tvalues[name] = value;\n\t\t}\n\t\tinputs[inputName] = values;\n\t}\n\tconst boundParams = new Map(graph.params.filter((binding) => binding.serviceAddress === id).map((b) => [b.slot, b.binding]));\n\tconst service = {};\n\tfor (const [name, param] of Object.entries(node.params)) {\n\t\tconst value = resolveParam(node, id, name, param, boundParams.get(name));\n\t\tif (value !== void 0) service[name] = value;\n\t}\n\treturn {\n\t\tservice,\n\t\tinputs\n\t};\n}\n/**\n* Joins resolved report entries back to their graph nodes — the last step of a\n* deploy report, run inside the Action with apply's resolved values.\n*\n* The entries cross Alchemy's action-input boundary, so they carry addresses\n* and plain entities only; the graph is held by closure on this side. That\n* split is why this join exists at all, and it is what keeps functions and\n* Standard Schemas (which a node carries, and which the plan's input hash\n* would have to serialize) out of the input.\n*\n* Skips an address the graph no longer holds: entries are data, the graph is\n* truth.\n*/\nfunction joinDeployment(graph, entries) {\n\tconst nodes = [];\n\tfor (const entry of entries) {\n\t\tconst node = graph.nodes.find((n) => n.id === entry.address)?.node;\n\t\tif (node === void 0 || node.kind !== \"service\" && node.kind !== \"resource\") continue;\n\t\tnodes.push({\n\t\t\taddress: entry.address,\n\t\t\tnode,\n\t\t\tentities: entry.entities\n\t\t});\n\t}\n\treturn nodes;\n}\nfunction missingBundleError(id) {\n\treturn new LowerError(`No bundle provided for service \"${id}\" (opts.bundles[\"${id}\"] is required).`);\n}\nfunction duplicateExtensionError(id) {\n\treturn new LowerError(`Extension \"${id}\" is listed more than once in \\`extensions\\` — each extension id must be unique.`);\n}\n/** Registries as extension id → descriptor. Fails on a duplicate id — the CLI validates config, but lowering() is the programmatic escape hatch that doesn't. */\nfunction extensionsById(config) {\n\tconst map = /* @__PURE__ */ new Map();\n\tfor (const extension of config.extensions) {\n\t\tif (map.has(extension.id)) return Effect.fail(duplicateExtensionError(extension.id));\n\t\tmap.set(extension.id, extension);\n\t}\n\treturn Effect.succeed(map);\n}\nfunction unknownExtensionError(extension, id) {\n\treturn new LowerError(`No extension \"${extension}\" is configured (needed by node \"${id}\") — add it to prisma-composer.config.ts's \\`extensions\\` (import its /control entry and list its descriptor).`);\n}\nfunction unknownNodeTypeError(extension, type) {\n\treturn new LowerError(`Extension \"${extension.id}\" has no descriptor for node type \"${type}\" (known: ${Object.keys(extension.nodes).join(\", \")}).`);\n}\n/** A provisioned param's need brand isn't registered by the consumer's extension (ADR-0031). */\nfunction unknownProvisionerError(extension, brand, edgeId) {\n\tconst known = extension.provisions !== void 0 && extension.provisions.size > 0 ? Array.from(extension.provisions.keys(), String).join(\", \") : \"(none registered)\";\n\treturn new LowerError(`Extension \"${extension.id}\" has no provisioner for need \"${String(brand)}\" (needed by edge \"${edgeId}\") (known: ${known}).`);\n}\n/** A provisioned edge whose consumer and provider nodes belong to different extensions (ADR-0031). */\nfunction crossExtensionProvisionError(edgeId) {\n\treturn new LowerError(`Provisioned edge \"${edgeId}\" spans two extensions — cross-extension provisioned edges aren't supported yet.`);\n}\n/**\n* More than one provisioned param on one connection (ADR-0031). One edge mints\n* ONE value, keyed by edge id, so a second need on the same connection would\n* silently receive the first's value under the first's brand.\n*/\nfunction multipleProvisionedParamsError(edgeId, names) {\n\treturn new LowerError(`Connection input \"${edgeId}\" declares more than one provisioned param (${names.join(\", \")}) — only one provisioned param per connection is supported.`);\n}\nfunction wrongKindError(extension, type, expected, got) {\n\treturn new LowerError(`Extension \"${extension}\"'s descriptor for node type \"${type}\" is a \"${got}\" descriptor — this node needs a \"${expected}\" descriptor.`);\n}\n/** Looks up one node's descriptor: extension by `node.extension`, then descriptor by `node.type`, then the kind check. */\nfunction descriptorFor(extensions, node, id) {\n\tconst extension = extensions.get(node.extension);\n\tif (extension === void 0) return Effect.fail(unknownExtensionError(node.extension, id));\n\tconst descriptor = extension.nodes[node.type];\n\tif (descriptor === void 0) return Effect.fail(unknownNodeTypeError(extension, node.type));\n\tif (descriptor.kind !== node.kind) return Effect.fail(wrongKindError(node.extension, node.type, node.kind, descriptor.kind));\n\treturn Effect.succeed(descriptor);\n}\n/**\n* The state-layer precedence a deploy resolves to: an explicit opts.state\n* always wins; failing that, the config's own (required) state. A pure\n* function so the precedence is testable without booting Alchemy.\n*/\nfunction resolveStateLayer(opts, config) {\n\treturn opts.state ?? config.state();\n}\n/**\n* All configured extensions' providers merged, config array order — an\n* extension without `providers` is skipped; no used-extensions-only\n* filtering (ADR-0017's pinned providers rule).\n*/\nfunction mergedProviders(config) {\n\tconst [first, ...rest] = config.extensions.flatMap((extension) => extension.providers !== void 0 ? [extension.providers()] : []);\n\treturn first === void 0 ? Layer.empty : Layer.mergeAll(first, ...rest);\n}\n/**\n* Composable form for mixed stacks: hand-wired Alchemy resources alongside Prisma App nodes in one stack effect.\n* Fails with LowerError or whatever an extension's lowering raises — the error type is open.\n*/\nfunction lowering(root, config, opts) {\n\treturn Effect.gen(function* () {\n\t\tconst graph = Load(root, { id: opts.name });\n\t\tconst extensions = yield* extensionsById(config);\n\t\tconst lowered = /* @__PURE__ */ new Map();\n\t\tconst entries = [];\n\t\tconst provisioned = /* @__PURE__ */ new Map();\n\t\tconst applications = /* @__PURE__ */ new Map();\n\t\tfor (const descriptor of config.extensions) {\n\t\t\tif (descriptor.application === void 0) continue;\n\t\t\tconst appCtx = {\n\t\t\t\tid: graph.root.id,\n\t\t\t\taddress: \"\",\n\t\t\t\tnode: graph.root.node,\n\t\t\t\tgraph,\n\t\t\t\topts,\n\t\t\t\tapplication: void 0,\n\t\t\t\tlowered,\n\t\t\t\tprovisioned\n\t\t\t};\n\t\t\tapplications.set(descriptor.id, yield* descriptor.application.provision(appCtx));\n\t\t}\n\t\tfor (const edge of graph.edges) {\n\t\t\tif (edge.kind !== \"dependency\") continue;\n\t\t\tconst consumer = graph.nodes.find((n) => n.id === edge.to)?.node;\n\t\t\tif (consumer === void 0 || consumer.kind !== \"service\") continue;\n\t\t\tconst slot = consumer.inputs[edge.input];\n\t\t\tif (slot === void 0) continue;\n\t\t\tconst provisionedParams = Object.entries(slot.connection.params).filter(([, param]) => param.provision !== void 0);\n\t\t\tif (provisionedParams.length === 0) continue;\n\t\t\tconst edgeId = `${edge.to}.${edge.input}`;\n\t\t\tif (provisionedParams.length > 1) return yield* Effect.fail(multipleProvisionedParamsError(edgeId, provisionedParams.map(([name]) => name)));\n\t\t\tconst need = provisionedParams[0]?.[1].provision;\n\t\t\tif (need === void 0) continue;\n\t\t\tconst provider = graph.nodes.find((n) => n.id === edge.from)?.node;\n\t\t\tif (provider === void 0 || provider.kind !== \"service\" && provider.kind !== \"resource\") continue;\n\t\t\tif (consumer.extension !== provider.extension) return yield* Effect.fail(crossExtensionProvisionError(edgeId));\n\t\t\tconst extension = extensions.get(consumer.extension);\n\t\t\tif (extension === void 0) return yield* Effect.fail(unknownExtensionError(consumer.extension, edge.to));\n\t\t\tconst provisioner = extension.provisions?.get(need.brand);\n\t\t\tif (provisioner === void 0) return yield* Effect.fail(unknownProvisionerError(extension, need.brand, edgeId));\n\t\t\tconst ref = yield* provisioner.provision({\n\t\t\t\tedgeId,\n\t\t\t\tconsumerAddress: edge.to,\n\t\t\t\tproviderAddress: edge.from,\n\t\t\t\tinput: edge.input,\n\t\t\t\tneed\n\t\t\t});\n\t\t\tprovisioned.set(edgeId, ref);\n\t\t}\n\t\tfor (const { id, node } of graph.nodes) {\n\t\t\tif (node.kind === \"module\") continue;\n\t\t\tif (node.kind === \"dependency\") continue;\n\t\t\tconst ctx = {\n\t\t\t\tid,\n\t\t\t\taddress: id,\n\t\t\t\tnode,\n\t\t\t\tgraph,\n\t\t\t\topts,\n\t\t\t\tapplication: applications.get(node.extension),\n\t\t\t\tlowered,\n\t\t\t\tprovisioned\n\t\t\t};\n\t\t\tconst descriptor = yield* descriptorFor(extensions, node, id);\n\t\t\tif (descriptor.kind === \"resource\") {\n\t\t\t\tconst result = yield* descriptor(ctx);\n\t\t\t\tlowered.set(id, result.outputs);\n\t\t\t\tentries.push({\n\t\t\t\t\taddress: id,\n\t\t\t\t\tentities: result.entities\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (descriptor.kind !== \"service\") return yield* Effect.fail(wrongKindError(node.extension, node.type, node.kind, descriptor.kind));\n\t\t\tconst service = node;\n\t\t\tconst provisionedNode = yield* descriptor.provision(ctx);\n\t\t\tconst typedConfig = buildConfig(service, id, graph, lowered, provisioned);\n\t\t\tconst serialized = yield* descriptor.serialize(ctx, provisionedNode, typedConfig);\n\t\t\tconst bundle = opts.bundles[id];\n\t\t\tif (bundle === void 0) return yield* Effect.fail(missingBundleError(id));\n\t\t\tconst artifact = yield* descriptor.package(ctx, {\n\t\t\t\tassembled: {\n\t\t\t\t\tdir: bundle.dir,\n\t\t\t\t\tentry: bundle.entry\n\t\t\t\t},\n\t\t\t\taddress: id\n\t\t\t});\n\t\t\tconst result = yield* descriptor.deploy(ctx, provisionedNode, artifact, serialized);\n\t\t\tlowered.set(id, result.outputs);\n\t\t\tentries.push({\n\t\t\t\taddress: id,\n\t\t\t\tentities: result.entities\n\t\t\t});\n\t\t}\n\t\tif (opts.report !== void 0) {\n\t\t\tconst report = opts.report;\n\t\t\tyield* Alchemy.Action(\"composer-deployment-report\", (input) => Effect.sync(() => {\n\t\t\t\treport({\n\t\t\t\t\tapp: opts.name,\n\t\t\t\t\tnodes: joinDeployment(graph, input.entries)\n\t\t\t\t});\n\t\t\t}))({\n\t\t\t\tnonce: Date.now(),\n\t\t\t\tentries\n\t\t\t});\n\t\t}\n\t});\n}\n/**\n* The whole-stack wrapper: Load → route each node through the config's\n* extension registries → an Alchemy Stack (the default export the alchemy\n* CLI consumes).\n*/\nfunction lower(root, config, opts) {\n\tconst stackEffect = Effect.orDie(lowering(root, config, opts));\n\treturn Alchemy.Stack(opts.name, {\n\t\tproviders: mergedProviders(config),\n\t\tstate: resolveStateLayer(opts, config)\n\t}, stackEffect);\n}\n//#endregion\nexport { LowerError, buildConfig, joinDeployment, lower, lowering, mergedProviders, resolveStateLayer };\n\n//# sourceMappingURL=deploy.mjs.map"],"mappings":";;;;;AAKA,IAAI,aAAa,cAAc,MAAM;CACpC,YAAY,SAAS;EACpB,MAAM,OAAO;EACb,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;;;;;;AAkBA,SAAS,aAAa,MAAM,WAAW,MAAM,OAAO,OAAO;CAC1D,IAAI,UAAU,KAAK,GAAG;EACrB,IAAI,MAAM,cAAc,KAAK,GAAG,MAAM,IAAI,WAAW,UAAU,KAAK,QAAQ,UAAU,cAAc,KAAK,KAAK,mEAAmE,cAAc,KAAK,IAAI,mBAAmB,kBAAkB,qCAAqC,OAAO,MAAM,UAAU,KAAK,EAAE,4EAA4E;EAC5X,IAAI,cAAc,KAAK,GAAG,OAAO;EACjC,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,SAAS,KAAK;EACvD,IAAI,kBAAkB,SAAS,MAAM,IAAI,WAAW,UAAU,KAAK,QAAQ,UAAU,cAAc,KAAK,KAAK,oGAAoG;EACjN,IAAI,OAAO,WAAW,KAAK,GAAG;GAC7B,MAAM,WAAW,OAAO,OAAO,KAAK,UAAU,MAAM,OAAO,CAAC,CAAC,KAAK,IAAI;GACtE,MAAM,IAAI,WAAW,UAAU,KAAK,QAAQ,UAAU,cAAc,KAAK,KAAK,+CAA+C,UAAU;EACxI;EACA,OAAO,OAAO;CACf;CACA,IAAI,MAAM,YAAY,KAAK,GAAG,OAAO,MAAM;CAC3C,IAAI,MAAM,aAAa,MAAM,OAAO,KAAK;CACzC,MAAM,IAAI,WAAW,UAAU,KAAK,QAAQ,UAAU,cAAc,KAAK,KAAK,2LAA2L;AAC1Q;;;;;;;;;;;;;AAaA,SAAS,YAAY,MAAM,IAAI,OAAO,SAAS,aAAa;CAC3D,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,CAAC,WAAW,cAAc,OAAO,QAAQ,KAAK,MAAM,GAAG;EACjE,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,EAAE,OAAO,MAAM,EAAE,UAAU,aAAa,EAAE,SAAS,YAAY;EACpG,MAAM,kBAAkB,SAAS,KAAK,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC;EAC1E,MAAM,SAAS,CAAC;EAChB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,UAAU,WAAW,MAAM,GAAG;GACxE,IAAI,MAAM,cAAc,KAAK,GAAG;IAC/B,OAAO,QAAQ,YAAY,IAAI,GAAG,GAAG,GAAG,WAAW;IACnD;GACD;GACA,MAAM,QAAQ,gBAAgB;GAC9B,IAAI,UAAU,KAAK,KAAK,MAAM,aAAa,QAAQ,SAAS,KAAK,GAAG,MAAM,IAAI,WAAW,qBAAqB,GAAG,GAAG,UAAU,oBAAoB,KAAK,uBAAuB,KAAK,KAAK,sDAAsD,OAAO,KAAK,eAAe,CAAC,CAAC,KAAK,IAAI,KAAK,UAAU,UAAU,KAAK,0GAA0G;GAC5Z,OAAO,QAAQ;EAChB;EACA,OAAO,aAAa;CACrB;CACA,MAAM,cAAc,IAAI,IAAI,MAAM,OAAO,QAAQ,YAAY,QAAQ,mBAAmB,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3H,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG;EACxD,MAAM,QAAQ,aAAa,MAAM,IAAI,MAAM,OAAO,YAAY,IAAI,IAAI,CAAC;EACvE,IAAI,UAAU,KAAK,GAAG,QAAQ,QAAQ;CACvC;CACA,OAAO;EACN;EACA;CACD;AACD;;;;;;;;;;;;;;AAcA,SAAS,eAAe,OAAO,SAAS;CACvC,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,SAAS,SAAS;EAC5B,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,EAAE,OAAO,MAAM,OAAO,CAAC,EAAE;EAC9D,IAAI,SAAS,KAAK,KAAK,KAAK,SAAS,aAAa,KAAK,SAAS,YAAY;EAC5E,MAAM,KAAK;GACV,SAAS,MAAM;GACf;GACA,UAAU,MAAM;EACjB,CAAC;CACF;CACA,OAAO;AACR;AACA,SAAS,mBAAmB,IAAI;CAC/B,OAAO,IAAI,WAAW,mCAAmC,GAAG,mBAAmB,GAAG,iBAAiB;AACpG;AACA,SAAS,wBAAwB,IAAI;CACpC,OAAO,IAAI,WAAW,cAAc,GAAG,iFAAiF;AACzH;;AAEA,SAAS,eAAe,QAAQ;CAC/B,MAAM,sBAAsB,IAAI,IAAI;CACpC,KAAK,MAAM,aAAa,OAAO,YAAY;EAC1C,IAAI,IAAI,IAAI,UAAU,EAAE,GAAG,OAAO,OAAO,KAAK,wBAAwB,UAAU,EAAE,CAAC;EACnF,IAAI,IAAI,UAAU,IAAI,SAAS;CAChC;CACA,OAAO,OAAO,QAAQ,GAAG;AAC1B;AACA,SAAS,sBAAsB,WAAW,IAAI;CAC7C,OAAO,IAAI,WAAW,iBAAiB,UAAU,mCAAmC,GAAG,+GAA+G;AACvM;AACA,SAAS,qBAAqB,WAAW,MAAM;CAC9C,OAAO,IAAI,WAAW,cAAc,UAAU,GAAG,qCAAqC,KAAK,YAAY,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,GAAG;AACnJ;;AAEA,SAAS,wBAAwB,WAAW,OAAO,QAAQ;CAC1D,MAAM,QAAQ,UAAU,eAAe,KAAK,KAAK,UAAU,WAAW,OAAO,IAAI,MAAM,KAAK,UAAU,WAAW,KAAK,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI,IAAI;CAC9I,OAAO,IAAI,WAAW,cAAc,UAAU,GAAG,iCAAiC,OAAO,KAAK,EAAE,qBAAqB,OAAO,aAAa,MAAM,GAAG;AACnJ;;AAEA,SAAS,6BAA6B,QAAQ;CAC7C,OAAO,IAAI,WAAW,qBAAqB,OAAO,iFAAiF;AACpI;;;;;;AAMA,SAAS,+BAA+B,QAAQ,OAAO;CACtD,OAAO,IAAI,WAAW,qBAAqB,OAAO,8CAA8C,MAAM,KAAK,IAAI,EAAE,4DAA4D;AAC9K;AACA,SAAS,eAAe,WAAW,MAAM,UAAU,KAAK;CACvD,OAAO,IAAI,WAAW,cAAc,UAAU,gCAAgC,KAAK,UAAU,IAAI,oCAAoC,SAAS,cAAc;AAC7J;;AAEA,SAAS,cAAc,YAAY,MAAM,IAAI;CAC5C,MAAM,YAAY,WAAW,IAAI,KAAK,SAAS;CAC/C,IAAI,cAAc,KAAK,GAAG,OAAO,OAAO,KAAK,sBAAsB,KAAK,WAAW,EAAE,CAAC;CACtF,MAAM,aAAa,UAAU,MAAM,KAAK;CACxC,IAAI,eAAe,KAAK,GAAG,OAAO,OAAO,KAAK,qBAAqB,WAAW,KAAK,IAAI,CAAC;CACxF,IAAI,WAAW,SAAS,KAAK,MAAM,OAAO,OAAO,KAAK,eAAe,KAAK,WAAW,KAAK,MAAM,KAAK,MAAM,WAAW,IAAI,CAAC;CAC3H,OAAO,OAAO,QAAQ,UAAU;AACjC;;;;;;AAMA,SAAS,kBAAkB,MAAM,QAAQ;CACxC,OAAO,KAAK,SAAS,OAAO,MAAM;AACnC;;;;;;AAMA,SAAS,gBAAgB,QAAQ;CAChC,MAAM,CAAC,OAAO,GAAG,QAAQ,OAAO,WAAW,SAAS,cAAc,UAAU,cAAc,KAAK,IAAI,CAAC,UAAU,UAAU,CAAC,IAAI,CAAC,CAAC;CAC/H,OAAO,UAAU,KAAK,IAAI,MAAM,QAAQ,MAAM,SAAS,OAAO,GAAG,IAAI;AACtE;;;;;AAKA,SAAS,SAAS,MAAM,QAAQ,MAAM;CACrC,OAAO,OAAO,IAAI,aAAa;EAC9B,MAAM,QAAQ,KAAK,MAAM,EAAE,IAAI,KAAK,KAAK,CAAC;EAC1C,MAAM,aAAa,OAAO,eAAe,MAAM;EAC/C,MAAM,0BAA0B,IAAI,IAAI;EACxC,MAAM,UAAU,CAAC;EACjB,MAAM,8BAA8B,IAAI,IAAI;EAC5C,MAAM,+BAA+B,IAAI,IAAI;EAC7C,KAAK,MAAM,cAAc,OAAO,YAAY;GAC3C,IAAI,WAAW,gBAAgB,KAAK,GAAG;GACvC,MAAM,SAAS;IACd,IAAI,MAAM,KAAK;IACf,SAAS;IACT,MAAM,MAAM,KAAK;IACjB;IACA;IACA,aAAa,KAAK;IAClB;IACA;GACD;GACA,aAAa,IAAI,WAAW,IAAI,OAAO,WAAW,YAAY,UAAU,MAAM,CAAC;EAChF;EACA,KAAK,MAAM,QAAQ,MAAM,OAAO;GAC/B,IAAI,KAAK,SAAS,cAAc;GAChC,MAAM,WAAW,MAAM,MAAM,MAAM,MAAM,EAAE,OAAO,KAAK,EAAE,CAAC,EAAE;GAC5D,IAAI,aAAa,KAAK,KAAK,SAAS,SAAS,WAAW;GACxD,MAAM,OAAO,SAAS,OAAO,KAAK;GAClC,IAAI,SAAS,KAAK,GAAG;GACrB,MAAM,oBAAoB,OAAO,QAAQ,KAAK,WAAW,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,MAAM,cAAc,KAAK,CAAC;GACjH,IAAI,kBAAkB,WAAW,GAAG;GACpC,MAAM,SAAS,GAAG,KAAK,GAAG,GAAG,KAAK;GAClC,IAAI,kBAAkB,SAAS,GAAG,OAAO,OAAO,OAAO,KAAK,+BAA+B,QAAQ,kBAAkB,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;GAC3I,MAAM,OAAO,kBAAkB,EAAE,GAAG,EAAE,CAAC;GACvC,IAAI,SAAS,KAAK,GAAG;GACrB,MAAM,WAAW,MAAM,MAAM,MAAM,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,EAAE;GAC9D,IAAI,aAAa,KAAK,KAAK,SAAS,SAAS,aAAa,SAAS,SAAS,YAAY;GACxF,IAAI,SAAS,cAAc,SAAS,WAAW,OAAO,OAAO,OAAO,KAAK,6BAA6B,MAAM,CAAC;GAC7G,MAAM,YAAY,WAAW,IAAI,SAAS,SAAS;GACnD,IAAI,cAAc,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,sBAAsB,SAAS,WAAW,KAAK,EAAE,CAAC;GACtG,MAAM,cAAc,UAAU,YAAY,IAAI,KAAK,KAAK;GACxD,IAAI,gBAAgB,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,wBAAwB,WAAW,KAAK,OAAO,MAAM,CAAC;GAC5G,MAAM,MAAM,OAAO,YAAY,UAAU;IACxC;IACA,iBAAiB,KAAK;IACtB,iBAAiB,KAAK;IACtB,OAAO,KAAK;IACZ;GACD,CAAC;GACD,YAAY,IAAI,QAAQ,GAAG;EAC5B;EACA,KAAK,MAAM,EAAE,IAAI,UAAU,MAAM,OAAO;GACvC,IAAI,KAAK,SAAS,UAAU;GAC5B,IAAI,KAAK,SAAS,cAAc;GAChC,MAAM,MAAM;IACX;IACA,SAAS;IACT;IACA;IACA;IACA,aAAa,aAAa,IAAI,KAAK,SAAS;IAC5C;IACA;GACD;GACA,MAAM,aAAa,OAAO,cAAc,YAAY,MAAM,EAAE;GAC5D,IAAI,WAAW,SAAS,YAAY;IACnC,MAAM,SAAS,OAAO,WAAW,GAAG;IACpC,QAAQ,IAAI,IAAI,OAAO,OAAO;IAC9B,QAAQ,KAAK;KACZ,SAAS;KACT,UAAU,OAAO;IAClB,CAAC;IACD;GACD;GACA,IAAI,WAAW,SAAS,WAAW,OAAO,OAAO,OAAO,KAAK,eAAe,KAAK,WAAW,KAAK,MAAM,KAAK,MAAM,WAAW,IAAI,CAAC;GAClI,MAAM,UAAU;GAChB,MAAM,kBAAkB,OAAO,WAAW,UAAU,GAAG;GACvD,MAAM,cAAc,YAAY,SAAS,IAAI,OAAO,SAAS,WAAW;GACxE,MAAM,aAAa,OAAO,WAAW,UAAU,KAAK,iBAAiB,WAAW;GAChF,MAAM,SAAS,KAAK,QAAQ;GAC5B,IAAI,WAAW,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,mBAAmB,EAAE,CAAC;GACvE,MAAM,WAAW,OAAO,WAAW,QAAQ,KAAK;IAC/C,WAAW;KACV,KAAK,OAAO;KACZ,OAAO,OAAO;IACf;IACA,SAAS;GACV,CAAC;GACD,MAAM,SAAS,OAAO,WAAW,OAAO,KAAK,iBAAiB,UAAU,UAAU;GAClF,QAAQ,IAAI,IAAI,OAAO,OAAO;GAC9B,QAAQ,KAAK;IACZ,SAAS;IACT,UAAU,OAAO;GAClB,CAAC;EACF;EACA,IAAI,KAAK,WAAW,KAAK,GAAG;GAC3B,MAAM,SAAS,KAAK;GACpB,OAAO,QAAQ,OAAO,+BAA+B,UAAU,OAAO,WAAW;IAChF,OAAO;KACN,KAAK,KAAK;KACV,OAAO,eAAe,OAAO,MAAM,OAAO;IAC3C,CAAC;GACF,CAAC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,IAAI;IAChB;GACD,CAAC;EACF;CACD,CAAC;AACF;;;;;;AAMA,SAAS,MAAM,MAAM,QAAQ,MAAM;CAClC,MAAM,cAAc,OAAO,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC;CAC7D,OAAO,QAAQ,MAAM,KAAK,MAAM;EAC/B,WAAW,gBAAgB,MAAM;EACjC,OAAO,kBAAkB,MAAM,MAAM;CACtC,GAAG,WAAW;AACf"}

package/dist/dist-B0axxnBf.mjs

@@ -0,0 +1,193 @@
+import { t as blindCast } from "./casts-Ci5rYYaR.mjs";
+import "./graph-BmrUEdo9-6Oq1hSmS.mjs";
+//#region ../../0-framework/0-foundation/foundation/dist/secret.mjs
+/**
+* A value wrapper that redacts everywhere except the one explicit reader,
+* `expose()`. Sensitivity is carried by the TYPE (`SecretBox<T>`), not a flag a
+* sink must remember to check: `String(box)`, template interpolation,
+* `JSON.stringify`, and `console.log`/`util.inspect` all print `[REDACTED]`, so
+* a secret can't leak through an accidental log or serialization.
+*
+* Shape matches the platform's own `secrecy` type (pdp-control-plane). The class
+* is nominal enough on its own — no phantom brand.
+*/
+const REDACTED = "[REDACTED]";
+var SecretBox = class {
+	#value;
+	constructor(value) {
+		this.#value = value;
+	}
+	/** The sole explicit door to the wrapped value. */
+	expose() {
+		return this.#value;
+	}
+	toString() {
+		return REDACTED;
+	}
+	toJSON() {
+		return REDACTED;
+	}
+	valueOf() {
+		return REDACTED;
+	}
+	[Symbol.toPrimitive]() {
+		return REDACTED;
+	}
+	[Symbol.for("nodejs.util.inspect.custom")]() {
+		return REDACTED;
+	}
+};
+//#endregion
+//#region ../../0-framework/1-core/core/dist/index.mjs
+/**
+* A data-only descriptor of a param's schema for introspection — the
+* validator's vendor tag, never the schema's own `validate`. `configOf`
+* reports it where the old model reported `type: 'string' | 'number'`, so the
+* config surface stays enumerable without leaking a function. Nothing consumes
+* more than the vendor tag yet; a richer projection (e.g. a JSON-Schema export
+* when the vendor offers one) is an additive change if a consumer needs it.
+*/
+function projectSchema(schema) {
+	return { vendor: schema["~standard"].vendor };
+}
+/**
+* Enumerates every config param the service declares: each input's connection
+* params, then the service's own params. Pure — reads `root.inputs`/`params`
+* directly, executes nothing but the (also pure) schema projection. Deliberately
+* does not go through `Load`: a service's connection-end inputs are legitimately
+* unwired from its own point of view (wiring is an enclosing module's concern),
+* and this introspects one service's declared shape regardless of how — or
+* whether — it composes into a larger graph.
+*/
+function configOf(root) {
+	const entries = [];
+	for (const [input, value] of Object.entries(root.inputs)) {
+		if (typeof value !== "object" || value === null) continue;
+		for (const [name, param] of Object.entries(value.connection.params)) entries.push({
+			owner: { input },
+			name,
+			schema: projectSchema(param.schema),
+			optional: param.optional === true,
+			default: param.default
+		});
+	}
+	for (const [name, param] of Object.entries(root.params)) entries.push({
+		owner: "service",
+		name,
+		schema: projectSchema(param.schema),
+		optional: param.optional === true,
+		default: param.default
+	});
+	return entries;
+}
+/**
+* The app's provision manifest: every secret binding the root resolved across
+* the graph (ADR-0029) — an opaque, target-defined source per service secret
+* slot; a deploy target's preflight reads its own payload. Pure graph
+* introspection, TARGET-AGNOSTIC — the target consumes it to verify each secret
+* exists on the platform before deploy. The values are provisioned out-of-band.
+*/
+function provisionManifest(graph) {
+	return graph.secrets;
+}
+/**
+* The app's param-binding manifest: every param a `provision()` call bound —
+* literal or an opaque, target-defined `ParamSource` — at the address that
+* declared it. The param sibling of `provisionManifest`, for a deploy
+* target's own preflight to consume (D2). Pure graph introspection,
+* TARGET-AGNOSTIC; a param this manifest omits simply falls back to its own
+* `default` at `buildConfig`.
+*/
+function paramManifest(graph) {
+	return graph.params;
+}
+function scalarSchema(name, check) {
+	return { "~standard": {
+		version: 1,
+		vendor: "@prisma/composer",
+		validate: (value) => check(value) ? { value } : { issues: [{ message: `expected ${name}, got ${typeof value}` }] }
+	} };
+}
+const stringSchema = scalarSchema("string", (v) => typeof v === "string");
+const numberSchema = scalarSchema("number", (v) => typeof v === "number" && Number.isFinite(v));
+function withFacets(schema, opts) {
+	return {
+		schema,
+		...opts.optional !== void 0 ? { optional: opts.optional } : {},
+		...opts.default !== void 0 ? { default: opts.default } : {},
+		...opts.provision !== void 0 ? { provision: opts.provision } : {}
+	};
+}
+/** A string-valued param. */
+function string(opts = {}) {
+	return withFacets(stringSchema, opts);
+}
+/** A number-valued param. */
+function number(opts = {}) {
+	return withFacets(numberSchema, opts);
+}
+/** A param over any caller-supplied Standard Schema — a structured `jobs`, say. */
+function param(schema, opts = {}) {
+	return withFacets(schema, opts);
+}
+/**
+* The boot-side half of the runtime split (see core-model.md § Runtime:
+* booting a service). Core's job at boot is structural only: turn a
+* concrete, typed Config into hydrated deps by calling each input's
+* connection.hydrate with its value slice. No environment read, no
+* validation, no strings — the pack's `load()` already read the process-local
+* stash into a typed Config before calling this.
+*/
+/**
+* Given a service and a concrete typed Config, hydrate every input
+* (connection.hydrate with its typed value slice). A resource dep and a
+* connection dep hydrate through identical machinery — the loaded client is
+* indistinguishable. The service's own params ride alongside in
+* `config.service`; the node's `load()` merges the two.
+*/
+async function hydrate(root, config) {
+	const deps = {};
+	for (const [name, inputNode] of Object.entries(root.inputs)) {
+		const values = config.inputs[name] ?? {};
+		deps[name] = await inputNode.connection.hydrate(values);
+	}
+	return deps;
+}
+/**
+* Synchronous hydrate — what the node's `load()` uses so
+* `const { db } = service.load()` reads without `await`. Requires every
+* connection.hydrate to return synchronously; a Promise return is a loud error
+* naming the input (an async client factory must use the async `hydrate` path).
+*/
+function hydrateSync(root, config) {
+	const deps = {};
+	for (const [name, inputNode] of Object.entries(root.inputs)) {
+		const values = config.inputs[name] ?? {};
+		const client = inputNode.connection.hydrate(values);
+		if (client instanceof Promise) throw new Error(`Connection hydrate for input "${name}" returned a Promise; load() requires a synchronous client factory.`);
+		deps[name] = client;
+	}
+	return deps;
+}
+/**
+* Wraps each of a service's resolved secret values in a redacting `SecretBox`
+* — what the node's `secrets()` accessor returns (ADR-0021, sibling to
+* `load()`/`config()`). The RESOLUTION of a secret's value (the boot
+* double-lookup that reads the platform var the pointer names) is the target
+* pack's job; core is handed the already-resolved strings and only boxes them,
+* so a secret is redacted by TYPE from here on. A declared slot missing from
+* `values` is a target contract violation, named loudly.
+*/
+function hydrateSecrets(root, values) {
+	const boxed = {};
+	for (const slot of Object.keys(root.secretSlots)) {
+		const value = values[slot];
+		if (value === void 0) throw new Error(`secret slot "${slot}" has no resolved value — the target must resolve every declared secret before hydrateSecrets().`);
+		boxed[slot] = new SecretBox(value);
+	}
+	return blindCast(boxed);
+}
+//#endregion
+export { number as a, provisionManifest as c, hydrateSync as i, string as l, hydrate as n, param as o, hydrateSecrets as r, paramManifest as s, configOf as t, SecretBox as u };
+
+//# sourceMappingURL=dist-B0axxnBf.mjs.map

package/dist/dist-B0axxnBf.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist-B0axxnBf.mjs","names":["#value","SecretBox$1"],"sources":["../../../0-framework/0-foundation/foundation/dist/secret.mjs","../../../0-framework/1-core/core/dist/index.mjs"],"sourcesContent":["//#region src/secret.ts\n/**\n* A value wrapper that redacts everywhere except the one explicit reader,\n* `expose()`. Sensitivity is carried by the TYPE (`SecretBox<T>`), not a flag a\n* sink must remember to check: `String(box)`, template interpolation,\n* `JSON.stringify`, and `console.log`/`util.inspect` all print `[REDACTED]`, so\n* a secret can't leak through an accidental log or serialization.\n*\n* Shape matches the platform's own `secrecy` type (pdp-control-plane). The class\n* is nominal enough on its own — no phantom brand.\n*/\nconst REDACTED = \"[REDACTED]\";\nvar SecretBox = class {\n\t#value;\n\tconstructor(value) {\n\t\tthis.#value = value;\n\t}\n\t/** The sole explicit door to the wrapped value. */\n\texpose() {\n\t\treturn this.#value;\n\t}\n\ttoString() {\n\t\treturn REDACTED;\n\t}\n\ttoJSON() {\n\t\treturn REDACTED;\n\t}\n\tvalueOf() {\n\t\treturn REDACTED;\n\t}\n\t[Symbol.toPrimitive]() {\n\t\treturn REDACTED;\n\t}\n\t[Symbol.for(\"nodejs.util.inspect.custom\")]() {\n\t\treturn REDACTED;\n\t}\n};\n//#endregion\nexport { SecretBox };\n\n//# sourceMappingURL=secret.mjs.map","import { _ as LoadError, a as isNode, c as isSecretSource, d as paramSource, f as provisionNeed, g as service, h as secretSource, i as freezeNode, l as module, m as secret, n as ResourceNodeBase, o as isParamSource, p as resource, r as dependency, s as isProvisionNeed, t as Load, u as paramNeed } from \"./graph-BmrUEdo9.mjs\";\nimport { SecretBox, SecretBox as SecretBox$1 } from \"@internal/foundation/secret\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/config.ts\n/**\n* A data-only descriptor of a param's schema for introspection — the\n* validator's vendor tag, never the schema's own `validate`. `configOf`\n* reports it where the old model reported `type: 'string' | 'number'`, so the\n* config surface stays enumerable without leaking a function. Nothing consumes\n* more than the vendor tag yet; a richer projection (e.g. a JSON-Schema export\n* when the vendor offers one) is an additive change if a consumer needs it.\n*/\nfunction projectSchema(schema) {\n\treturn { vendor: schema[\"~standard\"].vendor };\n}\n/**\n* Enumerates every config param the service declares: each input's connection\n* params, then the service's own params. Pure — reads `root.inputs`/`params`\n* directly, executes nothing but the (also pure) schema projection. Deliberately\n* does not go through `Load`: a service's connection-end inputs are legitimately\n* unwired from its own point of view (wiring is an enclosing module's concern),\n* and this introspects one service's declared shape regardless of how — or\n* whether — it composes into a larger graph.\n*/\nfunction configOf(root) {\n\tconst entries = [];\n\tfor (const [input, value] of Object.entries(root.inputs)) {\n\t\tif (typeof value !== \"object\" || value === null) continue;\n\t\tfor (const [name, param] of Object.entries(value.connection.params)) entries.push({\n\t\t\towner: { input },\n\t\t\tname,\n\t\t\tschema: projectSchema(param.schema),\n\t\t\toptional: param.optional === true,\n\t\t\tdefault: param.default\n\t\t});\n\t}\n\tfor (const [name, param] of Object.entries(root.params)) entries.push({\n\t\towner: \"service\",\n\t\tname,\n\t\tschema: projectSchema(param.schema),\n\t\toptional: param.optional === true,\n\t\tdefault: param.default\n\t});\n\treturn entries;\n}\n/**\n* The app's provision manifest: every secret binding the root resolved across\n* the graph (ADR-0029) — an opaque, target-defined source per service secret\n* slot; a deploy target's preflight reads its own payload. Pure graph\n* introspection, TARGET-AGNOSTIC — the target consumes it to verify each secret\n* exists on the platform before deploy. The values are provisioned out-of-band.\n*/\nfunction provisionManifest(graph) {\n\treturn graph.secrets;\n}\n/**\n* The app's param-binding manifest: every param a `provision()` call bound —\n* literal or an opaque, target-defined `ParamSource` — at the address that\n* declared it. The param sibling of `provisionManifest`, for a deploy\n* target's own preflight to consume (D2). Pure graph introspection,\n* TARGET-AGNOSTIC; a param this manifest omits simply falls back to its own\n* `default` at `buildConfig`.\n*/\nfunction paramManifest(graph) {\n\treturn graph.params;\n}\nfunction scalarSchema(name, check) {\n\treturn { \"~standard\": {\n\t\tversion: 1,\n\t\tvendor: \"@prisma/composer\",\n\t\tvalidate: (value) => check(value) ? { value } : { issues: [{ message: `expected ${name}, got ${typeof value}` }] }\n\t} };\n}\nconst stringSchema = scalarSchema(\"string\", (v) => typeof v === \"string\");\nconst numberSchema = scalarSchema(\"number\", (v) => typeof v === \"number\" && Number.isFinite(v));\nfunction withFacets(schema, opts) {\n\treturn {\n\t\tschema,\n\t\t...opts.optional !== void 0 ? { optional: opts.optional } : {},\n\t\t...opts.default !== void 0 ? { default: opts.default } : {},\n\t\t...opts.provision !== void 0 ? { provision: opts.provision } : {}\n\t};\n}\n/** A string-valued param. */\nfunction string(opts = {}) {\n\treturn withFacets(stringSchema, opts);\n}\n/** A number-valued param. */\nfunction number(opts = {}) {\n\treturn withFacets(numberSchema, opts);\n}\n/** A param over any caller-supplied Standard Schema — a structured `jobs`, say. */\nfunction param(schema, opts = {}) {\n\treturn withFacets(schema, opts);\n}\n//#endregion\n//#region src/hydrate.ts\n/**\n* The boot-side half of the runtime split (see core-model.md § Runtime:\n* booting a service). Core's job at boot is structural only: turn a\n* concrete, typed Config into hydrated deps by calling each input's\n* connection.hydrate with its value slice. No environment read, no\n* validation, no strings — the pack's `load()` already read the process-local\n* stash into a typed Config before calling this.\n*/\n/**\n* Given a service and a concrete typed Config, hydrate every input\n* (connection.hydrate with its typed value slice). A resource dep and a\n* connection dep hydrate through identical machinery — the loaded client is\n* indistinguishable. The service's own params ride alongside in\n* `config.service`; the node's `load()` merges the two.\n*/\nasync function hydrate(root, config) {\n\tconst deps = {};\n\tfor (const [name, inputNode] of Object.entries(root.inputs)) {\n\t\tconst values = config.inputs[name] ?? {};\n\t\tdeps[name] = await inputNode.connection.hydrate(values);\n\t}\n\treturn deps;\n}\n/**\n* Synchronous hydrate — what the node's `load()` uses so\n* `const { db } = service.load()` reads without `await`. Requires every\n* connection.hydrate to return synchronously; a Promise return is a loud error\n* naming the input (an async client factory must use the async `hydrate` path).\n*/\nfunction hydrateSync(root, config) {\n\tconst deps = {};\n\tfor (const [name, inputNode] of Object.entries(root.inputs)) {\n\t\tconst values = config.inputs[name] ?? {};\n\t\tconst client = inputNode.connection.hydrate(values);\n\t\tif (client instanceof Promise) throw new Error(`Connection hydrate for input \"${name}\" returned a Promise; load() requires a synchronous client factory.`);\n\t\tdeps[name] = client;\n\t}\n\treturn deps;\n}\n/**\n* Wraps each of a service's resolved secret values in a redacting `SecretBox`\n* — what the node's `secrets()` accessor returns (ADR-0021, sibling to\n* `load()`/`config()`). The RESOLUTION of a secret's value (the boot\n* double-lookup that reads the platform var the pointer names) is the target\n* pack's job; core is handed the already-resolved strings and only boxes them,\n* so a secret is redacted by TYPE from here on. A declared slot missing from\n* `values` is a target contract violation, named loudly.\n*/\nfunction hydrateSecrets(root, values) {\n\tconst boxed = {};\n\tfor (const slot of Object.keys(root.secretSlots)) {\n\t\tconst value = values[slot];\n\t\tif (value === void 0) throw new Error(`secret slot \"${slot}\" has no resolved value — the target must resolve every declared secret before hydrateSecrets().`);\n\t\tboxed[slot] = new SecretBox$1(value);\n\t}\n\treturn blindCast(boxed);\n}\n//#endregion\nexport { Load, LoadError, ResourceNodeBase, SecretBox, configOf, dependency, freezeNode, hydrate, hydrateSecrets, hydrateSync, isNode, isParamSource, isProvisionNeed, isSecretSource, module, number, param, paramManifest, paramNeed, paramSource, provisionManifest, provisionNeed, resource, secret, secretSource, service, string };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;;;;;;;;;AAWA,MAAM,WAAW;AACjB,IAAI,YAAY,MAAM;CACrB;CACA,YAAY,OAAO;EAClB,KAAKA,SAAS;CACf;;CAEA,SAAS;EACR,OAAO,KAAKA;CACb;CACA,WAAW;EACV,OAAO;CACR;CACA,SAAS;EACR,OAAO;CACR;CACA,UAAU;EACT,OAAO;CACR;CACA,CAAC,OAAO,eAAe;EACtB,OAAO;CACR;CACA,CAAC,OAAO,IAAI,4BAA4B,KAAK;EAC5C,OAAO;CACR;AACD;;;;;;;;;;;ACxBA,SAAS,cAAc,QAAQ;CAC9B,OAAO,EAAE,QAAQ,OAAO,YAAY,CAAC,OAAO;AAC7C;;;;;;;;;;AAUA,SAAS,SAAS,MAAM;CACvB,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;EACjD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,WAAW,MAAM,GAAG,QAAQ,KAAK;GACjF,OAAO,EAAE,MAAM;GACf;GACA,QAAQ,cAAc,MAAM,MAAM;GAClC,UAAU,MAAM,aAAa;GAC7B,SAAS,MAAM;EAChB,CAAC;CACF;CACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG,QAAQ,KAAK;EACrE,OAAO;EACP;EACA,QAAQ,cAAc,MAAM,MAAM;EAClC,UAAU,MAAM,aAAa;EAC7B,SAAS,MAAM;CAChB,CAAC;CACD,OAAO;AACR;;;;;;;;AAQA,SAAS,kBAAkB,OAAO;CACjC,OAAO,MAAM;AACd;;;;;;;;;AASA,SAAS,cAAc,OAAO;CAC7B,OAAO,MAAM;AACd;AACA,SAAS,aAAa,MAAM,OAAO;CAClC,OAAO,EAAE,aAAa;EACrB,SAAS;EACT,QAAQ;EACR,WAAW,UAAU,MAAM,KAAK,IAAI,EAAE,MAAM,IAAI,EAAE,QAAQ,CAAC,EAAE,SAAS,YAAY,KAAK,QAAQ,OAAO,QAAQ,CAAC,EAAE;CAClH,EAAE;AACH;AACA,MAAM,eAAe,aAAa,WAAW,MAAM,OAAO,MAAM,QAAQ;AACxE,MAAM,eAAe,aAAa,WAAW,MAAM,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC,CAAC;AAC9F,SAAS,WAAW,QAAQ,MAAM;CACjC,OAAO;EACN;EACA,GAAG,KAAK,aAAa,KAAK,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;EAC7D,GAAG,KAAK,YAAY,KAAK,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;EAC1D,GAAG,KAAK,cAAc,KAAK,IAAI,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;CACjE;AACD;;AAEA,SAAS,OAAO,OAAO,CAAC,GAAG;CAC1B,OAAO,WAAW,cAAc,IAAI;AACrC;;AAEA,SAAS,OAAO,OAAO,CAAC,GAAG;CAC1B,OAAO,WAAW,cAAc,IAAI;AACrC;;AAEA,SAAS,MAAM,QAAQ,OAAO,CAAC,GAAG;CACjC,OAAO,WAAW,QAAQ,IAAI;AAC/B;;;;;;;;;;;;;;;;AAkBA,eAAe,QAAQ,MAAM,QAAQ;CACpC,MAAM,OAAO,CAAC;CACd,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,KAAK,MAAM,GAAG;EAC5D,MAAM,SAAS,OAAO,OAAO,SAAS,CAAC;EACvC,KAAK,QAAQ,MAAM,UAAU,WAAW,QAAQ,MAAM;CACvD;CACA,OAAO;AACR;;;;;;;AAOA,SAAS,YAAY,MAAM,QAAQ;CAClC,MAAM,OAAO,CAAC;CACd,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,KAAK,MAAM,GAAG;EAC5D,MAAM,SAAS,OAAO,OAAO,SAAS,CAAC;EACvC,MAAM,SAAS,UAAU,WAAW,QAAQ,MAAM;EAClD,IAAI,kBAAkB,SAAS,MAAM,IAAI,MAAM,iCAAiC,KAAK,oEAAoE;EACzJ,KAAK,QAAQ;CACd;CACA,OAAO;AACR;;;;;;;;;;AAUA,SAAS,eAAe,MAAM,QAAQ;CACrC,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,WAAW,GAAG;EACjD,MAAM,QAAQ,OAAO;EACrB,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,MAAM,gBAAgB,KAAK,iGAAiG;EAC5J,MAAM,QAAQ,IAAIC,UAAY,KAAK;CACpC;CACA,OAAO,UAAU,KAAK;AACvB"}