@prisma/composer 0.1.0-dev.1

package/dist/graph-BmrUEdo9-6Oq1hSmS.mjs

@@ -0,0 +1,688 @@
+import { t as blindCast } from "./casts-Ci5rYYaR.mjs";
+//#region ../../0-framework/1-core/core/dist/graph-BmrUEdo9.mjs
+/** Thrown by Load when the graph is malformed. */
+var LoadError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "LoadError";
+	}
+};
+/**
+* Core model: node types and the factories that construct them, plain frozen
+* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).
+*/
+const NODE = Symbol.for("prisma:node");
+const SECRET_NEED = blindCast(Symbol.for("prisma:secret-need"));
+const SECRET_SOURCE = blindCast(Symbol.for("prisma:secret-source"));
+/** Declares a secret NEED. Nameless — the platform name is bound at the root via `envSecret`. */
+function secret() {
+	return Object.freeze({
+		[SECRET_NEED]: true,
+		kind: "secret"
+	});
+}
+/** Builds an opaque secret source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envSecret`) calls. Core forwards the source and never inspects the payload. */
+function secretSource(payload) {
+	return Object.freeze({
+		[SECRET_SOURCE]: true,
+		payload
+	});
+}
+/** True if `value` is a secret source (an `envSecret` result or a forwarded ctx.secrets ref). */
+function isSecretSource(value) {
+	return typeof value === "object" && value !== null && blindCast(value)[SECRET_SOURCE] === true;
+}
+const PROVISION_NEED = blindCast(Symbol.for("prisma:provision-need"));
+/** Builds an opaque provisioning need — the declaring package's own brand plus whatever payload its provisioner reads back. */
+function provisionNeed(brand, payload) {
+	return blindCast(Object.freeze({
+		[PROVISION_NEED]: true,
+		brand,
+		payload
+	}));
+}
+/** True if `value` is a provisioning need (a `provisionNeed()` result). */
+function isProvisionNeed(value) {
+	return typeof value === "object" && value !== null && blindCast(value)[PROVISION_NEED] === true;
+}
+const PARAM_SOURCE = blindCast(Symbol.for("prisma:param-source"));
+const PARAM_NEED = blindCast(Symbol.for("prisma:param-need"));
+/** Builds an opaque param source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envParam`) calls. Core forwards the source and never inspects the payload. */
+function paramSource(payload) {
+	return Object.freeze({
+		[PARAM_SOURCE]: true,
+		payload
+	});
+}
+/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */
+function isParamSource(value) {
+	return typeof value === "object" && value !== null && blindCast(value)[PARAM_SOURCE] === true;
+}
+/** Declares a module param-forwarding NEED. Nameless — bound to a `ParamSource` by an enclosing scope and forwarded into a child's real param. */
+function paramNeed() {
+	return Object.freeze({
+		[PARAM_NEED]: true,
+		kind: "param"
+	});
+}
+function requireType(type, factory) {
+	if (typeof type !== "string" || type.length === 0) throw new Error(`${factory}() requires a non-empty node type.`);
+}
+function requireName(name, factory) {
+	if (typeof name !== "string" || name.length === 0) throw new Error(`${factory}() requires a non-empty name.`);
+}
+function requireExtension(extension, factory) {
+	if (typeof extension !== "string" || extension.length === 0) throw new Error(`${factory}() requires a non-empty extension (the authoring extension's package name).`);
+}
+/**
+* Config keys join address/input/param names with "_" and uppercase — an
+* underscore inside a name would collide with that separator (e.g. param
+* "db_url" vs input "db"'s param "url" both hitting env key "DB_URL").
+*/
+function requireNoUnderscoreName(name, kind, factory) {
+	if (name.includes("_")) throw new Error(`${factory}() ${kind} name "${name}" may not contain "_" — config keys join names with "_" as the separator (e.g. an input "db"'s param "url" becomes env key "DB_URL"), so an underscore inside a name would collide with that separator.`);
+}
+function requireNoUnderscoreNames(names, kind, factory) {
+	for (const name of names) requireNoUnderscoreName(name, kind, factory);
+}
+function freezeParams(params) {
+	const frozen = {};
+	for (const [name, param] of Object.entries(params)) frozen[name] = Object.freeze({ ...param });
+	return Object.freeze(frozen);
+}
+function freezeSecrets(secrets) {
+	const frozen = {};
+	for (const [name, need] of Object.entries(secrets)) frozen[name] = Object.freeze({ ...need });
+	return blindCast(Object.freeze(frozen));
+}
+/** A frozen shallow copy that keeps the caller's declared type. */
+function frozenShallowCopy(obj) {
+	return blindCast(Object.freeze({ ...obj }));
+}
+/**
+* Seals a node instance after its constructor has assigned all fields — the
+* last statement of a concrete node class's constructor. A free function, not
+* a base-class method, so an instance stays structurally a plain frozen node.
+*/
+function freezeNode(node) {
+	Object.freeze(node);
+	return node;
+}
+/**
+* Everything `resource()` establishes, minus the freeze — an extension
+* whose resource node carries extra fields extends this, assigns them, and
+* calls `freezeNode(this)` as its constructor's last statement.
+*/
+var ResourceNodeBase = class {
+	[NODE] = true;
+	kind = "resource";
+	name;
+	extension;
+	type;
+	provides;
+	constructor(def) {
+		requireName(def.name, "resource");
+		requireExtension(def.extension, "resource");
+		const provides = def.provides;
+		if (typeof provides !== "object" || provides === null || typeof provides.kind !== "string" || provides.kind.length === 0 || typeof provides.satisfies !== "function") throw new Error("resource() requires `provides` — the Contract this resource offers (a non-empty `kind` plus its `satisfies()`).");
+		this.name = def.name;
+		this.extension = def.extension;
+		this.type = provides.kind;
+		this.provides = provides;
+	}
+};
+/** The core leaf: exactly the base, frozen. */
+var FrozenResourceNode = class extends ResourceNodeBase {
+	constructor(def) {
+		super(def);
+		freezeNode(this);
+	}
+};
+/**
+* Constructs a branded, frozen Resource node — an identity plus the Contract
+* it provides; the routing `type` is the contract's `kind`. Pure — nothing
+* is provisioned until a module provisions it.
+*/
+function resource(def) {
+	return new FrozenResourceNode(def);
+}
+/**
+* Constructs a branded, frozen Service node — declarations only (inputs,
+* params, build adapter, and the ports it exposes). Pure; carries no runtime behavior.
+*/
+function service(def) {
+	requireName(def.name, "service");
+	requireExtension(def.extension, "service");
+	requireType(def.type, "service");
+	requireNoUnderscoreNames(Object.keys(def.inputs), "input", "service");
+	requireNoUnderscoreNames(Object.keys(def.params), "param", "service");
+	requireNoUnderscoreNames(Object.keys(def.secrets ?? {}), "secret", "service");
+	for (const slot of Object.keys(def.secrets ?? {})) if (Object.hasOwn(def.params, slot)) throw new Error(`service() secret slot "${slot}" collides with a param of the same name — a secret slot and a service param derive the same config key (COMPOSER_<addr>_${slot.toUpperCase()}); rename one.`);
+	return Object.freeze({
+		[NODE]: true,
+		kind: "service",
+		name: def.name,
+		extension: def.extension,
+		type: def.type,
+		inputs: frozenShallowCopy(def.inputs),
+		params: freezeParams(def.params),
+		secretSlots: freezeSecrets(def.secrets ?? blindCast({})),
+		build: Object.freeze({ ...def.build }),
+		expose: def.expose !== void 0 ? frozenShallowCopy(def.expose) : void 0
+	});
+}
+/**
+* Constructs a branded, frozen DependencyEnd. `required` (if given) is the
+* contract Load compares a wired ref against via `satisfies()`; an unnamed
+* end's diagnostic `name` falls back to its `type`.
+*/
+function dependency(def) {
+	requireType(def.type, "dependency");
+	requireNoUnderscoreNames(Object.keys(def.connection.params), "param", "dependency");
+	const connection = Object.freeze({
+		params: freezeParams(def.connection.params),
+		hydrate: def.connection.hydrate
+	});
+	return Object.freeze({
+		[NODE]: true,
+		kind: "dependency",
+		name: def.name !== void 0 && def.name.length > 0 ? def.name : def.type,
+		type: def.type,
+		connection,
+		required: def.required
+	});
+}
+/**
+* Constructs a branded, frozen Module node. Construction is INERT — the body is
+* wiring, not user code, and runs only when the module is Loaded.
+*/
+function module(name, boundaryOrBody, maybeBody) {
+	requireName(name, "module");
+	const closedRoot = typeof boundaryOrBody === "function";
+	const boundary = closedRoot ? {} : boundaryOrBody;
+	const deps = frozenShallowCopy(boundary.deps ?? {});
+	const secretSlots = frozenShallowCopy(boundary.secrets ?? {});
+	const paramSlots = frozenShallowCopy(boundary.params ?? {});
+	const expose = frozenShallowCopy(boundary.expose ?? {});
+	const body = closedRoot ? (ctx) => {
+		boundaryOrBody(ctx);
+		return {};
+	} : maybeBody;
+	return Object.freeze({
+		[NODE]: true,
+		kind: "module",
+		name,
+		deps,
+		secretSlots,
+		paramSlots,
+		expose,
+		body
+	});
+}
+/**
+* True if `value` was constructed by this module's factories. Checks the
+* brand only, never a prototype — a graph may mix nodes from a different
+* installed copy of core (dual-package hazard).
+*/
+function isNode(value) {
+	return typeof value === "object" && value !== null && value[NODE] === true;
+}
+/**
+* Stable topological sort: every edge's `from` precedes its `to` in the
+* result. Ties (nodes with no ordering constraint between them) keep their
+* relative order from `nodes` — so a graph already authored producer-first
+* comes out byte-identical to its pre-sort layout; only a graph that
+* genuinely needs reordering (e.g. a module wired via a forged ref pointing at a
+* not-yet-provisioned producer) actually moves. A Kahn's-algorithm variant
+* that always picks the ready node with the smallest original index. Edges
+* whose endpoint falls outside `nodes` (e.g. a service-root's input edges
+* targeting the root, which is appended separately) are ignored. Cycles
+* cannot reach here: `assertDependencyDag` already rejects them for
+* dependency edges, and input edges never cycle.
+*/
+function topoSort(nodes, edges) {
+	const byId = new Map(nodes.map((n) => [n.id, n]));
+	const indexOf = new Map(nodes.map((n, i) => [n.id, i]));
+	const indegree = new Map(nodes.map((n) => [n.id, 0]));
+	const successors = /* @__PURE__ */ new Map();
+	for (const edge of edges) {
+		if (!byId.has(edge.from) || !byId.has(edge.to)) continue;
+		const targets = successors.get(edge.from) ?? [];
+		targets.push(edge.to);
+		successors.set(edge.from, targets);
+		indegree.set(edge.to, (indegree.get(edge.to) ?? 0) + 1);
+	}
+	const ready = new Set(nodes.filter((n) => indegree.get(n.id) === 0).map((n) => n.id));
+	const order = [];
+	while (ready.size > 0) {
+		let next;
+		let bestIndex = Number.POSITIVE_INFINITY;
+		for (const id of ready) {
+			const index = indexOf.get(id) ?? Number.POSITIVE_INFINITY;
+			if (index < bestIndex) {
+				bestIndex = index;
+				next = id;
+			}
+		}
+		if (next === void 0) break;
+		ready.delete(next);
+		order.push(next);
+		for (const target of successors.get(next) ?? []) {
+			const remaining = (indegree.get(target) ?? 0) - 1;
+			indegree.set(target, remaining);
+			if (remaining === 0) ready.add(target);
+		}
+	}
+	if (order.length !== nodes.length) throw new LoadError(`topological sort processed ${order.length} of ${nodes.length} nodes — the graph contains a cycle that slipped past the DAG validation.`);
+	return order.map((id) => byId.get(id)).filter((n) => n !== void 0);
+}
+function serviceInputs(service, serviceId) {
+	if (typeof service.inputs !== "object" || service.inputs === null) throw new LoadError(`Service "${serviceId}" has no inputs map.`);
+	const nodes = [];
+	const edges = [];
+	for (const [input, value] of Object.entries(service.inputs)) {
+		const kind = isNode(value) ? value.kind : void 0;
+		if (kind === "resource") throw new LoadError(`Input "${input}" of "${serviceId}" is a resource node — a resource is provisioned by the composing module, never created for a service that mentions it. Declare the input as a dependency (the pack's dependency factory) and wire the module-provisioned resource's ref into it.`);
+		if (kind !== "dependency") throw new LoadError(`Input "${input}" of "${serviceId}" is not a branded dependency end (construct it with the dependency() factory).`);
+		if (value.type.length === 0) throw new LoadError(`Input "${input}" of "${serviceId}" has an empty node type.`);
+		const id = `${serviceId}.${input}`;
+		nodes.push({
+			id,
+			node: value
+		});
+		edges.push({
+			from: id,
+			to: serviceId,
+			input,
+			kind: "input"
+		});
+	}
+	return {
+		nodes,
+		edges
+	};
+}
+function loadService(root, rootId) {
+	for (const [input, value] of Object.entries(root.inputs)) if (isNode(value) && value.kind === "dependency") throw new LoadError(`Service "${rootId}" has an unwired dependency input "${input}" — this service is composed by a module; deploy the module instead of loading "${rootId}" directly.`);
+	const secretSlots = Object.keys(root.secretSlots);
+	if (secretSlots.length > 0) {
+		const names = secretSlots.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Service "${rootId}" declares secret slot${secretSlots.length > 1 ? "s" : ""} ${names} but is being loaded directly — a lone service has no enclosing scope to bind them. Compose it inside a module that binds each with envSecret('NAME').`);
+	}
+	const rootGraphNode = {
+		id: rootId,
+		node: root
+	};
+	const { nodes, edges } = serviceInputs(root, rootId);
+	return {
+		root: rootGraphNode,
+		nodes: [...topoSort(nodes, edges), rootGraphNode],
+		edges,
+		secrets: [],
+		params: []
+	};
+}
+/**
+* Builds the ref a provision() call hands back: the id (so a producer with no
+* exposed ports — or an untyped slot — can still be wired wholesale) plus one
+* ref-port per exposed contract, each the contract's own runtime value (so
+* its `satisfies()` still works) tagged with the provider's id.
+*/
+function refFor(id, service) {
+	const ports = {};
+	for (const [port, contract] of Object.entries(service.expose ?? {})) ports[port] = {
+		...contract,
+		__providerId: id
+	};
+	return blindCast({
+		id,
+		...ports
+	});
+}
+/**
+* The resource variant of refFor: a resource has exactly one port — the
+* contract it provides — flattened onto the ref itself, tagged with the
+* provider id. `id` is written last so a hostile contract value cannot
+* clobber it.
+*/
+function refForResource(id, resource) {
+	return blindCast({
+		...resource.provides,
+		__providerId: id,
+		id
+	});
+}
+/** A wired value's producer id: a ref-port's `__providerId`, or a bare ref's `id`. */
+function producerIdOf(ref) {
+	if (typeof ref !== "object" || ref === null) return void 0;
+	if ("__providerId" in ref && typeof ref.__providerId === "string") return ref.__providerId;
+	if ("id" in ref && typeof ref.id === "string") return ref.id;
+}
+/**
+* Brands each `ctx.inputs` entry with the input key it stands for (see
+* flatten): diagnostic only — usage attribution relies on the per-key object
+* identity the branding copy creates, never on reading this back.
+*/
+const MODULE_INPUT_KEY = Symbol("prisma:module-input-key");
+/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.secrets` forwarding channel. */
+const MODULE_SECRET_KEY = Symbol("prisma:module-secret-key");
+/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.params` forwarding channel. */
+const MODULE_PARAM_KEY = Symbol("prisma:module-param-key");
+/** Whether `ref` carries a callable `satisfies` that accepts `required` truthily. */
+function satisfiesRequired(ref, required) {
+	return typeof ref === "object" && ref !== null && "satisfies" in ref && typeof ref.satisfies === "function" && ref.satisfies(required);
+}
+/**
+* Checks one recorded `wiring` object against the Deps it was wired against:
+* every named input exists and is a dependency slot, every referenced
+* producer is a real (by-now-provisioned) address, and a wired ref whose
+* slot declares a required contract must satisfy() it — no producer-kind
+* branching, the contract alone determines validity, whether the producer is
+* a service port or a resource. Shared by both provisioned kinds so a
+* module-as-child gets exactly the checks a service gets, and run once per
+* entry against the one `byId` shared by the whole recursive flatten, so a
+* forwarded ref resolves through to its real producer address regardless of
+* which ancestor scope provisioned it.
+*/
+function validateWiring(pending, byId) {
+	const { deps, wiring, targetId, targetKind, enclosingModuleName } = pending;
+	for (const [input, ref] of Object.entries(wiring)) {
+		const declared = blindCast(deps[input]);
+		if (declared === void 0 || !isNode(declared) || declared.kind !== "dependency") throw new LoadError(`The deps for "${targetId}" name "${input}", which is not a dependency slot of that ${targetKind}.`);
+		const producerId = producerIdOf(ref);
+		const producer = producerId !== void 0 ? byId.get(producerId) : void 0;
+		if (producerId === void 0 || producer === void 0) throw new LoadError(`The deps for "${targetId}.${input}" reference "${String(producerId)}", which is not provisioned in module "${enclosingModuleName}".`);
+		const required = declared.required;
+		if (required !== void 0 && !satisfiesRequired(ref, required)) throw new LoadError(`The deps for "${targetId}.${input}" do not satisfy the slot's required contract.`);
+	}
+	for (const [input, rawValue] of Object.entries(deps)) {
+		const value = blindCast(rawValue);
+		if (!isNode(value) || wiring[input] !== void 0) continue;
+		if (value.kind === "dependency") throw new LoadError(`Dependency input "${input}" of provisioned ${targetKind} "${targetId}" is not wired to a producer (module "${enclosingModuleName}").`);
+	}
+}
+/** The (unvalidated) edges a `wiring` object implies — one dependency edge per entry; `validateWiring` does the real checking. */
+function wiringEdges(wiring, targetId) {
+	return Object.entries(wiring).map(([input, ref]) => ({
+		from: producerIdOf(ref) ?? "",
+		to: targetId,
+		input,
+		kind: "dependency"
+	}));
+}
+/**
+* Checks the secrets wired into one provisioned child: every declared slot is
+* bound to a real secret source (an `envSecret` or a forwarded ctx.secrets
+* ref), and no wired key names a slot the child doesn't declare — the secret
+* analog of `validateWiring`'s per-input checks, but resolved inline (a source
+* carries its own name, so no whole-graph pass is needed).
+*/
+function validateSecretBinding(child, id, secretWiring, enclosingModuleName) {
+	const { kind } = child;
+	for (const slot of Object.keys(child.secretSlots)) {
+		const bound = secretWiring[slot];
+		if (bound === void 0) throw new LoadError(`Secret slot "${slot}" of provisioned ${kind} "${id}" is not bound (module "${enclosingModuleName}") — bind it with envSecret('NAME') or forward ctx.secrets.`);
+		if (!isSecretSource(bound)) throw new LoadError(`Secret slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-secret value — use envSecret('NAME') or a forwarded ctx.secrets ref.`);
+	}
+	for (const slot of Object.keys(secretWiring)) if (!Object.hasOwn(child.secretSlots, slot)) throw new LoadError(`The secrets for "${id}" name "${slot}", which is not a secret slot of that ${kind} (module "${enclosingModuleName}").`);
+}
+/**
+* Checks the params wired into a provisioned SERVICE: unlike a secret slot, a
+* declared param is never required to be bound here — it may fall back to its
+* own `default` (checked later, at `buildConfig`) — so this only rejects a
+* wired key that names something other than a real declared param.
+*/
+function validateServiceParamBinding(child, id, paramWiring, enclosingModuleName) {
+	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.params, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param of that service (module "${enclosingModuleName}").`);
+}
+/**
+* Checks the params wired into a provisioned MODULE: every declared
+* param-forwarding slot must be bound to a real `ParamSource` — a slot has no
+* schema of its own, so (unlike a service param) it cannot fall back to a
+* literal or a default; the param analog of `validateSecretBinding`.
+*/
+function validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {
+	for (const slot of Object.keys(child.paramSlots)) {
+		const bound = paramWiring[slot];
+		if (bound === void 0) throw new LoadError(`Param slot "${slot}" of provisioned module "${id}" is not bound (module "${enclosingModuleName}") — bind it with a param source (e.g. envParam('NAME')) or forward ctx.params.`);
+		if (!isParamSource(bound)) throw new LoadError(`Param slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-source value — a module param-forwarding slot carries no schema to validate a literal against; use envParam('NAME') or a forwarded ctx.params ref.`);
+	}
+	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.paramSlots, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param slot of that module (module "${enclosingModuleName}").`);
+}
+/**
+* Recursively flattens one module's body into the shared graph state and
+* returns its resolved ModuleOutputs (one ref-port per expose key) for the
+* caller (the enclosing provision() call, or Load itself for the root) to
+* use. `address` is this module's OWN full address, or `undefined` for the root
+* scope — its direct children then get bare (unprefixed) addresses, keeping
+* a single-level module identical to before nesting existed. `wiring` supplies a
+* resolved producer ref-port for each of this module's OWN declared deps (empty
+* for the root, which may not declare any — see the root non-empty-deps
+* check in loadModule). `nodes`, `edges`, `pending`, and `byId` are shared
+* across the ENTIRE recursive flatten, not per scope — a nested module may
+* forward in a producer provisioned by an ancestor scope, and it is the
+* shared `byId` (keyed by full address) that lets that resolve.
+*/
+function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes, edges, pending, secretBindings, paramBindings, byId) {
+	const localIds = /* @__PURE__ */ new Set();
+	const used = /* @__PURE__ */ new Set();
+	const usedSecrets = /* @__PURE__ */ new Set();
+	const usedParams = /* @__PURE__ */ new Set();
+	const ctxInputs = {};
+	for (const key of Object.keys(moduleNode.deps)) {
+		const wired = wiring[key];
+		ctxInputs[key] = typeof wired === "object" && wired !== null ? {
+			...wired,
+			[MODULE_INPUT_KEY]: key
+		} : wired;
+	}
+	const markUsed = (values) => {
+		for (const value of Object.values(values)) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);
+	};
+	const ctxSecrets = {};
+	for (const key of Object.keys(moduleNode.secretSlots)) {
+		const bound = secretWiring[key];
+		ctxSecrets[key] = typeof bound === "object" && bound !== null ? {
+			...bound,
+			[MODULE_SECRET_KEY]: key
+		} : bound;
+	}
+	const markSecretsUsed = (values) => {
+		for (const value of Object.values(values)) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);
+	};
+	const ctxParams = {};
+	for (const key of Object.keys(moduleNode.paramSlots)) {
+		const bound = paramWiring[key];
+		ctxParams[key] = typeof bound === "object" && bound !== null ? {
+			...bound,
+			[MODULE_PARAM_KEY]: key
+		} : bound;
+	}
+	const markParamsUsed = (values) => {
+		for (const value of Object.values(values)) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);
+	};
+	const provision = (child, opts) => {
+		const id = opts?.id ?? child.name;
+		const provisionWiring = opts?.deps;
+		const provisionSecrets = opts?.secrets;
+		const provisionParams = opts?.params;
+		if (typeof id !== "string" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module "${moduleNode.name}").`);
+		if (id.includes("_") || id.includes(".")) throw new LoadError(`provision() id "${id}" (module "${moduleNode.name}") may not contain "_" or "." — "_" is the config-key separator and "." the node-id path separator; either inside an id collides with the joined form of other names.`);
+		if (localIds.has(id)) throw new LoadError(`Duplicate provision id "${id}" in module "${moduleNode.name}".`);
+		const untrusted = child;
+		if (!isNode(untrusted) || untrusted.kind !== "service" && untrusted.kind !== "resource" && untrusted.kind !== "module") throw new LoadError(`provision("${id}") expects a branded service, resource, or module node (construct it with the service()/resource()/module() factories or a pack's own).`);
+		localIds.add(id);
+		const fullAddress = address === void 0 ? id : `${address}.${id}`;
+		if (child.kind === "resource") {
+			if (provisionWiring !== void 0) throw new LoadError(`provision("${id}") received deps for a resource — a resource has no dependency slots to satisfy.`);
+			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a resource — a resource has no secret slots to satisfy.`);
+			if (provisionParams !== void 0) throw new LoadError(`provision("${id}") received params for a resource — a resource has no params to satisfy.`);
+			if (child.type.length === 0) throw new LoadError(`provision("${id}") received a resource with an empty node type.`);
+			byId.set(fullAddress, child);
+			nodes.push({
+				id: fullAddress,
+				node: child
+			});
+			return refForResource(fullAddress, child);
+		}
+		const localWiring = { ...provisionWiring ?? {} };
+		markUsed(localWiring);
+		const localSecrets = { ...provisionSecrets ?? {} };
+		markSecretsUsed(localSecrets);
+		validateSecretBinding(child, id, localSecrets, moduleNode.name);
+		const localParams = { ...provisionParams ?? {} };
+		markParamsUsed(localParams);
+		if (child.kind === "service") {
+			for (const slot of Object.keys(child.secretSlots)) {
+				const bound = localSecrets[slot];
+				if (isSecretSource(bound)) secretBindings.push({
+					serviceAddress: fullAddress,
+					slot,
+					source: bound
+				});
+			}
+			validateServiceParamBinding(child, id, localParams, moduleNode.name);
+			for (const [slot, binding] of Object.entries(localParams)) paramBindings.push({
+				serviceAddress: fullAddress,
+				slot,
+				binding
+			});
+			const inputs = serviceInputs(child, fullAddress);
+			nodes.push(...inputs.nodes, {
+				id: fullAddress,
+				node: child
+			});
+			edges.push(...inputs.edges, ...wiringEdges(localWiring, fullAddress));
+			pending.push({
+				deps: child.inputs,
+				wiring: localWiring,
+				targetId: fullAddress,
+				targetKind: "service",
+				enclosingModuleName: moduleNode.name
+			});
+			byId.set(fullAddress, child);
+			return refFor(fullAddress, child);
+		}
+		validateParamNeedBinding(child, id, localParams, moduleNode.name);
+		edges.push(...wiringEdges(localWiring, fullAddress));
+		pending.push({
+			deps: child.deps,
+			wiring: localWiring,
+			targetId: fullAddress,
+			targetKind: "module",
+			enclosingModuleName: moduleNode.name
+		});
+		const childOutputs = flatten(child, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, secretBindings, paramBindings, byId);
+		nodes.push({
+			id: fullAddress,
+			node: child
+		});
+		byId.set(fullAddress, child);
+		return blindCast({
+			id: fullAddress,
+			...childOutputs
+		});
+	};
+	const ctx = blindCast({
+		inputs: ctxInputs,
+		secrets: ctxSecrets,
+		params: ctxParams,
+		provision: blindCast(provision)
+	});
+	const outputs = blindCast(moduleNode.body(ctx) ?? {});
+	markUsed(outputs);
+	for (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares input "${key}" but never forwards it into a provision nor returns it as an output.`);
+	for (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares secret "${key}" but never forwards it into a provision.`);
+	for (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares param "${key}" but never forwards it into a provision.`);
+	for (const [key, contract] of Object.entries(moduleNode.expose)) {
+		const port = outputs[key];
+		if (port === void 0) throw new LoadError(`Module "${moduleNode.name}" declares expose "${key}" but its body did not return a port for it.`);
+		if (!satisfiesRequired(port, contract)) throw new LoadError(`Module "${moduleNode.name}"'s returned port for expose "${key}" does not satisfy its declared contract.`);
+	}
+	return outputs;
+}
+function loadModule(root, opts) {
+	const rootId = opts?.id ?? root.name;
+	const rootDepKeys = Object.keys(root.deps);
+	if (rootDepKeys.length > 0) {
+		const names = rootDepKeys.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Module "${root.name}" declares input${rootDepKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to wire them; compose "${root.name}" from another module that provisions and wires it instead.`);
+	}
+	const rootSecretKeys = Object.keys(root.secretSlots);
+	if (rootSecretKeys.length > 0) {
+		const names = rootSecretKeys.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Module "${root.name}" declares secret${rootSecretKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds secrets with envSecret('NAME'), it does not declare secret slots of its own.`);
+	}
+	const rootParamKeys = Object.keys(root.paramSlots);
+	if (rootParamKeys.length > 0) {
+		const names = rootParamKeys.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Module "${root.name}" declares param${rootParamKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds params directly on each provision() call, it does not declare param-forwarding slots of its own.`);
+	}
+	const nodes = [];
+	const edges = [];
+	const pending = [];
+	const secretBindings = [];
+	const paramBindings = [];
+	const byId = /* @__PURE__ */ new Map();
+	flatten(root, void 0, {}, {}, {}, nodes, edges, pending, secretBindings, paramBindings, byId);
+	for (const entry of pending) validateWiring(entry, byId);
+	assertDependencyDag(edges);
+	const rootGraphNode = {
+		id: rootId,
+		node: root
+	};
+	return {
+		root: rootGraphNode,
+		nodes: [...topoSort(nodes, edges), rootGraphNode],
+		edges,
+		secrets: secretBindings,
+		params: paramBindings
+	};
+}
+/**
+* The dependency edges must form a DAG — a cycle means neither producer can
+* deploy first. Resources take no wiring, so only service/module-to-service/module
+* edges can ever participate in a cycle; no special-casing needed.
+*/
+function assertDependencyDag(edges) {
+	const adjacency = /* @__PURE__ */ new Map();
+	for (const edge of edges) {
+		if (edge.kind !== "dependency") continue;
+		const targets = adjacency.get(edge.from) ?? [];
+		targets.push(edge.to);
+		adjacency.set(edge.from, targets);
+	}
+	const visiting = /* @__PURE__ */ new Set();
+	const done = /* @__PURE__ */ new Set();
+	const stack = [];
+	const visit = (id) => {
+		if (done.has(id)) return;
+		if (visiting.has(id)) throw new LoadError(`Dependency cycle: ${[...stack.slice(stack.indexOf(id)), id].join(" → ")} — no deploy order exists.`);
+		visiting.add(id);
+		stack.push(id);
+		for (const next of adjacency.get(id) ?? []) visit(next);
+		stack.pop();
+		visiting.delete(id);
+		done.add(id);
+	};
+	for (const id of adjacency.keys()) visit(id);
+}
+/**
+* Builds the in-memory graph from a root node. A service root walks its own
+* `inputs`; a module root executes its body (wiring, not user code — the
+* designed exception to imports-run-nothing) and recursively flattens every
+* module it provisions into one graph of hierarchical addresses. A malformed
+* graph is a `LoadError` that names its fix; the individual validation rules
+* live with `loadService` / `loadModule` and are covered by name in the Load
+* tests. Executes nothing of the user's own code beyond module bodies.
+*/
+function Load(root, opts) {
+	if (!isNode(root)) throw new LoadError("Load expects a branded service or module node (construct it with the service()/module() factories).");
+	if (root.kind === "module") return loadModule(root, opts);
+	if (root.kind === "service") return loadService(root, opts?.id ?? "root");
+	throw new LoadError("Load expects a service or module root (received another node kind).");
+}
+//#endregion
+export { service as _, freezeNode as a, isProvisionNeed as c, paramNeed as d, paramSource as f, secretSource as g, secret as h, dependency as i, isSecretSource as l, resource as m, LoadError as n, isNode as o, provisionNeed as p, ResourceNodeBase as r, isParamSource as s, Load as t, module as u };
+
+//# sourceMappingURL=graph-BmrUEdo9-6Oq1hSmS.mjs.map