@prisma/composer 0.11.0-dev.2 → 0.11.0-dev.3

package/dist/{execute-log-CUzTOzSj-D5c_igNr.mjs.map → execute-log-CUzTOzSj-v-J7hbAb.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"execute-log-CUzTOzSj-D5c_igNr.mjs","names":["path"],"sources":["../../../0-framework/3-tooling/cli/dist/execute-log-CUzTOzSj.mjs"],"sourcesContent":["import { r as toStructured } from \"./shared-BTnATsqm.mjs\";\nimport { t as resolveAppIdentity } from \"./pipeline-Bt8QocRh.mjs\";\nimport { t as withEmulatorRetry } from \"./emulator-retry-DGonap4g.mjs\";\nimport { CliStructuredError } from \"@internal/foundation/errors\";\nimport * as path from \"node:path\";\nimport { notOk, ok } from \"@internal/foundation/result\";\nimport { DEV_DIR, resolveLocalTargets } from \"@internal/core/local-target\";\n//#region src/operations/execute-log.ts\n/**\n* The log executor — run-log.ts's attach-and-tail (config → localTarget →\n* container → attach → logs) with console and signal handling removed: the\n* merged stream comes back as an AsyncIterable, ended by the caller's\n* AbortSignal. Reached only by lazy import from log.ts — this module's\n* static graph transitively loads alchemy's provider tree, so the control\n* entry must never import it statically.\n*/\nfunction failureMessage(error) {\n\treturn error instanceof Error ? error.message : String(error);\n}\n/** The merge queue's bound: past this, the oldest line is dropped and the\n* consumer is told via a `lines-dropped` event — a log viewer tolerates loss\n* better than the host tolerates unbounded memory growth. Exported so tests\n* can size their floods relative to the bound. */\nconst LOG_QUEUE_LIMIT = 1e4;\n/**\n* Merges every attachment's log stream into one iterable: one pump per\n* attachment pushing into a shared bounded queue. A pump's throw becomes a\n* `stream-failed` event and ends that pump only; the merged iterable ends\n* when `input.signal` aborts, when every pump ends, or when the consumer\n* stops iterating (an early `break` aborts an internal controller so the\n* pumps tear down — the generator never waits on a source that will not\n* end). No event is delivered after the iterable has ended. Address\n* filtering and `tail` apply exactly as the CLI always has.\n*/\nasync function* mergeLogStreams(attachments, input) {\n\tconst controller = new AbortController();\n\tconst { signal } = controller;\n\tconst abortInternal = () => controller.abort();\n\tif (input.signal?.aborted === true) controller.abort();\n\tinput.signal?.addEventListener(\"abort\", abortInternal, { once: true });\n\tconst queue = [];\n\tlet dropped = 0;\n\tlet done = false;\n\tlet active = attachments.length;\n\tlet wake;\n\tconst notify = () => {\n\t\twake?.();\n\t\twake = void 0;\n\t};\n\tsignal.addEventListener(\"abort\", notify, { once: true });\n\tconst emit = (event) => {\n\t\tif (done) return;\n\t\ttry {\n\t\t\tinput.onEvent?.(event);\n\t\t} catch {}\n\t};\n\tconst pump = async (attachment) => {\n\t\ttry {\n\t\t\tfor await (const { service, line } of attachment.logs(signal, { tail: input.tail ?? 0 })) {\n\t\t\t\tif (signal.aborted) return;\n\t\t\t\tif (input.address !== void 0 && service !== input.address) continue;\n\t\t\t\tif (queue.length >= 1e4) {\n\t\t\t\t\tqueue.shift();\n\t\t\t\t\tdropped += 1;\n\t\t\t\t}\n\t\t\t\tqueue.push({\n\t\t\t\t\tservice,\n\t\t\t\t\tline\n\t\t\t\t});\n\t\t\t\tnotify();\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tif (!signal.aborted) emit({\n\t\t\t\tkind: \"stream-failed\",\n\t\t\t\tmessage: failureMessage(error)\n\t\t\t});\n\t\t} finally {\n\t\t\tactive -= 1;\n\t\t\tnotify();\n\t\t}\n\t};\n\tfor (const attachment of attachments) pump(attachment);\n\ttry {\n\t\twhile (true) {\n\t\t\tlet next = queue.shift();\n\t\t\twhile (next !== void 0) {\n\t\t\t\tif (dropped > 0) {\n\t\t\t\t\tconst count = dropped;\n\t\t\t\t\tdropped = 0;\n\t\t\t\t\temit({\n\t\t\t\t\t\tkind: \"lines-dropped\",\n\t\t\t\t\t\tcount\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tyield next;\n\t\t\t\tnext = queue.shift();\n\t\t\t}\n\t\t\tif (signal.aborted || active === 0) break;\n\t\t\tawait new Promise((resolve) => {\n\t\t\t\twake = resolve;\n\t\t\t});\n\t\t}\n\t} finally {\n\t\tdone = true;\n\t\tcontroller.abort();\n\t\tsignal.removeEventListener(\"abort\", notify);\n\t\tinput.signal?.removeEventListener(\"abort\", abortInternal);\n\t}\n}\n/** Resolves the running app and attaches to its log streams; the caller consumes `lines`. */\nasync function executeLog(input, deps, cwd) {\n\tif (process.platform === \"win32\") return notOk(new CliStructuredError(\"LOG.PLATFORM_UNSUPPORTED\", \"local dev is not supported on Windows yet.\"));\n\tconst devDir = path.join(cwd, DEV_DIR);\n\tlet name;\n\tconst attachments = [];\n\tlet services;\n\ttry {\n\t\tconst identity = deps.identity ?? await resolveAppIdentity(input.entry, input.name, cwd, {\n\t\t\tconfig: deps.config,\n\t\t\tconfigPath: deps.configPath\n\t\t});\n\t\tname = identity.name;\n\t\tconst resolved = await resolveLocalTargets(identity.config);\n\t\tfor (const target of resolved.values()) try {\n\t\t\tconst container = await target.container.ensure({\n\t\t\t\tappName: name,\n\t\t\t\tstage: void 0\n\t\t\t});\n\t\t\tattachments.push(await withEmulatorRetry(() => target.attach({\n\t\t\t\tcontainer,\n\t\t\t\tdevDir\n\t\t\t})));\n\t\t} catch (error) {\n\t\t\tthrow toStructured(\"LOG.ATTACH_FAILED\", error);\n\t\t}\n\t\ttry {\n\t\t\tservices = (await Promise.all(attachments.map((a) => withEmulatorRetry(() => a.endpoints())))).flat();\n\t\t} catch (error) {\n\t\t\tthrow toStructured(\"LOG.ATTACH_FAILED\", error);\n\t\t}\n\t} catch (error) {\n\t\tif (CliStructuredError.is(error)) return notOk(error);\n\t\tthrow error;\n\t}\n\tif (services.length === 0) return ok({\n\t\tappName: name,\n\t\tservices: [],\n\t\tlines: mergeLogStreams([], input)\n\t});\n\tif (input.address !== void 0 && !services.some((s) => s.address === input.address)) return notOk(new CliStructuredError(\"LOG.ADDRESS_UNKNOWN\", `no service \"${input.address}\" in \"${name}\" — running services: ${services.map((s) => s.address).join(\", \")}.`));\n\treturn ok({\n\t\tappName: name,\n\t\tservices,\n\t\tlines: mergeLogStreams(attachments, input)\n\t});\n}\n//#endregion\nexport { LOG_QUEUE_LIMIT, executeLog };\n\n//# sourceMappingURL=execute-log-CUzTOzSj.mjs.map"],"mappings":";;;;;;;;;;;;;;;;AAgBA,SAAS,eAAe,OAAO;CAC9B,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC7D;;;;;AAKA,MAAM,kBAAkB;;;;;;;;;;;AAWxB,gBAAgB,gBAAgB,aAAa,OAAO;CACnD,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,EAAE,WAAW;CACnB,MAAM,sBAAsB,WAAW,MAAM;CAC7C,IAAI,MAAM,QAAQ,YAAY,MAAM,WAAW,MAAM;CACrD,MAAM,QAAQ,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;CACrE,MAAM,QAAQ,CAAC;CACf,IAAI,UAAU;CACd,IAAI,OAAO;CACX,IAAI,SAAS,YAAY;CACzB,IAAI;CACJ,MAAM,eAAe;EACpB,OAAO;EACP,OAAO,KAAK;CACb;CACA,OAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;CACvD,MAAM,QAAQ,UAAU;EACvB,IAAI,MAAM;EACV,IAAI;GACH,MAAM,UAAU,KAAK;EACtB,QAAQ,CAAC;CACV;CACA,MAAM,OAAO,OAAO,eAAe;EAClC,IAAI;GACH,WAAW,MAAM,EAAE,SAAS,UAAU,WAAW,KAAK,QAAQ,EAAE,MAAM,MAAM,QAAQ,EAAE,CAAC,GAAG;IACzF,IAAI,OAAO,SAAS;IACpB,IAAI,MAAM,YAAY,KAAK,KAAK,YAAY,MAAM,SAAS;IAC3D,IAAI,MAAM,UAAU,KAAK;KACxB,MAAM,MAAM;KACZ,WAAW;IACZ;IACA,MAAM,KAAK;KACV;KACA;IACD,CAAC;IACD,OAAO;GACR;EACD,SAAS,OAAO;GACf,IAAI,CAAC,OAAO,SAAS,KAAK;IACzB,MAAM;IACN,SAAS,eAAe,KAAK;GAC9B,CAAC;EACF,UAAU;GACT,UAAU;GACV,OAAO;EACR;CACD;CACA,KAAK,MAAM,cAAc,aAAa,KAAK,UAAU;CACrD,IAAI;EACH,OAAO,MAAM;GACZ,IAAI,OAAO,MAAM,MAAM;GACvB,OAAO,SAAS,KAAK,GAAG;IACvB,IAAI,UAAU,GAAG;KAChB,MAAM,QAAQ;KACd,UAAU;KACV,KAAK;MACJ,MAAM;MACN;KACD,CAAC;IACF;IACA,MAAM;IACN,OAAO,MAAM,MAAM;GACpB;GACA,IAAI,OAAO,WAAW,WAAW,GAAG;GACpC,MAAM,IAAI,SAAS,YAAY;IAC9B,OAAO;GACR,CAAC;EACF;CACD,UAAU;EACT,OAAO;EACP,WAAW,MAAM;EACjB,OAAO,oBAAoB,SAAS,MAAM;EAC1C,MAAM,QAAQ,oBAAoB,SAAS,aAAa;CACzD;AACD;;AAEA,eAAe,WAAW,OAAO,MAAM,KAAK;CAC3C,IAAI,QAAQ,aAAa,SAAS,OAAO,MAAM,IAAI,mBAAmB,4BAA4B,4CAA4C,CAAC;CAC/I,MAAM,SAASA,OAAK,KAAK,KAAK,OAAO;CACrC,IAAI;CACJ,MAAM,cAAc,CAAC;CACrB,IAAI;CACJ,IAAI;EACH,MAAM,WAAW,KAAK,YAAY,MAAM,mBAAmB,MAAM,OAAO,MAAM,MAAM,KAAK;GACxF,QAAQ,KAAK;GACb,YAAY,KAAK;EAClB,CAAC;EACD,OAAO,SAAS;EAChB,MAAM,WAAW,MAAM,oBAAoB,SAAS,MAAM;EAC1D,KAAK,MAAM,UAAU,SAAS,OAAO,GAAG,IAAI;GAC3C,MAAM,YAAY,MAAM,OAAO,UAAU,OAAO;IAC/C,SAAS;IACT,OAAO,KAAK;GACb,CAAC;GACD,YAAY,KAAK,MAAM,wBAAwB,OAAO,OAAO;IAC5D;IACA;GACD,CAAC,CAAC,CAAC;EACJ,SAAS,OAAO;GACf,MAAM,aAAa,qBAAqB,KAAK;EAC9C;EACA,IAAI;GACH,YAAY,MAAM,QAAQ,IAAI,YAAY,KAAK,MAAM,wBAAwB,EAAE,UAAU,CAAC,CAAC,CAAC,EAAA,CAAG,KAAK;EACrG,SAAS,OAAO;GACf,MAAM,aAAa,qBAAqB,KAAK;EAC9C;CACD,SAAS,OAAO;EACf,IAAI,mBAAmB,GAAG,KAAK,GAAG,OAAO,MAAM,KAAK;EACpD,MAAM;CACP;CACA,IAAI,SAAS,WAAW,GAAG,OAAO,GAAG;EACpC,SAAS;EACT,UAAU,CAAC;EACX,OAAO,gBAAgB,CAAC,GAAG,KAAK;CACjC,CAAC;CACD,IAAI,MAAM,YAAY,KAAK,KAAK,CAAC,SAAS,MAAM,MAAM,EAAE,YAAY,MAAM,OAAO,GAAG,OAAO,MAAM,IAAI,mBAAmB,uBAAuB,eAAe,MAAM,QAAQ,QAAQ,KAAK,wBAAwB,SAAS,KAAK,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;CAC9P,OAAO,GAAG;EACT,SAAS;EACT;EACA,OAAO,gBAAgB,aAAa,KAAK;CAC1C,CAAC;AACF"}
+{"version":3,"file":"execute-log-CUzTOzSj-v-J7hbAb.mjs","names":["path"],"sources":["../../../0-framework/3-tooling/cli/dist/execute-log-CUzTOzSj.mjs"],"sourcesContent":["import { r as toStructured } from \"./shared-BTnATsqm.mjs\";\nimport { t as resolveAppIdentity } from \"./pipeline-Bt8QocRh.mjs\";\nimport { t as withEmulatorRetry } from \"./emulator-retry-DGonap4g.mjs\";\nimport { CliStructuredError } from \"@internal/foundation/errors\";\nimport * as path from \"node:path\";\nimport { notOk, ok } from \"@internal/foundation/result\";\nimport { DEV_DIR, resolveLocalTargets } from \"@internal/core/local-target\";\n//#region src/operations/execute-log.ts\n/**\n* The log executor — run-log.ts's attach-and-tail (config → localTarget →\n* container → attach → logs) with console and signal handling removed: the\n* merged stream comes back as an AsyncIterable, ended by the caller's\n* AbortSignal. Reached only by lazy import from log.ts — this module's\n* static graph transitively loads alchemy's provider tree, so the control\n* entry must never import it statically.\n*/\nfunction failureMessage(error) {\n\treturn error instanceof Error ? error.message : String(error);\n}\n/** The merge queue's bound: past this, the oldest line is dropped and the\n* consumer is told via a `lines-dropped` event — a log viewer tolerates loss\n* better than the host tolerates unbounded memory growth. Exported so tests\n* can size their floods relative to the bound. */\nconst LOG_QUEUE_LIMIT = 1e4;\n/**\n* Merges every attachment's log stream into one iterable: one pump per\n* attachment pushing into a shared bounded queue. A pump's throw becomes a\n* `stream-failed` event and ends that pump only; the merged iterable ends\n* when `input.signal` aborts, when every pump ends, or when the consumer\n* stops iterating (an early `break` aborts an internal controller so the\n* pumps tear down — the generator never waits on a source that will not\n* end). No event is delivered after the iterable has ended. Address\n* filtering and `tail` apply exactly as the CLI always has.\n*/\nasync function* mergeLogStreams(attachments, input) {\n\tconst controller = new AbortController();\n\tconst { signal } = controller;\n\tconst abortInternal = () => controller.abort();\n\tif (input.signal?.aborted === true) controller.abort();\n\tinput.signal?.addEventListener(\"abort\", abortInternal, { once: true });\n\tconst queue = [];\n\tlet dropped = 0;\n\tlet done = false;\n\tlet active = attachments.length;\n\tlet wake;\n\tconst notify = () => {\n\t\twake?.();\n\t\twake = void 0;\n\t};\n\tsignal.addEventListener(\"abort\", notify, { once: true });\n\tconst emit = (event) => {\n\t\tif (done) return;\n\t\ttry {\n\t\t\tinput.onEvent?.(event);\n\t\t} catch {}\n\t};\n\tconst pump = async (attachment) => {\n\t\ttry {\n\t\t\tfor await (const { service, line } of attachment.logs(signal, { tail: input.tail ?? 0 })) {\n\t\t\t\tif (signal.aborted) return;\n\t\t\t\tif (input.address !== void 0 && service !== input.address) continue;\n\t\t\t\tif (queue.length >= 1e4) {\n\t\t\t\t\tqueue.shift();\n\t\t\t\t\tdropped += 1;\n\t\t\t\t}\n\t\t\t\tqueue.push({\n\t\t\t\t\tservice,\n\t\t\t\t\tline\n\t\t\t\t});\n\t\t\t\tnotify();\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tif (!signal.aborted) emit({\n\t\t\t\tkind: \"stream-failed\",\n\t\t\t\tmessage: failureMessage(error)\n\t\t\t});\n\t\t} finally {\n\t\t\tactive -= 1;\n\t\t\tnotify();\n\t\t}\n\t};\n\tfor (const attachment of attachments) pump(attachment);\n\ttry {\n\t\twhile (true) {\n\t\t\tlet next = queue.shift();\n\t\t\twhile (next !== void 0) {\n\t\t\t\tif (dropped > 0) {\n\t\t\t\t\tconst count = dropped;\n\t\t\t\t\tdropped = 0;\n\t\t\t\t\temit({\n\t\t\t\t\t\tkind: \"lines-dropped\",\n\t\t\t\t\t\tcount\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tyield next;\n\t\t\t\tnext = queue.shift();\n\t\t\t}\n\t\t\tif (signal.aborted || active === 0) break;\n\t\t\tawait new Promise((resolve) => {\n\t\t\t\twake = resolve;\n\t\t\t});\n\t\t}\n\t} finally {\n\t\tdone = true;\n\t\tcontroller.abort();\n\t\tsignal.removeEventListener(\"abort\", notify);\n\t\tinput.signal?.removeEventListener(\"abort\", abortInternal);\n\t}\n}\n/** Resolves the running app and attaches to its log streams; the caller consumes `lines`. */\nasync function executeLog(input, deps, cwd) {\n\tif (process.platform === \"win32\") return notOk(new CliStructuredError(\"LOG.PLATFORM_UNSUPPORTED\", \"local dev is not supported on Windows yet.\"));\n\tconst devDir = path.join(cwd, DEV_DIR);\n\tlet name;\n\tconst attachments = [];\n\tlet services;\n\ttry {\n\t\tconst identity = deps.identity ?? await resolveAppIdentity(input.entry, input.name, cwd, {\n\t\t\tconfig: deps.config,\n\t\t\tconfigPath: deps.configPath\n\t\t});\n\t\tname = identity.name;\n\t\tconst resolved = await resolveLocalTargets(identity.config);\n\t\tfor (const target of resolved.values()) try {\n\t\t\tconst container = await target.container.ensure({\n\t\t\t\tappName: name,\n\t\t\t\tstage: void 0\n\t\t\t});\n\t\t\tattachments.push(await withEmulatorRetry(() => target.attach({\n\t\t\t\tcontainer,\n\t\t\t\tdevDir\n\t\t\t})));\n\t\t} catch (error) {\n\t\t\tthrow toStructured(\"LOG.ATTACH_FAILED\", error);\n\t\t}\n\t\ttry {\n\t\t\tservices = (await Promise.all(attachments.map((a) => withEmulatorRetry(() => a.endpoints())))).flat();\n\t\t} catch (error) {\n\t\t\tthrow toStructured(\"LOG.ATTACH_FAILED\", error);\n\t\t}\n\t} catch (error) {\n\t\tif (CliStructuredError.is(error)) return notOk(error);\n\t\tthrow error;\n\t}\n\tif (services.length === 0) return ok({\n\t\tappName: name,\n\t\tservices: [],\n\t\tlines: mergeLogStreams([], input)\n\t});\n\tif (input.address !== void 0 && !services.some((s) => s.address === input.address)) return notOk(new CliStructuredError(\"LOG.ADDRESS_UNKNOWN\", `no service \"${input.address}\" in \"${name}\" — running services: ${services.map((s) => s.address).join(\", \")}.`));\n\treturn ok({\n\t\tappName: name,\n\t\tservices,\n\t\tlines: mergeLogStreams(attachments, input)\n\t});\n}\n//#endregion\nexport { LOG_QUEUE_LIMIT, executeLog };\n\n//# sourceMappingURL=execute-log-CUzTOzSj.mjs.map"],"mappings":";;;;;;;;;;;;;;;;AAgBA,SAAS,eAAe,OAAO;CAC9B,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC7D;;;;;AAKA,MAAM,kBAAkB;;;;;;;;;;;AAWxB,gBAAgB,gBAAgB,aAAa,OAAO;CACnD,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,EAAE,WAAW;CACnB,MAAM,sBAAsB,WAAW,MAAM;CAC7C,IAAI,MAAM,QAAQ,YAAY,MAAM,WAAW,MAAM;CACrD,MAAM,QAAQ,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;CACrE,MAAM,QAAQ,CAAC;CACf,IAAI,UAAU;CACd,IAAI,OAAO;CACX,IAAI,SAAS,YAAY;CACzB,IAAI;CACJ,MAAM,eAAe;EACpB,OAAO;EACP,OAAO,KAAK;CACb;CACA,OAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;CACvD,MAAM,QAAQ,UAAU;EACvB,IAAI,MAAM;EACV,IAAI;GACH,MAAM,UAAU,KAAK;EACtB,QAAQ,CAAC;CACV;CACA,MAAM,OAAO,OAAO,eAAe;EAClC,IAAI;GACH,WAAW,MAAM,EAAE,SAAS,UAAU,WAAW,KAAK,QAAQ,EAAE,MAAM,MAAM,QAAQ,EAAE,CAAC,GAAG;IACzF,IAAI,OAAO,SAAS;IACpB,IAAI,MAAM,YAAY,KAAK,KAAK,YAAY,MAAM,SAAS;IAC3D,IAAI,MAAM,UAAU,KAAK;KACxB,MAAM,MAAM;KACZ,WAAW;IACZ;IACA,MAAM,KAAK;KACV;KACA;IACD,CAAC;IACD,OAAO;GACR;EACD,SAAS,OAAO;GACf,IAAI,CAAC,OAAO,SAAS,KAAK;IACzB,MAAM;IACN,SAAS,eAAe,KAAK;GAC9B,CAAC;EACF,UAAU;GACT,UAAU;GACV,OAAO;EACR;CACD;CACA,KAAK,MAAM,cAAc,aAAa,KAAK,UAAU;CACrD,IAAI;EACH,OAAO,MAAM;GACZ,IAAI,OAAO,MAAM,MAAM;GACvB,OAAO,SAAS,KAAK,GAAG;IACvB,IAAI,UAAU,GAAG;KAChB,MAAM,QAAQ;KACd,UAAU;KACV,KAAK;MACJ,MAAM;MACN;KACD,CAAC;IACF;IACA,MAAM;IACN,OAAO,MAAM,MAAM;GACpB;GACA,IAAI,OAAO,WAAW,WAAW,GAAG;GACpC,MAAM,IAAI,SAAS,YAAY;IAC9B,OAAO;GACR,CAAC;EACF;CACD,UAAU;EACT,OAAO;EACP,WAAW,MAAM;EACjB,OAAO,oBAAoB,SAAS,MAAM;EAC1C,MAAM,QAAQ,oBAAoB,SAAS,aAAa;CACzD;AACD;;AAEA,eAAe,WAAW,OAAO,MAAM,KAAK;CAC3C,IAAI,QAAQ,aAAa,SAAS,OAAO,MAAM,IAAI,mBAAmB,4BAA4B,4CAA4C,CAAC;CAC/I,MAAM,SAASA,OAAK,KAAK,KAAK,OAAO;CACrC,IAAI;CACJ,MAAM,cAAc,CAAC;CACrB,IAAI;CACJ,IAAI;EACH,MAAM,WAAW,KAAK,YAAY,MAAM,mBAAmB,MAAM,OAAO,MAAM,MAAM,KAAK;GACxF,QAAQ,KAAK;GACb,YAAY,KAAK;EAClB,CAAC;EACD,OAAO,SAAS;EAChB,MAAM,WAAW,MAAM,oBAAoB,SAAS,MAAM;EAC1D,KAAK,MAAM,UAAU,SAAS,OAAO,GAAG,IAAI;GAC3C,MAAM,YAAY,MAAM,OAAO,UAAU,OAAO;IAC/C,SAAS;IACT,OAAO,KAAK;GACb,CAAC;GACD,YAAY,KAAK,MAAM,wBAAwB,OAAO,OAAO;IAC5D;IACA;GACD,CAAC,CAAC,CAAC;EACJ,SAAS,OAAO;GACf,MAAM,aAAa,qBAAqB,KAAK;EAC9C;EACA,IAAI;GACH,YAAY,MAAM,QAAQ,IAAI,YAAY,KAAK,MAAM,wBAAwB,EAAE,UAAU,CAAC,CAAC,CAAC,EAAA,CAAG,KAAK;EACrG,SAAS,OAAO;GACf,MAAM,aAAa,qBAAqB,KAAK;EAC9C;CACD,SAAS,OAAO;EACf,IAAI,mBAAmB,GAAG,KAAK,GAAG,OAAO,MAAM,KAAK;EACpD,MAAM;CACP;CACA,IAAI,SAAS,WAAW,GAAG,OAAO,GAAG;EACpC,SAAS;EACT,UAAU,CAAC;EACX,OAAO,gBAAgB,CAAC,GAAG,KAAK;CACjC,CAAC;CACD,IAAI,MAAM,YAAY,KAAK,KAAK,CAAC,SAAS,MAAM,MAAM,EAAE,YAAY,MAAM,OAAO,GAAG,OAAO,MAAM,IAAI,mBAAmB,uBAAuB,eAAe,MAAM,QAAQ,QAAQ,KAAK,wBAAwB,SAAS,KAAK,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;CAC9P,OAAO,GAAG;EACT,SAAS;EACT;EACA,OAAO,gBAAgB,aAAa,KAAK;CAC1C,CAAC;AACF"}

package/dist/{graph-BJgUfGB0-kvgFzT4q.mjs → graph-BfKAg2Ap-CrhKkEzd.mjs}

@@ -1,7 +1,9 @@
 import { t as blindCast } from "./casts-DpaahrlC-C5XMnP9S.mjs";
 import { t as InternalError } from "./internal-error-BIc-ehme-Ck_lgxD_.mjs";
 import { t as CliStructuredError } from "./errors-0e8IVwzi.mjs";
-//#region ../../0-framework/1-core/core/dist/graph-BJgUfGB0.mjs
+//#region ../../0-framework/1-core/core/dist/graph-BfKAg2Ap.mjs
+/** The reserved name of a resource's single anonymous output port. Rejected as a user-declared port name (node.ts). */
+const RESOURCE_OUT_PORT = "$out";
 /**
 * Thrown by Load when the graph is malformed. Structured at origin
 * (base-type rule 6): one type-level code covers every raise site until a
@@ -92,6 +94,16 @@ function isConfigKeySegment(name) {
 function requireConfigKeySegmentName(name, kind, factory) {
 	if (!isConfigKeySegment(name)) throw new Error(`${factory}() ${kind} name "${name}" must contain only ASCII letters and digits ([A-Za-z0-9]) — declared names derive deterministic config keys, uppercased and joined with "_" (an input "db"'s param "url" becomes config key "DB_URL"), so an underscore inside a name collides with that separator and any other character has no place in a config key. "${name}" would put "${name.toUpperCase()}" inside the derived key.`);
 }
+/**
+* `$out` names a resource's single anonymous output on the wire (the
+* application topology's reserved port name), so no declared port — a dep
+* slot or an expose entry — may claim it. Input names are already confined
+* to [A-Za-z0-9] by the config-key rule; expose and module-dep names are
+* not, so the reservation is checked wherever a port name is declared.
+*/
+function requireNotReservedPortNames(names, factory) {
+	for (const name of names) if (name === "$out") throw new Error(`${factory}() declares a port named "$out" — that name is reserved for a resource's anonymous output; choose another name.`);
+}
 function requireConfigKeySegmentNames(names, kind, factory) {
 	for (const name of names) requireConfigKeySegmentName(name, kind, factory);
 }
@@ -162,6 +174,7 @@ function service(def) {
 	requireType(def.type, "service");
 	requireConfigKeySegmentNames(Object.keys(def.inputs), "input", "service");
 	requireConfigKeySegmentNames(Object.keys(def.params), "param", "service");
+	if (def.expose !== void 0) requireNotReservedPortNames(Object.keys(def.expose), "service");
 	if (def.input !== void 0 && typeof def.input["~standard"]?.validate !== "function") throw new Error("service() `input` must be a Standard Schema (an object with a \"~standard\".validate function) — see https://standardschema.dev (ADR-0042).");
 	return Object.freeze({
 		[NODE]: true,
@@ -205,6 +218,8 @@ function module(name, boundaryOrBody, maybeBody) {
 	requireName(name, "module");
 	const closedRoot = typeof boundaryOrBody === "function";
 	const boundary = closedRoot ? {} : boundaryOrBody;
+	requireNotReservedPortNames(Object.keys(boundary.deps ?? {}), "module");
+	requireNotReservedPortNames(Object.keys(boundary.expose ?? {}), "module");
 	const deps = frozenShallowCopy(boundary.deps ?? {});
 	const secretSlots = frozenShallowCopy(boundary.secrets ?? {});
 	const paramSlots = frozenShallowCopy(boundary.params ?? {});
@@ -281,6 +296,35 @@ function topoSort(nodes, edges) {
 	if (order.length !== nodes.length) throw new InternalError(`topological sort processed ${order.length} of ${nodes.length} nodes — the graph contains a cycle that slipped past the DAG validation.`);
 	return order.map((id) => byId.get(id)).filter((n) => n !== void 0);
 }
+/**
+* The declared boundary ports of a module or service node at `id`: dep slots
+* as `in` ports (contractKind = the slot's `type`), exposed contracts as
+* `out` ports (contractKind = the contract's `kind`). A resource's one
+* `$out` port is recorded at its provision site instead (load-module.ts).
+*/
+function boundaryPortsOf(id, node) {
+	const ports = [];
+	const slots = node.kind === "module" ? node.deps : node.inputs;
+	for (const [name, slot] of Object.entries(slots)) {
+		const type = typeof slot === "object" && slot !== null && "type" in slot && typeof slot.type === "string" ? slot.type : void 0;
+		ports.push({
+			node: id,
+			direction: "in",
+			name,
+			contractKind: type
+		});
+	}
+	for (const [name, contract] of Object.entries(node.expose ?? {})) {
+		const kind = typeof contract === "object" && contract !== null && "kind" in contract && typeof contract.kind === "string" ? contract.kind : void 0;
+		ports.push({
+			node: id,
+			direction: "out",
+			name,
+			contractKind: kind
+		});
+	}
+	return ports;
+}
 function serviceInputs(service, serviceId) {
 	if (typeof service.inputs !== "object" || service.inputs === null) throw new LoadError(`Service "${serviceId}" has no inputs map.`);
 	const nodes = [];
@@ -293,6 +337,7 @@ function serviceInputs(service, serviceId) {
 		const id = `${serviceId}.${input}`;
 		nodes.push({
 			id,
+			parent: serviceId,
 			node: value
 		});
 		edges.push({
@@ -312,6 +357,7 @@ function loadService(root, rootId) {
 	if (root.inputSchema !== void 0) throw new LoadError(`Service "${rootId}" declares an input schema but is being loaded directly — a lone service has no enclosing scope to bind its input. Compose it inside a module whose provision() call binds \`input: { … }\` (ADR-0042).`);
 	const rootGraphNode = {
 		id: rootId,
+		parent: void 0,
 		node: root
 	};
 	const { nodes, edges } = serviceInputs(root, rootId);
@@ -319,11 +365,31 @@ function loadService(root, rootId) {
 		root: rootGraphNode,
 		nodes: [...topoSort(nodes, edges), rootGraphNode],
 		edges,
+		ports: boundaryPortsOf(rootId, root),
+		authoredEdges: [],
 		inputBindings: [],
 		params: []
 	};
 }
 /**
+* Brands a ref-port with the AUTHORED endpoint it stands for — which port of
+* which node the author wired, before any forwarding chain resolves. Read
+* only by `authoredSourceOf`; `__providerId` keeps carrying the resolved
+* producer for the flat (post-dereference) edges.
+*/
+const AUTHORED_PORT = Symbol("prisma:authored-port");
+/** The authored out-port brand carried by `ref`, if any. */
+function authoredPortOf(ref) {
+	if (typeof ref !== "object" || ref === null) return void 0;
+	const brand = blindCast(ref)[AUTHORED_PORT];
+	if (typeof brand !== "object" || brand === null) return void 0;
+	const { node, name } = blindCast(brand);
+	return typeof node === "string" && typeof name === "string" ? {
+		node,
+		name
+	} : void 0;
+}
+/**
 * Builds the ref a provision() call hands back: the id (so a producer with no
 * exposed ports — or an untyped slot — can still be wired wholesale) plus one
 * ref-port per exposed contract, each the contract's own runtime value (so
@@ -333,7 +399,11 @@ function refFor(id, service) {
 	const ports = {};
 	for (const [port, contract] of Object.entries(service.expose ?? {})) ports[port] = {
 		...contract,
-		__providerId: id
+		__providerId: id,
+		[AUTHORED_PORT]: {
+			node: id,
+			name: port
+		}
 	};
 	return blindCast({
 		id,
@@ -343,14 +413,18 @@ function refFor(id, service) {
 /**
 * The resource variant of refFor: a resource has exactly one port — the
 * contract it provides — flattened onto the ref itself, tagged with the
-* provider id. `id` is written last so a hostile contract value cannot
-* clobber it.
+* provider id. `id` and the authored brand are written last so a hostile
+* contract value cannot clobber them.
 */
 function refForResource(id, resource) {
 	return blindCast({
 		...resource.provides,
 		__providerId: id,
-		id
+		id,
+		[AUTHORED_PORT]: {
+			node: id,
+			name: RESOURCE_OUT_PORT
+		}
 	});
 }
 /** A wired value's producer id: a ref-port's `__providerId`, or a bare ref's `id`. */
@@ -483,8 +557,14 @@ function validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {
 * across the ENTIRE recursive flatten, not per scope — a nested module may
 * forward in a producer provisioned by an ancestor scope, and it is the
 * shared `byId` (keyed by full address) that lets that resolve.
+*
+* `selfId` is this module's own node id — the root's given id when `address`
+* is `undefined`, the full address otherwise. It anchors the authored view:
+* children carry it as their `parent`, and this module's own boundary ports
+* (and the authored edges touching them) are recorded against it.
 */
-function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes, edges, pending, inputBindings, paramBindings, byId) {
+function flatten(moduleNode, address, selfId, wiring, secretWiring, paramWiring, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges) {
+	ports.push(...boundaryPortsOf(selfId, moduleNode));
 	const localIds = /* @__PURE__ */ new Set();
 	const used = /* @__PURE__ */ new Set();
 	const usedSecrets = /* @__PURE__ */ new Set();
@@ -500,6 +580,33 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 	const markUsed = (values) => {
 		for (const value of values) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);
 	};
+	const authoredSourceOf = (value) => {
+		for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) return {
+			node: selfId,
+			direction: "in",
+			name: key
+		};
+		const brand = authoredPortOf(value);
+		return brand === void 0 ? void 0 : {
+			node: brand.node,
+			direction: "out",
+			name: brand.name
+		};
+	};
+	/** Records the authored edge each wiring entry declares: source port → the target's own `in` port. */
+	const recordAuthoredWiring = (targetId, targetWiring) => {
+		for (const [input, ref] of Object.entries(targetWiring)) {
+			const from = authoredSourceOf(ref);
+			if (from !== void 0) authoredEdges.push({
+				from,
+				to: {
+					node: targetId,
+					direction: "in",
+					name: input
+				}
+			});
+		}
+	};
 	const ctxSecrets = {};
 	for (const key of Object.keys(moduleNode.secretSlots)) {
 		const bound = secretWiring[key];
@@ -544,8 +651,15 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 			byId.set(fullAddress, child);
 			nodes.push({
 				id: fullAddress,
+				parent: selfId,
 				node: child
 			});
+			ports.push({
+				node: fullAddress,
+				direction: "out",
+				name: RESOURCE_OUT_PORT,
+				contractKind: child.provides.kind
+			});
 			return refForResource(fullAddress, child);
 		}
 		const localWiring = { ...provisionWiring ?? {} };
@@ -577,9 +691,12 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 			const inputs = serviceInputs(child, fullAddress);
 			nodes.push(...inputs.nodes, {
 				id: fullAddress,
+				parent: selfId,
 				node: child
 			});
 			edges.push(...inputs.edges, ...wiringEdges(localWiring, fullAddress));
+			ports.push(...boundaryPortsOf(fullAddress, child));
+			recordAuthoredWiring(fullAddress, localWiring);
 			pending.push({
 				deps: child.inputs,
 				wiring: localWiring,
@@ -594,6 +711,7 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 		validateSecretBinding(child, id, localSecrets, moduleNode.name);
 		validateParamNeedBinding(child, id, localParams, moduleNode.name);
 		edges.push(...wiringEdges(localWiring, fullAddress));
+		recordAuthoredWiring(fullAddress, localWiring);
 		pending.push({
 			deps: child.deps,
 			wiring: localWiring,
@@ -601,15 +719,24 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 			targetKind: "module",
 			enclosingModuleName: moduleNode.name
 		});
-		const childOutputs = flatten(child, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, inputBindings, paramBindings, byId);
+		const childOutputs = flatten(child, fullAddress, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges);
 		nodes.push({
 			id: fullAddress,
+			parent: selfId,
 			node: child
 		});
 		byId.set(fullAddress, child);
+		const brandedOutputs = {};
+		for (const [key, value] of Object.entries(childOutputs)) brandedOutputs[key] = typeof value === "object" && value !== null ? {
+			...value,
+			[AUTHORED_PORT]: {
+				node: fullAddress,
+				name: key
+			}
+		} : value;
 		return blindCast({
 			id: fullAddress,
-			...childOutputs
+			...brandedOutputs
 		});
 	};
 	const ctx = blindCast({
@@ -627,6 +754,15 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 		const port = outputs[key];
 		if (port === void 0) throw new LoadError(`Module "${moduleNode.name}" declares expose "${key}" but its body did not return a port for it.`);
 		if (!satisfiesRequired(port, contract)) throw new LoadError(`Module "${moduleNode.name}"'s returned port for expose "${key}" does not satisfy its declared contract.`);
+		const from = authoredSourceOf(port);
+		if (from !== void 0) authoredEdges.push({
+			from,
+			to: {
+				node: selfId,
+				direction: "out",
+				name: key
+			}
+		});
 	}
 	return outputs;
 }
@@ -653,17 +789,22 @@ function loadModule(root, opts) {
 	const inputBindings = [];
 	const paramBindings = [];
 	const byId = /* @__PURE__ */ new Map();
-	flatten(root, void 0, {}, {}, {}, nodes, edges, pending, inputBindings, paramBindings, byId);
+	const ports = [];
+	const authoredEdges = [];
+	flatten(root, void 0, rootId, {}, {}, {}, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges);
 	for (const entry of pending) validateWiring(entry, byId);
 	assertDependencyDag(edges);
 	const rootGraphNode = {
 		id: rootId,
+		parent: void 0,
 		node: root
 	};
 	return {
 		root: rootGraphNode,
 		nodes: [...topoSort(nodes, edges), rootGraphNode],
 		edges,
+		ports,
+		authoredEdges,
 		inputBindings,
 		params: paramBindings
 	};
@@ -712,6 +853,6 @@ function Load(root, opts) {
 	throw new LoadError("Load expects a service or module root (received another node kind).");
 }
 //#endregion
-export { service as _, freezeNode as a, isProvisionNeed as c, paramNeed as d, paramSource as f, secretSource as g, secret as h, dependency as i, isSecretSource as l, resource as m, LoadError as n, isNode as o, provisionNeed as p, ResourceNodeBase as r, isParamSource as s, Load as t, module as u };
+export { secretSource as _, dependency as a, isParamSource as c, module as d, paramNeed as f, secret as g, resource as h, ResourceNodeBase as i, isProvisionNeed as l, provisionNeed as m, LoadError as n, freezeNode as o, paramSource as p, RESOURCE_OUT_PORT as r, isNode as s, Load as t, isSecretSource as u, service as v };
 
-//# sourceMappingURL=graph-BJgUfGB0-kvgFzT4q.mjs.map
+//# sourceMappingURL=graph-BfKAg2Ap-CrhKkEzd.mjs.map

package/dist/graph-BfKAg2Ap-CrhKkEzd.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-BfKAg2Ap-CrhKkEzd.mjs","names":[],"sources":["../../../0-framework/1-core/core/dist/graph-BfKAg2Ap.mjs"],"sourcesContent":["import { CliStructuredError, InternalError } from \"@internal/foundation/errors\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/graph-types.ts\n/** The reserved name of a resource's single anonymous output port. Rejected as a user-declared port name (node.ts). */\nconst RESOURCE_OUT_PORT = \"$out\";\n/**\n* Thrown by Load when the graph is malformed. Structured at origin\n* (base-type rule 6): one type-level code covers every raise site until a\n* finer per-site taxonomy is carved out. The `name` stays\n* `CliStructuredError` — structural recognition depends on it.\n*/\nvar LoadError = class extends CliStructuredError {\n\tconstructor(message) {\n\t\tsuper(\"COMPOSE.GRAPH_INVALID\", message);\n\t}\n};\n//#endregion\n//#region src/node.ts\n/**\n* Core model: node types and the factories that construct them, plain frozen\n* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).\n*/\nconst NODE = Symbol.for(\"prisma:node\");\nconst SECRET_NEED = blindCast(Symbol.for(\"prisma:secret-need\"));\nconst SECRET_SOURCE = blindCast(Symbol.for(\"prisma:secret-source\"));\n/** Declares a secret NEED. Nameless — the platform name is bound at the root via `envSecret`. */\nfunction secret() {\n\treturn Object.freeze({\n\t\t[SECRET_NEED]: true,\n\t\tkind: \"secret\"\n\t});\n}\n/** Builds an opaque secret source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envSecret`) calls. Core forwards the source and never inspects the payload. */\nfunction secretSource(payload) {\n\treturn Object.freeze({\n\t\t[SECRET_SOURCE]: true,\n\t\tpayload\n\t});\n}\n/** True if `value` is a secret source (an `envSecret` result or a forwarded ctx.secrets ref). */\nfunction isSecretSource(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[SECRET_SOURCE] === true;\n}\nconst PROVISION_NEED = blindCast(Symbol.for(\"prisma:provision-need\"));\n/** Builds an opaque provisioning need — the declaring package's own brand plus whatever payload its provisioner reads back. */\nfunction provisionNeed(brand, payload) {\n\treturn blindCast(Object.freeze({\n\t\t[PROVISION_NEED]: true,\n\t\tbrand,\n\t\tpayload\n\t}));\n}\n/** True if `value` is a provisioning need (a `provisionNeed()` result). */\nfunction isProvisionNeed(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[PROVISION_NEED] === true;\n}\nconst PARAM_SOURCE = blindCast(Symbol.for(\"prisma:param-source\"));\nconst PARAM_NEED = blindCast(Symbol.for(\"prisma:param-need\"));\n/** Builds an opaque param source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envParam`) calls. Core forwards the source and never inspects the payload. */\nfunction paramSource(payload) {\n\treturn Object.freeze({\n\t\t[PARAM_SOURCE]: true,\n\t\tpayload\n\t});\n}\n/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */\nfunction isParamSource(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[PARAM_SOURCE] === true;\n}\n/** Declares a module param-forwarding NEED. Nameless — bound to a `ParamSource` by an enclosing scope and forwarded into a child's real param. */\nfunction paramNeed() {\n\treturn Object.freeze({\n\t\t[PARAM_NEED]: true,\n\t\tkind: \"param\"\n\t});\n}\nfunction requireType(type, factory) {\n\tif (typeof type !== \"string\" || type.length === 0) throw new Error(`${factory}() requires a non-empty node type.`);\n}\nfunction requireName(name, factory) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(`${factory}() requires a non-empty name.`);\n}\nfunction requireExtension(extension, factory) {\n\tif (typeof extension !== \"string\" || extension.length === 0) throw new Error(`${factory}() requires a non-empty extension (the authoring extension's package name).`);\n}\n/**\n* Core's grammar for every name that becomes a config-key segment —\n* addresses, input/param/secret names: ASCII letters and digits only.\n* Conservative by design so any target medium — POSIX env-var keys\n* included — can uppercase and \"_\"-join segments without escaping.\n*/\nfunction isConfigKeySegment(name) {\n\treturn /^[A-Za-z0-9]+$/.test(name);\n}\nfunction requireConfigKeySegmentName(name, kind, factory) {\n\tif (!isConfigKeySegment(name)) throw new Error(`${factory}() ${kind} name \"${name}\" must contain only ASCII letters and digits ([A-Za-z0-9]) — declared names derive deterministic config keys, uppercased and joined with \"_\" (an input \"db\"'s param \"url\" becomes config key \"DB_URL\"), so an underscore inside a name collides with that separator and any other character has no place in a config key. \"${name}\" would put \"${name.toUpperCase()}\" inside the derived key.`);\n}\n/**\n* `$out` names a resource's single anonymous output on the wire (the\n* application topology's reserved port name), so no declared port — a dep\n* slot or an expose entry — may claim it. Input names are already confined\n* to [A-Za-z0-9] by the config-key rule; expose and module-dep names are\n* not, so the reservation is checked wherever a port name is declared.\n*/\nfunction requireNotReservedPortNames(names, factory) {\n\tfor (const name of names) if (name === \"$out\") throw new Error(`${factory}() declares a port named \"$out\" — that name is reserved for a resource's anonymous output; choose another name.`);\n}\nfunction requireConfigKeySegmentNames(names, kind, factory) {\n\tfor (const name of names) requireConfigKeySegmentName(name, kind, factory);\n}\nfunction freezeParams(params) {\n\tconst frozen = {};\n\tfor (const [name, param] of Object.entries(params)) frozen[name] = Object.freeze({ ...param });\n\treturn Object.freeze(frozen);\n}\n/** A frozen shallow copy that keeps the caller's declared type. */\nfunction frozenShallowCopy(obj) {\n\treturn blindCast(Object.freeze({ ...obj }));\n}\n/**\n* Seals a node instance after its constructor has assigned all fields — the\n* last statement of a concrete node class's constructor. A free function, not\n* a base-class method, so an instance stays structurally a plain frozen node.\n*/\nfunction freezeNode(node) {\n\tObject.freeze(node);\n\treturn node;\n}\n/**\n* Everything `resource()` establishes, minus the freeze — an extension\n* whose resource node carries extra fields extends this, assigns them, and\n* calls `freezeNode(this)` as its constructor's last statement.\n*/\nvar ResourceNodeBase = class {\n\t[NODE] = true;\n\tkind = \"resource\";\n\tname;\n\textension;\n\ttype;\n\tprovides;\n\tconstructor(def) {\n\t\trequireName(def.name, \"resource\");\n\t\trequireExtension(def.extension, \"resource\");\n\t\tconst provides = def.provides;\n\t\tif (typeof provides !== \"object\" || provides === null || typeof provides.kind !== \"string\" || provides.kind.length === 0 || typeof provides.satisfies !== \"function\") throw new Error(\"resource() requires `provides` — the Contract this resource offers (a non-empty `kind` plus its `satisfies()`).\");\n\t\tthis.name = def.name;\n\t\tthis.extension = def.extension;\n\t\tthis.type = provides.kind;\n\t\tthis.provides = provides;\n\t}\n};\n/** The core leaf: exactly the base, frozen. */\nvar FrozenResourceNode = class extends ResourceNodeBase {\n\tconstructor(def) {\n\t\tsuper(def);\n\t\tfreezeNode(this);\n\t}\n};\n/**\n* Constructs a branded, frozen Resource node — an identity plus the Contract\n* it provides; the routing `type` is the contract's `kind`. Pure — nothing\n* is provisioned until a module provisions it.\n*/\nfunction resource(def) {\n\treturn new FrozenResourceNode(def);\n}\n/**\n* Constructs a branded, frozen Service node — declarations only (inputs,\n* params, the input schema, build adapter, and the ports it exposes). Pure;\n* carries no runtime behavior.\n*/\nfunction service(def) {\n\trequireName(def.name, \"service\");\n\trequireExtension(def.extension, \"service\");\n\trequireType(def.type, \"service\");\n\trequireConfigKeySegmentNames(Object.keys(def.inputs), \"input\", \"service\");\n\trequireConfigKeySegmentNames(Object.keys(def.params), \"param\", \"service\");\n\tif (def.expose !== void 0) requireNotReservedPortNames(Object.keys(def.expose), \"service\");\n\tif (def.input !== void 0 && typeof def.input[\"~standard\"]?.validate !== \"function\") throw new Error(\"service() `input` must be a Standard Schema (an object with a \\\"~standard\\\".validate function) — see https://standardschema.dev (ADR-0042).\");\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"service\",\n\t\tname: def.name,\n\t\textension: def.extension,\n\t\ttype: def.type,\n\t\tinputs: frozenShallowCopy(def.inputs),\n\t\tparams: freezeParams(def.params),\n\t\tinputSchema: blindCast(def.input),\n\t\tbuild: Object.freeze({ ...def.build }),\n\t\texpose: def.expose !== void 0 ? frozenShallowCopy(def.expose) : void 0\n\t});\n}\n/**\n* Constructs a branded, frozen DependencyEnd. `required` (if given) is the\n* contract Load compares a wired ref against via `satisfies()`; an unnamed\n* end's diagnostic `name` falls back to its `type`.\n*/\nfunction dependency(def) {\n\trequireType(def.type, \"dependency\");\n\trequireConfigKeySegmentNames(Object.keys(def.connection.params), \"param\", \"dependency\");\n\tconst connection = Object.freeze({\n\t\tparams: freezeParams(def.connection.params),\n\t\thydrate: def.connection.hydrate\n\t});\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"dependency\",\n\t\tname: def.name !== void 0 && def.name.length > 0 ? def.name : def.type,\n\t\ttype: def.type,\n\t\tconnection,\n\t\trequired: def.required\n\t});\n}\n/**\n* Constructs a branded, frozen Module node. Construction is INERT — the body is\n* wiring, not user code, and runs only when the module is Loaded.\n*/\nfunction module(name, boundaryOrBody, maybeBody) {\n\trequireName(name, \"module\");\n\tconst closedRoot = typeof boundaryOrBody === \"function\";\n\tconst boundary = closedRoot ? {} : boundaryOrBody;\n\trequireNotReservedPortNames(Object.keys(boundary.deps ?? {}), \"module\");\n\trequireNotReservedPortNames(Object.keys(boundary.expose ?? {}), \"module\");\n\tconst deps = frozenShallowCopy(boundary.deps ?? {});\n\tconst secretSlots = frozenShallowCopy(boundary.secrets ?? {});\n\tconst paramSlots = frozenShallowCopy(boundary.params ?? {});\n\tconst expose = frozenShallowCopy(boundary.expose ?? {});\n\tconst body = closedRoot ? (ctx) => {\n\t\tboundaryOrBody(ctx);\n\t\treturn {};\n\t} : maybeBody;\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"module\",\n\t\tname,\n\t\tdeps,\n\t\tsecretSlots,\n\t\tparamSlots,\n\t\texpose,\n\t\tbody\n\t});\n}\n/**\n* True if `value` was constructed by this module's factories. Checks the\n* brand only, never a prototype — a graph may mix nodes from a different\n* installed copy of core (dual-package hazard).\n*/\nfunction isNode(value) {\n\treturn typeof value === \"object\" && value !== null && value[NODE] === true;\n}\n//#endregion\n//#region src/toposort.ts\n/**\n* Stable topological sort: every edge's `from` precedes its `to` in the\n* result. Ties (nodes with no ordering constraint between them) keep their\n* relative order from `nodes` — so a graph already authored producer-first\n* comes out byte-identical to its pre-sort layout; only a graph that\n* genuinely needs reordering (e.g. a module wired via a forged ref pointing at a\n* not-yet-provisioned producer) actually moves. A Kahn's-algorithm variant\n* that always picks the ready node with the smallest original index. Edges\n* whose endpoint falls outside `nodes` (e.g. a service-root's input edges\n* targeting the root, which is appended separately) are ignored. Cycles\n* cannot reach here: `assertDependencyDag` already rejects them for\n* dependency edges, and input edges never cycle.\n*/\nfunction topoSort(nodes, edges) {\n\tconst byId = new Map(nodes.map((n) => [n.id, n]));\n\tconst indexOf = new Map(nodes.map((n, i) => [n.id, i]));\n\tconst indegree = new Map(nodes.map((n) => [n.id, 0]));\n\tconst successors = /* @__PURE__ */ new Map();\n\tfor (const edge of edges) {\n\t\tif (!byId.has(edge.from) || !byId.has(edge.to)) continue;\n\t\tconst targets = successors.get(edge.from) ?? [];\n\t\ttargets.push(edge.to);\n\t\tsuccessors.set(edge.from, targets);\n\t\tindegree.set(edge.to, (indegree.get(edge.to) ?? 0) + 1);\n\t}\n\tconst ready = new Set(nodes.filter((n) => indegree.get(n.id) === 0).map((n) => n.id));\n\tconst order = [];\n\twhile (ready.size > 0) {\n\t\tlet next;\n\t\tlet bestIndex = Number.POSITIVE_INFINITY;\n\t\tfor (const id of ready) {\n\t\t\tconst index = indexOf.get(id) ?? Number.POSITIVE_INFINITY;\n\t\t\tif (index < bestIndex) {\n\t\t\t\tbestIndex = index;\n\t\t\t\tnext = id;\n\t\t\t}\n\t\t}\n\t\tif (next === void 0) break;\n\t\tready.delete(next);\n\t\torder.push(next);\n\t\tfor (const target of successors.get(next) ?? []) {\n\t\t\tconst remaining = (indegree.get(target) ?? 0) - 1;\n\t\t\tindegree.set(target, remaining);\n\t\t\tif (remaining === 0) ready.add(target);\n\t\t}\n\t}\n\tif (order.length !== nodes.length) throw new InternalError(`topological sort processed ${order.length} of ${nodes.length} nodes — the graph contains a cycle that slipped past the DAG validation.`);\n\treturn order.map((id) => byId.get(id)).filter((n) => n !== void 0);\n}\n//#endregion\n//#region src/load-service.ts\n/**\n* The declared boundary ports of a module or service node at `id`: dep slots\n* as `in` ports (contractKind = the slot's `type`), exposed contracts as\n* `out` ports (contractKind = the contract's `kind`). A resource's one\n* `$out` port is recorded at its provision site instead (load-module.ts).\n*/\nfunction boundaryPortsOf(id, node) {\n\tconst ports = [];\n\tconst slots = node.kind === \"module\" ? node.deps : node.inputs;\n\tfor (const [name, slot] of Object.entries(slots)) {\n\t\tconst type = typeof slot === \"object\" && slot !== null && \"type\" in slot && typeof slot.type === \"string\" ? slot.type : void 0;\n\t\tports.push({\n\t\t\tnode: id,\n\t\t\tdirection: \"in\",\n\t\t\tname,\n\t\t\tcontractKind: type\n\t\t});\n\t}\n\tfor (const [name, contract] of Object.entries(node.expose ?? {})) {\n\t\tconst kind = typeof contract === \"object\" && contract !== null && \"kind\" in contract && typeof contract.kind === \"string\" ? contract.kind : void 0;\n\t\tports.push({\n\t\t\tnode: id,\n\t\t\tdirection: \"out\",\n\t\t\tname,\n\t\t\tcontractKind: kind\n\t\t});\n\t}\n\treturn ports;\n}\nfunction serviceInputs(service, serviceId) {\n\tif (typeof service.inputs !== \"object\" || service.inputs === null) throw new LoadError(`Service \"${serviceId}\" has no inputs map.`);\n\tconst nodes = [];\n\tconst edges = [];\n\tfor (const [input, value] of Object.entries(service.inputs)) {\n\t\tconst kind = isNode(value) ? value.kind : void 0;\n\t\tif (kind === \"resource\") throw new LoadError(`Input \"${input}\" of \"${serviceId}\" is a resource node — a resource is provisioned by the composing module, never created for a service that mentions it. Declare the input as a dependency (the pack's dependency factory) and wire the module-provisioned resource's ref into it.`);\n\t\tif (kind !== \"dependency\") throw new LoadError(`Input \"${input}\" of \"${serviceId}\" is not a branded dependency end (construct it with the dependency() factory).`);\n\t\tif (value.type.length === 0) throw new LoadError(`Input \"${input}\" of \"${serviceId}\" has an empty node type.`);\n\t\tconst id = `${serviceId}.${input}`;\n\t\tnodes.push({\n\t\t\tid,\n\t\t\tparent: serviceId,\n\t\t\tnode: value\n\t\t});\n\t\tedges.push({\n\t\t\tfrom: id,\n\t\t\tto: serviceId,\n\t\t\tinput,\n\t\t\tkind: \"input\"\n\t\t});\n\t}\n\treturn {\n\t\tnodes,\n\t\tedges\n\t};\n}\nfunction loadService(root, rootId) {\n\tfor (const [input, value] of Object.entries(root.inputs)) if (isNode(value) && value.kind === \"dependency\") throw new LoadError(`Service \"${rootId}\" has an unwired dependency input \"${input}\" — this service is composed by a module; deploy the module instead of loading \"${rootId}\" directly.`);\n\tif (root.inputSchema !== void 0) throw new LoadError(`Service \"${rootId}\" declares an input schema but is being loaded directly — a lone service has no enclosing scope to bind its input. Compose it inside a module whose provision() call binds \\`input: { … }\\` (ADR-0042).`);\n\tconst rootGraphNode = {\n\t\tid: rootId,\n\t\tparent: void 0,\n\t\tnode: root\n\t};\n\tconst { nodes, edges } = serviceInputs(root, rootId);\n\treturn {\n\t\troot: rootGraphNode,\n\t\tnodes: [...topoSort(nodes, edges), rootGraphNode],\n\t\tedges,\n\t\tports: boundaryPortsOf(rootId, root),\n\t\tauthoredEdges: [],\n\t\tinputBindings: [],\n\t\tparams: []\n\t};\n}\n//#endregion\n//#region src/load-module.ts\n/**\n* Brands a ref-port with the AUTHORED endpoint it stands for — which port of\n* which node the author wired, before any forwarding chain resolves. Read\n* only by `authoredSourceOf`; `__providerId` keeps carrying the resolved\n* producer for the flat (post-dereference) edges.\n*/\nconst AUTHORED_PORT = Symbol(\"prisma:authored-port\");\n/** The authored out-port brand carried by `ref`, if any. */\nfunction authoredPortOf(ref) {\n\tif (typeof ref !== \"object\" || ref === null) return void 0;\n\tconst brand = blindCast(ref)[AUTHORED_PORT];\n\tif (typeof brand !== \"object\" || brand === null) return void 0;\n\tconst { node, name } = blindCast(brand);\n\treturn typeof node === \"string\" && typeof name === \"string\" ? {\n\t\tnode,\n\t\tname\n\t} : void 0;\n}\n/**\n* Builds the ref a provision() call hands back: the id (so a producer with no\n* exposed ports — or an untyped slot — can still be wired wholesale) plus one\n* ref-port per exposed contract, each the contract's own runtime value (so\n* its `satisfies()` still works) tagged with the provider's id.\n*/\nfunction refFor(id, service) {\n\tconst ports = {};\n\tfor (const [port, contract] of Object.entries(service.expose ?? {})) ports[port] = {\n\t\t...contract,\n\t\t__providerId: id,\n\t\t[AUTHORED_PORT]: {\n\t\t\tnode: id,\n\t\t\tname: port\n\t\t}\n\t};\n\treturn blindCast({\n\t\tid,\n\t\t...ports\n\t});\n}\n/**\n* The resource variant of refFor: a resource has exactly one port — the\n* contract it provides — flattened onto the ref itself, tagged with the\n* provider id. `id` and the authored brand are written last so a hostile\n* contract value cannot clobber them.\n*/\nfunction refForResource(id, resource) {\n\treturn blindCast({\n\t\t...resource.provides,\n\t\t__providerId: id,\n\t\tid,\n\t\t[AUTHORED_PORT]: {\n\t\t\tnode: id,\n\t\t\tname: RESOURCE_OUT_PORT\n\t\t}\n\t});\n}\n/** A wired value's producer id: a ref-port's `__providerId`, or a bare ref's `id`. */\nfunction producerIdOf(ref) {\n\tif (typeof ref !== \"object\" || ref === null) return void 0;\n\tif (\"__providerId\" in ref && typeof ref.__providerId === \"string\") return ref.__providerId;\n\tif (\"id\" in ref && typeof ref.id === \"string\") return ref.id;\n}\n/**\n* Brands each `ctx.inputs` entry with the input key it stands for (see\n* flatten): diagnostic only — usage attribution relies on the per-key object\n* identity the branding copy creates, never on reading this back.\n*/\nconst MODULE_INPUT_KEY = Symbol(\"prisma:module-input-key\");\n/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.secrets` forwarding channel. */\nconst MODULE_SECRET_KEY = Symbol(\"prisma:module-secret-key\");\n/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.params` forwarding channel. */\nconst MODULE_PARAM_KEY = Symbol(\"prisma:module-param-key\");\n/** Whether `ref` carries a callable `satisfies` that accepts `required` truthily. */\nfunction satisfiesRequired(ref, required) {\n\treturn typeof ref === \"object\" && ref !== null && \"satisfies\" in ref && typeof ref.satisfies === \"function\" && ref.satisfies(required);\n}\n/**\n* Checks one recorded `wiring` object against the Deps it was wired against:\n* every named input exists and is a dependency slot, every referenced\n* producer is a real (by-now-provisioned) address, and a wired ref whose\n* slot declares a required contract must satisfy() it — no producer-kind\n* branching, the contract alone determines validity, whether the producer is\n* a service port or a resource. Shared by both provisioned kinds so a\n* module-as-child gets exactly the checks a service gets, and run once per\n* entry against the one `byId` shared by the whole recursive flatten, so a\n* forwarded ref resolves through to its real producer address regardless of\n* which ancestor scope provisioned it.\n*/\nfunction validateWiring(pending, byId) {\n\tconst { deps, wiring, targetId, targetKind, enclosingModuleName } = pending;\n\tfor (const [input, ref] of Object.entries(wiring)) {\n\t\tconst declared = blindCast(deps[input]);\n\t\tif (declared === void 0 || !isNode(declared) || declared.kind !== \"dependency\") throw new LoadError(`The deps for \"${targetId}\" name \"${input}\", which is not a dependency slot of that ${targetKind}.`);\n\t\tconst producerId = producerIdOf(ref);\n\t\tconst producer = producerId !== void 0 ? byId.get(producerId) : void 0;\n\t\tif (producerId === void 0 || producer === void 0) throw new LoadError(`The deps for \"${targetId}.${input}\" reference \"${String(producerId)}\", which is not provisioned in module \"${enclosingModuleName}\".`);\n\t\tconst required = declared.required;\n\t\tif (required !== void 0 && !satisfiesRequired(ref, required)) throw new LoadError(`The deps for \"${targetId}.${input}\" do not satisfy the slot's required contract.`);\n\t}\n\tfor (const [input, rawValue] of Object.entries(deps)) {\n\t\tconst value = blindCast(rawValue);\n\t\tif (!isNode(value) || wiring[input] !== void 0) continue;\n\t\tif (value.kind === \"dependency\") throw new LoadError(`Dependency input \"${input}\" of provisioned ${targetKind} \"${targetId}\" is not wired to a producer (module \"${enclosingModuleName}\").`);\n\t}\n}\n/**\n* Flattens a value into itself plus every nested object/array member value —\n* identity fodder for the ctx.secrets/ctx.params usage marking, which must\n* see a forwarded source wherever it sits inside an input binding (ADR-0042).\n* A secret/param source is an opaque leaf: it is pushed (a forwarded ref IS\n* such a source, so identity-matching still needs it) but never descended\n* into, so a ref buried in an unrelated source's payload is not falsely seen\n* as used. `seen` guards object cycles so a self-referential binding cannot\n* recurse forever.\n*/\nfunction deepValues(value, out, seen = /* @__PURE__ */ new WeakSet()) {\n\tout.push(value);\n\tif (typeof value !== \"object\" || value === null) return;\n\tif (isSecretSource(value) || isParamSource(value)) return;\n\tif (seen.has(value)) return;\n\tseen.add(value);\n\tconst members = Array.isArray(value) ? value : Object.values(value);\n\tfor (const member of members) deepValues(member, out, seen);\n}\n/** The (unvalidated) edges a `wiring` object implies — one dependency edge per entry; `validateWiring` does the real checking. */\nfunction wiringEdges(wiring, targetId) {\n\treturn Object.entries(wiring).map(([input, ref]) => ({\n\t\tfrom: producerIdOf(ref) ?? \"\",\n\t\tto: targetId,\n\t\tinput,\n\t\tkind: \"dependency\"\n\t}));\n}\n/**\n* Checks the secrets wired into one provisioned child MODULE: every declared\n* forwarding slot is bound to a real secret source (an `envSecret` or a\n* forwarded ctx.secrets ref), and no wired key names a slot the module\n* doesn't declare — the secret analog of `validateWiring`'s per-input checks,\n* but resolved inline (a source carries its own name, so no whole-graph pass\n* is needed).\n*/\nfunction validateSecretBinding(child, id, secretWiring, enclosingModuleName) {\n\tconst { kind } = child;\n\tfor (const slot of Object.keys(child.secretSlots)) {\n\t\tconst bound = secretWiring[slot];\n\t\tif (bound === void 0) throw new LoadError(`Secret slot \"${slot}\" of provisioned ${kind} \"${id}\" is not bound (module \"${enclosingModuleName}\") — bind it with envSecret('NAME') or forward ctx.secrets.`);\n\t\tif (!isSecretSource(bound)) throw new LoadError(`Secret slot \"${slot}\" of \"${id}\" (module \"${enclosingModuleName}\") was wired with a non-secret value — use envSecret('NAME') or a forwarded ctx.secrets ref.`);\n\t}\n\tfor (const slot of Object.keys(secretWiring)) if (!Object.hasOwn(child.secretSlots, slot)) throw new LoadError(`The secrets for \"${id}\" name \"${slot}\", which is not a secret slot of that ${kind} (module \"${enclosingModuleName}\").`);\n}\n/**\n* Checks the params wired into a provisioned SERVICE: unlike a secret slot, a\n* declared param is never required to be bound here — it may fall back to its\n* own `default` (checked later, at `buildConfig`) — so this only rejects a\n* wired key that names something other than a real declared param.\n*/\nfunction validateServiceParamBinding(child, id, paramWiring, enclosingModuleName) {\n\tfor (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.params, slot)) throw new LoadError(`The params for \"${id}\" name \"${slot}\", which is not a param of that service (module \"${enclosingModuleName}\").`);\n}\n/**\n* Checks the params wired into a provisioned MODULE: every declared\n* param-forwarding slot must be bound to a real `ParamSource` — a slot has no\n* schema of its own, so (unlike a service param) it cannot fall back to a\n* literal or a default; the param analog of `validateSecretBinding`.\n*/\nfunction validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {\n\tfor (const slot of Object.keys(child.paramSlots)) {\n\t\tconst bound = paramWiring[slot];\n\t\tif (bound === void 0) throw new LoadError(`Param slot \"${slot}\" of provisioned module \"${id}\" is not bound (module \"${enclosingModuleName}\") — bind it with a param source (e.g. envParam('NAME')) or forward ctx.params.`);\n\t\tif (!isParamSource(bound)) throw new LoadError(`Param slot \"${slot}\" of \"${id}\" (module \"${enclosingModuleName}\") was wired with a non-source value — a module param-forwarding slot carries no schema to validate a literal against; use envParam('NAME') or a forwarded ctx.params ref.`);\n\t}\n\tfor (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.paramSlots, slot)) throw new LoadError(`The params for \"${id}\" name \"${slot}\", which is not a param slot of that module (module \"${enclosingModuleName}\").`);\n}\n/**\n* Recursively flattens one module's body into the shared graph state and\n* returns its resolved ModuleOutputs (one ref-port per expose key) for the\n* caller (the enclosing provision() call, or Load itself for the root) to\n* use. `address` is this module's OWN full address, or `undefined` for the root\n* scope — its direct children then get bare (unprefixed) addresses, keeping\n* a single-level module identical to before nesting existed. `wiring` supplies a\n* resolved producer ref-port for each of this module's OWN declared deps (empty\n* for the root, which may not declare any — see the root non-empty-deps\n* check in loadModule). `nodes`, `edges`, `pending`, and `byId` are shared\n* across the ENTIRE recursive flatten, not per scope — a nested module may\n* forward in a producer provisioned by an ancestor scope, and it is the\n* shared `byId` (keyed by full address) that lets that resolve.\n*\n* `selfId` is this module's own node id — the root's given id when `address`\n* is `undefined`, the full address otherwise. It anchors the authored view:\n* children carry it as their `parent`, and this module's own boundary ports\n* (and the authored edges touching them) are recorded against it.\n*/\nfunction flatten(moduleNode, address, selfId, wiring, secretWiring, paramWiring, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges) {\n\tports.push(...boundaryPortsOf(selfId, moduleNode));\n\tconst localIds = /* @__PURE__ */ new Set();\n\tconst used = /* @__PURE__ */ new Set();\n\tconst usedSecrets = /* @__PURE__ */ new Set();\n\tconst usedParams = /* @__PURE__ */ new Set();\n\tconst ctxInputs = {};\n\tfor (const key of Object.keys(moduleNode.deps)) {\n\t\tconst wired = wiring[key];\n\t\tctxInputs[key] = typeof wired === \"object\" && wired !== null ? {\n\t\t\t...wired,\n\t\t\t[MODULE_INPUT_KEY]: key\n\t\t} : wired;\n\t}\n\tconst markUsed = (values) => {\n\t\tfor (const value of values) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);\n\t};\n\tconst authoredSourceOf = (value) => {\n\t\tfor (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) return {\n\t\t\tnode: selfId,\n\t\t\tdirection: \"in\",\n\t\t\tname: key\n\t\t};\n\t\tconst brand = authoredPortOf(value);\n\t\treturn brand === void 0 ? void 0 : {\n\t\t\tnode: brand.node,\n\t\t\tdirection: \"out\",\n\t\t\tname: brand.name\n\t\t};\n\t};\n\t/** Records the authored edge each wiring entry declares: source port → the target's own `in` port. */\n\tconst recordAuthoredWiring = (targetId, targetWiring) => {\n\t\tfor (const [input, ref] of Object.entries(targetWiring)) {\n\t\t\tconst from = authoredSourceOf(ref);\n\t\t\tif (from !== void 0) authoredEdges.push({\n\t\t\t\tfrom,\n\t\t\t\tto: {\n\t\t\t\t\tnode: targetId,\n\t\t\t\t\tdirection: \"in\",\n\t\t\t\t\tname: input\n\t\t\t\t}\n\t\t\t});\n\t\t}\n\t};\n\tconst ctxSecrets = {};\n\tfor (const key of Object.keys(moduleNode.secretSlots)) {\n\t\tconst bound = secretWiring[key];\n\t\tctxSecrets[key] = typeof bound === \"object\" && bound !== null ? {\n\t\t\t...bound,\n\t\t\t[MODULE_SECRET_KEY]: key\n\t\t} : bound;\n\t}\n\tconst markSecretsUsed = (values) => {\n\t\tfor (const value of values) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);\n\t};\n\tconst ctxParams = {};\n\tfor (const key of Object.keys(moduleNode.paramSlots)) {\n\t\tconst bound = paramWiring[key];\n\t\tctxParams[key] = typeof bound === \"object\" && bound !== null ? {\n\t\t\t...bound,\n\t\t\t[MODULE_PARAM_KEY]: key\n\t\t} : bound;\n\t}\n\tconst markParamsUsed = (values) => {\n\t\tfor (const value of values) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);\n\t};\n\tconst provision = (child, opts) => {\n\t\tconst id = opts?.id ?? child.name;\n\t\tconst provisionWiring = opts?.deps;\n\t\tconst provisionSecrets = opts?.secrets;\n\t\tconst provisionInput = opts?.input;\n\t\tconst provisionParams = opts?.params;\n\t\tif (typeof id !== \"string\" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module \"${moduleNode.name}\").`);\n\t\tif (!isConfigKeySegment(id)) throw new LoadError(`provision() id \"${id}\" (module \"${moduleNode.name}\") must contain only ASCII letters and digits ([A-Za-z0-9]) — the id becomes an address segment, and addresses derive deterministic config keys (segments uppercased and joined with \"_\"). \"${id}\" would put \"${id.toUpperCase()}\" inside the derived key. (\"_\" collides with the key separator and \".\" with the address separator.)`);\n\t\tif (localIds.has(id)) throw new LoadError(`Duplicate provision id \"${id}\" in module \"${moduleNode.name}\".`);\n\t\tconst untrusted = child;\n\t\tif (!isNode(untrusted) || untrusted.kind !== \"service\" && untrusted.kind !== \"resource\" && untrusted.kind !== \"module\") throw new LoadError(`provision(\"${id}\") expects a branded service, resource, or module node (construct it with the service()/resource()/module() factories or a pack's own).`);\n\t\tlocalIds.add(id);\n\t\tconst fullAddress = address === void 0 ? id : `${address}.${id}`;\n\t\tif (child.kind === \"resource\") {\n\t\t\tif (provisionWiring !== void 0) throw new LoadError(`provision(\"${id}\") received deps for a resource — a resource has no dependency slots to satisfy.`);\n\t\t\tif (provisionSecrets !== void 0) throw new LoadError(`provision(\"${id}\") received secrets for a resource — a resource has no secret slots to satisfy.`);\n\t\t\tif (provisionInput !== void 0) throw new LoadError(`provision(\"${id}\") received an input binding for a resource — a resource declares no input schema.`);\n\t\t\tif (provisionParams !== void 0) throw new LoadError(`provision(\"${id}\") received params for a resource — a resource has no params to satisfy.`);\n\t\t\tif (child.type.length === 0) throw new LoadError(`provision(\"${id}\") received a resource with an empty node type.`);\n\t\t\tbyId.set(fullAddress, child);\n\t\t\tnodes.push({\n\t\t\t\tid: fullAddress,\n\t\t\t\tparent: selfId,\n\t\t\t\tnode: child\n\t\t\t});\n\t\t\tports.push({\n\t\t\t\tnode: fullAddress,\n\t\t\t\tdirection: \"out\",\n\t\t\t\tname: RESOURCE_OUT_PORT,\n\t\t\t\tcontractKind: child.provides.kind\n\t\t\t});\n\t\t\treturn refForResource(fullAddress, child);\n\t\t}\n\t\tconst localWiring = { ...provisionWiring ?? {} };\n\t\tmarkUsed(Object.values(localWiring));\n\t\tconst localSecrets = { ...provisionSecrets ?? {} };\n\t\tmarkSecretsUsed(Object.values(localSecrets));\n\t\tconst localParams = { ...provisionParams ?? {} };\n\t\tmarkParamsUsed(Object.values(localParams));\n\t\tif (child.kind === \"service\") {\n\t\t\tif (provisionSecrets !== void 0) throw new LoadError(`provision(\"${id}\") received secrets for a service — a service takes its secrets as envSecret(...) leaves of its \\`input\\` binding (ADR-0042), not a secrets map.`);\n\t\t\tif (child.inputSchema !== void 0 && provisionInput === void 0) throw new LoadError(`Input of provisioned service \"${id}\" is not bound (module \"${moduleNode.name}\") — the service declares an input schema; bind it with \\`input: { … }\\` on its provision() call.`);\n\t\t\tif (child.inputSchema === void 0 && provisionInput !== void 0) throw new LoadError(`provision(\"${id}\") received an input binding, but the service declares no input schema (module \"${moduleNode.name}\").`);\n\t\t\tif (provisionInput !== void 0) {\n\t\t\t\tconst leaves = [];\n\t\t\t\tdeepValues(provisionInput, leaves);\n\t\t\t\tmarkSecretsUsed(leaves);\n\t\t\t\tmarkParamsUsed(leaves);\n\t\t\t\tinputBindings.push({\n\t\t\t\t\tserviceAddress: fullAddress,\n\t\t\t\t\tbinding: blindCast(provisionInput)\n\t\t\t\t});\n\t\t\t}\n\t\t\tvalidateServiceParamBinding(child, id, localParams, moduleNode.name);\n\t\t\tfor (const [slot, binding] of Object.entries(localParams)) paramBindings.push({\n\t\t\t\tserviceAddress: fullAddress,\n\t\t\t\tslot,\n\t\t\t\tbinding\n\t\t\t});\n\t\t\tconst inputs = serviceInputs(child, fullAddress);\n\t\t\tnodes.push(...inputs.nodes, {\n\t\t\t\tid: fullAddress,\n\t\t\t\tparent: selfId,\n\t\t\t\tnode: child\n\t\t\t});\n\t\t\tedges.push(...inputs.edges, ...wiringEdges(localWiring, fullAddress));\n\t\t\tports.push(...boundaryPortsOf(fullAddress, child));\n\t\t\trecordAuthoredWiring(fullAddress, localWiring);\n\t\t\tpending.push({\n\t\t\t\tdeps: child.inputs,\n\t\t\t\twiring: localWiring,\n\t\t\t\ttargetId: fullAddress,\n\t\t\t\ttargetKind: \"service\",\n\t\t\t\tenclosingModuleName: moduleNode.name\n\t\t\t});\n\t\t\tbyId.set(fullAddress, child);\n\t\t\treturn refFor(fullAddress, child);\n\t\t}\n\t\tif (provisionInput !== void 0) throw new LoadError(`provision(\"${id}\") received an input binding for a module — a module has no input schema; bind the input on the service that declares it.`);\n\t\tvalidateSecretBinding(child, id, localSecrets, moduleNode.name);\n\t\tvalidateParamNeedBinding(child, id, localParams, moduleNode.name);\n\t\tedges.push(...wiringEdges(localWiring, fullAddress));\n\t\trecordAuthoredWiring(fullAddress, localWiring);\n\t\tpending.push({\n\t\t\tdeps: child.deps,\n\t\t\twiring: localWiring,\n\t\t\ttargetId: fullAddress,\n\t\t\ttargetKind: \"module\",\n\t\t\tenclosingModuleName: moduleNode.name\n\t\t});\n\t\tconst childOutputs = flatten(child, fullAddress, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges);\n\t\tnodes.push({\n\t\t\tid: fullAddress,\n\t\t\tparent: selfId,\n\t\t\tnode: child\n\t\t});\n\t\tbyId.set(fullAddress, child);\n\t\tconst brandedOutputs = {};\n\t\tfor (const [key, value] of Object.entries(childOutputs)) brandedOutputs[key] = typeof value === \"object\" && value !== null ? {\n\t\t\t...value,\n\t\t\t[AUTHORED_PORT]: {\n\t\t\t\tnode: fullAddress,\n\t\t\t\tname: key\n\t\t\t}\n\t\t} : value;\n\t\treturn blindCast({\n\t\t\tid: fullAddress,\n\t\t\t...brandedOutputs\n\t\t});\n\t};\n\tconst ctx = blindCast({\n\t\tinputs: ctxInputs,\n\t\tsecrets: ctxSecrets,\n\t\tparams: ctxParams,\n\t\tprovision: blindCast(provision)\n\t});\n\tconst outputs = blindCast(moduleNode.body(ctx) ?? {});\n\tmarkUsed(Object.values(outputs));\n\tfor (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares input \"${key}\" but never forwards it into a provision nor returns it as an output.`);\n\tfor (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares secret \"${key}\" but never forwards it into a provision.`);\n\tfor (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares param \"${key}\" but never forwards it into a provision.`);\n\tfor (const [key, contract] of Object.entries(moduleNode.expose)) {\n\t\tconst port = outputs[key];\n\t\tif (port === void 0) throw new LoadError(`Module \"${moduleNode.name}\" declares expose \"${key}\" but its body did not return a port for it.`);\n\t\tif (!satisfiesRequired(port, contract)) throw new LoadError(`Module \"${moduleNode.name}\"'s returned port for expose \"${key}\" does not satisfy its declared contract.`);\n\t\tconst from = authoredSourceOf(port);\n\t\tif (from !== void 0) authoredEdges.push({\n\t\t\tfrom,\n\t\t\tto: {\n\t\t\t\tnode: selfId,\n\t\t\t\tdirection: \"out\",\n\t\t\t\tname: key\n\t\t\t}\n\t\t});\n\t}\n\treturn outputs;\n}\nfunction loadModule(root, opts) {\n\tconst rootId = opts?.id ?? root.name;\n\tconst rootDepKeys = Object.keys(root.deps);\n\tif (rootDepKeys.length > 0) {\n\t\tconst names = rootDepKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares input${rootDepKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to wire them; compose \"${root.name}\" from another module that provisions and wires it instead.`);\n\t}\n\tconst rootSecretKeys = Object.keys(root.secretSlots);\n\tif (rootSecretKeys.length > 0) {\n\t\tconst names = rootSecretKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares secret${rootSecretKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds secrets with envSecret('NAME'), it does not declare secret slots of its own.`);\n\t}\n\tconst rootParamKeys = Object.keys(root.paramSlots);\n\tif (rootParamKeys.length > 0) {\n\t\tconst names = rootParamKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares param${rootParamKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds params directly on each provision() call, it does not declare param-forwarding slots of its own.`);\n\t}\n\tconst nodes = [];\n\tconst edges = [];\n\tconst pending = [];\n\tconst inputBindings = [];\n\tconst paramBindings = [];\n\tconst byId = /* @__PURE__ */ new Map();\n\tconst ports = [];\n\tconst authoredEdges = [];\n\tflatten(root, void 0, rootId, {}, {}, {}, nodes, edges, pending, inputBindings, paramBindings, byId, ports, authoredEdges);\n\tfor (const entry of pending) validateWiring(entry, byId);\n\tassertDependencyDag(edges);\n\tconst rootGraphNode = {\n\t\tid: rootId,\n\t\tparent: void 0,\n\t\tnode: root\n\t};\n\treturn {\n\t\troot: rootGraphNode,\n\t\tnodes: [...topoSort(nodes, edges), rootGraphNode],\n\t\tedges,\n\t\tports,\n\t\tauthoredEdges,\n\t\tinputBindings,\n\t\tparams: paramBindings\n\t};\n}\n/**\n* The dependency edges must form a DAG — a cycle means neither producer can\n* deploy first. Resources take no wiring, so only service/module-to-service/module\n* edges can ever participate in a cycle; no special-casing needed.\n*/\nfunction assertDependencyDag(edges) {\n\tconst adjacency = /* @__PURE__ */ new Map();\n\tfor (const edge of edges) {\n\t\tif (edge.kind !== \"dependency\") continue;\n\t\tconst targets = adjacency.get(edge.from) ?? [];\n\t\ttargets.push(edge.to);\n\t\tadjacency.set(edge.from, targets);\n\t}\n\tconst visiting = /* @__PURE__ */ new Set();\n\tconst done = /* @__PURE__ */ new Set();\n\tconst stack = [];\n\tconst visit = (id) => {\n\t\tif (done.has(id)) return;\n\t\tif (visiting.has(id)) throw new LoadError(`Dependency cycle: ${[...stack.slice(stack.indexOf(id)), id].join(\" → \")} — no deploy order exists.`);\n\t\tvisiting.add(id);\n\t\tstack.push(id);\n\t\tfor (const next of adjacency.get(id) ?? []) visit(next);\n\t\tstack.pop();\n\t\tvisiting.delete(id);\n\t\tdone.add(id);\n\t};\n\tfor (const id of adjacency.keys()) visit(id);\n}\n//#endregion\n//#region src/graph.ts\n/**\n* Builds the in-memory graph from a root node. A service root walks its own\n* `inputs`; a module root executes its body (wiring, not user code — the\n* designed exception to imports-run-nothing) and recursively flattens every\n* module it provisions into one graph of hierarchical addresses. A malformed\n* graph is a `LoadError` that names its fix; the individual validation rules\n* live with `loadService` / `loadModule` and are covered by name in the Load\n* tests. Executes nothing of the user's own code beyond module bodies.\n*/\nfunction Load(root, opts) {\n\tif (!isNode(root)) throw new LoadError(\"Load expects a branded service or module node (construct it with the service()/module() factories).\");\n\tif (root.kind === \"module\") return loadModule(root, opts);\n\tif (root.kind === \"service\") return loadService(root, opts?.id ?? \"root\");\n\tthrow new LoadError(\"Load expects a service or module root (received another node kind).\");\n}\n//#endregion\nexport { LoadError as _, isNode as a, isSecretSource as c, paramSource as d, provisionNeed as f, service as g, secretSource as h, freezeNode as i, module as l, secret as m, ResourceNodeBase as n, isParamSource as o, resource as p, dependency as r, isProvisionNeed as s, Load as t, paramNeed as u, RESOURCE_OUT_PORT as v };\n\n//# sourceMappingURL=graph-BfKAg2Ap.mjs.map"],"mappings":";;;;;AAIA,MAAM,oBAAoB;;;;;;;AAO1B,IAAI,YAAY,cAAc,mBAAmB;CAChD,YAAY,SAAS;EACpB,MAAM,yBAAyB,OAAO;CACvC;AACD;;;;;AAOA,MAAM,OAAO,OAAO,IAAI,aAAa;AACrC,MAAM,cAAc,UAAU,OAAO,IAAI,oBAAoB,CAAC;AAC9D,MAAM,gBAAgB,UAAU,OAAO,IAAI,sBAAsB,CAAC;;AAElE,SAAS,SAAS;CACjB,OAAO,OAAO,OAAO;GACnB,cAAc;EACf,MAAM;CACP,CAAC;AACF;;AAEA,SAAS,aAAa,SAAS;CAC9B,OAAO,OAAO,OAAO;GACnB,gBAAgB;EACjB;CACD,CAAC;AACF;;AAEA,SAAS,eAAe,OAAO;CAC9B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,mBAAmB;AAC3F;AACA,MAAM,iBAAiB,UAAU,OAAO,IAAI,uBAAuB,CAAC;;AAEpE,SAAS,cAAc,OAAO,SAAS;CACtC,OAAO,UAAU,OAAO,OAAO;GAC7B,iBAAiB;EAClB;EACA;CACD,CAAC,CAAC;AACH;;AAEA,SAAS,gBAAgB,OAAO;CAC/B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,oBAAoB;AAC5F;AACA,MAAM,eAAe,UAAU,OAAO,IAAI,qBAAqB,CAAC;AAChE,MAAM,aAAa,UAAU,OAAO,IAAI,mBAAmB,CAAC;;AAE5D,SAAS,YAAY,SAAS;CAC7B,OAAO,OAAO,OAAO;GACnB,eAAe;EAChB;CACD,CAAC;AACF;;AAEA,SAAS,cAAc,OAAO;CAC7B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,kBAAkB;AAC1F;;AAEA,SAAS,YAAY;CACpB,OAAO,OAAO,OAAO;GACnB,aAAa;EACd,MAAM;CACP,CAAC;AACF;AACA,SAAS,YAAY,MAAM,SAAS;CACnC,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,mCAAmC;AAClH;AACA,SAAS,YAAY,MAAM,SAAS;CACnC,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,8BAA8B;AAC7G;AACA,SAAS,iBAAiB,WAAW,SAAS;CAC7C,IAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,4EAA4E;AACrK;;;;;;;AAOA,SAAS,mBAAmB,MAAM;CACjC,OAAO,iBAAiB,KAAK,IAAI;AAClC;AACA,SAAS,4BAA4B,MAAM,MAAM,SAAS;CACzD,IAAI,CAAC,mBAAmB,IAAI,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,KAAK,KAAK,SAAS,KAAK,6TAA6T,KAAK,eAAe,KAAK,YAAY,EAAE,0BAA0B;AACjd;;;;;;;;AAQA,SAAS,4BAA4B,OAAO,SAAS;CACpD,KAAK,MAAM,QAAQ,OAAO,IAAI,SAAS,QAAQ,MAAM,IAAI,MAAM,GAAG,QAAQ,gHAAgH;AAC3L;AACA,SAAS,6BAA6B,OAAO,MAAM,SAAS;CAC3D,KAAK,MAAM,QAAQ,OAAO,4BAA4B,MAAM,MAAM,OAAO;AAC1E;AACA,SAAS,aAAa,QAAQ;CAC7B,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAAG,OAAO,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,CAAC;CAC7F,OAAO,OAAO,OAAO,MAAM;AAC5B;;AAEA,SAAS,kBAAkB,KAAK;CAC/B,OAAO,UAAU,OAAO,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC3C;;;;;;AAMA,SAAS,WAAW,MAAM;CACzB,OAAO,OAAO,IAAI;CAClB,OAAO;AACR;;;;;;AAMA,IAAI,mBAAmB,MAAM;CAC5B,CAAC,QAAQ;CACT,OAAO;CACP;CACA;CACA;CACA;CACA,YAAY,KAAK;EAChB,YAAY,IAAI,MAAM,UAAU;EAChC,iBAAiB,IAAI,WAAW,UAAU;EAC1C,MAAM,WAAW,IAAI;EACrB,IAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,WAAW,KAAK,OAAO,SAAS,cAAc,YAAY,MAAM,IAAI,MAAM,iHAAiH;EACvS,KAAK,OAAO,IAAI;EAChB,KAAK,YAAY,IAAI;EACrB,KAAK,OAAO,SAAS;EACrB,KAAK,WAAW;CACjB;AACD;;AAEA,IAAI,qBAAqB,cAAc,iBAAiB;CACvD,YAAY,KAAK;EAChB,MAAM,GAAG;EACT,WAAW,IAAI;CAChB;AACD;;;;;;AAMA,SAAS,SAAS,KAAK;CACtB,OAAO,IAAI,mBAAmB,GAAG;AAClC;;;;;;AAMA,SAAS,QAAQ,KAAK;CACrB,YAAY,IAAI,MAAM,SAAS;CAC/B,iBAAiB,IAAI,WAAW,SAAS;CACzC,YAAY,IAAI,MAAM,SAAS;CAC/B,6BAA6B,OAAO,KAAK,IAAI,MAAM,GAAG,SAAS,SAAS;CACxE,6BAA6B,OAAO,KAAK,IAAI,MAAM,GAAG,SAAS,SAAS;CACxE,IAAI,IAAI,WAAW,KAAK,GAAG,4BAA4B,OAAO,KAAK,IAAI,MAAM,GAAG,SAAS;CACzF,IAAI,IAAI,UAAU,KAAK,KAAK,OAAO,IAAI,MAAM,YAAY,EAAE,aAAa,YAAY,MAAM,IAAI,MAAM,6IAA6I;CACjP,OAAO,OAAO,OAAO;GACnB,OAAO;EACR,MAAM;EACN,MAAM,IAAI;EACV,WAAW,IAAI;EACf,MAAM,IAAI;EACV,QAAQ,kBAAkB,IAAI,MAAM;EACpC,QAAQ,aAAa,IAAI,MAAM;EAC/B,aAAa,UAAU,IAAI,KAAK;EAChC,OAAO,OAAO,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC;EACrC,QAAQ,IAAI,WAAW,KAAK,IAAI,kBAAkB,IAAI,MAAM,IAAI,KAAK;CACtE,CAAC;AACF;;;;;;AAMA,SAAS,WAAW,KAAK;CACxB,YAAY,IAAI,MAAM,YAAY;CAClC,6BAA6B,OAAO,KAAK,IAAI,WAAW,MAAM,GAAG,SAAS,YAAY;CACtF,MAAM,aAAa,OAAO,OAAO;EAChC,QAAQ,aAAa,IAAI,WAAW,MAAM;EAC1C,SAAS,IAAI,WAAW;CACzB,CAAC;CACD,OAAO,OAAO,OAAO;GACnB,OAAO;EACR,MAAM;EACN,MAAM,IAAI,SAAS,KAAK,KAAK,IAAI,KAAK,SAAS,IAAI,IAAI,OAAO,IAAI;EAClE,MAAM,IAAI;EACV;EACA,UAAU,IAAI;CACf,CAAC;AACF;;;;;AAKA,SAAS,OAAO,MAAM,gBAAgB,WAAW;CAChD,YAAY,MAAM,QAAQ;CAC1B,MAAM,aAAa,OAAO,mBAAmB;CAC7C,MAAM,WAAW,aAAa,CAAC,IAAI;CACnC,4BAA4B,OAAO,KAAK,SAAS,QAAQ,CAAC,CAAC,GAAG,QAAQ;CACtE,4BAA4B,OAAO,KAAK,SAAS,UAAU,CAAC,CAAC,GAAG,QAAQ;CACxE,MAAM,OAAO,kBAAkB,SAAS,QAAQ,CAAC,CAAC;CAClD,MAAM,cAAc,kBAAkB,SAAS,WAAW,CAAC,CAAC;CAC5D,MAAM,aAAa,kBAAkB,SAAS,UAAU,CAAC,CAAC;CAC1D,MAAM,SAAS,kBAAkB,SAAS,UAAU,CAAC,CAAC;CACtD,MAAM,OAAO,cAAc,QAAQ;EAClC,eAAe,GAAG;EAClB,OAAO,CAAC;CACT,IAAI;CACJ,OAAO,OAAO,OAAO;GACnB,OAAO;EACR,MAAM;EACN;EACA;EACA;EACA;EACA;EACA;CACD,CAAC;AACF;;;;;;AAMA,SAAS,OAAO,OAAO;CACtB,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,UAAU;AACvE;;;;;;;;;;;;;;AAgBA,SAAS,SAAS,OAAO,OAAO;CAC/B,MAAM,OAAO,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CAChD,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CACtD,MAAM,WAAW,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CACpD,MAAM,6BAA6B,IAAI,IAAI;CAC3C,KAAK,MAAM,QAAQ,OAAO;EACzB,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,EAAE,GAAG;EAChD,MAAM,UAAU,WAAW,IAAI,KAAK,IAAI,KAAK,CAAC;EAC9C,QAAQ,KAAK,KAAK,EAAE;EACpB,WAAW,IAAI,KAAK,MAAM,OAAO;EACjC,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,EAAE,KAAK,KAAK,CAAC;CACvD;CACA,MAAM,QAAQ,IAAI,IAAI,MAAM,QAAQ,MAAM,SAAS,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC;CACpF,MAAM,QAAQ,CAAC;CACf,OAAO,MAAM,OAAO,GAAG;EACtB,IAAI;EACJ,IAAI,YAAY,OAAO;EACvB,KAAK,MAAM,MAAM,OAAO;GACvB,MAAM,QAAQ,QAAQ,IAAI,EAAE,KAAK,OAAO;GACxC,IAAI,QAAQ,WAAW;IACtB,YAAY;IACZ,OAAO;GACR;EACD;EACA,IAAI,SAAS,KAAK,GAAG;EACrB,MAAM,OAAO,IAAI;EACjB,MAAM,KAAK,IAAI;EACf,KAAK,MAAM,UAAU,WAAW,IAAI,IAAI,KAAK,CAAC,GAAG;GAChD,MAAM,aAAa,SAAS,IAAI,MAAM,KAAK,KAAK;GAChD,SAAS,IAAI,QAAQ,SAAS;GAC9B,IAAI,cAAc,GAAG,MAAM,IAAI,MAAM;EACtC;CACD;CACA,IAAI,MAAM,WAAW,MAAM,QAAQ,MAAM,IAAI,cAAc,8BAA8B,MAAM,OAAO,MAAM,MAAM,OAAO,0EAA0E;CACnM,OAAO,MAAM,KAAK,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,KAAK,CAAC;AAClE;;;;;;;AASA,SAAS,gBAAgB,IAAI,MAAM;CAClC,MAAM,QAAQ,CAAC;CACf,MAAM,QAAQ,KAAK,SAAS,WAAW,KAAK,OAAO,KAAK;CACxD,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,GAAG;EACjD,MAAM,OAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,UAAU,QAAQ,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,KAAK;EAC7H,MAAM,KAAK;GACV,MAAM;GACN,WAAW;GACX;GACA,cAAc;EACf,CAAC;CACF;CACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,GAAG;EACjE,MAAM,OAAO,OAAO,aAAa,YAAY,aAAa,QAAQ,UAAU,YAAY,OAAO,SAAS,SAAS,WAAW,SAAS,OAAO,KAAK;EACjJ,MAAM,KAAK;GACV,MAAM;GACN,WAAW;GACX;GACA,cAAc;EACf,CAAC;CACF;CACA,OAAO;AACR;AACA,SAAS,cAAc,SAAS,WAAW;CAC1C,IAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,WAAW,MAAM,MAAM,IAAI,UAAU,YAAY,UAAU,qBAAqB;CAClI,MAAM,QAAQ,CAAC;CACf,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,QAAQ,MAAM,GAAG;EAC5D,MAAM,OAAO,OAAO,KAAK,IAAI,MAAM,OAAO,KAAK;EAC/C,IAAI,SAAS,YAAY,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,kPAAkP;EACjU,IAAI,SAAS,cAAc,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,gFAAgF;EACjK,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,0BAA0B;EAC7G,MAAM,KAAK,GAAG,UAAU,GAAG;EAC3B,MAAM,KAAK;GACV;GACA,QAAQ;GACR,MAAM;EACP,CAAC;EACD,MAAM,KAAK;GACV,MAAM;GACN,IAAI;GACJ;GACA,MAAM;EACP,CAAC;CACF;CACA,OAAO;EACN;EACA;CACD;AACD;AACA,SAAS,YAAY,MAAM,QAAQ;CAClC,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG,IAAI,OAAO,KAAK,KAAK,MAAM,SAAS,cAAc,MAAM,IAAI,UAAU,YAAY,OAAO,qCAAqC,MAAM,kFAAkF,OAAO,YAAY;CACnS,IAAI,KAAK,gBAAgB,KAAK,GAAG,MAAM,IAAI,UAAU,YAAY,OAAO,wMAAwM;CAChR,MAAM,gBAAgB;EACrB,IAAI;EACJ,QAAQ,KAAK;EACb,MAAM;CACP;CACA,MAAM,EAAE,OAAO,UAAU,cAAc,MAAM,MAAM;CACnD,OAAO;EACN,MAAM;EACN,OAAO,CAAC,GAAG,SAAS,OAAO,KAAK,GAAG,aAAa;EAChD;EACA,OAAO,gBAAgB,QAAQ,IAAI;EACnC,eAAe,CAAC;EAChB,eAAe,CAAC;EAChB,QAAQ,CAAC;CACV;AACD;;;;;;;AASA,MAAM,gBAAgB,OAAO,sBAAsB;;AAEnD,SAAS,eAAe,KAAK;CAC5B,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO,KAAK;CACzD,MAAM,QAAQ,UAAU,GAAG,CAAC,CAAC;CAC7B,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO,KAAK;CAC7D,MAAM,EAAE,MAAM,SAAS,UAAU,KAAK;CACtC,OAAO,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;EAC7D;EACA;CACD,IAAI,KAAK;AACV;;;;;;;AAOA,SAAS,OAAO,IAAI,SAAS;CAC5B,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,GAAG,MAAM,QAAQ;EAClF,GAAG;EACH,cAAc;GACb,gBAAgB;GAChB,MAAM;GACN,MAAM;EACP;CACD;CACA,OAAO,UAAU;EAChB;EACA,GAAG;CACJ,CAAC;AACF;;;;;;;AAOA,SAAS,eAAe,IAAI,UAAU;CACrC,OAAO,UAAU;EAChB,GAAG,SAAS;EACZ,cAAc;EACd;GACC,gBAAgB;GAChB,MAAM;GACN,MAAM;EACP;CACD,CAAC;AACF;;AAEA,SAAS,aAAa,KAAK;CAC1B,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO,KAAK;CACzD,IAAI,kBAAkB,OAAO,OAAO,IAAI,iBAAiB,UAAU,OAAO,IAAI;CAC9E,IAAI,QAAQ,OAAO,OAAO,IAAI,OAAO,UAAU,OAAO,IAAI;AAC3D;;;;;;AAMA,MAAM,mBAAmB,OAAO,yBAAyB;;AAEzD,MAAM,oBAAoB,OAAO,0BAA0B;;AAE3D,MAAM,mBAAmB,OAAO,yBAAyB;;AAEzD,SAAS,kBAAkB,KAAK,UAAU;CACzC,OAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,eAAe,OAAO,OAAO,IAAI,cAAc,cAAc,IAAI,UAAU,QAAQ;AACtI;;;;;;;;;;;;;AAaA,SAAS,eAAe,SAAS,MAAM;CACtC,MAAM,EAAE,MAAM,QAAQ,UAAU,YAAY,wBAAwB;CACpE,KAAK,MAAM,CAAC,OAAO,QAAQ,OAAO,QAAQ,MAAM,GAAG;EAClD,MAAM,WAAW,UAAU,KAAK,MAAM;EACtC,IAAI,aAAa,KAAK,KAAK,CAAC,OAAO,QAAQ,KAAK,SAAS,SAAS,cAAc,MAAM,IAAI,UAAU,iBAAiB,SAAS,UAAU,MAAM,4CAA4C,WAAW,EAAE;EACvM,MAAM,aAAa,aAAa,GAAG;EACnC,MAAM,WAAW,eAAe,KAAK,IAAI,KAAK,IAAI,UAAU,IAAI,KAAK;EACrE,IAAI,eAAe,KAAK,KAAK,aAAa,KAAK,GAAG,MAAM,IAAI,UAAU,iBAAiB,SAAS,GAAG,MAAM,eAAe,OAAO,UAAU,EAAE,yCAAyC,oBAAoB,GAAG;EAC3M,MAAM,WAAW,SAAS;EAC1B,IAAI,aAAa,KAAK,KAAK,CAAC,kBAAkB,KAAK,QAAQ,GAAG,MAAM,IAAI,UAAU,iBAAiB,SAAS,GAAG,MAAM,+CAA+C;CACrK;CACA,KAAK,MAAM,CAAC,OAAO,aAAa,OAAO,QAAQ,IAAI,GAAG;EACrD,MAAM,QAAQ,UAAU,QAAQ;EAChC,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,WAAW,KAAK,GAAG;EAChD,IAAI,MAAM,SAAS,cAAc,MAAM,IAAI,UAAU,qBAAqB,MAAM,mBAAmB,WAAW,IAAI,SAAS,wCAAwC,oBAAoB,IAAI;CAC5L;AACD;;;;;;;;;;;AAWA,SAAS,WAAW,OAAO,KAAK,uBAAuB,IAAI,QAAQ,GAAG;CACrE,IAAI,KAAK,KAAK;CACd,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;CACjD,IAAI,eAAe,KAAK,KAAK,cAAc,KAAK,GAAG;CACnD,IAAI,KAAK,IAAI,KAAK,GAAG;CACrB,KAAK,IAAI,KAAK;CACd,MAAM,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,OAAO,OAAO,KAAK;CAClE,KAAK,MAAM,UAAU,SAAS,WAAW,QAAQ,KAAK,IAAI;AAC3D;;AAEA,SAAS,YAAY,QAAQ,UAAU;CACtC,OAAO,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU;EACpD,MAAM,aAAa,GAAG,KAAK;EAC3B,IAAI;EACJ;EACA,MAAM;CACP,EAAE;AACH;;;;;;;;;AASA,SAAS,sBAAsB,OAAO,IAAI,cAAc,qBAAqB;CAC5E,MAAM,EAAE,SAAS;CACjB,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,WAAW,GAAG;EAClD,MAAM,QAAQ,aAAa;EAC3B,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,UAAU,gBAAgB,KAAK,mBAAmB,KAAK,IAAI,GAAG,0BAA0B,oBAAoB,4DAA4D;EACxM,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM,IAAI,UAAU,gBAAgB,KAAK,QAAQ,GAAG,aAAa,oBAAoB,6FAA6F;CAC/M;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,aAAa,IAAI,GAAG,MAAM,IAAI,UAAU,oBAAoB,GAAG,UAAU,KAAK,wCAAwC,KAAK,YAAY,oBAAoB,IAAI;AACvO;;;;;;;AAOA,SAAS,4BAA4B,OAAO,IAAI,aAAa,qBAAqB;CACjF,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,QAAQ,IAAI,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,UAAU,KAAK,mDAAmD,oBAAoB,IAAI;AAC1N;;;;;;;AAOA,SAAS,yBAAyB,OAAO,IAAI,aAAa,qBAAqB;CAC9E,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,UAAU,GAAG;EACjD,MAAM,QAAQ,YAAY;EAC1B,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,UAAU,eAAe,KAAK,2BAA2B,GAAG,0BAA0B,oBAAoB,gFAAgF;EAC1N,IAAI,CAAC,cAAc,KAAK,GAAG,MAAM,IAAI,UAAU,eAAe,KAAK,QAAQ,GAAG,aAAa,oBAAoB,2KAA2K;CAC3R;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,YAAY,IAAI,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,UAAU,KAAK,uDAAuD,oBAAoB,IAAI;AAClO;;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,QAAQ,YAAY,SAAS,QAAQ,QAAQ,cAAc,aAAa,OAAO,OAAO,SAAS,eAAe,eAAe,MAAM,OAAO,eAAe;CACjK,MAAM,KAAK,GAAG,gBAAgB,QAAQ,UAAU,CAAC;CACjD,MAAM,2BAA2B,IAAI,IAAI;CACzC,MAAM,uBAAuB,IAAI,IAAI;CACrC,MAAM,8BAA8B,IAAI,IAAI;CAC5C,MAAM,6BAA6B,IAAI,IAAI;CAC3C,MAAM,YAAY,CAAC;CACnB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,IAAI,GAAG;EAC/C,MAAM,QAAQ,OAAO;EACrB,UAAU,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC9D,GAAG;IACF,mBAAmB;EACrB,IAAI;CACL;CACA,MAAM,YAAY,WAAW;EAC5B,KAAK,MAAM,SAAS,QAAQ,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAAG,IAAI,UAAU,UAAU,MAAM,KAAK,IAAI,GAAG;CACjH;CACA,MAAM,oBAAoB,UAAU;EACnC,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAAG,IAAI,UAAU,UAAU,MAAM,OAAO;GAC9E,MAAM;GACN,WAAW;GACX,MAAM;EACP;EACA,MAAM,QAAQ,eAAe,KAAK;EAClC,OAAO,UAAU,KAAK,IAAI,KAAK,IAAI;GAClC,MAAM,MAAM;GACZ,WAAW;GACX,MAAM,MAAM;EACb;CACD;;CAEA,MAAM,wBAAwB,UAAU,iBAAiB;EACxD,KAAK,MAAM,CAAC,OAAO,QAAQ,OAAO,QAAQ,YAAY,GAAG;GACxD,MAAM,OAAO,iBAAiB,GAAG;GACjC,IAAI,SAAS,KAAK,GAAG,cAAc,KAAK;IACvC;IACA,IAAI;KACH,MAAM;KACN,WAAW;KACX,MAAM;IACP;GACD,CAAC;EACF;CACD;CACA,MAAM,aAAa,CAAC;CACpB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,WAAW,GAAG;EACtD,MAAM,QAAQ,aAAa;EAC3B,WAAW,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC/D,GAAG;IACF,oBAAoB;EACtB,IAAI;CACL;CACA,MAAM,mBAAmB,WAAW;EACnC,KAAK,MAAM,SAAS,QAAQ,KAAK,MAAM,OAAO,OAAO,KAAK,UAAU,GAAG,IAAI,UAAU,WAAW,MAAM,YAAY,IAAI,GAAG;CAC1H;CACA,MAAM,YAAY,CAAC;CACnB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,GAAG;EACrD,MAAM,QAAQ,YAAY;EAC1B,UAAU,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC9D,GAAG;IACF,mBAAmB;EACrB,IAAI;CACL;CACA,MAAM,kBAAkB,WAAW;EAClC,KAAK,MAAM,SAAS,QAAQ,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAAG,IAAI,UAAU,UAAU,MAAM,WAAW,IAAI,GAAG;CACvH;CACA,MAAM,aAAa,OAAO,SAAS;EAClC,MAAM,KAAK,MAAM,MAAM,MAAM;EAC7B,MAAM,kBAAkB,MAAM;EAC9B,MAAM,mBAAmB,MAAM;EAC/B,MAAM,iBAAiB,MAAM;EAC7B,MAAM,kBAAkB,MAAM;EAC9B,IAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG,MAAM,IAAI,UAAU,gDAAgD,WAAW,KAAK,IAAI;EACvI,IAAI,CAAC,mBAAmB,EAAE,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,aAAa,WAAW,KAAK,8LAA8L,GAAG,eAAe,GAAG,YAAY,EAAE,oGAAoG;EACza,IAAI,SAAS,IAAI,EAAE,GAAG,MAAM,IAAI,UAAU,2BAA2B,GAAG,eAAe,WAAW,KAAK,GAAG;EAC1G,MAAM,YAAY;EAClB,IAAI,CAAC,OAAO,SAAS,KAAK,UAAU,SAAS,aAAa,UAAU,SAAS,cAAc,UAAU,SAAS,UAAU,MAAM,IAAI,UAAU,cAAc,GAAG,wIAAwI;EACrS,SAAS,IAAI,EAAE;EACf,MAAM,cAAc,YAAY,KAAK,IAAI,KAAK,GAAG,QAAQ,GAAG;EAC5D,IAAI,MAAM,SAAS,YAAY;GAC9B,IAAI,oBAAoB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,iFAAiF;GACtJ,IAAI,qBAAqB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,gFAAgF;GACtJ,IAAI,mBAAmB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,mFAAmF;GACvJ,IAAI,oBAAoB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,yEAAyE;GAC9I,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,gDAAgD;GAClH,KAAK,IAAI,aAAa,KAAK;GAC3B,MAAM,KAAK;IACV,IAAI;IACJ,QAAQ;IACR,MAAM;GACP,CAAC;GACD,MAAM,KAAK;IACV,MAAM;IACN,WAAW;IACX,MAAM;IACN,cAAc,MAAM,SAAS;GAC9B,CAAC;GACD,OAAO,eAAe,aAAa,KAAK;EACzC;EACA,MAAM,cAAc,EAAE,GAAG,mBAAmB,CAAC,EAAE;EAC/C,SAAS,OAAO,OAAO,WAAW,CAAC;EACnC,MAAM,eAAe,EAAE,GAAG,oBAAoB,CAAC,EAAE;EACjD,gBAAgB,OAAO,OAAO,YAAY,CAAC;EAC3C,MAAM,cAAc,EAAE,GAAG,mBAAmB,CAAC,EAAE;EAC/C,eAAe,OAAO,OAAO,WAAW,CAAC;EACzC,IAAI,MAAM,SAAS,WAAW;GAC7B,IAAI,qBAAqB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,iJAAiJ;GACvN,IAAI,MAAM,gBAAgB,KAAK,KAAK,mBAAmB,KAAK,GAAG,MAAM,IAAI,UAAU,iCAAiC,GAAG,0BAA0B,WAAW,KAAK,kGAAkG;GACnQ,IAAI,MAAM,gBAAgB,KAAK,KAAK,mBAAmB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,kFAAkF,WAAW,KAAK,IAAI;GAC1M,IAAI,mBAAmB,KAAK,GAAG;IAC9B,MAAM,SAAS,CAAC;IAChB,WAAW,gBAAgB,MAAM;IACjC,gBAAgB,MAAM;IACtB,eAAe,MAAM;IACrB,cAAc,KAAK;KAClB,gBAAgB;KAChB,SAAS,UAAU,cAAc;IAClC,CAAC;GACF;GACA,4BAA4B,OAAO,IAAI,aAAa,WAAW,IAAI;GACnE,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,WAAW,GAAG,cAAc,KAAK;IAC7E,gBAAgB;IAChB;IACA;GACD,CAAC;GACD,MAAM,SAAS,cAAc,OAAO,WAAW;GAC/C,MAAM,KAAK,GAAG,OAAO,OAAO;IAC3B,IAAI;IACJ,QAAQ;IACR,MAAM;GACP,CAAC;GACD,MAAM,KAAK,GAAG,OAAO,OAAO,GAAG,YAAY,aAAa,WAAW,CAAC;GACpE,MAAM,KAAK,GAAG,gBAAgB,aAAa,KAAK,CAAC;GACjD,qBAAqB,aAAa,WAAW;GAC7C,QAAQ,KAAK;IACZ,MAAM,MAAM;IACZ,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,qBAAqB,WAAW;GACjC,CAAC;GACD,KAAK,IAAI,aAAa,KAAK;GAC3B,OAAO,OAAO,aAAa,KAAK;EACjC;EACA,IAAI,mBAAmB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,0HAA0H;EAC9L,sBAAsB,OAAO,IAAI,cAAc,WAAW,IAAI;EAC9D,yBAAyB,OAAO,IAAI,aAAa,WAAW,IAAI;EAChE,MAAM,KAAK,GAAG,YAAY,aAAa,WAAW,CAAC;EACnD,qBAAqB,aAAa,WAAW;EAC7C,QAAQ,KAAK;GACZ,MAAM,MAAM;GACZ,QAAQ;GACR,UAAU;GACV,YAAY;GACZ,qBAAqB,WAAW;EACjC,CAAC;EACD,MAAM,eAAe,QAAQ,OAAO,aAAa,aAAa,aAAa,cAAc,aAAa,OAAO,OAAO,SAAS,eAAe,eAAe,MAAM,OAAO,aAAa;EACrL,MAAM,KAAK;GACV,IAAI;GACJ,QAAQ;GACR,MAAM;EACP,CAAC;EACD,KAAK,IAAI,aAAa,KAAK;EAC3B,MAAM,iBAAiB,CAAC;EACxB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,YAAY,GAAG,eAAe,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC5H,GAAG;IACF,gBAAgB;IAChB,MAAM;IACN,MAAM;GACP;EACD,IAAI;EACJ,OAAO,UAAU;GAChB,IAAI;GACJ,GAAG;EACJ,CAAC;CACF;CACA,MAAM,MAAM,UAAU;EACrB,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,WAAW,UAAU,SAAS;CAC/B,CAAC;CACD,MAAM,UAAU,UAAU,WAAW,KAAK,GAAG,KAAK,CAAC,CAAC;CACpD,SAAS,OAAO,OAAO,OAAO,CAAC;CAC/B,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,oBAAoB,IAAI,sEAAsE;CACjN,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,qBAAqB,IAAI,0CAA0C;CACpM,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,oBAAoB,IAAI,0CAA0C;CACjM,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,WAAW,MAAM,GAAG;EAChE,MAAM,OAAO,QAAQ;EACrB,IAAI,SAAS,KAAK,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,qBAAqB,IAAI,6CAA6C;EAC1I,IAAI,CAAC,kBAAkB,MAAM,QAAQ,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,gCAAgC,IAAI,0CAA0C;EACrK,MAAM,OAAO,iBAAiB,IAAI;EAClC,IAAI,SAAS,KAAK,GAAG,cAAc,KAAK;GACvC;GACA,IAAI;IACH,MAAM;IACN,WAAW;IACX,MAAM;GACP;EACD,CAAC;CACF;CACA,OAAO;AACR;AACA,SAAS,WAAW,MAAM,MAAM;CAC/B,MAAM,SAAS,MAAM,MAAM,KAAK;CAChC,MAAM,cAAc,OAAO,KAAK,KAAK,IAAI;CACzC,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,QAAQ,YAAY,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACxD,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,kBAAkB,YAAY,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,4FAA4F,KAAK,KAAK,4DAA4D;CACzQ;CACA,MAAM,iBAAiB,OAAO,KAAK,KAAK,WAAW;CACnD,IAAI,eAAe,SAAS,GAAG;EAC9B,MAAM,QAAQ,eAAe,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EAC3D,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,mBAAmB,eAAe,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,6KAA6K;CACxR;CACA,MAAM,gBAAgB,OAAO,KAAK,KAAK,UAAU;CACjD,IAAI,cAAc,SAAS,GAAG;EAC7B,MAAM,QAAQ,cAAc,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EAC1D,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,kBAAkB,cAAc,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,iMAAiM;CAC1S;CACA,MAAM,QAAQ,CAAC;CACf,MAAM,QAAQ,CAAC;CACf,MAAM,UAAU,CAAC;CACjB,MAAM,gBAAgB,CAAC;CACvB,MAAM,gBAAgB,CAAC;CACvB,MAAM,uBAAuB,IAAI,IAAI;CACrC,MAAM,QAAQ,CAAC;CACf,MAAM,gBAAgB,CAAC;CACvB,QAAQ,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,OAAO,SAAS,eAAe,eAAe,MAAM,OAAO,aAAa;CACzH,KAAK,MAAM,SAAS,SAAS,eAAe,OAAO,IAAI;CACvD,oBAAoB,KAAK;CACzB,MAAM,gBAAgB;EACrB,IAAI;EACJ,QAAQ,KAAK;EACb,MAAM;CACP;CACA,OAAO;EACN,MAAM;EACN,OAAO,CAAC,GAAG,SAAS,OAAO,KAAK,GAAG,aAAa;EAChD;EACA;EACA;EACA;EACA,QAAQ;CACT;AACD;;;;;;AAMA,SAAS,oBAAoB,OAAO;CACnC,MAAM,4BAA4B,IAAI,IAAI;CAC1C,KAAK,MAAM,QAAQ,OAAO;EACzB,IAAI,KAAK,SAAS,cAAc;EAChC,MAAM,UAAU,UAAU,IAAI,KAAK,IAAI,KAAK,CAAC;EAC7C,QAAQ,KAAK,KAAK,EAAE;EACpB,UAAU,IAAI,KAAK,MAAM,OAAO;CACjC;CACA,MAAM,2BAA2B,IAAI,IAAI;CACzC,MAAM,uBAAuB,IAAI,IAAI;CACrC,MAAM,QAAQ,CAAC;CACf,MAAM,SAAS,OAAO;EACrB,IAAI,KAAK,IAAI,EAAE,GAAG;EAClB,IAAI,SAAS,IAAI,EAAE,GAAG,MAAM,IAAI,UAAU,qBAAqB,CAAC,GAAG,MAAM,MAAM,MAAM,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,2BAA2B;EAC9I,SAAS,IAAI,EAAE;EACf,MAAM,KAAK,EAAE;EACb,KAAK,MAAM,QAAQ,UAAU,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI;EACtD,MAAM,IAAI;EACV,SAAS,OAAO,EAAE;EAClB,KAAK,IAAI,EAAE;CACZ;CACA,KAAK,MAAM,MAAM,UAAU,KAAK,GAAG,MAAM,EAAE;AAC5C;;;;;;;;;;AAYA,SAAS,KAAK,MAAM,MAAM;CACzB,IAAI,CAAC,OAAO,IAAI,GAAG,MAAM,IAAI,UAAU,qGAAqG;CAC5I,IAAI,KAAK,SAAS,UAAU,OAAO,WAAW,MAAM,IAAI;CACxD,IAAI,KAAK,SAAS,WAAW,OAAO,YAAY,MAAM,MAAM,MAAM,MAAM;CACxE,MAAM,IAAI,UAAU,qEAAqE;AAC1F"}

package/dist/{graph-DqklX5Sf-BNS2aO1j.d.mts → graph-CPeatmoF-DfDx8ctT.d.mts}

@@ -1,5 +1,5 @@
-import { U as ServiceNode, d as Graph, w as NodeId, x as ModuleNode } from "./graph-types-N6brq1zY-1VMNwtkJ.mjs";
-//#region ../../0-framework/1-core/core/dist/graph-DqklX5Sf.d.mts
+import { C as ModuleNode, E as NodeId, p as Graph, q as ServiceNode } from "./graph-types-BTTaRnih-BF6PobQ3.mjs";
+//#region ../../0-framework/1-core/core/dist/graph-CPeatmoF.d.mts
 //#region src/graph.d.ts
 /**
  * Builds the in-memory graph from a root node. A service root walks its own
@@ -15,4 +15,4 @@ declare function Load(root: ServiceNode | ModuleNode, opts?: {
 }): Graph;
 //#endregion
 export { Load as t };
-//# sourceMappingURL=graph-DqklX5Sf-BNS2aO1j.d.mts.map
+//# sourceMappingURL=graph-CPeatmoF-DfDx8ctT.d.mts.map

package/dist/graph-CPeatmoF-DfDx8ctT.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-CPeatmoF-DfDx8ctT.d.mts","names":[],"sources":["../../../0-framework/1-core/core/dist/graph-CPeatmoF.d.mts"],"mappings":";;;;;;;;;;;;iBAWiB,KAAK,MAAM,cAAc,YAAY;EACpD,KAAK;IACH"}

package/dist/{graph-types-N6brq1zY-1VMNwtkJ.d.mts → graph-types-BTTaRnih-BF6PobQ3.d.mts}

@@ -77,7 +77,7 @@ declare class CliStructuredError extends Error implements StructuredError {
   static is(error: unknown): error is CliStructuredError;
 }
 //#endregion
-//#region ../../0-framework/1-core/core/dist/graph-types-N6brq1zY.d.mts
+//#region ../../0-framework/1-core/core/dist/graph-types-BTTaRnih.d.mts
 //#region src/config.d.ts
 /**
  * A declared config param — pure data: a caller-owned Standard Schema
@@ -584,8 +584,45 @@ declare function isNode(value: unknown): value is ServiceNode | ResourceNode | D
 type NodeId = string;
 interface GraphNode {
   readonly id: NodeId;
+  /**
+   * The containing node's id — `undefined` only on the root. Carried
+   * explicitly because containment is STATED, never derived: the dots in an
+   * address are a readable-uniqueness convention, and anything downstream
+   * (the platform's application topology included) treats the id as opaque.
+   */
+  readonly parent: NodeId | undefined;
   readonly node: ServiceNode | ResourceNode | DependencyEnd | ModuleNode;
 }
+/** The reserved name of a resource's single anonymous output port. Rejected as a user-declared port name (node.ts). */
+declare const RESOURCE_OUT_PORT = "$out";
+/** One end of an authored edge: a boundary port named by its owning node, direction, and name. */
+interface PortEndpoint {
+  readonly node: NodeId;
+  readonly direction: 'in' | 'out';
+  readonly name: string;
+}
+/**
+ * A declared boundary port: a module's dep/expose entry, a service's
+ * input/expose entry, or a resource's one anonymous output (`$out`).
+ * `contractKind` is the protocol brand riding the port — a DependencyEnd's
+ * `type` on an `in` port, the exposed Contract's `kind` on an `out` port.
+ */
+interface BoundaryPort extends PortEndpoint {
+  readonly contractKind: string | undefined;
+}
+/**
+ * A pre-dereference edge, exactly as authored: module boundaries are
+ * ordinary edges (an input forwarded into a child is module-`in` →
+ * child-`in`; a child's output exposed by its module is child-`out` →
+ * module-`out`; a re-exposed own input is `in` → `out` on the same module),
+ * where the flat `edges` view resolves every forwarding chain through to the
+ * real producer. A wiring whose source names no port (a whole ref wired
+ * wholesale into an untyped slot) authors no edge here.
+ */
+interface AuthoredEdge {
+  readonly from: PortEndpoint;
+  readonly to: PortEndpoint;
+}
 /**
  * `input`: a service consumes its own declared dependency slot — from the
  * slot node to the service. `dependency`: a service consumes a provisioned
@@ -632,6 +669,10 @@ interface Graph {
   /** Root + one per input, topo-ordered (deps first). */
   readonly nodes: readonly GraphNode[];
   readonly edges: readonly Edge[];
+  /** Every declared boundary port, in declaration order. */
+  readonly ports: readonly BoundaryPort[];
+  /** The authored (pre-dereference) edges between boundary ports, in declaration order. */
+  readonly authoredEdges: readonly AuthoredEdge[];
   /** Every service input binding a `provision()` call supplied (ADR-0042). */
   readonly inputBindings: readonly ServiceInputBinding[];
   /** Every service param bound at provision — literal or source; unbound params are absent here and fall back to their `default` (see `buildConfig`). */
@@ -647,5 +688,5 @@ declare class LoadError extends CliStructuredError {
   constructor(message: string);
 }
 //#endregion
-export { module as $, ParamSource as A, SecretSource as B, NODE as C, ParamNeed as D, ParamBindings as E, ResourceNode as F, configOf as G, ServiceInputBinding as H, ResourceNodeBase as I, inputManifest as J, dependency as K, RunnableServiceNode as L, ProvisionNeed as M, ProvisionedRef as N, ParamNeedBindings as O, RefPort as P, isSecretSource as Q, SecretBindings as R, ModuleOutputs as S, ParamBinding as T, ServiceNode as U, Secrets as V, Values as W, isParamSource as X, isNode as Y, isProvisionNeed as Z, InputValueOf as _, Connection as a, provisionNeed as at, ModuleContext as b, Deps as c, secretSource as ct, Graph as d, CliStructuredError as dt, number as et, GraphNode as f, InputRef as g, InputBinding as h, ConfigParam as i, paramSource as it, Params as j, ParamNeeds as k, Edge as l, service as lt, HydratedDeps as m, Config as n, paramManifest as nt, Contract as o, resource as ot, Hydrated as p, freezeNode as q, ConfigDeclaration as r, paramNeed as rt, DependencyEnd as s, secret as st, BuildAdapter as t, param as tt, Expose as u, string as ut, LoadError as v, NodeId as w, ModuleNode as x, ModuleBuilder as y, SecretNeed as z };
-//# sourceMappingURL=graph-types-N6brq1zY-1VMNwtkJ.d.mts.map
+export { isNode as $, ParamNeedBindings as A, ResourceNodeBase as B, ModuleNode as C, ParamBinding as D, NodeId as E, ProvisionNeed as F, Secrets as G, SecretBindings as H, ProvisionedRef as I, Values as J, ServiceInputBinding as K, RESOURCE_OUT_PORT as L, ParamSource as M, Params as N, ParamBindings as O, PortEndpoint as P, inputManifest as Q, RefPort as R, ModuleContext as S, NODE as T, SecretNeed as U, RunnableServiceNode as V, SecretSource as W, dependency as X, configOf as Y, freezeNode as Z, InputBinding as _, ConfigDeclaration as a, param as at, LoadError as b, Contract as c, paramSource as ct, Edge as d, secret as dt, isParamSource as et, Expose as f, secretSource as ft, HydratedDeps as g, Hydrated as h, CliStructuredError as ht, Config as i, number as it, ParamNeeds as j, ParamNeed as k, DependencyEnd as l, provisionNeed as lt, GraphNode as m, string as mt, BoundaryPort as n, isSecretSource as nt, ConfigParam as o, paramManifest as ot, Graph as p, service as pt, ServiceNode as q, BuildAdapter as r, module as rt, Connection as s, paramNeed as st, AuthoredEdge as t, isProvisionNeed as tt, Deps as u, resource as ut, InputRef as v, ModuleOutputs as w, ModuleBuilder as x, InputValueOf as y, ResourceNode as z };
+//# sourceMappingURL=graph-types-BTTaRnih-BF6PobQ3.d.mts.map