@prisma/composer 0.2.0-dev.1 → 0.2.0-dev.10

package/dist/node-control.mjs

@@ -46,26 +46,10 @@ function resolveFile(entrySpec, moduleDir) {
 		}
 	};
 }
-/**
-* The directory form: `dir` is the built tree, resolved against dirname(module)
-* (ADR-0004) and copied whole; `entry` resolves inside `dir` and names the file
-* that boots. An `entry` that resolves outside `dir` is rejected rather than
-* followed — only `dir` is ever copied.
-*/
-async function resolveDir(dirSpec, entrySpec, moduleDir) {
-	const dirPath = path.resolve(moduleDir, dirSpec);
-	if (!fs.existsSync(dirPath)) throw new Error(`no built directory at ${dirPath} — run your build first (the build adapter's dir, "${dirSpec}", resolves against dirname(module)).`);
-	if (!fs.statSync(dirPath).isDirectory()) throw new Error(`the build adapter's dir ("${dirPath}") is not a directory — drop dir to deploy a single built file, naming it as entry.`);
-	const entryPath = path.resolve(dirPath, entrySpec);
-	if (!entryPath.startsWith(dirPath + path.sep)) throw new Error(`the build adapter's entry ("${entrySpec}") resolves to ${entryPath}, which is not inside dir ("${dirPath}") — in the directory form entry names a file inside dir, and only dir is copied.`);
-	if (!fs.existsSync(entryPath) || !fs.statSync(entryPath).isFile()) throw new Error(`no built entry at ${entryPath} — run your build first (the build adapter's entry, "${entrySpec}", resolves inside dir, "${dirPath}").`);
-	await assertNoSymlinks(dirPath);
-	return {
-		source: dirPath,
-		sourceField: "dir",
-		entry: path.relative(dirPath, entryPath).split(path.sep).join("/"),
-		copyInto: (bundleDir) => fs.promises.cp(dirPath, bundleDir, { recursive: true })
-	};
+/** The shared "dir contains symlinks" error, reused by both the root-is-a-symlink case and the nested-symlink walk below — one message shape, never two to drift apart. */
+function symlinksFoundError(dirPath, found) {
+	const listed = found.slice(0, 5).join(", ");
+	return /* @__PURE__ */ new Error(`the build adapter's dir ("${dirPath}") contains symlinks, which the platform's packager rejects: ${listed}${found.length > 5 ? `, and ${found.length - 5} more` : ""}. The tree is copied verbatim, so make your build emit real files in dir (for example, a hoisted node_modules, or dereference the links into dir with cp -RL).`);
 }
 /**
 * Compute's packager rejects symlinks, so a tree containing one cannot deploy.
@@ -73,7 +57,10 @@ async function resolveDir(dirSpec, entrySpec, moduleDir) {
 * the artifact must be what the author's build produced (ADR-0005), and
 * following a link that points outside `dir` would pull in files the author
 * never named. The walk reads dirents (lstat semantics), so a symlinked
-* directory is reported and never descended into.
+* directory is reported and never descended into. Checks only `dirPath`'s
+* children — the caller (`resolveDir`) checks `dirPath` itself before this
+* runs, since that check also decides "not a directory" vs "is a symlink"
+* and must happen before any dereferencing stat.
 */
 async function assertNoSymlinks(dirPath) {
 	const found = [];
@@ -85,9 +72,40 @@ async function assertNoSymlinks(dirPath) {
 		}
 	};
 	await walk(dirPath);
-	if (found.length === 0) return;
-	const listed = found.slice(0, 5).join(", ");
-	throw new Error(`the build adapter's dir ("${dirPath}") contains symlinks, which the platform's packager rejects: ${listed}${found.length > 5 ? `, and ${found.length - 5} more` : ""}. The tree is copied verbatim, so make your build emit real files in dir (for example, a hoisted node_modules, or dereference the links into dir with cp -RL).`);
+	if (found.length > 0) throw symlinksFoundError(dirPath, found);
+}
+/**
+* The directory form: `dir` is the built tree, resolved against dirname(module)
+* (ADR-0004) and copied whole; `entry` resolves inside `dir` and names the file
+* that boots. An `entry` that resolves outside `dir` is rejected rather than
+* followed — only `dir` is ever copied.
+*
+* `dir` itself can be a symlink — not just something inside it. `lstat` it
+* before anything else so that case hard-errors identically whether the link
+* points at a real directory (which a dereferencing `stat` would otherwise
+* accept as "is a directory") or at a file: neither is ever silently
+* dereferenced and copied (ADR-0005).
+*/
+async function resolveDir(dirSpec, entrySpec, moduleDir) {
+	const dirPath = path.resolve(moduleDir, dirSpec);
+	let dirLstat;
+	try {
+		dirLstat = await fs.promises.lstat(dirPath);
+	} catch {
+		throw new Error(`no built directory at ${dirPath} — run your build first (the build adapter's dir, "${dirSpec}", resolves against dirname(module)).`);
+	}
+	if (dirLstat.isSymbolicLink()) throw symlinksFoundError(dirPath, [dirPath]);
+	if (!dirLstat.isDirectory()) throw new Error(`the build adapter's dir ("${dirPath}") is not a directory — drop dir to deploy a single built file, naming it as entry.`);
+	const entryPath = path.resolve(dirPath, entrySpec);
+	if (!entryPath.startsWith(dirPath + path.sep)) throw new Error(`the build adapter's entry ("${entrySpec}") resolves to ${entryPath}, which is not inside dir ("${dirPath}") — in the directory form entry names a file inside dir, and only dir is copied.`);
+	if (!fs.existsSync(entryPath) || !fs.statSync(entryPath).isFile()) throw new Error(`no built entry at ${entryPath} — run your build first (the build adapter's entry, "${entrySpec}", resolves inside dir, "${dirPath}").`);
+	await assertNoSymlinks(dirPath);
+	return {
+		source: dirPath,
+		sourceField: "dir",
+		entry: path.relative(dirPath, entryPath).split(path.sep).join("/"),
+		copyInto: (bundleDir) => fs.promises.cp(dirPath, bundleDir, { recursive: true })
+	};
 }
 /**
 * The working dir is cleared on every assemble, so it must not overlap the copy
@@ -125,7 +143,8 @@ async function assemble(input) {
 	await runnable.copyInto(path.join(workDir, "bundle"));
 	return {
 		dir: workDir,
-		entry: path.posix.join("bundle", runnable.entry)
+		entry: path.posix.join("bundle", runnable.entry),
+		watch: [runnable.source]
 	};
 }
 /** The node build extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */

package/dist/node-control.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"node-control.mjs","names":[],"sources":["../../../0-framework/2-authoring/node/dist/control.mjs"],"sourcesContent":["import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { build } from \"esbuild\";\n//#region src/control/build.ts\n/**\n* The extension's control entry (ADR-0017): `nodeBuild()` returns the build\n* descriptor `prisma-composer.config.ts` lists. Deploy-only (ADR-0005): the user\n* builds their own runnable; `assemble` copies what they built under `bundle/`\n* and adds the framework's boot wrapper — it never bundles or transforms the\n* app's code.\n*\n* Two forms, chosen by the descriptor: without `dir`, `entry` is a single\n* self-contained file and only that file is copied. With `dir`, the whole\n* directory is copied verbatim and `entry` names the file inside it that boots.\n* Neither form discovers anything — no tree-walking for an entry, no filename\n* heuristics; the author states the paths and we copy exactly those.\n*\n* The wrapper is a SEPARATE esbuild build of the service module (declarations\n* only, whose node carries run()/load()), emitted as `main.mjs` at the\n* working-dir root — a dictated name (object entry `{ main }`), not a\n* discovered one. run() and the app entry must be independent module instances\n* that hand off through process.env, so the wrapper is its own self-contained\n* build; `@prisma/*` is inlined, `bun` is a Compute built-in.\n*\n* Artifact layout: `<cwd>/.prisma-composer/artifacts/<address>/` (deploy-owned,\n* ADR-0005) holds `main.mjs` at the root and the app's built runnable under\n* `bundle/`.\n*/\n/** Narrows the shared BuildAdapter to this extension's own descriptor — the value-level mirror of the registry routing on (extension, type). `dir` is optional: absent is the single-file form. */\nfunction isNodeBuild(descriptor) {\n\treturn descriptor.type === \"node\" && (!(\"dir\" in descriptor) || typeof descriptor.dir === \"string\");\n}\n/** The single-file form: `entry` is the whole built runnable, resolved against dirname(module) (ADR-0004). */\nfunction resolveFile(entrySpec, moduleDir) {\n\tconst entryPath = path.resolve(moduleDir, entrySpec);\n\tif (!fs.existsSync(entryPath)) throw new Error(`no built entry at ${entryPath} — run your build first (the build adapter's entry, \"${entrySpec}\", resolves against dirname(module)).`);\n\tconst entryFile = path.basename(entryPath);\n\treturn {\n\t\tsource: entryPath,\n\t\tsourceField: \"entry\",\n\t\tentry: entryFile,\n\t\tcopyInto: async (bundleDir) => {\n\t\t\tawait fs.promises.mkdir(bundleDir, { recursive: true });\n\t\t\tawait fs.promises.copyFile(entryPath, path.join(bundleDir, entryFile));\n\t\t}\n\t};\n}\n/**\n* The directory form: `dir` is the built tree, resolved against dirname(module)\n* (ADR-0004) and copied whole; `entry` resolves inside `dir` and names the file\n* that boots. An `entry` that resolves outside `dir` is rejected rather than\n* followed — only `dir` is ever copied.\n*/\nasync function resolveDir(dirSpec, entrySpec, moduleDir) {\n\tconst dirPath = path.resolve(moduleDir, dirSpec);\n\tif (!fs.existsSync(dirPath)) throw new Error(`no built directory at ${dirPath} — run your build first (the build adapter's dir, \"${dirSpec}\", resolves against dirname(module)).`);\n\tif (!fs.statSync(dirPath).isDirectory()) throw new Error(`the build adapter's dir (\"${dirPath}\") is not a directory — drop dir to deploy a single built file, naming it as entry.`);\n\tconst entryPath = path.resolve(dirPath, entrySpec);\n\tif (!entryPath.startsWith(dirPath + path.sep)) throw new Error(`the build adapter's entry (\"${entrySpec}\") resolves to ${entryPath}, which is not inside dir (\"${dirPath}\") — in the directory form entry names a file inside dir, and only dir is copied.`);\n\tif (!fs.existsSync(entryPath) || !fs.statSync(entryPath).isFile()) throw new Error(`no built entry at ${entryPath} — run your build first (the build adapter's entry, \"${entrySpec}\", resolves inside dir, \"${dirPath}\").`);\n\tawait assertNoSymlinks(dirPath);\n\treturn {\n\t\tsource: dirPath,\n\t\tsourceField: \"dir\",\n\t\tentry: path.relative(dirPath, entryPath).split(path.sep).join(\"/\"),\n\t\tcopyInto: (bundleDir) => fs.promises.cp(dirPath, bundleDir, { recursive: true })\n\t};\n}\n/**\n* Compute's packager rejects symlinks, so a tree containing one cannot deploy.\n* We fail here, naming the links, rather than dereferencing them on the copy:\n* the artifact must be what the author's build produced (ADR-0005), and\n* following a link that points outside `dir` would pull in files the author\n* never named. The walk reads dirents (lstat semantics), so a symlinked\n* directory is reported and never descended into.\n*/\nasync function assertNoSymlinks(dirPath) {\n\tconst found = [];\n\tconst walk = async (current) => {\n\t\tfor (const entry of await fs.promises.readdir(current, { withFileTypes: true })) {\n\t\t\tconst full = path.join(current, entry.name);\n\t\t\tif (entry.isSymbolicLink()) found.push(full);\n\t\t\telse if (entry.isDirectory()) await walk(full);\n\t\t}\n\t};\n\tawait walk(dirPath);\n\tif (found.length === 0) return;\n\tconst listed = found.slice(0, 5).join(\", \");\n\tthrow new Error(`the build adapter's dir (\"${dirPath}\") contains symlinks, which the platform's packager rejects: ${listed}${found.length > 5 ? `, and ${found.length - 5} more` : \"\"}. The tree is copied verbatim, so make your build emit real files in dir (for example, a hoisted node_modules, or dereference the links into dir with cp -RL).`);\n}\n/**\n* The working dir is cleared on every assemble, so it must not overlap the copy\n* source: inside it, the rm would delete the source before the copy; the other\n* way round, the copy would recurse into its own output.\n*/\nfunction assertOutsideWorkDir(runnable, workDir) {\n\tconst { source, sourceField } = runnable;\n\tif (source === workDir || source.startsWith(workDir + path.sep)) throw new Error(`the build adapter's ${sourceField} (\"${source}\") resolves inside the deploy working dir (\"${workDir}\"), which is cleared on every assemble — point ${sourceField} at your build output elsewhere.`);\n\tif (workDir.startsWith(source + path.sep)) throw new Error(`the deploy working dir (\"${workDir}\") sits inside the build adapter's ${sourceField} (\"${source}\"), so assembling would copy the artifact into itself — point ${sourceField} at your build output elsewhere.`);\n}\nasync function assemble(input) {\n\tif (!isNodeBuild(input.build)) throw new Error(`@prisma/composer/node/control: expected a \"node\" build adapter, got \"${input.build.type}\".`);\n\tconst buildDescriptor = input.build;\n\tconst serviceModule = fileURLToPath(buildDescriptor.module);\n\tconst moduleDir = path.dirname(serviceModule);\n\tconst runnable = buildDescriptor.dir === void 0 ? resolveFile(buildDescriptor.entry, moduleDir) : await resolveDir(buildDescriptor.dir, buildDescriptor.entry, moduleDir);\n\tconst workDir = path.join(input.cwd, \".prisma-composer\", \"artifacts\", input.address);\n\tassertOutsideWorkDir(runnable, workDir);\n\tawait fs.promises.rm(workDir, {\n\t\trecursive: true,\n\t\tforce: true\n\t});\n\tawait fs.promises.mkdir(workDir, { recursive: true });\n\tawait build({\n\t\tentryPoints: { main: serviceModule },\n\t\toutdir: workDir,\n\t\tbundle: true,\n\t\tformat: \"esm\",\n\t\tplatform: \"node\",\n\t\texternal: [\"bun\", \"bun:*\"],\n\t\toutExtension: { \".js\": \".mjs\" }\n\t});\n\tif (!fs.existsSync(path.join(workDir, \"main.mjs\"))) throw new Error(`esbuild produced no main.mjs in ${workDir}`);\n\tawait runnable.copyInto(path.join(workDir, \"bundle\"));\n\treturn {\n\t\tdir: workDir,\n\t\tentry: path.posix.join(\"bundle\", runnable.entry)\n\t};\n}\n/** The node build extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */\nconst nodeBuild = () => ({\n\tid: \"@prisma/composer/node\",\n\tnodes: { node: {\n\t\tkind: \"build\",\n\t\tassemble\n\t} }\n});\n//#endregion\nexport { assemble, nodeBuild };\n\n//# sourceMappingURL=control.mjs.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAS,YAAY,YAAY;CAChC,OAAO,WAAW,SAAS,WAAW,EAAE,SAAS,eAAe,OAAO,WAAW,QAAQ;AAC3F;;AAEA,SAAS,YAAY,WAAW,WAAW;CAC1C,MAAM,YAAY,KAAK,QAAQ,WAAW,SAAS;CACnD,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG,MAAM,IAAI,MAAM,qBAAqB,UAAU,uDAAuD,UAAU,sCAAsC;CACrL,MAAM,YAAY,KAAK,SAAS,SAAS;CACzC,OAAO;EACN,QAAQ;EACR,aAAa;EACb,OAAO;EACP,UAAU,OAAO,cAAc;GAC9B,MAAM,GAAG,SAAS,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;GACtD,MAAM,GAAG,SAAS,SAAS,WAAW,KAAK,KAAK,WAAW,SAAS,CAAC;EACtE;CACD;AACD;;;;;;;AAOA,eAAe,WAAW,SAAS,WAAW,WAAW;CACxD,MAAM,UAAU,KAAK,QAAQ,WAAW,OAAO;CAC/C,IAAI,CAAC,GAAG,WAAW,OAAO,GAAG,MAAM,IAAI,MAAM,yBAAyB,QAAQ,qDAAqD,QAAQ,sCAAsC;CACjL,IAAI,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC,YAAY,GAAG,MAAM,IAAI,MAAM,6BAA6B,QAAQ,oFAAoF;CAClL,MAAM,YAAY,KAAK,QAAQ,SAAS,SAAS;CACjD,IAAI,CAAC,UAAU,WAAW,UAAU,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,+BAA+B,UAAU,iBAAiB,UAAU,8BAA8B,QAAQ,kFAAkF;CAC3P,IAAI,CAAC,GAAG,WAAW,SAAS,KAAK,CAAC,GAAG,SAAS,SAAS,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,qBAAqB,UAAU,uDAAuD,UAAU,2BAA2B,QAAQ,IAAI;CAC1N,MAAM,iBAAiB,OAAO;CAC9B,OAAO;EACN,QAAQ;EACR,aAAa;EACb,OAAO,KAAK,SAAS,SAAS,SAAS,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;EACjE,WAAW,cAAc,GAAG,SAAS,GAAG,SAAS,WAAW,EAAE,WAAW,KAAK,CAAC;CAChF;AACD;;;;;;;;;AASA,eAAe,iBAAiB,SAAS;CACxC,MAAM,QAAQ,CAAC;CACf,MAAM,OAAO,OAAO,YAAY;EAC/B,KAAK,MAAM,SAAS,MAAM,GAAG,SAAS,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;GAChF,MAAM,OAAO,KAAK,KAAK,SAAS,MAAM,IAAI;GAC1C,IAAI,MAAM,eAAe,GAAG,MAAM,KAAK,IAAI;QACtC,IAAI,MAAM,YAAY,GAAG,MAAM,KAAK,IAAI;EAC9C;CACD;CACA,MAAM,KAAK,OAAO;CAClB,IAAI,MAAM,WAAW,GAAG;CACxB,MAAM,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;CAC1C,MAAM,IAAI,MAAM,6BAA6B,QAAQ,+DAA+D,SAAS,MAAM,SAAS,IAAI,SAAS,MAAM,SAAS,EAAE,SAAS,GAAG,+JAA+J;AACtV;;;;;;AAMA,SAAS,qBAAqB,UAAU,SAAS;CAChD,MAAM,EAAE,QAAQ,gBAAgB;CAChC,IAAI,WAAW,WAAW,OAAO,WAAW,UAAU,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,uBAAuB,YAAY,KAAK,OAAO,8CAA8C,QAAQ,iDAAiD,YAAY,iCAAiC;CACpR,IAAI,QAAQ,WAAW,SAAS,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,4BAA4B,QAAQ,qCAAqC,YAAY,KAAK,OAAO,gEAAgE,YAAY,iCAAiC;AAC1Q;AACA,eAAe,SAAS,OAAO;CAC9B,IAAI,CAAC,YAAY,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,wEAAwE,MAAM,MAAM,KAAK,GAAG;CAC3I,MAAM,kBAAkB,MAAM;CAC9B,MAAM,gBAAgB,cAAc,gBAAgB,MAAM;CAC1D,MAAM,YAAY,KAAK,QAAQ,aAAa;CAC5C,MAAM,WAAW,gBAAgB,QAAQ,KAAK,IAAI,YAAY,gBAAgB,OAAO,SAAS,IAAI,MAAM,WAAW,gBAAgB,KAAK,gBAAgB,OAAO,SAAS;CACxK,MAAM,UAAU,KAAK,KAAK,MAAM,KAAK,oBAAoB,aAAa,MAAM,OAAO;CACnF,qBAAqB,UAAU,OAAO;CACtC,MAAM,GAAG,SAAS,GAAG,SAAS;EAC7B,WAAW;EACX,OAAO;CACR,CAAC;CACD,MAAM,GAAG,SAAS,MAAM,SAAS,EAAE,WAAW,KAAK,CAAC;CACpD,MAAM,MAAM;EACX,aAAa,EAAE,MAAM,cAAc;EACnC,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,UAAU,CAAC,OAAO,OAAO;EACzB,cAAc,EAAE,OAAO,OAAO;CAC/B,CAAC;CACD,IAAI,CAAC,GAAG,WAAW,KAAK,KAAK,SAAS,UAAU,CAAC,GAAG,MAAM,IAAI,MAAM,mCAAmC,SAAS;CAChH,MAAM,SAAS,SAAS,KAAK,KAAK,SAAS,QAAQ,CAAC;CACpD,OAAO;EACN,KAAK;EACL,OAAO,KAAK,MAAM,KAAK,UAAU,SAAS,KAAK;CAChD;AACD;;AAEA,MAAM,mBAAmB;CACxB,IAAI;CACJ,OAAO,EAAE,MAAM;EACd,MAAM;EACN;CACD,EAAE;AACH"}
+{"version":3,"file":"node-control.mjs","names":[],"sources":["../../../0-framework/2-authoring/node/dist/control.mjs"],"sourcesContent":["import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { build } from \"esbuild\";\n//#region src/control/build.ts\n/**\n* The extension's control entry (ADR-0017): `nodeBuild()` returns the build\n* descriptor `prisma-composer.config.ts` lists. Deploy-only (ADR-0005): the user\n* builds their own runnable; `assemble` copies what they built under `bundle/`\n* and adds the framework's boot wrapper — it never bundles or transforms the\n* app's code.\n*\n* Two forms, chosen by the descriptor: without `dir`, `entry` is a single\n* self-contained file and only that file is copied. With `dir`, the whole\n* directory is copied verbatim and `entry` names the file inside it that boots.\n* Neither form discovers anything — no tree-walking for an entry, no filename\n* heuristics; the author states the paths and we copy exactly those.\n*\n* The wrapper is a SEPARATE esbuild build of the service module (declarations\n* only, whose node carries run()/load()), emitted as `main.mjs` at the\n* working-dir root — a dictated name (object entry `{ main }`), not a\n* discovered one. run() and the app entry must be independent module instances\n* that hand off through process.env, so the wrapper is its own self-contained\n* build; `@prisma/*` is inlined, `bun` is a Compute built-in.\n*\n* Artifact layout: `<cwd>/.prisma-composer/artifacts/<address>/` (deploy-owned,\n* ADR-0005) holds `main.mjs` at the root and the app's built runnable under\n* `bundle/`.\n*/\n/** Narrows the shared BuildAdapter to this extension's own descriptor — the value-level mirror of the registry routing on (extension, type). `dir` is optional: absent is the single-file form. */\nfunction isNodeBuild(descriptor) {\n\treturn descriptor.type === \"node\" && (!(\"dir\" in descriptor) || typeof descriptor.dir === \"string\");\n}\n/** The single-file form: `entry` is the whole built runnable, resolved against dirname(module) (ADR-0004). */\nfunction resolveFile(entrySpec, moduleDir) {\n\tconst entryPath = path.resolve(moduleDir, entrySpec);\n\tif (!fs.existsSync(entryPath)) throw new Error(`no built entry at ${entryPath} — run your build first (the build adapter's entry, \"${entrySpec}\", resolves against dirname(module)).`);\n\tconst entryFile = path.basename(entryPath);\n\treturn {\n\t\tsource: entryPath,\n\t\tsourceField: \"entry\",\n\t\tentry: entryFile,\n\t\tcopyInto: async (bundleDir) => {\n\t\t\tawait fs.promises.mkdir(bundleDir, { recursive: true });\n\t\t\tawait fs.promises.copyFile(entryPath, path.join(bundleDir, entryFile));\n\t\t}\n\t};\n}\n/** The shared \"dir contains symlinks\" error, reused by both the root-is-a-symlink case and the nested-symlink walk below — one message shape, never two to drift apart. */\nfunction symlinksFoundError(dirPath, found) {\n\tconst listed = found.slice(0, 5).join(\", \");\n\treturn /* @__PURE__ */ new Error(`the build adapter's dir (\"${dirPath}\") contains symlinks, which the platform's packager rejects: ${listed}${found.length > 5 ? `, and ${found.length - 5} more` : \"\"}. The tree is copied verbatim, so make your build emit real files in dir (for example, a hoisted node_modules, or dereference the links into dir with cp -RL).`);\n}\n/**\n* Compute's packager rejects symlinks, so a tree containing one cannot deploy.\n* We fail here, naming the links, rather than dereferencing them on the copy:\n* the artifact must be what the author's build produced (ADR-0005), and\n* following a link that points outside `dir` would pull in files the author\n* never named. The walk reads dirents (lstat semantics), so a symlinked\n* directory is reported and never descended into. Checks only `dirPath`'s\n* children — the caller (`resolveDir`) checks `dirPath` itself before this\n* runs, since that check also decides \"not a directory\" vs \"is a symlink\"\n* and must happen before any dereferencing stat.\n*/\nasync function assertNoSymlinks(dirPath) {\n\tconst found = [];\n\tconst walk = async (current) => {\n\t\tfor (const entry of await fs.promises.readdir(current, { withFileTypes: true })) {\n\t\t\tconst full = path.join(current, entry.name);\n\t\t\tif (entry.isSymbolicLink()) found.push(full);\n\t\t\telse if (entry.isDirectory()) await walk(full);\n\t\t}\n\t};\n\tawait walk(dirPath);\n\tif (found.length > 0) throw symlinksFoundError(dirPath, found);\n}\n/**\n* The directory form: `dir` is the built tree, resolved against dirname(module)\n* (ADR-0004) and copied whole; `entry` resolves inside `dir` and names the file\n* that boots. An `entry` that resolves outside `dir` is rejected rather than\n* followed — only `dir` is ever copied.\n*\n* `dir` itself can be a symlink — not just something inside it. `lstat` it\n* before anything else so that case hard-errors identically whether the link\n* points at a real directory (which a dereferencing `stat` would otherwise\n* accept as \"is a directory\") or at a file: neither is ever silently\n* dereferenced and copied (ADR-0005).\n*/\nasync function resolveDir(dirSpec, entrySpec, moduleDir) {\n\tconst dirPath = path.resolve(moduleDir, dirSpec);\n\tlet dirLstat;\n\ttry {\n\t\tdirLstat = await fs.promises.lstat(dirPath);\n\t} catch {\n\t\tthrow new Error(`no built directory at ${dirPath} — run your build first (the build adapter's dir, \"${dirSpec}\", resolves against dirname(module)).`);\n\t}\n\tif (dirLstat.isSymbolicLink()) throw symlinksFoundError(dirPath, [dirPath]);\n\tif (!dirLstat.isDirectory()) throw new Error(`the build adapter's dir (\"${dirPath}\") is not a directory — drop dir to deploy a single built file, naming it as entry.`);\n\tconst entryPath = path.resolve(dirPath, entrySpec);\n\tif (!entryPath.startsWith(dirPath + path.sep)) throw new Error(`the build adapter's entry (\"${entrySpec}\") resolves to ${entryPath}, which is not inside dir (\"${dirPath}\") — in the directory form entry names a file inside dir, and only dir is copied.`);\n\tif (!fs.existsSync(entryPath) || !fs.statSync(entryPath).isFile()) throw new Error(`no built entry at ${entryPath} — run your build first (the build adapter's entry, \"${entrySpec}\", resolves inside dir, \"${dirPath}\").`);\n\tawait assertNoSymlinks(dirPath);\n\treturn {\n\t\tsource: dirPath,\n\t\tsourceField: \"dir\",\n\t\tentry: path.relative(dirPath, entryPath).split(path.sep).join(\"/\"),\n\t\tcopyInto: (bundleDir) => fs.promises.cp(dirPath, bundleDir, { recursive: true })\n\t};\n}\n/**\n* The working dir is cleared on every assemble, so it must not overlap the copy\n* source: inside it, the rm would delete the source before the copy; the other\n* way round, the copy would recurse into its own output.\n*/\nfunction assertOutsideWorkDir(runnable, workDir) {\n\tconst { source, sourceField } = runnable;\n\tif (source === workDir || source.startsWith(workDir + path.sep)) throw new Error(`the build adapter's ${sourceField} (\"${source}\") resolves inside the deploy working dir (\"${workDir}\"), which is cleared on every assemble — point ${sourceField} at your build output elsewhere.`);\n\tif (workDir.startsWith(source + path.sep)) throw new Error(`the deploy working dir (\"${workDir}\") sits inside the build adapter's ${sourceField} (\"${source}\"), so assembling would copy the artifact into itself — point ${sourceField} at your build output elsewhere.`);\n}\nasync function assemble(input) {\n\tif (!isNodeBuild(input.build)) throw new Error(`@prisma/composer/node/control: expected a \"node\" build adapter, got \"${input.build.type}\".`);\n\tconst buildDescriptor = input.build;\n\tconst serviceModule = fileURLToPath(buildDescriptor.module);\n\tconst moduleDir = path.dirname(serviceModule);\n\tconst runnable = buildDescriptor.dir === void 0 ? resolveFile(buildDescriptor.entry, moduleDir) : await resolveDir(buildDescriptor.dir, buildDescriptor.entry, moduleDir);\n\tconst workDir = path.join(input.cwd, \".prisma-composer\", \"artifacts\", input.address);\n\tassertOutsideWorkDir(runnable, workDir);\n\tawait fs.promises.rm(workDir, {\n\t\trecursive: true,\n\t\tforce: true\n\t});\n\tawait fs.promises.mkdir(workDir, { recursive: true });\n\tawait build({\n\t\tentryPoints: { main: serviceModule },\n\t\toutdir: workDir,\n\t\tbundle: true,\n\t\tformat: \"esm\",\n\t\tplatform: \"node\",\n\t\texternal: [\"bun\", \"bun:*\"],\n\t\toutExtension: { \".js\": \".mjs\" }\n\t});\n\tif (!fs.existsSync(path.join(workDir, \"main.mjs\"))) throw new Error(`esbuild produced no main.mjs in ${workDir}`);\n\tawait runnable.copyInto(path.join(workDir, \"bundle\"));\n\treturn {\n\t\tdir: workDir,\n\t\tentry: path.posix.join(\"bundle\", runnable.entry),\n\t\twatch: [runnable.source]\n\t};\n}\n/** The node build extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */\nconst nodeBuild = () => ({\n\tid: \"@prisma/composer/node\",\n\tnodes: { node: {\n\t\tkind: \"build\",\n\t\tassemble\n\t} }\n});\n//#endregion\nexport { assemble, nodeBuild };\n\n//# sourceMappingURL=control.mjs.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAS,YAAY,YAAY;CAChC,OAAO,WAAW,SAAS,WAAW,EAAE,SAAS,eAAe,OAAO,WAAW,QAAQ;AAC3F;;AAEA,SAAS,YAAY,WAAW,WAAW;CAC1C,MAAM,YAAY,KAAK,QAAQ,WAAW,SAAS;CACnD,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG,MAAM,IAAI,MAAM,qBAAqB,UAAU,uDAAuD,UAAU,sCAAsC;CACrL,MAAM,YAAY,KAAK,SAAS,SAAS;CACzC,OAAO;EACN,QAAQ;EACR,aAAa;EACb,OAAO;EACP,UAAU,OAAO,cAAc;GAC9B,MAAM,GAAG,SAAS,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;GACtD,MAAM,GAAG,SAAS,SAAS,WAAW,KAAK,KAAK,WAAW,SAAS,CAAC;EACtE;CACD;AACD;;AAEA,SAAS,mBAAmB,SAAS,OAAO;CAC3C,MAAM,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;CAC1C,uBAAuB,IAAI,MAAM,6BAA6B,QAAQ,+DAA+D,SAAS,MAAM,SAAS,IAAI,SAAS,MAAM,SAAS,EAAE,SAAS,GAAG,+JAA+J;AACvW;;;;;;;;;;;;AAYA,eAAe,iBAAiB,SAAS;CACxC,MAAM,QAAQ,CAAC;CACf,MAAM,OAAO,OAAO,YAAY;EAC/B,KAAK,MAAM,SAAS,MAAM,GAAG,SAAS,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;GAChF,MAAM,OAAO,KAAK,KAAK,SAAS,MAAM,IAAI;GAC1C,IAAI,MAAM,eAAe,GAAG,MAAM,KAAK,IAAI;QACtC,IAAI,MAAM,YAAY,GAAG,MAAM,KAAK,IAAI;EAC9C;CACD;CACA,MAAM,KAAK,OAAO;CAClB,IAAI,MAAM,SAAS,GAAG,MAAM,mBAAmB,SAAS,KAAK;AAC9D;;;;;;;;;;;;;AAaA,eAAe,WAAW,SAAS,WAAW,WAAW;CACxD,MAAM,UAAU,KAAK,QAAQ,WAAW,OAAO;CAC/C,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,GAAG,SAAS,MAAM,OAAO;CAC3C,QAAQ;EACP,MAAM,IAAI,MAAM,yBAAyB,QAAQ,qDAAqD,QAAQ,sCAAsC;CACrJ;CACA,IAAI,SAAS,eAAe,GAAG,MAAM,mBAAmB,SAAS,CAAC,OAAO,CAAC;CAC1E,IAAI,CAAC,SAAS,YAAY,GAAG,MAAM,IAAI,MAAM,6BAA6B,QAAQ,oFAAoF;CACtK,MAAM,YAAY,KAAK,QAAQ,SAAS,SAAS;CACjD,IAAI,CAAC,UAAU,WAAW,UAAU,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,+BAA+B,UAAU,iBAAiB,UAAU,8BAA8B,QAAQ,kFAAkF;CAC3P,IAAI,CAAC,GAAG,WAAW,SAAS,KAAK,CAAC,GAAG,SAAS,SAAS,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,qBAAqB,UAAU,uDAAuD,UAAU,2BAA2B,QAAQ,IAAI;CAC1N,MAAM,iBAAiB,OAAO;CAC9B,OAAO;EACN,QAAQ;EACR,aAAa;EACb,OAAO,KAAK,SAAS,SAAS,SAAS,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;EACjE,WAAW,cAAc,GAAG,SAAS,GAAG,SAAS,WAAW,EAAE,WAAW,KAAK,CAAC;CAChF;AACD;;;;;;AAMA,SAAS,qBAAqB,UAAU,SAAS;CAChD,MAAM,EAAE,QAAQ,gBAAgB;CAChC,IAAI,WAAW,WAAW,OAAO,WAAW,UAAU,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,uBAAuB,YAAY,KAAK,OAAO,8CAA8C,QAAQ,iDAAiD,YAAY,iCAAiC;CACpR,IAAI,QAAQ,WAAW,SAAS,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,4BAA4B,QAAQ,qCAAqC,YAAY,KAAK,OAAO,gEAAgE,YAAY,iCAAiC;AAC1Q;AACA,eAAe,SAAS,OAAO;CAC9B,IAAI,CAAC,YAAY,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,wEAAwE,MAAM,MAAM,KAAK,GAAG;CAC3I,MAAM,kBAAkB,MAAM;CAC9B,MAAM,gBAAgB,cAAc,gBAAgB,MAAM;CAC1D,MAAM,YAAY,KAAK,QAAQ,aAAa;CAC5C,MAAM,WAAW,gBAAgB,QAAQ,KAAK,IAAI,YAAY,gBAAgB,OAAO,SAAS,IAAI,MAAM,WAAW,gBAAgB,KAAK,gBAAgB,OAAO,SAAS;CACxK,MAAM,UAAU,KAAK,KAAK,MAAM,KAAK,oBAAoB,aAAa,MAAM,OAAO;CACnF,qBAAqB,UAAU,OAAO;CACtC,MAAM,GAAG,SAAS,GAAG,SAAS;EAC7B,WAAW;EACX,OAAO;CACR,CAAC;CACD,MAAM,GAAG,SAAS,MAAM,SAAS,EAAE,WAAW,KAAK,CAAC;CACpD,MAAM,MAAM;EACX,aAAa,EAAE,MAAM,cAAc;EACnC,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,UAAU,CAAC,OAAO,OAAO;EACzB,cAAc,EAAE,OAAO,OAAO;CAC/B,CAAC;CACD,IAAI,CAAC,GAAG,WAAW,KAAK,KAAK,SAAS,UAAU,CAAC,GAAG,MAAM,IAAI,MAAM,mCAAmC,SAAS;CAChH,MAAM,SAAS,SAAS,KAAK,KAAK,SAAS,QAAQ,CAAC;CACpD,OAAO;EACN,KAAK;EACL,OAAO,KAAK,MAAM,KAAK,UAAU,SAAS,KAAK;EAC/C,OAAO,CAAC,SAAS,MAAM;CACxB;AACD;;AAEA,MAAM,mBAAmB;CACxB,IAAI;CACJ,OAAO,EAAE,MAAM;EACd,MAAM;EACN;CACD,EAAE;AACH"}

package/dist/node.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.mts","names":[],"sources":["../../../0-framework/2-authoring/node/dist/index.d.mts"],"mappings":";;;;;UAGU,yBAAyB;WACxB;WACA;;;KAGN;EACH;EACA;EACA;;EAEA;EACA;EACA;;cAEY,YAAY,MAAM,qBAAqB"}

package/dist/report.d.mts

@@ -1,5 +1,5 @@
-import { u as DeploymentResult } from "./app-config-BPb3LCdH-CH7b8Khi.mjs";
-import "./deploy-Cqu_-Hna.mjs";
+import { u as DeploymentResult } from "./app-config-CVyObaOe-PF94uVBK.mjs";
+import "./deploy-BP2DrIX_.mjs";
 //#region ../../0-framework/3-tooling/cli/dist/report.d.mts
 //#region src/render-deployment.d.ts
 /**

package/dist/report.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.mts","names":[],"sources":["../../../0-framework/3-tooling/cli/dist/report.d.mts"],"mappings":";;;;;;;;iBAMiB,iBAAiB,QAAQ;;;;;iBAKzB,iBAAiB,QAAQ"}

package/dist/service-rpc.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-rpc.d.mts","names":[],"sources":["../../../0-framework/2-authoring/service-rpc/dist/index.d.mts"],"mappings":";;;;;;cAIc;;cAEA,uBAAuB;;KAEhC,SAAS,gBAAgB,eAAe;iBAC5B,IAAI,UAAU,kBAAkB,UAAU,kBAAkB;EAC3E,OAAO;EACP,QAAQ;KACL,OAAO,iBAAiB,WAAW,OAAO,QAAQ,iBAAiB,YAAY;iBACnE,IAAI,UAAU,gBAAgB,SAAS,UAAU,IAAI,cAAc,OAAO,IAAI;;KAE1F,OAAO,KAAK,UAAU,uBAAuB,OAAO;;;;;;;;KAQpD,aAAa,KAAK,YAAY,QAAQ;iBAC1B,WAAW,UAAU,gBAAgB,SAAS,UAAU,GAAG,aAAa;EACvF,QAAQ;EACR;IACE,OAAO;;;iBAGM,SAAS,YAAY,gBAAgB,eAAe,eAAe,KAAK,MAAM,gBAAgB;;;;cAIjG;KACT,cAAc;KACd,MAAM,KAAK,UAAU,uBAAuB,OAAO;;UAE9C;;WAEC;;KAEN,WAAW,IAAI,cAAc,aAAa,aAAa,MAAM,cAAc,OAAO,OAAO,GAAG,MAAM,YAAY,KAAK,sBAAsB,QAAQ;;KAEjJ,SAAS,UAAU,kBAAkB,cAAc,YAAY,kBAAkB,WAAW,MAAM,YAAY,aAAa,SAAS,WAAW,MAAM,YAAY,aAAa,OAAO,IAAI,WAAW;;;;;;;;;;;iBAWxL,MAAM,UAAU,aAAa,UAAU,SAAS,IAAI,SAAS,GAAG,UAAU,KAAK,KAAK,YAAY,QAAQ"}

package/dist/service-rpc.mjs

@@ -1,6 +1,6 @@
 import { t as blindCast } from "./casts-Ci5rYYaR.mjs";
-import { i as dependency, p as provisionNeed } from "./graph-BmrUEdo9-6Oq1hSmS.mjs";
-import { l as string } from "./dist-B0axxnBf.mjs";
+import { i as dependency, p as provisionNeed } from "./graph-CP16cJyH-D5IW87Y-.mjs";
+import { l as string } from "./dist-BkSJOwTm.mjs";
 //#region ../../0-framework/2-authoring/service-rpc/dist/index.mjs
 /** Bounded jittered backoff for retrying a dropped call. `maxRetries` is retries after the first attempt. */
 const RETRY = {

package/dist/testing.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.mts","names":[],"sources":["../../../0-framework/1-core/core/dist/testing.d.mts"],"mappings":";;;;;;;;;;KASK,cAAc,UAAU,MAAM,UAAU,UAAU,aAAa,KAAK,QAAQ,OAAO;;;;;;;;;iBASvE,YAAY,UAAU,MAAM,UAAU,QAAQ,UAAU,QAAQ,UAAU,SAAS,SAAS,oBAAoB,GAAG,GAAG,GAAG,IAAI,WAAW,cAAc,GAAG,KAAK,oBAAoB,GAAG,GAAG,GAAG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prisma/composer",
-  "version": "0.2.0-dev.1",
+  "version": "0.2.0-dev.10",
   "type": "module",
   "description": "Prisma Composer — build a Prisma App by composing Modules. Core authoring, deploy pipeline, the prisma-composer CLI, and the service-rpc/node/nextjs authoring surfaces.",
   "bin": {
@@ -22,7 +22,8 @@
     "./package.json": "./package.json"
   },
   "files": [
-    "dist"
+    "dist",
+    "src"
   ],
   "dependencies": {
     "@standard-schema/spec": "^1.1.0",
@@ -36,15 +37,15 @@
     "@prisma/management-api-sdk": "^1.50.0"
   },
   "devDependencies": {
-    "@internal/assemble": "0.2.0-dev.1",
-    "@internal/cli": "0.2.0-dev.1",
-    "@internal/core": "0.2.0-dev.1",
-    "@internal/foundation": "0.2.0-dev.1",
-    "@internal/lowering": "0.2.0-dev.1",
-    "@internal/nextjs": "0.2.0-dev.1",
-    "@internal/node": "0.2.0-dev.1",
-    "@internal/service-rpc": "0.2.0-dev.1",
-    "@internal/tsdown-config": "0.2.0-dev.1",
+    "@internal/assemble": "0.2.0-dev.10",
+    "@internal/cli": "0.2.0-dev.10",
+    "@internal/core": "0.2.0-dev.10",
+    "@internal/foundation": "0.2.0-dev.10",
+    "@internal/lowering": "0.2.0-dev.10",
+    "@internal/nextjs": "0.2.0-dev.10",
+    "@internal/node": "0.2.0-dev.10",
+    "@internal/service-rpc": "0.2.0-dev.10",
+    "@internal/tsdown-config": "0.2.0-dev.10",
     "@types/node": "^25.9.3",
     "tsdown": "^0.22.7",
     "typescript": "^6.0.3"

package/src/exports/assertions.ts

@@ -0,0 +1 @@
+export * from '@internal/foundation/assertions';

package/src/exports/casts.ts

@@ -0,0 +1 @@
+export * from '@internal/foundation/casts';

package/src/exports/config.ts

@@ -0,0 +1 @@
+export * from '@internal/core/config';

package/src/exports/deploy.ts

@@ -0,0 +1 @@
+export * from '@internal/core/deploy';

package/src/exports/index.ts

@@ -0,0 +1 @@
+export * from '@internal/core';

package/src/exports/nextjs-control.ts

@@ -0,0 +1 @@
+export * from '@internal/nextjs/control';

package/src/exports/nextjs.ts

@@ -0,0 +1,2 @@
+export * from '@internal/nextjs';
+export { default } from '@internal/nextjs';

package/src/exports/node-control.ts

@@ -0,0 +1 @@
+export * from '@internal/node/control';

package/src/exports/node.ts

@@ -0,0 +1,2 @@
+export * from '@internal/node';
+export { default } from '@internal/node';

package/src/exports/report.ts

@@ -0,0 +1 @@
+export * from '@internal/cli/report';

package/src/exports/service-rpc.ts

@@ -0,0 +1 @@
+export * from '@internal/service-rpc';

package/src/exports/testing.ts

@@ -0,0 +1 @@
+export * from '@internal/core/testing';

package/dist/config-Cqu_-Hna.d.mts

@@ -1 +0,0 @@
-import "./app-config-BPb3LCdH-CH7b8Khi.mjs";

package/dist/deploy-Cqu_-Hna.d.mts

@@ -1 +0,0 @@
-import "./app-config-BPb3LCdH-CH7b8Khi.mjs";

package/dist/graph-BmrUEdo9-6Oq1hSmS.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"graph-BmrUEdo9-6Oq1hSmS.mjs","names":[],"sources":["../../../0-framework/1-core/core/dist/graph-BmrUEdo9.mjs"],"sourcesContent":["import { blindCast } from \"@internal/foundation/casts\";\n//#region src/graph-types.ts\n/** Thrown by Load when the graph is malformed. */\nvar LoadError = class extends Error {\n\tconstructor(message) {\n\t\tsuper(message);\n\t\tthis.name = \"LoadError\";\n\t}\n};\n//#endregion\n//#region src/node.ts\n/**\n* Core model: node types and the factories that construct them, plain frozen\n* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).\n*/\nconst NODE = Symbol.for(\"prisma:node\");\nconst SECRET_NEED = blindCast(Symbol.for(\"prisma:secret-need\"));\nconst SECRET_SOURCE = blindCast(Symbol.for(\"prisma:secret-source\"));\n/** Declares a secret NEED. Nameless — the platform name is bound at the root via `envSecret`. */\nfunction secret() {\n\treturn Object.freeze({\n\t\t[SECRET_NEED]: true,\n\t\tkind: \"secret\"\n\t});\n}\n/** Builds an opaque secret source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envSecret`) calls. Core forwards the source and never inspects the payload. */\nfunction secretSource(payload) {\n\treturn Object.freeze({\n\t\t[SECRET_SOURCE]: true,\n\t\tpayload\n\t});\n}\n/** True if `value` is a secret source (an `envSecret` result or a forwarded ctx.secrets ref). */\nfunction isSecretSource(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[SECRET_SOURCE] === true;\n}\nconst PROVISION_NEED = blindCast(Symbol.for(\"prisma:provision-need\"));\n/** Builds an opaque provisioning need — the declaring package's own brand plus whatever payload its provisioner reads back. */\nfunction provisionNeed(brand, payload) {\n\treturn blindCast(Object.freeze({\n\t\t[PROVISION_NEED]: true,\n\t\tbrand,\n\t\tpayload\n\t}));\n}\n/** True if `value` is a provisioning need (a `provisionNeed()` result). */\nfunction isProvisionNeed(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[PROVISION_NEED] === true;\n}\nconst PARAM_SOURCE = blindCast(Symbol.for(\"prisma:param-source\"));\nconst PARAM_NEED = blindCast(Symbol.for(\"prisma:param-need\"));\n/** Builds an opaque param source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envParam`) calls. Core forwards the source and never inspects the payload. */\nfunction paramSource(payload) {\n\treturn Object.freeze({\n\t\t[PARAM_SOURCE]: true,\n\t\tpayload\n\t});\n}\n/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */\nfunction isParamSource(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[PARAM_SOURCE] === true;\n}\n/** Declares a module param-forwarding NEED. Nameless — bound to a `ParamSource` by an enclosing scope and forwarded into a child's real param. */\nfunction paramNeed() {\n\treturn Object.freeze({\n\t\t[PARAM_NEED]: true,\n\t\tkind: \"param\"\n\t});\n}\nfunction requireType(type, factory) {\n\tif (typeof type !== \"string\" || type.length === 0) throw new Error(`${factory}() requires a non-empty node type.`);\n}\nfunction requireName(name, factory) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(`${factory}() requires a non-empty name.`);\n}\nfunction requireExtension(extension, factory) {\n\tif (typeof extension !== \"string\" || extension.length === 0) throw new Error(`${factory}() requires a non-empty extension (the authoring extension's package name).`);\n}\n/**\n* Config keys join address/input/param names with \"_\" and uppercase — an\n* underscore inside a name would collide with that separator (e.g. param\n* \"db_url\" vs input \"db\"'s param \"url\" both hitting env key \"DB_URL\").\n*/\nfunction requireNoUnderscoreName(name, kind, factory) {\n\tif (name.includes(\"_\")) throw new Error(`${factory}() ${kind} name \"${name}\" may not contain \"_\" — config keys join names with \"_\" as the separator (e.g. an input \"db\"'s param \"url\" becomes env key \"DB_URL\"), so an underscore inside a name would collide with that separator.`);\n}\nfunction requireNoUnderscoreNames(names, kind, factory) {\n\tfor (const name of names) requireNoUnderscoreName(name, kind, factory);\n}\nfunction freezeParams(params) {\n\tconst frozen = {};\n\tfor (const [name, param] of Object.entries(params)) frozen[name] = Object.freeze({ ...param });\n\treturn Object.freeze(frozen);\n}\nfunction freezeSecrets(secrets) {\n\tconst frozen = {};\n\tfor (const [name, need] of Object.entries(secrets)) frozen[name] = Object.freeze({ ...need });\n\treturn blindCast(Object.freeze(frozen));\n}\n/** A frozen shallow copy that keeps the caller's declared type. */\nfunction frozenShallowCopy(obj) {\n\treturn blindCast(Object.freeze({ ...obj }));\n}\n/**\n* Seals a node instance after its constructor has assigned all fields — the\n* last statement of a concrete node class's constructor. A free function, not\n* a base-class method, so an instance stays structurally a plain frozen node.\n*/\nfunction freezeNode(node) {\n\tObject.freeze(node);\n\treturn node;\n}\n/**\n* Everything `resource()` establishes, minus the freeze — an extension\n* whose resource node carries extra fields extends this, assigns them, and\n* calls `freezeNode(this)` as its constructor's last statement.\n*/\nvar ResourceNodeBase = class {\n\t[NODE] = true;\n\tkind = \"resource\";\n\tname;\n\textension;\n\ttype;\n\tprovides;\n\tconstructor(def) {\n\t\trequireName(def.name, \"resource\");\n\t\trequireExtension(def.extension, \"resource\");\n\t\tconst provides = def.provides;\n\t\tif (typeof provides !== \"object\" || provides === null || typeof provides.kind !== \"string\" || provides.kind.length === 0 || typeof provides.satisfies !== \"function\") throw new Error(\"resource() requires `provides` — the Contract this resource offers (a non-empty `kind` plus its `satisfies()`).\");\n\t\tthis.name = def.name;\n\t\tthis.extension = def.extension;\n\t\tthis.type = provides.kind;\n\t\tthis.provides = provides;\n\t}\n};\n/** The core leaf: exactly the base, frozen. */\nvar FrozenResourceNode = class extends ResourceNodeBase {\n\tconstructor(def) {\n\t\tsuper(def);\n\t\tfreezeNode(this);\n\t}\n};\n/**\n* Constructs a branded, frozen Resource node — an identity plus the Contract\n* it provides; the routing `type` is the contract's `kind`. Pure — nothing\n* is provisioned until a module provisions it.\n*/\nfunction resource(def) {\n\treturn new FrozenResourceNode(def);\n}\n/**\n* Constructs a branded, frozen Service node — declarations only (inputs,\n* params, build adapter, and the ports it exposes). Pure; carries no runtime behavior.\n*/\nfunction service(def) {\n\trequireName(def.name, \"service\");\n\trequireExtension(def.extension, \"service\");\n\trequireType(def.type, \"service\");\n\trequireNoUnderscoreNames(Object.keys(def.inputs), \"input\", \"service\");\n\trequireNoUnderscoreNames(Object.keys(def.params), \"param\", \"service\");\n\trequireNoUnderscoreNames(Object.keys(def.secrets ?? {}), \"secret\", \"service\");\n\tfor (const slot of Object.keys(def.secrets ?? {})) if (Object.hasOwn(def.params, slot)) throw new Error(`service() secret slot \"${slot}\" collides with a param of the same name — a secret slot and a service param derive the same config key (COMPOSER_<addr>_${slot.toUpperCase()}); rename one.`);\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"service\",\n\t\tname: def.name,\n\t\textension: def.extension,\n\t\ttype: def.type,\n\t\tinputs: frozenShallowCopy(def.inputs),\n\t\tparams: freezeParams(def.params),\n\t\tsecretSlots: freezeSecrets(def.secrets ?? blindCast({})),\n\t\tbuild: Object.freeze({ ...def.build }),\n\t\texpose: def.expose !== void 0 ? frozenShallowCopy(def.expose) : void 0\n\t});\n}\n/**\n* Constructs a branded, frozen DependencyEnd. `required` (if given) is the\n* contract Load compares a wired ref against via `satisfies()`; an unnamed\n* end's diagnostic `name` falls back to its `type`.\n*/\nfunction dependency(def) {\n\trequireType(def.type, \"dependency\");\n\trequireNoUnderscoreNames(Object.keys(def.connection.params), \"param\", \"dependency\");\n\tconst connection = Object.freeze({\n\t\tparams: freezeParams(def.connection.params),\n\t\thydrate: def.connection.hydrate\n\t});\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"dependency\",\n\t\tname: def.name !== void 0 && def.name.length > 0 ? def.name : def.type,\n\t\ttype: def.type,\n\t\tconnection,\n\t\trequired: def.required\n\t});\n}\n/**\n* Constructs a branded, frozen Module node. Construction is INERT — the body is\n* wiring, not user code, and runs only when the module is Loaded.\n*/\nfunction module(name, boundaryOrBody, maybeBody) {\n\trequireName(name, \"module\");\n\tconst closedRoot = typeof boundaryOrBody === \"function\";\n\tconst boundary = closedRoot ? {} : boundaryOrBody;\n\tconst deps = frozenShallowCopy(boundary.deps ?? {});\n\tconst secretSlots = frozenShallowCopy(boundary.secrets ?? {});\n\tconst paramSlots = frozenShallowCopy(boundary.params ?? {});\n\tconst expose = frozenShallowCopy(boundary.expose ?? {});\n\tconst body = closedRoot ? (ctx) => {\n\t\tboundaryOrBody(ctx);\n\t\treturn {};\n\t} : maybeBody;\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"module\",\n\t\tname,\n\t\tdeps,\n\t\tsecretSlots,\n\t\tparamSlots,\n\t\texpose,\n\t\tbody\n\t});\n}\n/**\n* True if `value` was constructed by this module's factories. Checks the\n* brand only, never a prototype — a graph may mix nodes from a different\n* installed copy of core (dual-package hazard).\n*/\nfunction isNode(value) {\n\treturn typeof value === \"object\" && value !== null && value[NODE] === true;\n}\n//#endregion\n//#region src/toposort.ts\n/**\n* Stable topological sort: every edge's `from` precedes its `to` in the\n* result. Ties (nodes with no ordering constraint between them) keep their\n* relative order from `nodes` — so a graph already authored producer-first\n* comes out byte-identical to its pre-sort layout; only a graph that\n* genuinely needs reordering (e.g. a module wired via a forged ref pointing at a\n* not-yet-provisioned producer) actually moves. A Kahn's-algorithm variant\n* that always picks the ready node with the smallest original index. Edges\n* whose endpoint falls outside `nodes` (e.g. a service-root's input edges\n* targeting the root, which is appended separately) are ignored. Cycles\n* cannot reach here: `assertDependencyDag` already rejects them for\n* dependency edges, and input edges never cycle.\n*/\nfunction topoSort(nodes, edges) {\n\tconst byId = new Map(nodes.map((n) => [n.id, n]));\n\tconst indexOf = new Map(nodes.map((n, i) => [n.id, i]));\n\tconst indegree = new Map(nodes.map((n) => [n.id, 0]));\n\tconst successors = /* @__PURE__ */ new Map();\n\tfor (const edge of edges) {\n\t\tif (!byId.has(edge.from) || !byId.has(edge.to)) continue;\n\t\tconst targets = successors.get(edge.from) ?? [];\n\t\ttargets.push(edge.to);\n\t\tsuccessors.set(edge.from, targets);\n\t\tindegree.set(edge.to, (indegree.get(edge.to) ?? 0) + 1);\n\t}\n\tconst ready = new Set(nodes.filter((n) => indegree.get(n.id) === 0).map((n) => n.id));\n\tconst order = [];\n\twhile (ready.size > 0) {\n\t\tlet next;\n\t\tlet bestIndex = Number.POSITIVE_INFINITY;\n\t\tfor (const id of ready) {\n\t\t\tconst index = indexOf.get(id) ?? Number.POSITIVE_INFINITY;\n\t\t\tif (index < bestIndex) {\n\t\t\t\tbestIndex = index;\n\t\t\t\tnext = id;\n\t\t\t}\n\t\t}\n\t\tif (next === void 0) break;\n\t\tready.delete(next);\n\t\torder.push(next);\n\t\tfor (const target of successors.get(next) ?? []) {\n\t\t\tconst remaining = (indegree.get(target) ?? 0) - 1;\n\t\t\tindegree.set(target, remaining);\n\t\t\tif (remaining === 0) ready.add(target);\n\t\t}\n\t}\n\tif (order.length !== nodes.length) throw new LoadError(`topological sort processed ${order.length} of ${nodes.length} nodes — the graph contains a cycle that slipped past the DAG validation.`);\n\treturn order.map((id) => byId.get(id)).filter((n) => n !== void 0);\n}\n//#endregion\n//#region src/load-service.ts\nfunction serviceInputs(service, serviceId) {\n\tif (typeof service.inputs !== \"object\" || service.inputs === null) throw new LoadError(`Service \"${serviceId}\" has no inputs map.`);\n\tconst nodes = [];\n\tconst edges = [];\n\tfor (const [input, value] of Object.entries(service.inputs)) {\n\t\tconst kind = isNode(value) ? value.kind : void 0;\n\t\tif (kind === \"resource\") throw new LoadError(`Input \"${input}\" of \"${serviceId}\" is a resource node — a resource is provisioned by the composing module, never created for a service that mentions it. Declare the input as a dependency (the pack's dependency factory) and wire the module-provisioned resource's ref into it.`);\n\t\tif (kind !== \"dependency\") throw new LoadError(`Input \"${input}\" of \"${serviceId}\" is not a branded dependency end (construct it with the dependency() factory).`);\n\t\tif (value.type.length === 0) throw new LoadError(`Input \"${input}\" of \"${serviceId}\" has an empty node type.`);\n\t\tconst id = `${serviceId}.${input}`;\n\t\tnodes.push({\n\t\t\tid,\n\t\t\tnode: value\n\t\t});\n\t\tedges.push({\n\t\t\tfrom: id,\n\t\t\tto: serviceId,\n\t\t\tinput,\n\t\t\tkind: \"input\"\n\t\t});\n\t}\n\treturn {\n\t\tnodes,\n\t\tedges\n\t};\n}\nfunction loadService(root, rootId) {\n\tfor (const [input, value] of Object.entries(root.inputs)) if (isNode(value) && value.kind === \"dependency\") throw new LoadError(`Service \"${rootId}\" has an unwired dependency input \"${input}\" — this service is composed by a module; deploy the module instead of loading \"${rootId}\" directly.`);\n\tconst secretSlots = Object.keys(root.secretSlots);\n\tif (secretSlots.length > 0) {\n\t\tconst names = secretSlots.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Service \"${rootId}\" declares secret slot${secretSlots.length > 1 ? \"s\" : \"\"} ${names} but is being loaded directly — a lone service has no enclosing scope to bind them. Compose it inside a module that binds each with envSecret('NAME').`);\n\t}\n\tconst rootGraphNode = {\n\t\tid: rootId,\n\t\tnode: root\n\t};\n\tconst { nodes, edges } = serviceInputs(root, rootId);\n\treturn {\n\t\troot: rootGraphNode,\n\t\tnodes: [...topoSort(nodes, edges), rootGraphNode],\n\t\tedges,\n\t\tsecrets: [],\n\t\tparams: []\n\t};\n}\n//#endregion\n//#region src/load-module.ts\n/**\n* Builds the ref a provision() call hands back: the id (so a producer with no\n* exposed ports — or an untyped slot — can still be wired wholesale) plus one\n* ref-port per exposed contract, each the contract's own runtime value (so\n* its `satisfies()` still works) tagged with the provider's id.\n*/\nfunction refFor(id, service) {\n\tconst ports = {};\n\tfor (const [port, contract] of Object.entries(service.expose ?? {})) ports[port] = {\n\t\t...contract,\n\t\t__providerId: id\n\t};\n\treturn blindCast({\n\t\tid,\n\t\t...ports\n\t});\n}\n/**\n* The resource variant of refFor: a resource has exactly one port — the\n* contract it provides — flattened onto the ref itself, tagged with the\n* provider id. `id` is written last so a hostile contract value cannot\n* clobber it.\n*/\nfunction refForResource(id, resource) {\n\treturn blindCast({\n\t\t...resource.provides,\n\t\t__providerId: id,\n\t\tid\n\t});\n}\n/** A wired value's producer id: a ref-port's `__providerId`, or a bare ref's `id`. */\nfunction producerIdOf(ref) {\n\tif (typeof ref !== \"object\" || ref === null) return void 0;\n\tif (\"__providerId\" in ref && typeof ref.__providerId === \"string\") return ref.__providerId;\n\tif (\"id\" in ref && typeof ref.id === \"string\") return ref.id;\n}\n/**\n* Brands each `ctx.inputs` entry with the input key it stands for (see\n* flatten): diagnostic only — usage attribution relies on the per-key object\n* identity the branding copy creates, never on reading this back.\n*/\nconst MODULE_INPUT_KEY = Symbol(\"prisma:module-input-key\");\n/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.secrets` forwarding channel. */\nconst MODULE_SECRET_KEY = Symbol(\"prisma:module-secret-key\");\n/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.params` forwarding channel. */\nconst MODULE_PARAM_KEY = Symbol(\"prisma:module-param-key\");\n/** Whether `ref` carries a callable `satisfies` that accepts `required` truthily. */\nfunction satisfiesRequired(ref, required) {\n\treturn typeof ref === \"object\" && ref !== null && \"satisfies\" in ref && typeof ref.satisfies === \"function\" && ref.satisfies(required);\n}\n/**\n* Checks one recorded `wiring` object against the Deps it was wired against:\n* every named input exists and is a dependency slot, every referenced\n* producer is a real (by-now-provisioned) address, and a wired ref whose\n* slot declares a required contract must satisfy() it — no producer-kind\n* branching, the contract alone determines validity, whether the producer is\n* a service port or a resource. Shared by both provisioned kinds so a\n* module-as-child gets exactly the checks a service gets, and run once per\n* entry against the one `byId` shared by the whole recursive flatten, so a\n* forwarded ref resolves through to its real producer address regardless of\n* which ancestor scope provisioned it.\n*/\nfunction validateWiring(pending, byId) {\n\tconst { deps, wiring, targetId, targetKind, enclosingModuleName } = pending;\n\tfor (const [input, ref] of Object.entries(wiring)) {\n\t\tconst declared = blindCast(deps[input]);\n\t\tif (declared === void 0 || !isNode(declared) || declared.kind !== \"dependency\") throw new LoadError(`The deps for \"${targetId}\" name \"${input}\", which is not a dependency slot of that ${targetKind}.`);\n\t\tconst producerId = producerIdOf(ref);\n\t\tconst producer = producerId !== void 0 ? byId.get(producerId) : void 0;\n\t\tif (producerId === void 0 || producer === void 0) throw new LoadError(`The deps for \"${targetId}.${input}\" reference \"${String(producerId)}\", which is not provisioned in module \"${enclosingModuleName}\".`);\n\t\tconst required = declared.required;\n\t\tif (required !== void 0 && !satisfiesRequired(ref, required)) throw new LoadError(`The deps for \"${targetId}.${input}\" do not satisfy the slot's required contract.`);\n\t}\n\tfor (const [input, rawValue] of Object.entries(deps)) {\n\t\tconst value = blindCast(rawValue);\n\t\tif (!isNode(value) || wiring[input] !== void 0) continue;\n\t\tif (value.kind === \"dependency\") throw new LoadError(`Dependency input \"${input}\" of provisioned ${targetKind} \"${targetId}\" is not wired to a producer (module \"${enclosingModuleName}\").`);\n\t}\n}\n/** The (unvalidated) edges a `wiring` object implies — one dependency edge per entry; `validateWiring` does the real checking. */\nfunction wiringEdges(wiring, targetId) {\n\treturn Object.entries(wiring).map(([input, ref]) => ({\n\t\tfrom: producerIdOf(ref) ?? \"\",\n\t\tto: targetId,\n\t\tinput,\n\t\tkind: \"dependency\"\n\t}));\n}\n/**\n* Checks the secrets wired into one provisioned child: every declared slot is\n* bound to a real secret source (an `envSecret` or a forwarded ctx.secrets\n* ref), and no wired key names a slot the child doesn't declare — the secret\n* analog of `validateWiring`'s per-input checks, but resolved inline (a source\n* carries its own name, so no whole-graph pass is needed).\n*/\nfunction validateSecretBinding(child, id, secretWiring, enclosingModuleName) {\n\tconst { kind } = child;\n\tfor (const slot of Object.keys(child.secretSlots)) {\n\t\tconst bound = secretWiring[slot];\n\t\tif (bound === void 0) throw new LoadError(`Secret slot \"${slot}\" of provisioned ${kind} \"${id}\" is not bound (module \"${enclosingModuleName}\") — bind it with envSecret('NAME') or forward ctx.secrets.`);\n\t\tif (!isSecretSource(bound)) throw new LoadError(`Secret slot \"${slot}\" of \"${id}\" (module \"${enclosingModuleName}\") was wired with a non-secret value — use envSecret('NAME') or a forwarded ctx.secrets ref.`);\n\t}\n\tfor (const slot of Object.keys(secretWiring)) if (!Object.hasOwn(child.secretSlots, slot)) throw new LoadError(`The secrets for \"${id}\" name \"${slot}\", which is not a secret slot of that ${kind} (module \"${enclosingModuleName}\").`);\n}\n/**\n* Checks the params wired into a provisioned SERVICE: unlike a secret slot, a\n* declared param is never required to be bound here — it may fall back to its\n* own `default` (checked later, at `buildConfig`) — so this only rejects a\n* wired key that names something other than a real declared param.\n*/\nfunction validateServiceParamBinding(child, id, paramWiring, enclosingModuleName) {\n\tfor (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.params, slot)) throw new LoadError(`The params for \"${id}\" name \"${slot}\", which is not a param of that service (module \"${enclosingModuleName}\").`);\n}\n/**\n* Checks the params wired into a provisioned MODULE: every declared\n* param-forwarding slot must be bound to a real `ParamSource` — a slot has no\n* schema of its own, so (unlike a service param) it cannot fall back to a\n* literal or a default; the param analog of `validateSecretBinding`.\n*/\nfunction validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {\n\tfor (const slot of Object.keys(child.paramSlots)) {\n\t\tconst bound = paramWiring[slot];\n\t\tif (bound === void 0) throw new LoadError(`Param slot \"${slot}\" of provisioned module \"${id}\" is not bound (module \"${enclosingModuleName}\") — bind it with a param source (e.g. envParam('NAME')) or forward ctx.params.`);\n\t\tif (!isParamSource(bound)) throw new LoadError(`Param slot \"${slot}\" of \"${id}\" (module \"${enclosingModuleName}\") was wired with a non-source value — a module param-forwarding slot carries no schema to validate a literal against; use envParam('NAME') or a forwarded ctx.params ref.`);\n\t}\n\tfor (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.paramSlots, slot)) throw new LoadError(`The params for \"${id}\" name \"${slot}\", which is not a param slot of that module (module \"${enclosingModuleName}\").`);\n}\n/**\n* Recursively flattens one module's body into the shared graph state and\n* returns its resolved ModuleOutputs (one ref-port per expose key) for the\n* caller (the enclosing provision() call, or Load itself for the root) to\n* use. `address` is this module's OWN full address, or `undefined` for the root\n* scope — its direct children then get bare (unprefixed) addresses, keeping\n* a single-level module identical to before nesting existed. `wiring` supplies a\n* resolved producer ref-port for each of this module's OWN declared deps (empty\n* for the root, which may not declare any — see the root non-empty-deps\n* check in loadModule). `nodes`, `edges`, `pending`, and `byId` are shared\n* across the ENTIRE recursive flatten, not per scope — a nested module may\n* forward in a producer provisioned by an ancestor scope, and it is the\n* shared `byId` (keyed by full address) that lets that resolve.\n*/\nfunction flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes, edges, pending, secretBindings, paramBindings, byId) {\n\tconst localIds = /* @__PURE__ */ new Set();\n\tconst used = /* @__PURE__ */ new Set();\n\tconst usedSecrets = /* @__PURE__ */ new Set();\n\tconst usedParams = /* @__PURE__ */ new Set();\n\tconst ctxInputs = {};\n\tfor (const key of Object.keys(moduleNode.deps)) {\n\t\tconst wired = wiring[key];\n\t\tctxInputs[key] = typeof wired === \"object\" && wired !== null ? {\n\t\t\t...wired,\n\t\t\t[MODULE_INPUT_KEY]: key\n\t\t} : wired;\n\t}\n\tconst markUsed = (values) => {\n\t\tfor (const value of Object.values(values)) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);\n\t};\n\tconst ctxSecrets = {};\n\tfor (const key of Object.keys(moduleNode.secretSlots)) {\n\t\tconst bound = secretWiring[key];\n\t\tctxSecrets[key] = typeof bound === \"object\" && bound !== null ? {\n\t\t\t...bound,\n\t\t\t[MODULE_SECRET_KEY]: key\n\t\t} : bound;\n\t}\n\tconst markSecretsUsed = (values) => {\n\t\tfor (const value of Object.values(values)) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);\n\t};\n\tconst ctxParams = {};\n\tfor (const key of Object.keys(moduleNode.paramSlots)) {\n\t\tconst bound = paramWiring[key];\n\t\tctxParams[key] = typeof bound === \"object\" && bound !== null ? {\n\t\t\t...bound,\n\t\t\t[MODULE_PARAM_KEY]: key\n\t\t} : bound;\n\t}\n\tconst markParamsUsed = (values) => {\n\t\tfor (const value of Object.values(values)) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);\n\t};\n\tconst provision = (child, opts) => {\n\t\tconst id = opts?.id ?? child.name;\n\t\tconst provisionWiring = opts?.deps;\n\t\tconst provisionSecrets = opts?.secrets;\n\t\tconst provisionParams = opts?.params;\n\t\tif (typeof id !== \"string\" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module \"${moduleNode.name}\").`);\n\t\tif (id.includes(\"_\") || id.includes(\".\")) throw new LoadError(`provision() id \"${id}\" (module \"${moduleNode.name}\") may not contain \"_\" or \".\" — \"_\" is the config-key separator and \".\" the node-id path separator; either inside an id collides with the joined form of other names.`);\n\t\tif (localIds.has(id)) throw new LoadError(`Duplicate provision id \"${id}\" in module \"${moduleNode.name}\".`);\n\t\tconst untrusted = child;\n\t\tif (!isNode(untrusted) || untrusted.kind !== \"service\" && untrusted.kind !== \"resource\" && untrusted.kind !== \"module\") throw new LoadError(`provision(\"${id}\") expects a branded service, resource, or module node (construct it with the service()/resource()/module() factories or a pack's own).`);\n\t\tlocalIds.add(id);\n\t\tconst fullAddress = address === void 0 ? id : `${address}.${id}`;\n\t\tif (child.kind === \"resource\") {\n\t\t\tif (provisionWiring !== void 0) throw new LoadError(`provision(\"${id}\") received deps for a resource — a resource has no dependency slots to satisfy.`);\n\t\t\tif (provisionSecrets !== void 0) throw new LoadError(`provision(\"${id}\") received secrets for a resource — a resource has no secret slots to satisfy.`);\n\t\t\tif (provisionParams !== void 0) throw new LoadError(`provision(\"${id}\") received params for a resource — a resource has no params to satisfy.`);\n\t\t\tif (child.type.length === 0) throw new LoadError(`provision(\"${id}\") received a resource with an empty node type.`);\n\t\t\tbyId.set(fullAddress, child);\n\t\t\tnodes.push({\n\t\t\t\tid: fullAddress,\n\t\t\t\tnode: child\n\t\t\t});\n\t\t\treturn refForResource(fullAddress, child);\n\t\t}\n\t\tconst localWiring = { ...provisionWiring ?? {} };\n\t\tmarkUsed(localWiring);\n\t\tconst localSecrets = { ...provisionSecrets ?? {} };\n\t\tmarkSecretsUsed(localSecrets);\n\t\tvalidateSecretBinding(child, id, localSecrets, moduleNode.name);\n\t\tconst localParams = { ...provisionParams ?? {} };\n\t\tmarkParamsUsed(localParams);\n\t\tif (child.kind === \"service\") {\n\t\t\tfor (const slot of Object.keys(child.secretSlots)) {\n\t\t\t\tconst bound = localSecrets[slot];\n\t\t\t\tif (isSecretSource(bound)) secretBindings.push({\n\t\t\t\t\tserviceAddress: fullAddress,\n\t\t\t\t\tslot,\n\t\t\t\t\tsource: bound\n\t\t\t\t});\n\t\t\t}\n\t\t\tvalidateServiceParamBinding(child, id, localParams, moduleNode.name);\n\t\t\tfor (const [slot, binding] of Object.entries(localParams)) paramBindings.push({\n\t\t\t\tserviceAddress: fullAddress,\n\t\t\t\tslot,\n\t\t\t\tbinding\n\t\t\t});\n\t\t\tconst inputs = serviceInputs(child, fullAddress);\n\t\t\tnodes.push(...inputs.nodes, {\n\t\t\t\tid: fullAddress,\n\t\t\t\tnode: child\n\t\t\t});\n\t\t\tedges.push(...inputs.edges, ...wiringEdges(localWiring, fullAddress));\n\t\t\tpending.push({\n\t\t\t\tdeps: child.inputs,\n\t\t\t\twiring: localWiring,\n\t\t\t\ttargetId: fullAddress,\n\t\t\t\ttargetKind: \"service\",\n\t\t\t\tenclosingModuleName: moduleNode.name\n\t\t\t});\n\t\t\tbyId.set(fullAddress, child);\n\t\t\treturn refFor(fullAddress, child);\n\t\t}\n\t\tvalidateParamNeedBinding(child, id, localParams, moduleNode.name);\n\t\tedges.push(...wiringEdges(localWiring, fullAddress));\n\t\tpending.push({\n\t\t\tdeps: child.deps,\n\t\t\twiring: localWiring,\n\t\t\ttargetId: fullAddress,\n\t\t\ttargetKind: \"module\",\n\t\t\tenclosingModuleName: moduleNode.name\n\t\t});\n\t\tconst childOutputs = flatten(child, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, secretBindings, paramBindings, byId);\n\t\tnodes.push({\n\t\t\tid: fullAddress,\n\t\t\tnode: child\n\t\t});\n\t\tbyId.set(fullAddress, child);\n\t\treturn blindCast({\n\t\t\tid: fullAddress,\n\t\t\t...childOutputs\n\t\t});\n\t};\n\tconst ctx = blindCast({\n\t\tinputs: ctxInputs,\n\t\tsecrets: ctxSecrets,\n\t\tparams: ctxParams,\n\t\tprovision: blindCast(provision)\n\t});\n\tconst outputs = blindCast(moduleNode.body(ctx) ?? {});\n\tmarkUsed(outputs);\n\tfor (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares input \"${key}\" but never forwards it into a provision nor returns it as an output.`);\n\tfor (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares secret \"${key}\" but never forwards it into a provision.`);\n\tfor (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares param \"${key}\" but never forwards it into a provision.`);\n\tfor (const [key, contract] of Object.entries(moduleNode.expose)) {\n\t\tconst port = outputs[key];\n\t\tif (port === void 0) throw new LoadError(`Module \"${moduleNode.name}\" declares expose \"${key}\" but its body did not return a port for it.`);\n\t\tif (!satisfiesRequired(port, contract)) throw new LoadError(`Module \"${moduleNode.name}\"'s returned port for expose \"${key}\" does not satisfy its declared contract.`);\n\t}\n\treturn outputs;\n}\nfunction loadModule(root, opts) {\n\tconst rootId = opts?.id ?? root.name;\n\tconst rootDepKeys = Object.keys(root.deps);\n\tif (rootDepKeys.length > 0) {\n\t\tconst names = rootDepKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares input${rootDepKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to wire them; compose \"${root.name}\" from another module that provisions and wires it instead.`);\n\t}\n\tconst rootSecretKeys = Object.keys(root.secretSlots);\n\tif (rootSecretKeys.length > 0) {\n\t\tconst names = rootSecretKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares secret${rootSecretKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds secrets with envSecret('NAME'), it does not declare secret slots of its own.`);\n\t}\n\tconst rootParamKeys = Object.keys(root.paramSlots);\n\tif (rootParamKeys.length > 0) {\n\t\tconst names = rootParamKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares param${rootParamKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds params directly on each provision() call, it does not declare param-forwarding slots of its own.`);\n\t}\n\tconst nodes = [];\n\tconst edges = [];\n\tconst pending = [];\n\tconst secretBindings = [];\n\tconst paramBindings = [];\n\tconst byId = /* @__PURE__ */ new Map();\n\tflatten(root, void 0, {}, {}, {}, nodes, edges, pending, secretBindings, paramBindings, byId);\n\tfor (const entry of pending) validateWiring(entry, byId);\n\tassertDependencyDag(edges);\n\tconst rootGraphNode = {\n\t\tid: rootId,\n\t\tnode: root\n\t};\n\treturn {\n\t\troot: rootGraphNode,\n\t\tnodes: [...topoSort(nodes, edges), rootGraphNode],\n\t\tedges,\n\t\tsecrets: secretBindings,\n\t\tparams: paramBindings\n\t};\n}\n/**\n* The dependency edges must form a DAG — a cycle means neither producer can\n* deploy first. Resources take no wiring, so only service/module-to-service/module\n* edges can ever participate in a cycle; no special-casing needed.\n*/\nfunction assertDependencyDag(edges) {\n\tconst adjacency = /* @__PURE__ */ new Map();\n\tfor (const edge of edges) {\n\t\tif (edge.kind !== \"dependency\") continue;\n\t\tconst targets = adjacency.get(edge.from) ?? [];\n\t\ttargets.push(edge.to);\n\t\tadjacency.set(edge.from, targets);\n\t}\n\tconst visiting = /* @__PURE__ */ new Set();\n\tconst done = /* @__PURE__ */ new Set();\n\tconst stack = [];\n\tconst visit = (id) => {\n\t\tif (done.has(id)) return;\n\t\tif (visiting.has(id)) throw new LoadError(`Dependency cycle: ${[...stack.slice(stack.indexOf(id)), id].join(\" → \")} — no deploy order exists.`);\n\t\tvisiting.add(id);\n\t\tstack.push(id);\n\t\tfor (const next of adjacency.get(id) ?? []) visit(next);\n\t\tstack.pop();\n\t\tvisiting.delete(id);\n\t\tdone.add(id);\n\t};\n\tfor (const id of adjacency.keys()) visit(id);\n}\n//#endregion\n//#region src/graph.ts\n/**\n* Builds the in-memory graph from a root node. A service root walks its own\n* `inputs`; a module root executes its body (wiring, not user code — the\n* designed exception to imports-run-nothing) and recursively flattens every\n* module it provisions into one graph of hierarchical addresses. A malformed\n* graph is a `LoadError` that names its fix; the individual validation rules\n* live with `loadService` / `loadModule` and are covered by name in the Load\n* tests. Executes nothing of the user's own code beyond module bodies.\n*/\nfunction Load(root, opts) {\n\tif (!isNode(root)) throw new LoadError(\"Load expects a branded service or module node (construct it with the service()/module() factories).\");\n\tif (root.kind === \"module\") return loadModule(root, opts);\n\tif (root.kind === \"service\") return loadService(root, opts?.id ?? \"root\");\n\tthrow new LoadError(\"Load expects a service or module root (received another node kind).\");\n}\n//#endregion\nexport { LoadError as _, isNode as a, isSecretSource as c, paramSource as d, provisionNeed as f, service as g, secretSource as h, freezeNode as i, module as l, secret as m, ResourceNodeBase as n, isParamSource as o, resource as p, dependency as r, isProvisionNeed as s, Load as t, paramNeed as u };\n\n//# sourceMappingURL=graph-BmrUEdo9.mjs.map"],"mappings":";;;AAGA,IAAI,YAAY,cAAc,MAAM;CACnC,YAAY,SAAS;EACpB,MAAM,OAAO;EACb,KAAK,OAAO;CACb;AACD;;;;;AAOA,MAAM,OAAO,OAAO,IAAI,aAAa;AACrC,MAAM,cAAc,UAAU,OAAO,IAAI,oBAAoB,CAAC;AAC9D,MAAM,gBAAgB,UAAU,OAAO,IAAI,sBAAsB,CAAC;;AAElE,SAAS,SAAS;CACjB,OAAO,OAAO,OAAO;GACnB,cAAc;EACf,MAAM;CACP,CAAC;AACF;;AAEA,SAAS,aAAa,SAAS;CAC9B,OAAO,OAAO,OAAO;GACnB,gBAAgB;EACjB;CACD,CAAC;AACF;;AAEA,SAAS,eAAe,OAAO;CAC9B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,mBAAmB;AAC3F;AACA,MAAM,iBAAiB,UAAU,OAAO,IAAI,uBAAuB,CAAC;;AAEpE,SAAS,cAAc,OAAO,SAAS;CACtC,OAAO,UAAU,OAAO,OAAO;GAC7B,iBAAiB;EAClB;EACA;CACD,CAAC,CAAC;AACH;;AAEA,SAAS,gBAAgB,OAAO;CAC/B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,oBAAoB;AAC5F;AACA,MAAM,eAAe,UAAU,OAAO,IAAI,qBAAqB,CAAC;AAChE,MAAM,aAAa,UAAU,OAAO,IAAI,mBAAmB,CAAC;;AAE5D,SAAS,YAAY,SAAS;CAC7B,OAAO,OAAO,OAAO;GACnB,eAAe;EAChB;CACD,CAAC;AACF;;AAEA,SAAS,cAAc,OAAO;CAC7B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,kBAAkB;AAC1F;;AAEA,SAAS,YAAY;CACpB,OAAO,OAAO,OAAO;GACnB,aAAa;EACd,MAAM;CACP,CAAC;AACF;AACA,SAAS,YAAY,MAAM,SAAS;CACnC,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,mCAAmC;AAClH;AACA,SAAS,YAAY,MAAM,SAAS;CACnC,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,8BAA8B;AAC7G;AACA,SAAS,iBAAiB,WAAW,SAAS;CAC7C,IAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,4EAA4E;AACrK;;;;;;AAMA,SAAS,wBAAwB,MAAM,MAAM,SAAS;CACrD,IAAI,KAAK,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,KAAK,KAAK,SAAS,KAAK,wMAAwM;AACpR;AACA,SAAS,yBAAyB,OAAO,MAAM,SAAS;CACvD,KAAK,MAAM,QAAQ,OAAO,wBAAwB,MAAM,MAAM,OAAO;AACtE;AACA,SAAS,aAAa,QAAQ;CAC7B,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAAG,OAAO,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,CAAC;CAC7F,OAAO,OAAO,OAAO,MAAM;AAC5B;AACA,SAAS,cAAc,SAAS;CAC/B,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG,OAAO,QAAQ,OAAO,OAAO,EAAE,GAAG,KAAK,CAAC;CAC5F,OAAO,UAAU,OAAO,OAAO,MAAM,CAAC;AACvC;;AAEA,SAAS,kBAAkB,KAAK;CAC/B,OAAO,UAAU,OAAO,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC3C;;;;;;AAMA,SAAS,WAAW,MAAM;CACzB,OAAO,OAAO,IAAI;CAClB,OAAO;AACR;;;;;;AAMA,IAAI,mBAAmB,MAAM;CAC5B,CAAC,QAAQ;CACT,OAAO;CACP;CACA;CACA;CACA;CACA,YAAY,KAAK;EAChB,YAAY,IAAI,MAAM,UAAU;EAChC,iBAAiB,IAAI,WAAW,UAAU;EAC1C,MAAM,WAAW,IAAI;EACrB,IAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,WAAW,KAAK,OAAO,SAAS,cAAc,YAAY,MAAM,IAAI,MAAM,iHAAiH;EACvS,KAAK,OAAO,IAAI;EAChB,KAAK,YAAY,IAAI;EACrB,KAAK,OAAO,SAAS;EACrB,KAAK,WAAW;CACjB;AACD;;AAEA,IAAI,qBAAqB,cAAc,iBAAiB;CACvD,YAAY,KAAK;EAChB,MAAM,GAAG;EACT,WAAW,IAAI;CAChB;AACD;;;;;;AAMA,SAAS,SAAS,KAAK;CACtB,OAAO,IAAI,mBAAmB,GAAG;AAClC;;;;;AAKA,SAAS,QAAQ,KAAK;CACrB,YAAY,IAAI,MAAM,SAAS;CAC/B,iBAAiB,IAAI,WAAW,SAAS;CACzC,YAAY,IAAI,MAAM,SAAS;CAC/B,yBAAyB,OAAO,KAAK,IAAI,MAAM,GAAG,SAAS,SAAS;CACpE,yBAAyB,OAAO,KAAK,IAAI,MAAM,GAAG,SAAS,SAAS;CACpE,yBAAyB,OAAO,KAAK,IAAI,WAAW,CAAC,CAAC,GAAG,UAAU,SAAS;CAC5E,KAAK,MAAM,QAAQ,OAAO,KAAK,IAAI,WAAW,CAAC,CAAC,GAAG,IAAI,OAAO,OAAO,IAAI,QAAQ,IAAI,GAAG,MAAM,IAAI,MAAM,0BAA0B,KAAK,2HAA2H,KAAK,YAAY,EAAE,eAAe;CACpS,OAAO,OAAO,OAAO;GACnB,OAAO;EACR,MAAM;EACN,MAAM,IAAI;EACV,WAAW,IAAI;EACf,MAAM,IAAI;EACV,QAAQ,kBAAkB,IAAI,MAAM;EACpC,QAAQ,aAAa,IAAI,MAAM;EAC/B,aAAa,cAAc,IAAI,WAAW,UAAU,CAAC,CAAC,CAAC;EACvD,OAAO,OAAO,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC;EACrC,QAAQ,IAAI,WAAW,KAAK,IAAI,kBAAkB,IAAI,MAAM,IAAI,KAAK;CACtE,CAAC;AACF;;;;;;AAMA,SAAS,WAAW,KAAK;CACxB,YAAY,IAAI,MAAM,YAAY;CAClC,yBAAyB,OAAO,KAAK,IAAI,WAAW,MAAM,GAAG,SAAS,YAAY;CAClF,MAAM,aAAa,OAAO,OAAO;EAChC,QAAQ,aAAa,IAAI,WAAW,MAAM;EAC1C,SAAS,IAAI,WAAW;CACzB,CAAC;CACD,OAAO,OAAO,OAAO;GACnB,OAAO;EACR,MAAM;EACN,MAAM,IAAI,SAAS,KAAK,KAAK,IAAI,KAAK,SAAS,IAAI,IAAI,OAAO,IAAI;EAClE,MAAM,IAAI;EACV;EACA,UAAU,IAAI;CACf,CAAC;AACF;;;;;AAKA,SAAS,OAAO,MAAM,gBAAgB,WAAW;CAChD,YAAY,MAAM,QAAQ;CAC1B,MAAM,aAAa,OAAO,mBAAmB;CAC7C,MAAM,WAAW,aAAa,CAAC,IAAI;CACnC,MAAM,OAAO,kBAAkB,SAAS,QAAQ,CAAC,CAAC;CAClD,MAAM,cAAc,kBAAkB,SAAS,WAAW,CAAC,CAAC;CAC5D,MAAM,aAAa,kBAAkB,SAAS,UAAU,CAAC,CAAC;CAC1D,MAAM,SAAS,kBAAkB,SAAS,UAAU,CAAC,CAAC;CACtD,MAAM,OAAO,cAAc,QAAQ;EAClC,eAAe,GAAG;EAClB,OAAO,CAAC;CACT,IAAI;CACJ,OAAO,OAAO,OAAO;GACnB,OAAO;EACR,MAAM;EACN;EACA;EACA;EACA;EACA;EACA;CACD,CAAC;AACF;;;;;;AAMA,SAAS,OAAO,OAAO;CACtB,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,UAAU;AACvE;;;;;;;;;;;;;;AAgBA,SAAS,SAAS,OAAO,OAAO;CAC/B,MAAM,OAAO,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CAChD,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CACtD,MAAM,WAAW,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CACpD,MAAM,6BAA6B,IAAI,IAAI;CAC3C,KAAK,MAAM,QAAQ,OAAO;EACzB,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,EAAE,GAAG;EAChD,MAAM,UAAU,WAAW,IAAI,KAAK,IAAI,KAAK,CAAC;EAC9C,QAAQ,KAAK,KAAK,EAAE;EACpB,WAAW,IAAI,KAAK,MAAM,OAAO;EACjC,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,EAAE,KAAK,KAAK,CAAC;CACvD;CACA,MAAM,QAAQ,IAAI,IAAI,MAAM,QAAQ,MAAM,SAAS,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC;CACpF,MAAM,QAAQ,CAAC;CACf,OAAO,MAAM,OAAO,GAAG;EACtB,IAAI;EACJ,IAAI,YAAY,OAAO;EACvB,KAAK,MAAM,MAAM,OAAO;GACvB,MAAM,QAAQ,QAAQ,IAAI,EAAE,KAAK,OAAO;GACxC,IAAI,QAAQ,WAAW;IACtB,YAAY;IACZ,OAAO;GACR;EACD;EACA,IAAI,SAAS,KAAK,GAAG;EACrB,MAAM,OAAO,IAAI;EACjB,MAAM,KAAK,IAAI;EACf,KAAK,MAAM,UAAU,WAAW,IAAI,IAAI,KAAK,CAAC,GAAG;GAChD,MAAM,aAAa,SAAS,IAAI,MAAM,KAAK,KAAK;GAChD,SAAS,IAAI,QAAQ,SAAS;GAC9B,IAAI,cAAc,GAAG,MAAM,IAAI,MAAM;EACtC;CACD;CACA,IAAI,MAAM,WAAW,MAAM,QAAQ,MAAM,IAAI,UAAU,8BAA8B,MAAM,OAAO,MAAM,MAAM,OAAO,0EAA0E;CAC/L,OAAO,MAAM,KAAK,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,KAAK,CAAC;AAClE;AAGA,SAAS,cAAc,SAAS,WAAW;CAC1C,IAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,WAAW,MAAM,MAAM,IAAI,UAAU,YAAY,UAAU,qBAAqB;CAClI,MAAM,QAAQ,CAAC;CACf,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,QAAQ,MAAM,GAAG;EAC5D,MAAM,OAAO,OAAO,KAAK,IAAI,MAAM,OAAO,KAAK;EAC/C,IAAI,SAAS,YAAY,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,kPAAkP;EACjU,IAAI,SAAS,cAAc,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,gFAAgF;EACjK,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,0BAA0B;EAC7G,MAAM,KAAK,GAAG,UAAU,GAAG;EAC3B,MAAM,KAAK;GACV;GACA,MAAM;EACP,CAAC;EACD,MAAM,KAAK;GACV,MAAM;GACN,IAAI;GACJ;GACA,MAAM;EACP,CAAC;CACF;CACA,OAAO;EACN;EACA;CACD;AACD;AACA,SAAS,YAAY,MAAM,QAAQ;CAClC,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG,IAAI,OAAO,KAAK,KAAK,MAAM,SAAS,cAAc,MAAM,IAAI,UAAU,YAAY,OAAO,qCAAqC,MAAM,kFAAkF,OAAO,YAAY;CACnS,MAAM,cAAc,OAAO,KAAK,KAAK,WAAW;CAChD,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,QAAQ,YAAY,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACxD,MAAM,IAAI,UAAU,YAAY,OAAO,wBAAwB,YAAY,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,uJAAuJ;CAClQ;CACA,MAAM,gBAAgB;EACrB,IAAI;EACJ,MAAM;CACP;CACA,MAAM,EAAE,OAAO,UAAU,cAAc,MAAM,MAAM;CACnD,OAAO;EACN,MAAM;EACN,OAAO,CAAC,GAAG,SAAS,OAAO,KAAK,GAAG,aAAa;EAChD;EACA,SAAS,CAAC;EACV,QAAQ,CAAC;CACV;AACD;;;;;;;AASA,SAAS,OAAO,IAAI,SAAS;CAC5B,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,GAAG,MAAM,QAAQ;EAClF,GAAG;EACH,cAAc;CACf;CACA,OAAO,UAAU;EAChB;EACA,GAAG;CACJ,CAAC;AACF;;;;;;;AAOA,SAAS,eAAe,IAAI,UAAU;CACrC,OAAO,UAAU;EAChB,GAAG,SAAS;EACZ,cAAc;EACd;CACD,CAAC;AACF;;AAEA,SAAS,aAAa,KAAK;CAC1B,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO,KAAK;CACzD,IAAI,kBAAkB,OAAO,OAAO,IAAI,iBAAiB,UAAU,OAAO,IAAI;CAC9E,IAAI,QAAQ,OAAO,OAAO,IAAI,OAAO,UAAU,OAAO,IAAI;AAC3D;;;;;;AAMA,MAAM,mBAAmB,OAAO,yBAAyB;;AAEzD,MAAM,oBAAoB,OAAO,0BAA0B;;AAE3D,MAAM,mBAAmB,OAAO,yBAAyB;;AAEzD,SAAS,kBAAkB,KAAK,UAAU;CACzC,OAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,eAAe,OAAO,OAAO,IAAI,cAAc,cAAc,IAAI,UAAU,QAAQ;AACtI;;;;;;;;;;;;;AAaA,SAAS,eAAe,SAAS,MAAM;CACtC,MAAM,EAAE,MAAM,QAAQ,UAAU,YAAY,wBAAwB;CACpE,KAAK,MAAM,CAAC,OAAO,QAAQ,OAAO,QAAQ,MAAM,GAAG;EAClD,MAAM,WAAW,UAAU,KAAK,MAAM;EACtC,IAAI,aAAa,KAAK,KAAK,CAAC,OAAO,QAAQ,KAAK,SAAS,SAAS,cAAc,MAAM,IAAI,UAAU,iBAAiB,SAAS,UAAU,MAAM,4CAA4C,WAAW,EAAE;EACvM,MAAM,aAAa,aAAa,GAAG;EACnC,MAAM,WAAW,eAAe,KAAK,IAAI,KAAK,IAAI,UAAU,IAAI,KAAK;EACrE,IAAI,eAAe,KAAK,KAAK,aAAa,KAAK,GAAG,MAAM,IAAI,UAAU,iBAAiB,SAAS,GAAG,MAAM,eAAe,OAAO,UAAU,EAAE,yCAAyC,oBAAoB,GAAG;EAC3M,MAAM,WAAW,SAAS;EAC1B,IAAI,aAAa,KAAK,KAAK,CAAC,kBAAkB,KAAK,QAAQ,GAAG,MAAM,IAAI,UAAU,iBAAiB,SAAS,GAAG,MAAM,+CAA+C;CACrK;CACA,KAAK,MAAM,CAAC,OAAO,aAAa,OAAO,QAAQ,IAAI,GAAG;EACrD,MAAM,QAAQ,UAAU,QAAQ;EAChC,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,WAAW,KAAK,GAAG;EAChD,IAAI,MAAM,SAAS,cAAc,MAAM,IAAI,UAAU,qBAAqB,MAAM,mBAAmB,WAAW,IAAI,SAAS,wCAAwC,oBAAoB,IAAI;CAC5L;AACD;;AAEA,SAAS,YAAY,QAAQ,UAAU;CACtC,OAAO,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU;EACpD,MAAM,aAAa,GAAG,KAAK;EAC3B,IAAI;EACJ;EACA,MAAM;CACP,EAAE;AACH;;;;;;;;AAQA,SAAS,sBAAsB,OAAO,IAAI,cAAc,qBAAqB;CAC5E,MAAM,EAAE,SAAS;CACjB,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,WAAW,GAAG;EAClD,MAAM,QAAQ,aAAa;EAC3B,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,UAAU,gBAAgB,KAAK,mBAAmB,KAAK,IAAI,GAAG,0BAA0B,oBAAoB,4DAA4D;EACxM,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM,IAAI,UAAU,gBAAgB,KAAK,QAAQ,GAAG,aAAa,oBAAoB,6FAA6F;CAC/M;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,aAAa,IAAI,GAAG,MAAM,IAAI,UAAU,oBAAoB,GAAG,UAAU,KAAK,wCAAwC,KAAK,YAAY,oBAAoB,IAAI;AACvO;;;;;;;AAOA,SAAS,4BAA4B,OAAO,IAAI,aAAa,qBAAqB;CACjF,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,QAAQ,IAAI,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,UAAU,KAAK,mDAAmD,oBAAoB,IAAI;AAC1N;;;;;;;AAOA,SAAS,yBAAyB,OAAO,IAAI,aAAa,qBAAqB;CAC9E,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,UAAU,GAAG;EACjD,MAAM,QAAQ,YAAY;EAC1B,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,UAAU,eAAe,KAAK,2BAA2B,GAAG,0BAA0B,oBAAoB,gFAAgF;EAC1N,IAAI,CAAC,cAAc,KAAK,GAAG,MAAM,IAAI,UAAU,eAAe,KAAK,QAAQ,GAAG,aAAa,oBAAoB,2KAA2K;CAC3R;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,YAAY,IAAI,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,UAAU,KAAK,uDAAuD,oBAAoB,IAAI;AAClO;;;;;;;;;;;;;;;AAeA,SAAS,QAAQ,YAAY,SAAS,QAAQ,cAAc,aAAa,OAAO,OAAO,SAAS,gBAAgB,eAAe,MAAM;CACpI,MAAM,2BAA2B,IAAI,IAAI;CACzC,MAAM,uBAAuB,IAAI,IAAI;CACrC,MAAM,8BAA8B,IAAI,IAAI;CAC5C,MAAM,6BAA6B,IAAI,IAAI;CAC3C,MAAM,YAAY,CAAC;CACnB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,IAAI,GAAG;EAC/C,MAAM,QAAQ,OAAO;EACrB,UAAU,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC9D,GAAG;IACF,mBAAmB;EACrB,IAAI;CACL;CACA,MAAM,YAAY,WAAW;EAC5B,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GAAG,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAAG,IAAI,UAAU,UAAU,MAAM,KAAK,IAAI,GAAG;CAChI;CACA,MAAM,aAAa,CAAC;CACpB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,WAAW,GAAG;EACtD,MAAM,QAAQ,aAAa;EAC3B,WAAW,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC/D,GAAG;IACF,oBAAoB;EACtB,IAAI;CACL;CACA,MAAM,mBAAmB,WAAW;EACnC,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GAAG,KAAK,MAAM,OAAO,OAAO,KAAK,UAAU,GAAG,IAAI,UAAU,WAAW,MAAM,YAAY,IAAI,GAAG;CACzI;CACA,MAAM,YAAY,CAAC;CACnB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,GAAG;EACrD,MAAM,QAAQ,YAAY;EAC1B,UAAU,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC9D,GAAG;IACF,mBAAmB;EACrB,IAAI;CACL;CACA,MAAM,kBAAkB,WAAW;EAClC,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GAAG,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAAG,IAAI,UAAU,UAAU,MAAM,WAAW,IAAI,GAAG;CACtI;CACA,MAAM,aAAa,OAAO,SAAS;EAClC,MAAM,KAAK,MAAM,MAAM,MAAM;EAC7B,MAAM,kBAAkB,MAAM;EAC9B,MAAM,mBAAmB,MAAM;EAC/B,MAAM,kBAAkB,MAAM;EAC9B,IAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG,MAAM,IAAI,UAAU,gDAAgD,WAAW,KAAK,IAAI;EACvI,IAAI,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,GAAG,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,aAAa,WAAW,KAAK,sKAAsK;EACvR,IAAI,SAAS,IAAI,EAAE,GAAG,MAAM,IAAI,UAAU,2BAA2B,GAAG,eAAe,WAAW,KAAK,GAAG;EAC1G,MAAM,YAAY;EAClB,IAAI,CAAC,OAAO,SAAS,KAAK,UAAU,SAAS,aAAa,UAAU,SAAS,cAAc,UAAU,SAAS,UAAU,MAAM,IAAI,UAAU,cAAc,GAAG,wIAAwI;EACrS,SAAS,IAAI,EAAE;EACf,MAAM,cAAc,YAAY,KAAK,IAAI,KAAK,GAAG,QAAQ,GAAG;EAC5D,IAAI,MAAM,SAAS,YAAY;GAC9B,IAAI,oBAAoB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,iFAAiF;GACtJ,IAAI,qBAAqB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,gFAAgF;GACtJ,IAAI,oBAAoB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,yEAAyE;GAC9I,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,gDAAgD;GAClH,KAAK,IAAI,aAAa,KAAK;GAC3B,MAAM,KAAK;IACV,IAAI;IACJ,MAAM;GACP,CAAC;GACD,OAAO,eAAe,aAAa,KAAK;EACzC;EACA,MAAM,cAAc,EAAE,GAAG,mBAAmB,CAAC,EAAE;EAC/C,SAAS,WAAW;EACpB,MAAM,eAAe,EAAE,GAAG,oBAAoB,CAAC,EAAE;EACjD,gBAAgB,YAAY;EAC5B,sBAAsB,OAAO,IAAI,cAAc,WAAW,IAAI;EAC9D,MAAM,cAAc,EAAE,GAAG,mBAAmB,CAAC,EAAE;EAC/C,eAAe,WAAW;EAC1B,IAAI,MAAM,SAAS,WAAW;GAC7B,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,WAAW,GAAG;IAClD,MAAM,QAAQ,aAAa;IAC3B,IAAI,eAAe,KAAK,GAAG,eAAe,KAAK;KAC9C,gBAAgB;KAChB;KACA,QAAQ;IACT,CAAC;GACF;GACA,4BAA4B,OAAO,IAAI,aAAa,WAAW,IAAI;GACnE,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,WAAW,GAAG,cAAc,KAAK;IAC7E,gBAAgB;IAChB;IACA;GACD,CAAC;GACD,MAAM,SAAS,cAAc,OAAO,WAAW;GAC/C,MAAM,KAAK,GAAG,OAAO,OAAO;IAC3B,IAAI;IACJ,MAAM;GACP,CAAC;GACD,MAAM,KAAK,GAAG,OAAO,OAAO,GAAG,YAAY,aAAa,WAAW,CAAC;GACpE,QAAQ,KAAK;IACZ,MAAM,MAAM;IACZ,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,qBAAqB,WAAW;GACjC,CAAC;GACD,KAAK,IAAI,aAAa,KAAK;GAC3B,OAAO,OAAO,aAAa,KAAK;EACjC;EACA,yBAAyB,OAAO,IAAI,aAAa,WAAW,IAAI;EAChE,MAAM,KAAK,GAAG,YAAY,aAAa,WAAW,CAAC;EACnD,QAAQ,KAAK;GACZ,MAAM,MAAM;GACZ,QAAQ;GACR,UAAU;GACV,YAAY;GACZ,qBAAqB,WAAW;EACjC,CAAC;EACD,MAAM,eAAe,QAAQ,OAAO,aAAa,aAAa,cAAc,aAAa,OAAO,OAAO,SAAS,gBAAgB,eAAe,IAAI;EACnJ,MAAM,KAAK;GACV,IAAI;GACJ,MAAM;EACP,CAAC;EACD,KAAK,IAAI,aAAa,KAAK;EAC3B,OAAO,UAAU;GAChB,IAAI;GACJ,GAAG;EACJ,CAAC;CACF;CACA,MAAM,MAAM,UAAU;EACrB,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,WAAW,UAAU,SAAS;CAC/B,CAAC;CACD,MAAM,UAAU,UAAU,WAAW,KAAK,GAAG,KAAK,CAAC,CAAC;CACpD,SAAS,OAAO;CAChB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,oBAAoB,IAAI,sEAAsE;CACjN,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,qBAAqB,IAAI,0CAA0C;CACpM,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,oBAAoB,IAAI,0CAA0C;CACjM,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,WAAW,MAAM,GAAG;EAChE,MAAM,OAAO,QAAQ;EACrB,IAAI,SAAS,KAAK,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,qBAAqB,IAAI,6CAA6C;EAC1I,IAAI,CAAC,kBAAkB,MAAM,QAAQ,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,gCAAgC,IAAI,0CAA0C;CACtK;CACA,OAAO;AACR;AACA,SAAS,WAAW,MAAM,MAAM;CAC/B,MAAM,SAAS,MAAM,MAAM,KAAK;CAChC,MAAM,cAAc,OAAO,KAAK,KAAK,IAAI;CACzC,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,QAAQ,YAAY,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACxD,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,kBAAkB,YAAY,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,4FAA4F,KAAK,KAAK,4DAA4D;CACzQ;CACA,MAAM,iBAAiB,OAAO,KAAK,KAAK,WAAW;CACnD,IAAI,eAAe,SAAS,GAAG;EAC9B,MAAM,QAAQ,eAAe,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EAC3D,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,mBAAmB,eAAe,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,6KAA6K;CACxR;CACA,MAAM,gBAAgB,OAAO,KAAK,KAAK,UAAU;CACjD,IAAI,cAAc,SAAS,GAAG;EAC7B,MAAM,QAAQ,cAAc,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EAC1D,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,kBAAkB,cAAc,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,iMAAiM;CAC1S;CACA,MAAM,QAAQ,CAAC;CACf,MAAM,QAAQ,CAAC;CACf,MAAM,UAAU,CAAC;CACjB,MAAM,iBAAiB,CAAC;CACxB,MAAM,gBAAgB,CAAC;CACvB,MAAM,uBAAuB,IAAI,IAAI;CACrC,QAAQ,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,OAAO,SAAS,gBAAgB,eAAe,IAAI;CAC5F,KAAK,MAAM,SAAS,SAAS,eAAe,OAAO,IAAI;CACvD,oBAAoB,KAAK;CACzB,MAAM,gBAAgB;EACrB,IAAI;EACJ,MAAM;CACP;CACA,OAAO;EACN,MAAM;EACN,OAAO,CAAC,GAAG,SAAS,OAAO,KAAK,GAAG,aAAa;EAChD;EACA,SAAS;EACT,QAAQ;CACT;AACD;;;;;;AAMA,SAAS,oBAAoB,OAAO;CACnC,MAAM,4BAA4B,IAAI,IAAI;CAC1C,KAAK,MAAM,QAAQ,OAAO;EACzB,IAAI,KAAK,SAAS,cAAc;EAChC,MAAM,UAAU,UAAU,IAAI,KAAK,IAAI,KAAK,CAAC;EAC7C,QAAQ,KAAK,KAAK,EAAE;EACpB,UAAU,IAAI,KAAK,MAAM,OAAO;CACjC;CACA,MAAM,2BAA2B,IAAI,IAAI;CACzC,MAAM,uBAAuB,IAAI,IAAI;CACrC,MAAM,QAAQ,CAAC;CACf,MAAM,SAAS,OAAO;EACrB,IAAI,KAAK,IAAI,EAAE,GAAG;EAClB,IAAI,SAAS,IAAI,EAAE,GAAG,MAAM,IAAI,UAAU,qBAAqB,CAAC,GAAG,MAAM,MAAM,MAAM,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,2BAA2B;EAC9I,SAAS,IAAI,EAAE;EACf,MAAM,KAAK,EAAE;EACb,KAAK,MAAM,QAAQ,UAAU,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI;EACtD,MAAM,IAAI;EACV,SAAS,OAAO,EAAE;EAClB,KAAK,IAAI,EAAE;CACZ;CACA,KAAK,MAAM,MAAM,UAAU,KAAK,GAAG,MAAM,EAAE;AAC5C;;;;;;;;;;AAYA,SAAS,KAAK,MAAM,MAAM;CACzB,IAAI,CAAC,OAAO,IAAI,GAAG,MAAM,IAAI,UAAU,qGAAqG;CAC5I,IAAI,KAAK,SAAS,UAAU,OAAO,WAAW,MAAM,IAAI;CACxD,IAAI,KAAK,SAAS,WAAW,OAAO,YAAY,MAAM,MAAM,MAAM,MAAM;CACxE,MAAM,IAAI,UAAU,qEAAqE;AAC1F"}