@prisma/composer 0.23.0-dev.3 → 0.23.0-dev.4

package/dist/dist-DiYPSVUE.mjs

@@ -0,0 +1,177 @@
+import fs from "node:fs";
+import path from "node:path";
+//#region ../../0-framework/2-authoring/bundle-paths/dist/index.mjs
+/**
+* The path-containment predicate and bundle-link validation shared by every
+* assembly and packaging seam (node/nextjs adapters, the compute artifact
+* writer, the local extractor). This predicate is the enforcement point of
+* ADR-0047's boundary — a symlink may be preserved only while its target
+* stays inside the assembled bundle — so it exists exactly once.
+*
+* Windows cannot create `dir`/`file` symlinks without Developer Mode or an
+* elevated token (`EPERM`). Directory junctions need no such privilege, so
+* assemble uses them on win32; file links fall back to a copy of the target.
+*/
+/** How a platform materializes a bundle link without needing symlink privilege. */
+function bundleLinkStrategy(platform, type) {
+	if (platform !== "win32") return "symlink";
+	return type === "dir" ? "junction" : "symlink-with-copy-fallback";
+}
+function isNotPermitted(error) {
+	return error instanceof Error && Reflect.get(error, "code") === "EPERM";
+}
+/**
+* Creates a link at `linkPath` whose stored target is `target`.
+* `resolvedTarget` is the absolute path of that target in the destination
+* tree — junctions require it. The win32 file-copy fallback reads
+* `copySource` (source-tree path) when set, otherwise `resolvedTarget`, and
+* only when the target exists and stays inside `copyWithinRoot` (ADR-0047:
+* never dereference an escaping link into the artifact).
+*
+* Junction/symlink strategies may temporarily store an escaping
+* `resolvedTarget` (pnpm absolute junctions into the tracing-root store);
+* later staging rewrites them, and `assertBundleSymlinksStayInside` is the
+* final gate. Only the file-copy fallback must refuse escapes — copying would
+* materialize deploy-machine content as a regular file with no link left to
+* validate.
+*/
+async function createBundleLink(linkPath, target, type, options) {
+	const strategy = bundleLinkStrategy(options.platform ?? process.platform, type);
+	if (strategy === "junction") {
+		await fs.promises.symlink(options.resolvedTarget, linkPath, "junction");
+		return;
+	}
+	if (strategy === "symlink") {
+		await fs.promises.symlink(target, linkPath, type);
+		return;
+	}
+	try {
+		await fs.promises.symlink(target, linkPath, "file");
+	} catch (error) {
+		if (!isNotPermitted(error)) throw error;
+		if (!isWithin(path.resolve(options.copyWithinRoot), path.resolve(options.resolvedTarget))) throw new Error(`refusing to materialize a file link whose target escapes the bundle: ${linkPath} -> ${options.resolvedTarget}`, { cause: error });
+		const copyFrom = options.copySource ?? options.resolvedTarget;
+		try {
+			await fs.promises.stat(copyFrom);
+		} catch {
+			throw new Error(`the assembled bundle contains a dangling symlink: ${linkPath}`);
+		}
+		await fs.promises.copyFile(copyFrom, linkPath);
+	}
+}
+/**
+* Map a link's stored target from the source tree into the destination tree.
+* pnpm on Windows often materializes directory links as junctions with absolute
+* targets; copying those verbatim leaves them pointing at the source, which
+* `assertBundleSymlinksStayInside` correctly rejects as an escape.
+*/
+function mapLinkIntoDestination(sourceRoot, destinationRoot, sourcePath, destinationPath, rawTarget) {
+	const resolvedSource = path.resolve(path.dirname(sourcePath), rawTarget);
+	if (isWithin(sourceRoot, resolvedSource)) {
+		const resolvedTarget = path.resolve(destinationRoot, path.relative(sourceRoot, resolvedSource));
+		return {
+			target: path.relative(path.dirname(destinationPath), resolvedTarget),
+			resolvedTarget
+		};
+	}
+	return {
+		target: rawTarget,
+		resolvedTarget: path.resolve(path.dirname(destinationPath), rawTarget)
+	};
+}
+/** Restores directory-link metadata lost by `fs.cp` on Windows. */
+async function repairWindowsDirectorySymlinks(root) {
+	if (process.platform !== "win32") return;
+	const visit = async (directory) => {
+		for (const entry of await fs.promises.readdir(directory, { withFileTypes: true })) {
+			const full = path.join(directory, entry.name);
+			if (entry.isSymbolicLink()) {
+				const target = await fs.promises.readlink(full);
+				if (path.isAbsolute(target)) continue;
+				const resolvedTarget = path.resolve(path.dirname(full), target);
+				if (!isWithin(root, resolvedTarget)) continue;
+				try {
+					if (!(await fs.promises.stat(resolvedTarget)).isDirectory()) continue;
+				} catch {
+					continue;
+				}
+				await fs.promises.unlink(full);
+				await createBundleLink(full, target, "dir", {
+					resolvedTarget,
+					copyWithinRoot: root
+				});
+			} else if (entry.isDirectory()) await visit(full);
+		}
+	};
+	await visit(root);
+}
+/** Copy without `fs.cp`'s symlink privilege requirement: real files first, then links. */
+async function copyTreeVerbatimWalk(source, destination) {
+	const sourceRoot = path.resolve(source);
+	const destinationRoot = path.resolve(destination);
+	const links = [];
+	const copyNonLinks = async (sourceDir, destinationDir) => {
+		await fs.promises.mkdir(destinationDir, { recursive: true });
+		for (const entry of await fs.promises.readdir(sourceDir, { withFileTypes: true })) {
+			const sourcePath = path.join(sourceDir, entry.name);
+			const destinationPath = path.join(destinationDir, entry.name);
+			if (entry.isSymbolicLink()) links.push({
+				sourcePath,
+				destinationPath
+			});
+			else if (entry.isDirectory()) await copyNonLinks(sourcePath, destinationPath);
+			else if (entry.isFile()) await fs.promises.copyFile(sourcePath, destinationPath);
+		}
+	};
+	await copyNonLinks(source, destination);
+	for (const { sourcePath, destinationPath } of links) {
+		const rawTarget = await fs.promises.readlink(sourcePath);
+		const resolvedSource = path.resolve(path.dirname(sourcePath), rawTarget);
+		let type = "file";
+		try {
+			type = (await fs.promises.stat(resolvedSource)).isDirectory() ? "dir" : "file";
+		} catch {}
+		const mapped = mapLinkIntoDestination(sourceRoot, destinationRoot, sourcePath, destinationPath, rawTarget);
+		await fs.promises.mkdir(path.dirname(destinationPath), { recursive: true });
+		await createBundleLink(destinationPath, mapped.target, type, {
+			resolvedTarget: mapped.resolvedTarget,
+			copySource: resolvedSource,
+			copyWithinRoot: destinationRoot
+		});
+	}
+}
+async function copyTreeVerbatim(source, destination) {
+	await copyTreeVerbatimWalk(source, destination);
+}
+/** Lexical containment: `candidate` is `root` itself or below it. Both paths
+* must already be absolute or share a resolution base; no filesystem access. */
+function isWithin(root, candidate) {
+	const relative = path.relative(root, candidate);
+	return relative === "" || !relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative);
+}
+/** Walks the assembled bundle and rejects a dangling symlink or one whose
+* resolved target escapes the bundle root. Symlinked directories are not
+* descended: their targets are validated, and their contents belong to the
+* target's own location. */
+async function assertBundleSymlinksStayInside(bundleDir) {
+	const realRoot = await fs.promises.realpath(bundleDir);
+	const walk = async (directory) => {
+		for (const entry of await fs.promises.readdir(directory, { withFileTypes: true })) {
+			const full = path.join(directory, entry.name);
+			if (entry.isSymbolicLink()) {
+				let realTarget;
+				try {
+					realTarget = await fs.promises.realpath(full);
+				} catch {
+					throw new Error(`the assembled bundle contains a dangling symlink: ${full}`);
+				}
+				if (!isWithin(realRoot, realTarget)) throw new Error(`the assembled bundle contains a symlink whose target escapes the bundle: ${full} -> ${await fs.promises.readlink(full)}`);
+			} else if (entry.isDirectory()) await walk(full);
+		}
+	};
+	await walk(bundleDir);
+}
+//#endregion
+export { repairWindowsDirectorySymlinks as a, isWithin as i, copyTreeVerbatim as n, createBundleLink as r, assertBundleSymlinksStayInside as t };
+
+//# sourceMappingURL=dist-DiYPSVUE.mjs.map

package/dist/dist-DiYPSVUE.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist-DiYPSVUE.mjs","names":[],"sources":["../../../0-framework/2-authoring/bundle-paths/dist/index.mjs"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\n//#region src/bundle-paths.ts\n/**\n* The path-containment predicate and bundle-link validation shared by every\n* assembly and packaging seam (node/nextjs adapters, the compute artifact\n* writer, the local extractor). This predicate is the enforcement point of\n* ADR-0047's boundary — a symlink may be preserved only while its target\n* stays inside the assembled bundle — so it exists exactly once.\n*\n* Windows cannot create `dir`/`file` symlinks without Developer Mode or an\n* elevated token (`EPERM`). Directory junctions need no such privilege, so\n* assemble uses them on win32; file links fall back to a copy of the target.\n*/\n/** How a platform materializes a bundle link without needing symlink privilege. */\nfunction bundleLinkStrategy(platform, type) {\n\tif (platform !== \"win32\") return \"symlink\";\n\treturn type === \"dir\" ? \"junction\" : \"symlink-with-copy-fallback\";\n}\nfunction isNotPermitted(error) {\n\treturn error instanceof Error && Reflect.get(error, \"code\") === \"EPERM\";\n}\n/**\n* Creates a link at `linkPath` whose stored target is `target`.\n* `resolvedTarget` is the absolute path of that target in the destination\n* tree — junctions require it. The win32 file-copy fallback reads\n* `copySource` (source-tree path) when set, otherwise `resolvedTarget`, and\n* only when the target exists and stays inside `copyWithinRoot` (ADR-0047:\n* never dereference an escaping link into the artifact).\n*\n* Junction/symlink strategies may temporarily store an escaping\n* `resolvedTarget` (pnpm absolute junctions into the tracing-root store);\n* later staging rewrites them, and `assertBundleSymlinksStayInside` is the\n* final gate. Only the file-copy fallback must refuse escapes — copying would\n* materialize deploy-machine content as a regular file with no link left to\n* validate.\n*/\nasync function createBundleLink(linkPath, target, type, options) {\n\tconst strategy = bundleLinkStrategy(options.platform ?? process.platform, type);\n\tif (strategy === \"junction\") {\n\t\tawait fs.promises.symlink(options.resolvedTarget, linkPath, \"junction\");\n\t\treturn;\n\t}\n\tif (strategy === \"symlink\") {\n\t\tawait fs.promises.symlink(target, linkPath, type);\n\t\treturn;\n\t}\n\ttry {\n\t\tawait fs.promises.symlink(target, linkPath, \"file\");\n\t} catch (error) {\n\t\tif (!isNotPermitted(error)) throw error;\n\t\tif (!isWithin(path.resolve(options.copyWithinRoot), path.resolve(options.resolvedTarget))) throw new Error(`refusing to materialize a file link whose target escapes the bundle: ${linkPath} -> ${options.resolvedTarget}`, { cause: error });\n\t\tconst copyFrom = options.copySource ?? options.resolvedTarget;\n\t\ttry {\n\t\t\tawait fs.promises.stat(copyFrom);\n\t\t} catch {\n\t\t\tthrow new Error(`the assembled bundle contains a dangling symlink: ${linkPath}`);\n\t\t}\n\t\tawait fs.promises.copyFile(copyFrom, linkPath);\n\t}\n}\n/**\n* Map a link's stored target from the source tree into the destination tree.\n* pnpm on Windows often materializes directory links as junctions with absolute\n* targets; copying those verbatim leaves them pointing at the source, which\n* `assertBundleSymlinksStayInside` correctly rejects as an escape.\n*/\nfunction mapLinkIntoDestination(sourceRoot, destinationRoot, sourcePath, destinationPath, rawTarget) {\n\tconst resolvedSource = path.resolve(path.dirname(sourcePath), rawTarget);\n\tif (isWithin(sourceRoot, resolvedSource)) {\n\t\tconst resolvedTarget = path.resolve(destinationRoot, path.relative(sourceRoot, resolvedSource));\n\t\treturn {\n\t\t\ttarget: path.relative(path.dirname(destinationPath), resolvedTarget),\n\t\t\tresolvedTarget\n\t\t};\n\t}\n\treturn {\n\t\ttarget: rawTarget,\n\t\tresolvedTarget: path.resolve(path.dirname(destinationPath), rawTarget)\n\t};\n}\n/** Restores directory-link metadata lost by `fs.cp` on Windows. */\nasync function repairWindowsDirectorySymlinks(root) {\n\tif (process.platform !== \"win32\") return;\n\tconst visit = async (directory) => {\n\t\tfor (const entry of await fs.promises.readdir(directory, { withFileTypes: true })) {\n\t\t\tconst full = path.join(directory, entry.name);\n\t\t\tif (entry.isSymbolicLink()) {\n\t\t\t\tconst target = await fs.promises.readlink(full);\n\t\t\t\tif (path.isAbsolute(target)) continue;\n\t\t\t\tconst resolvedTarget = path.resolve(path.dirname(full), target);\n\t\t\t\tif (!isWithin(root, resolvedTarget)) continue;\n\t\t\t\ttry {\n\t\t\t\t\tif (!(await fs.promises.stat(resolvedTarget)).isDirectory()) continue;\n\t\t\t\t} catch {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tawait fs.promises.unlink(full);\n\t\t\t\tawait createBundleLink(full, target, \"dir\", {\n\t\t\t\t\tresolvedTarget,\n\t\t\t\t\tcopyWithinRoot: root\n\t\t\t\t});\n\t\t\t} else if (entry.isDirectory()) await visit(full);\n\t\t}\n\t};\n\tawait visit(root);\n}\n/** Copy without `fs.cp`'s symlink privilege requirement: real files first, then links. */\nasync function copyTreeVerbatimWalk(source, destination) {\n\tconst sourceRoot = path.resolve(source);\n\tconst destinationRoot = path.resolve(destination);\n\tconst links = [];\n\tconst copyNonLinks = async (sourceDir, destinationDir) => {\n\t\tawait fs.promises.mkdir(destinationDir, { recursive: true });\n\t\tfor (const entry of await fs.promises.readdir(sourceDir, { withFileTypes: true })) {\n\t\t\tconst sourcePath = path.join(sourceDir, entry.name);\n\t\t\tconst destinationPath = path.join(destinationDir, entry.name);\n\t\t\tif (entry.isSymbolicLink()) links.push({\n\t\t\t\tsourcePath,\n\t\t\t\tdestinationPath\n\t\t\t});\n\t\t\telse if (entry.isDirectory()) await copyNonLinks(sourcePath, destinationPath);\n\t\t\telse if (entry.isFile()) await fs.promises.copyFile(sourcePath, destinationPath);\n\t\t}\n\t};\n\tawait copyNonLinks(source, destination);\n\tfor (const { sourcePath, destinationPath } of links) {\n\t\tconst rawTarget = await fs.promises.readlink(sourcePath);\n\t\tconst resolvedSource = path.resolve(path.dirname(sourcePath), rawTarget);\n\t\tlet type = \"file\";\n\t\ttry {\n\t\t\ttype = (await fs.promises.stat(resolvedSource)).isDirectory() ? \"dir\" : \"file\";\n\t\t} catch {}\n\t\tconst mapped = mapLinkIntoDestination(sourceRoot, destinationRoot, sourcePath, destinationPath, rawTarget);\n\t\tawait fs.promises.mkdir(path.dirname(destinationPath), { recursive: true });\n\t\tawait createBundleLink(destinationPath, mapped.target, type, {\n\t\t\tresolvedTarget: mapped.resolvedTarget,\n\t\t\tcopySource: resolvedSource,\n\t\t\tcopyWithinRoot: destinationRoot\n\t\t});\n\t}\n}\nasync function copyTreeVerbatim(source, destination) {\n\tawait copyTreeVerbatimWalk(source, destination);\n}\n/** Lexical containment: `candidate` is `root` itself or below it. Both paths\n* must already be absolute or share a resolution base; no filesystem access. */\nfunction isWithin(root, candidate) {\n\tconst relative = path.relative(root, candidate);\n\treturn relative === \"\" || !relative.startsWith(`..${path.sep}`) && relative !== \"..\" && !path.isAbsolute(relative);\n}\n/** Walks the assembled bundle and rejects a dangling symlink or one whose\n* resolved target escapes the bundle root. Symlinked directories are not\n* descended: their targets are validated, and their contents belong to the\n* target's own location. */\nasync function assertBundleSymlinksStayInside(bundleDir) {\n\tconst realRoot = await fs.promises.realpath(bundleDir);\n\tconst walk = async (directory) => {\n\t\tfor (const entry of await fs.promises.readdir(directory, { withFileTypes: true })) {\n\t\t\tconst full = path.join(directory, entry.name);\n\t\t\tif (entry.isSymbolicLink()) {\n\t\t\t\tlet realTarget;\n\t\t\t\ttry {\n\t\t\t\t\trealTarget = await fs.promises.realpath(full);\n\t\t\t\t} catch {\n\t\t\t\t\tthrow new Error(`the assembled bundle contains a dangling symlink: ${full}`);\n\t\t\t\t}\n\t\t\t\tif (!isWithin(realRoot, realTarget)) throw new Error(`the assembled bundle contains a symlink whose target escapes the bundle: ${full} -> ${await fs.promises.readlink(full)}`);\n\t\t\t} else if (entry.isDirectory()) await walk(full);\n\t\t}\n\t};\n\tawait walk(bundleDir);\n}\n//#endregion\nexport { assertBundleSymlinksStayInside, bundleLinkStrategy, copyTreeVerbatim, createBundleLink, isWithin, repairWindowsDirectorySymlinks };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;;;;;;;;;;;AAeA,SAAS,mBAAmB,UAAU,MAAM;CAC3C,IAAI,aAAa,SAAS,OAAO;CACjC,OAAO,SAAS,QAAQ,aAAa;AACtC;AACA,SAAS,eAAe,OAAO;CAC9B,OAAO,iBAAiB,SAAS,QAAQ,IAAI,OAAO,MAAM,MAAM;AACjE;;;;;;;;;;;;;;;;AAgBA,eAAe,iBAAiB,UAAU,QAAQ,MAAM,SAAS;CAChE,MAAM,WAAW,mBAAmB,QAAQ,YAAY,QAAQ,UAAU,IAAI;CAC9E,IAAI,aAAa,YAAY;EAC5B,MAAM,GAAG,SAAS,QAAQ,QAAQ,gBAAgB,UAAU,UAAU;EACtE;CACD;CACA,IAAI,aAAa,WAAW;EAC3B,MAAM,GAAG,SAAS,QAAQ,QAAQ,UAAU,IAAI;EAChD;CACD;CACA,IAAI;EACH,MAAM,GAAG,SAAS,QAAQ,QAAQ,UAAU,MAAM;CACnD,SAAS,OAAO;EACf,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;EAClC,IAAI,CAAC,SAAS,KAAK,QAAQ,QAAQ,cAAc,GAAG,KAAK,QAAQ,QAAQ,cAAc,CAAC,GAAG,MAAM,IAAI,MAAM,wEAAwE,SAAS,MAAM,QAAQ,kBAAkB,EAAE,OAAO,MAAM,CAAC;EAC5O,MAAM,WAAW,QAAQ,cAAc,QAAQ;EAC/C,IAAI;GACH,MAAM,GAAG,SAAS,KAAK,QAAQ;EAChC,QAAQ;GACP,MAAM,IAAI,MAAM,qDAAqD,UAAU;EAChF;EACA,MAAM,GAAG,SAAS,SAAS,UAAU,QAAQ;CAC9C;AACD;;;;;;;AAOA,SAAS,uBAAuB,YAAY,iBAAiB,YAAY,iBAAiB,WAAW;CACpG,MAAM,iBAAiB,KAAK,QAAQ,KAAK,QAAQ,UAAU,GAAG,SAAS;CACvE,IAAI,SAAS,YAAY,cAAc,GAAG;EACzC,MAAM,iBAAiB,KAAK,QAAQ,iBAAiB,KAAK,SAAS,YAAY,cAAc,CAAC;EAC9F,OAAO;GACN,QAAQ,KAAK,SAAS,KAAK,QAAQ,eAAe,GAAG,cAAc;GACnE;EACD;CACD;CACA,OAAO;EACN,QAAQ;EACR,gBAAgB,KAAK,QAAQ,KAAK,QAAQ,eAAe,GAAG,SAAS;CACtE;AACD;;AAEA,eAAe,+BAA+B,MAAM;CACnD,IAAI,QAAQ,aAAa,SAAS;CAClC,MAAM,QAAQ,OAAO,cAAc;EAClC,KAAK,MAAM,SAAS,MAAM,GAAG,SAAS,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG;GAClF,MAAM,OAAO,KAAK,KAAK,WAAW,MAAM,IAAI;GAC5C,IAAI,MAAM,eAAe,GAAG;IAC3B,MAAM,SAAS,MAAM,GAAG,SAAS,SAAS,IAAI;IAC9C,IAAI,KAAK,WAAW,MAAM,GAAG;IAC7B,MAAM,iBAAiB,KAAK,QAAQ,KAAK,QAAQ,IAAI,GAAG,MAAM;IAC9D,IAAI,CAAC,SAAS,MAAM,cAAc,GAAG;IACrC,IAAI;KACH,IAAI,EAAE,MAAM,GAAG,SAAS,KAAK,cAAc,EAAA,CAAG,YAAY,GAAG;IAC9D,QAAQ;KACP;IACD;IACA,MAAM,GAAG,SAAS,OAAO,IAAI;IAC7B,MAAM,iBAAiB,MAAM,QAAQ,OAAO;KAC3C;KACA,gBAAgB;IACjB,CAAC;GACF,OAAO,IAAI,MAAM,YAAY,GAAG,MAAM,MAAM,IAAI;EACjD;CACD;CACA,MAAM,MAAM,IAAI;AACjB;;AAEA,eAAe,qBAAqB,QAAQ,aAAa;CACxD,MAAM,aAAa,KAAK,QAAQ,MAAM;CACtC,MAAM,kBAAkB,KAAK,QAAQ,WAAW;CAChD,MAAM,QAAQ,CAAC;CACf,MAAM,eAAe,OAAO,WAAW,mBAAmB;EACzD,MAAM,GAAG,SAAS,MAAM,gBAAgB,EAAE,WAAW,KAAK,CAAC;EAC3D,KAAK,MAAM,SAAS,MAAM,GAAG,SAAS,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG;GAClF,MAAM,aAAa,KAAK,KAAK,WAAW,MAAM,IAAI;GAClD,MAAM,kBAAkB,KAAK,KAAK,gBAAgB,MAAM,IAAI;GAC5D,IAAI,MAAM,eAAe,GAAG,MAAM,KAAK;IACtC;IACA;GACD,CAAC;QACI,IAAI,MAAM,YAAY,GAAG,MAAM,aAAa,YAAY,eAAe;QACvE,IAAI,MAAM,OAAO,GAAG,MAAM,GAAG,SAAS,SAAS,YAAY,eAAe;EAChF;CACD;CACA,MAAM,aAAa,QAAQ,WAAW;CACtC,KAAK,MAAM,EAAE,YAAY,qBAAqB,OAAO;EACpD,MAAM,YAAY,MAAM,GAAG,SAAS,SAAS,UAAU;EACvD,MAAM,iBAAiB,KAAK,QAAQ,KAAK,QAAQ,UAAU,GAAG,SAAS;EACvE,IAAI,OAAO;EACX,IAAI;GACH,QAAQ,MAAM,GAAG,SAAS,KAAK,cAAc,EAAA,CAAG,YAAY,IAAI,QAAQ;EACzE,QAAQ,CAAC;EACT,MAAM,SAAS,uBAAuB,YAAY,iBAAiB,YAAY,iBAAiB,SAAS;EACzG,MAAM,GAAG,SAAS,MAAM,KAAK,QAAQ,eAAe,GAAG,EAAE,WAAW,KAAK,CAAC;EAC1E,MAAM,iBAAiB,iBAAiB,OAAO,QAAQ,MAAM;GAC5D,gBAAgB,OAAO;GACvB,YAAY;GACZ,gBAAgB;EACjB,CAAC;CACF;AACD;AACA,eAAe,iBAAiB,QAAQ,aAAa;CACpD,MAAM,qBAAqB,QAAQ,WAAW;AAC/C;;;AAGA,SAAS,SAAS,MAAM,WAAW;CAClC,MAAM,WAAW,KAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,MAAM,CAAC,SAAS,WAAW,KAAK,KAAK,KAAK,KAAK,aAAa,QAAQ,CAAC,KAAK,WAAW,QAAQ;AAClH;;;;;AAKA,eAAe,+BAA+B,WAAW;CACxD,MAAM,WAAW,MAAM,GAAG,SAAS,SAAS,SAAS;CACrD,MAAM,OAAO,OAAO,cAAc;EACjC,KAAK,MAAM,SAAS,MAAM,GAAG,SAAS,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG;GAClF,MAAM,OAAO,KAAK,KAAK,WAAW,MAAM,IAAI;GAC5C,IAAI,MAAM,eAAe,GAAG;IAC3B,IAAI;IACJ,IAAI;KACH,aAAa,MAAM,GAAG,SAAS,SAAS,IAAI;IAC7C,QAAQ;KACP,MAAM,IAAI,MAAM,qDAAqD,MAAM;IAC5E;IACA,IAAI,CAAC,SAAS,UAAU,UAAU,GAAG,MAAM,IAAI,MAAM,4EAA4E,KAAK,MAAM,MAAM,GAAG,SAAS,SAAS,IAAI,GAAG;GAC/K,OAAO,IAAI,MAAM,YAAY,GAAG,MAAM,KAAK,IAAI;EAChD;CACD;CACA,MAAM,KAAK,SAAS;AACrB"}

package/dist/nextjs-control.mjs

@@ -1,4 +1,4 @@
-import { i as repairWindowsDirectorySymlinks, n as copyTreeVerbatim, r as isWithin, t as assertBundleSymlinksStayInside } from "./dist-D1TA1xGC.mjs";
+import { a as repairWindowsDirectorySymlinks, i as isWithin, n as copyTreeVerbatim, r as createBundleLink, t as assertBundleSymlinksStayInside } from "./dist-DiYPSVUE.mjs";
 import * as fs$1 from "node:fs";
 import * as path$1 from "node:path";
 import { fileURLToPath } from "node:url";
@@ -100,7 +100,6 @@ async function missingLinkTargets(bundleDir) {
 	const missing = [];
 	for (const linkPath of await collectSymlinks(bundleDir)) {
 		const rawTarget = await fs$1.promises.readlink(linkPath);
-		if (path$1.isAbsolute(rawTarget)) continue;
 		const target = path$1.resolve(path$1.dirname(linkPath), rawTarget);
 		if (!isWithin(bundleDir, target) || await lstatIfPresent(target) !== void 0) continue;
 		if (await hasSymlinkAncestor(bundleDir, target)) continue;
@@ -109,6 +108,44 @@ async function missingLinkTargets(bundleDir) {
 	return missing;
 }
 /**
+* Absolute junctions (pnpm on Windows) often point from `.next/standalone`
+* straight into the app's `node_modules/.pnpm/...` under the tracing root —
+* outside the standalone copy root. After `copyTreeVerbatim` those links still
+* escape the assembled bundle; stage the real target under the bundle at the
+* same tracing-root-relative path and repoint the link.
+*/
+async function stageEscapingTracingRootLinks(bundleDir, tracedRootReal) {
+	const nodeModulesRoot = path$1.join(tracedRootReal, "node_modules");
+	const stagedSources = /* @__PURE__ */ new Set();
+	for (const linkPath of await collectSymlinks(bundleDir)) {
+		const rawTarget = await fs$1.promises.readlink(linkPath);
+		let resolved = path$1.resolve(path$1.dirname(linkPath), rawTarget);
+		if (await lstatIfPresent(resolved) === void 0) continue;
+		try {
+			resolved = await fs$1.promises.realpath(resolved);
+		} catch {
+			continue;
+		}
+		if (isWithin(bundleDir, resolved)) continue;
+		if (!isWithin(nodeModulesRoot, resolved) && resolved !== nodeModulesRoot) continue;
+		const stagedAt = path$1.join(bundleDir, path$1.relative(tracedRootReal, resolved));
+		if (await lstatIfPresent(stagedAt) === void 0) {
+			await fs$1.promises.mkdir(path$1.dirname(stagedAt), { recursive: true });
+			if ((await fs$1.promises.stat(resolved)).isDirectory()) await copyTreeVerbatim(resolved, stagedAt);
+			else await fs$1.promises.copyFile(resolved, stagedAt);
+			stagedSources.add(resolved);
+		}
+		const type = (await fs$1.promises.stat(stagedAt)).isDirectory() ? "dir" : "file";
+		await fs$1.promises.unlink(linkPath);
+		await createBundleLink(linkPath, path$1.relative(path$1.dirname(linkPath), stagedAt), type, {
+			resolvedTarget: stagedAt,
+			copySource: stagedAt,
+			copyWithinRoot: bundleDir
+		});
+	}
+	return [...stagedSources];
+}
+/**
 * pnpm can leave a traced hoist link in standalone while omitting the virtual-
 * store directory it targets. The same target still exists at the corresponding
 * path under outputFileTracingRoot. Stage only that exact, real in-root target;
@@ -137,6 +174,7 @@ async function stageMissingStandaloneLinkTargets(bundleDir, manifest) {
 			staged = true;
 		}
 	}
+	for (const source of await stageEscapingTracingRootLinks(bundleDir, tracedRootReal)) stagedSources.add(source);
 	return [...stagedSources];
 }
 /** The built standalone server.js for a nextjs build — `appDir`'s standalone root plus the app subpath Next recorded. Single-sourced so `assemble()` (deploy) and the integration-test seam can't drift. */

package/dist/nextjs-control.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"nextjs-control.mjs","names":["path","fs"],"sources":["../../../0-framework/2-authoring/nextjs/dist/control.mjs"],"sourcesContent":["import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { assertBundleSymlinksStayInside, copyTreeVerbatim, isWithin, repairWindowsDirectorySymlinks } from \"@internal/bundle-paths\";\nimport { build } from \"esbuild\";\n//#region src/control/build.ts\n/**\n* The extension's control entry (ADR-0017): `nextjsBuild()` returns the build\n* descriptor `prisma-composer.config.ts` lists. Deploy-only (ADR-0005): the user\n* runs `next build` (`output: \"standalone\"`); `assemble` then performs the\n* *documented* Next standalone deploy — it ships the standalone tree and copies\n* in the client assets Next deliberately omits (`.next/static`, `public/`) — and\n* adds the framework's boot wrapper. This is the canonical `cp` step from the\n* Next docs, run at deploy so no app needs a build-script for it.\n*\n* It does not guess: the app's location inside the standalone tree (deep, when\n* `outputFileTracingRoot` is the monorepo root) is *read from Next's own build\n* manifest* (`.next/required-server-files.json`'s `relativeAppDir`), never walked\n* for or computed from a hardcoded depth. It does not launder: node_modules is\n* shipped exactly as `next build` produced it. The packager preserves a link\n* only after resolving its target inside the assembled bundle, and rejects\n* escaping links. When Next records an in-root package link but omits its target\n* from standalone (seen with pnpm's virtual store), assembly stages that exact\n* target from `outputFileTracingRoot` so the artifact remains self-contained.\n*\n* Artifact layout: `<workDir>/main.mjs` (our wrapper) + `<workDir>/bundle/`\n* (the standalone tree, with static/public copied in). The packager adds\n* `bootstrap.js` + the manifest at the root; bootstrap imports main.mjs, whose\n* run() dynamically imports `./bundle/<relativeAppDir>/server.js`.\n*\n* Paths are file-relative (ADR-0004): `appDir` resolves against\n* `dirname(build.module)`.\n*/\n/** Narrows the shared BuildAdapter to this extension's own descriptor — the value-level mirror of the registry routing on (extension, type). */\nfunction isNextjsBuild(descriptor) {\n\treturn descriptor.type === \"nextjs\" && \"appDir\" in descriptor && typeof descriptor.appDir === \"string\";\n}\nfunction readServerFilesManifest(appDir) {\n\tconst manifestPath = path.join(appDir, \".next\", \"required-server-files.json\");\n\tif (!fs.existsSync(manifestPath)) throw new Error(`no ${path.join(\".next\", \"required-server-files.json\")} under ${appDir} — run \\`next build\\` with output: \"standalone\" first.`);\n\tconst manifest = JSON.parse(fs.readFileSync(manifestPath, \"utf8\"));\n\tconst relativeAppDir = manifest?.relativeAppDir;\n\tconst tracingRoot = manifest?.config?.outputFileTracingRoot;\n\treturn {\n\t\tpath: manifestPath,\n\t\trelativeAppDir: typeof relativeAppDir === \"string\" ? relativeAppDir : void 0,\n\t\ttracingRoot: typeof tracingRoot === \"string\" ? path.resolve(appDir, tracingRoot) : void 0\n\t};\n}\n/**\n* The app's own subpath within `.next/standalone`, as an OS-relative path. Next\n* mirrors the app's location under `outputFileTracingRoot` (deep, when that's the\n* monorepo root); rather than walk the tree for `server.js`, we read where Next\n* put it from `.next/required-server-files.json` — `relativeAppDir` is exactly\n* that subpath. Older Next lacks the field; fall back to computing it from the\n* same manifest's `config.outputFileTracingRoot`.\n*/\nfunction appRelFrom(manifest, appDir) {\n\tconst posixRel = manifest.relativeAppDir ?? (manifest.tracingRoot === void 0 ? void 0 : path.relative(manifest.tracingRoot, appDir).split(path.sep).join(\"/\"));\n\tif (posixRel === void 0) throw new Error(`${manifest.path} records neither relativeAppDir nor config.outputFileTracingRoot — cannot locate the standalone server`);\n\tconst rel = posixRel.split(\"/\").join(path.sep);\n\tif (path.isAbsolute(rel) || !isWithin(appDir, path.join(appDir, rel))) throw new Error(`${manifest.path} records an app location that escapes its tracing root (${posixRel}) — refusing to stage outside the bundle`);\n\treturn rel;\n}\nasync function lstatIfPresent(candidate) {\n\ttry {\n\t\treturn await fs.promises.lstat(candidate);\n\t} catch (error) {\n\t\tif (error instanceof Error && Reflect.get(error, \"code\") === \"ENOENT\") return void 0;\n\t\tthrow error;\n\t}\n}\n/** Do not write through an existing link while repairing a missing target. */\nasync function hasSymlinkAncestor(root, candidate) {\n\tconst relative = path.relative(root, path.dirname(candidate));\n\tlet cursor = root;\n\tfor (const segment of relative.split(path.sep).filter(Boolean)) {\n\t\tcursor = path.join(cursor, segment);\n\t\tconst stat = await lstatIfPresent(cursor);\n\t\tif (stat === void 0) return false;\n\t\tif (stat.isSymbolicLink()) return true;\n\t}\n\treturn false;\n}\nasync function collectSymlinks(root) {\n\tconst links = [];\n\tasync function visit(directory) {\n\t\tfor (const entry of await fs.promises.readdir(directory, { withFileTypes: true })) {\n\t\t\tconst entryPath = path.join(directory, entry.name);\n\t\t\tif (entry.isSymbolicLink()) links.push(entryPath);\n\t\t\telse if (entry.isDirectory()) await visit(entryPath);\n\t\t}\n\t}\n\tawait visit(root);\n\treturn links;\n}\n/** In-bundle link targets that the standalone tree does not contain — the\n* repairs staging has to make. */\nasync function missingLinkTargets(bundleDir) {\n\tconst missing = [];\n\tfor (const linkPath of await collectSymlinks(bundleDir)) {\n\t\tconst rawTarget = await fs.promises.readlink(linkPath);\n\t\tif (path.isAbsolute(rawTarget)) continue;\n\t\tconst target = path.resolve(path.dirname(linkPath), rawTarget);\n\t\tif (!isWithin(bundleDir, target) || await lstatIfPresent(target) !== void 0) continue;\n\t\tif (await hasSymlinkAncestor(bundleDir, target)) continue;\n\t\tmissing.push(target);\n\t}\n\treturn missing;\n}\n/**\n* pnpm can leave a traced hoist link in standalone while omitting the virtual-\n* store directory it targets. The same target still exists at the corresponding\n* path under outputFileTracingRoot. Stage only that exact, real in-root target;\n* unsafe or genuinely unavailable links remain for the packager to reject.\n*/\nasync function stageMissingStandaloneLinkTargets(bundleDir, manifest) {\n\tconst tracingRoot = manifest.tracingRoot;\n\tif (tracingRoot === void 0) {\n\t\tif ((await missingLinkTargets(bundleDir)).length === 0) return [];\n\t\tthrow new Error(`${manifest.path} records no config.outputFileTracingRoot, but the standalone tree contains symlinks whose targets Next omitted — the source root those targets must be staged from is unknown. Rebuild with a Next version that records config.outputFileTracingRoot, or set outputFileTracingRoot in next.config.`);\n\t}\n\tif (await lstatIfPresent(tracingRoot) === void 0) return [];\n\tconst tracedRootReal = await fs.promises.realpath(tracingRoot);\n\tconst stagedSources = /* @__PURE__ */ new Set();\n\tlet staged = true;\n\twhile (staged) {\n\t\tstaged = false;\n\t\tfor (const target of await missingLinkTargets(bundleDir)) {\n\t\t\tconst standaloneRelative = path.relative(bundleDir, target);\n\t\t\tconst source = path.resolve(tracingRoot, standaloneRelative);\n\t\t\tif (await lstatIfPresent(source) === void 0) continue;\n\t\t\tif (!isWithin(tracedRootReal, await fs.promises.realpath(source))) continue;\n\t\t\tawait fs.promises.mkdir(path.dirname(target), { recursive: true });\n\t\t\tawait copyTreeVerbatim(source, target);\n\t\t\tstagedSources.add(source);\n\t\t\tstaged = true;\n\t\t}\n\t}\n\treturn [...stagedSources];\n}\n/** The built standalone server.js for a nextjs build — `appDir`'s standalone root plus the app subpath Next recorded. Single-sourced so `assemble()` (deploy) and the integration-test seam can't drift. */\nfunction standaloneServerPath(build) {\n\tconst appDir = path.resolve(path.dirname(fileURLToPath(build.module)), build.appDir);\n\tconst manifest = readServerFilesManifest(appDir);\n\treturn path.join(appDir, \".next\", \"standalone\", appRelFrom(manifest, appDir), \"server.js\");\n}\nasync function assemble(input) {\n\tif (!isNextjsBuild(input.build)) throw new Error(`@prisma/composer/nextjs/control: expected a \"nextjs\" build adapter (with appDir), got \"${input.build.type}\".`);\n\tconst buildDescriptor = input.build;\n\tconst appDir = path.resolve(path.dirname(fileURLToPath(buildDescriptor.module)), buildDescriptor.appDir);\n\tconst standaloneRoot = path.join(appDir, \".next\", \"standalone\");\n\tif (!fs.existsSync(standaloneRoot)) throw new Error(`no ${path.join(\".next\", \"standalone\")} under ${appDir} — run \\`next build\\` with output: \"standalone\" first.`);\n\tconst manifest = readServerFilesManifest(appDir);\n\tconst appRel = appRelFrom(manifest, appDir);\n\tconst workDir = path.join(input.cwd, \".prisma-composer\", \"artifacts\", input.address);\n\tawait fs.promises.rm(workDir, {\n\t\trecursive: true,\n\t\tforce: true\n\t});\n\tawait fs.promises.mkdir(workDir, { recursive: true });\n\tconst bundleDir = path.join(workDir, \"bundle\");\n\tawait copyTreeVerbatim(standaloneRoot, bundleDir);\n\tconst stagedLinkTargets = await stageMissingStandaloneLinkTargets(bundleDir, manifest);\n\tawait repairWindowsDirectorySymlinks(bundleDir);\n\tconst appOut = path.join(bundleDir, appRel);\n\tconst staticSrc = path.join(appDir, \".next\", \"static\");\n\tif (fs.existsSync(staticSrc)) await copyTreeVerbatim(staticSrc, path.join(appOut, \".next\", \"static\"));\n\tconst publicSrc = path.join(appDir, \"public\");\n\tif (fs.existsSync(publicSrc)) await copyTreeVerbatim(publicSrc, path.join(appOut, \"public\"));\n\tawait assertBundleSymlinksStayInside(bundleDir);\n\tawait build({\n\t\tentryPoints: { main: fileURLToPath(buildDescriptor.module) },\n\t\toutdir: workDir,\n\t\tbundle: true,\n\t\tformat: \"esm\",\n\t\tplatform: \"node\",\n\t\texternal: [\"bun\", \"bun:*\"],\n\t\toutExtension: { \".js\": \".mjs\" }\n\t});\n\tif (!fs.existsSync(path.join(workDir, \"main.mjs\"))) throw new Error(`esbuild produced no main.mjs in ${workDir}`);\n\treturn {\n\t\tdir: workDir,\n\t\tentry: path.posix.join(\"bundle\", appRel.split(path.sep).join(\"/\"), \"server.js\"),\n\t\twatch: [standaloneRoot, ...stagedLinkTargets]\n\t};\n}\n/** The nextjs build extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */\nconst nextjsBuild = () => ({\n\tid: \"@prisma/composer/nextjs\",\n\tnodes: { nextjs: {\n\t\tkind: \"build\",\n\t\tassemble\n\t} }\n});\n//#endregion\nexport { assemble, nextjsBuild, standaloneServerPath };\n\n//# sourceMappingURL=control.mjs.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAS,cAAc,YAAY;CAClC,OAAO,WAAW,SAAS,YAAY,YAAY,cAAc,OAAO,WAAW,WAAW;AAC/F;AACA,SAAS,wBAAwB,QAAQ;CACxC,MAAM,eAAeA,OAAK,KAAK,QAAQ,SAAS,4BAA4B;CAC5E,IAAI,CAACC,KAAG,WAAW,YAAY,GAAG,MAAM,IAAI,MAAM,MAAMD,OAAK,KAAK,SAAS,4BAA4B,EAAE,SAAS,OAAO,uDAAuD;CAChL,MAAM,WAAW,KAAK,MAAMC,KAAG,aAAa,cAAc,MAAM,CAAC;CACjE,MAAM,iBAAiB,UAAU;CACjC,MAAM,cAAc,UAAU,QAAQ;CACtC,OAAO;EACN,MAAM;EACN,gBAAgB,OAAO,mBAAmB,WAAW,iBAAiB,KAAK;EAC3E,aAAa,OAAO,gBAAgB,WAAWD,OAAK,QAAQ,QAAQ,WAAW,IAAI,KAAK;CACzF;AACD;;;;;;;;;AASA,SAAS,WAAW,UAAU,QAAQ;CACrC,MAAM,WAAW,SAAS,mBAAmB,SAAS,gBAAgB,KAAK,IAAI,KAAK,IAAIA,OAAK,SAAS,SAAS,aAAa,MAAM,CAAC,CAAC,MAAMA,OAAK,GAAG,CAAC,CAAC,KAAK,GAAG;CAC5J,IAAI,aAAa,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,SAAS,KAAK,uGAAuG;CACjK,MAAM,MAAM,SAAS,MAAM,GAAG,CAAC,CAAC,KAAKA,OAAK,GAAG;CAC7C,IAAIA,OAAK,WAAW,GAAG,KAAK,CAAC,SAAS,QAAQA,OAAK,KAAK,QAAQ,GAAG,CAAC,GAAG,MAAM,IAAI,MAAM,GAAG,SAAS,KAAK,0DAA0D,SAAS,yCAAyC;CACpN,OAAO;AACR;AACA,eAAe,eAAe,WAAW;CACxC,IAAI;EACH,OAAO,MAAMC,KAAG,SAAS,MAAM,SAAS;CACzC,SAAS,OAAO;EACf,IAAI,iBAAiB,SAAS,QAAQ,IAAI,OAAO,MAAM,MAAM,UAAU,OAAO,KAAK;EACnF,MAAM;CACP;AACD;;AAEA,eAAe,mBAAmB,MAAM,WAAW;CAClD,MAAM,WAAWD,OAAK,SAAS,MAAMA,OAAK,QAAQ,SAAS,CAAC;CAC5D,IAAI,SAAS;CACb,KAAK,MAAM,WAAW,SAAS,MAAMA,OAAK,GAAG,CAAC,CAAC,OAAO,OAAO,GAAG;EAC/D,SAASA,OAAK,KAAK,QAAQ,OAAO;EAClC,MAAM,OAAO,MAAM,eAAe,MAAM;EACxC,IAAI,SAAS,KAAK,GAAG,OAAO;EAC5B,IAAI,KAAK,eAAe,GAAG,OAAO;CACnC;CACA,OAAO;AACR;AACA,eAAe,gBAAgB,MAAM;CACpC,MAAM,QAAQ,CAAC;CACf,eAAe,MAAM,WAAW;EAC/B,KAAK,MAAM,SAAS,MAAMC,KAAG,SAAS,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG;GAClF,MAAM,YAAYD,OAAK,KAAK,WAAW,MAAM,IAAI;GACjD,IAAI,MAAM,eAAe,GAAG,MAAM,KAAK,SAAS;QAC3C,IAAI,MAAM,YAAY,GAAG,MAAM,MAAM,SAAS;EACpD;CACD;CACA,MAAM,MAAM,IAAI;CAChB,OAAO;AACR;;;AAGA,eAAe,mBAAmB,WAAW;CAC5C,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,YAAY,MAAM,gBAAgB,SAAS,GAAG;EACxD,MAAM,YAAY,MAAMC,KAAG,SAAS,SAAS,QAAQ;EACrD,IAAID,OAAK,WAAW,SAAS,GAAG;EAChC,MAAM,SAASA,OAAK,QAAQA,OAAK,QAAQ,QAAQ,GAAG,SAAS;EAC7D,IAAI,CAAC,SAAS,WAAW,MAAM,KAAK,MAAM,eAAe,MAAM,MAAM,KAAK,GAAG;EAC7E,IAAI,MAAM,mBAAmB,WAAW,MAAM,GAAG;EACjD,QAAQ,KAAK,MAAM;CACpB;CACA,OAAO;AACR;;;;;;;AAOA,eAAe,kCAAkC,WAAW,UAAU;CACrE,MAAM,cAAc,SAAS;CAC7B,IAAI,gBAAgB,KAAK,GAAG;EAC3B,KAAK,MAAM,mBAAmB,SAAS,EAAA,CAAG,WAAW,GAAG,OAAO,CAAC;EAChE,MAAM,IAAI,MAAM,GAAG,SAAS,KAAK,mSAAmS;CACrU;CACA,IAAI,MAAM,eAAe,WAAW,MAAM,KAAK,GAAG,OAAO,CAAC;CAC1D,MAAM,iBAAiB,MAAMC,KAAG,SAAS,SAAS,WAAW;CAC7D,MAAM,gCAAgC,IAAI,IAAI;CAC9C,IAAI,SAAS;CACb,OAAO,QAAQ;EACd,SAAS;EACT,KAAK,MAAM,UAAU,MAAM,mBAAmB,SAAS,GAAG;GACzD,MAAM,qBAAqBD,OAAK,SAAS,WAAW,MAAM;GAC1D,MAAM,SAASA,OAAK,QAAQ,aAAa,kBAAkB;GAC3D,IAAI,MAAM,eAAe,MAAM,MAAM,KAAK,GAAG;GAC7C,IAAI,CAAC,SAAS,gBAAgB,MAAMC,KAAG,SAAS,SAAS,MAAM,CAAC,GAAG;GACnE,MAAMA,KAAG,SAAS,MAAMD,OAAK,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;GACjE,MAAM,iBAAiB,QAAQ,MAAM;GACrC,cAAc,IAAI,MAAM;GACxB,SAAS;EACV;CACD;CACA,OAAO,CAAC,GAAG,aAAa;AACzB;;AAEA,SAAS,qBAAqB,OAAO;CACpC,MAAM,SAASA,OAAK,QAAQA,OAAK,QAAQ,cAAc,MAAM,MAAM,CAAC,GAAG,MAAM,MAAM;CACnF,MAAM,WAAW,wBAAwB,MAAM;CAC/C,OAAOA,OAAK,KAAK,QAAQ,SAAS,cAAc,WAAW,UAAU,MAAM,GAAG,WAAW;AAC1F;AACA,eAAe,SAAS,OAAO;CAC9B,IAAI,CAAC,cAAc,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,0FAA0F,MAAM,MAAM,KAAK,GAAG;CAC/J,MAAM,kBAAkB,MAAM;CAC9B,MAAM,SAASA,OAAK,QAAQA,OAAK,QAAQ,cAAc,gBAAgB,MAAM,CAAC,GAAG,gBAAgB,MAAM;CACvG,MAAM,iBAAiBA,OAAK,KAAK,QAAQ,SAAS,YAAY;CAC9D,IAAI,CAACC,KAAG,WAAW,cAAc,GAAG,MAAM,IAAI,MAAM,MAAMD,OAAK,KAAK,SAAS,YAAY,EAAE,SAAS,OAAO,uDAAuD;CAClK,MAAM,WAAW,wBAAwB,MAAM;CAC/C,MAAM,SAAS,WAAW,UAAU,MAAM;CAC1C,MAAM,UAAUA,OAAK,KAAK,MAAM,KAAK,oBAAoB,aAAa,MAAM,OAAO;CACnF,MAAMC,KAAG,SAAS,GAAG,SAAS;EAC7B,WAAW;EACX,OAAO;CACR,CAAC;CACD,MAAMA,KAAG,SAAS,MAAM,SAAS,EAAE,WAAW,KAAK,CAAC;CACpD,MAAM,YAAYD,OAAK,KAAK,SAAS,QAAQ;CAC7C,MAAM,iBAAiB,gBAAgB,SAAS;CAChD,MAAM,oBAAoB,MAAM,kCAAkC,WAAW,QAAQ;CACrF,MAAM,+BAA+B,SAAS;CAC9C,MAAM,SAASA,OAAK,KAAK,WAAW,MAAM;CAC1C,MAAM,YAAYA,OAAK,KAAK,QAAQ,SAAS,QAAQ;CACrD,IAAIC,KAAG,WAAW,SAAS,GAAG,MAAM,iBAAiB,WAAWD,OAAK,KAAK,QAAQ,SAAS,QAAQ,CAAC;CACpG,MAAM,YAAYA,OAAK,KAAK,QAAQ,QAAQ;CAC5C,IAAIC,KAAG,WAAW,SAAS,GAAG,MAAM,iBAAiB,WAAWD,OAAK,KAAK,QAAQ,QAAQ,CAAC;CAC3F,MAAM,+BAA+B,SAAS;CAC9C,MAAM,MAAM;EACX,aAAa,EAAE,MAAM,cAAc,gBAAgB,MAAM,EAAE;EAC3D,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,UAAU,CAAC,OAAO,OAAO;EACzB,cAAc,EAAE,OAAO,OAAO;CAC/B,CAAC;CACD,IAAI,CAACC,KAAG,WAAWD,OAAK,KAAK,SAAS,UAAU,CAAC,GAAG,MAAM,IAAI,MAAM,mCAAmC,SAAS;CAChH,OAAO;EACN,KAAK;EACL,OAAOA,OAAK,MAAM,KAAK,UAAU,OAAO,MAAMA,OAAK,GAAG,CAAC,CAAC,KAAK,GAAG,GAAG,WAAW;EAC9E,OAAO,CAAC,gBAAgB,GAAG,iBAAiB;CAC7C;AACD;;AAEA,MAAM,qBAAqB;CAC1B,IAAI;CACJ,OAAO,EAAE,QAAQ;EAChB,MAAM;EACN;CACD,EAAE;AACH"}
+{"version":3,"file":"nextjs-control.mjs","names":["path","fs"],"sources":["../../../0-framework/2-authoring/nextjs/dist/control.mjs"],"sourcesContent":["import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { assertBundleSymlinksStayInside, copyTreeVerbatim, createBundleLink, isWithin, repairWindowsDirectorySymlinks } from \"@internal/bundle-paths\";\nimport { build } from \"esbuild\";\n//#region src/control/build.ts\n/**\n* The extension's control entry (ADR-0017): `nextjsBuild()` returns the build\n* descriptor `prisma-composer.config.ts` lists. Deploy-only (ADR-0005): the user\n* runs `next build` (`output: \"standalone\"`); `assemble` then performs the\n* *documented* Next standalone deploy — it ships the standalone tree and copies\n* in the client assets Next deliberately omits (`.next/static`, `public/`) — and\n* adds the framework's boot wrapper. This is the canonical `cp` step from the\n* Next docs, run at deploy so no app needs a build-script for it.\n*\n* It does not guess: the app's location inside the standalone tree (deep, when\n* `outputFileTracingRoot` is the monorepo root) is *read from Next's own build\n* manifest* (`.next/required-server-files.json`'s `relativeAppDir`), never walked\n* for or computed from a hardcoded depth. It does not launder: node_modules is\n* shipped exactly as `next build` produced it. The packager preserves a link\n* only after resolving its target inside the assembled bundle, and rejects\n* escaping links. When Next records an in-root package link but omits its target\n* from standalone (seen with pnpm's virtual store), assembly stages that exact\n* target from `outputFileTracingRoot` so the artifact remains self-contained.\n*\n* Artifact layout: `<workDir>/main.mjs` (our wrapper) + `<workDir>/bundle/`\n* (the standalone tree, with static/public copied in). The packager adds\n* `bootstrap.js` + the manifest at the root; bootstrap imports main.mjs, whose\n* run() dynamically imports `./bundle/<relativeAppDir>/server.js`.\n*\n* Paths are file-relative (ADR-0004): `appDir` resolves against\n* `dirname(build.module)`.\n*/\n/** Narrows the shared BuildAdapter to this extension's own descriptor — the value-level mirror of the registry routing on (extension, type). */\nfunction isNextjsBuild(descriptor) {\n\treturn descriptor.type === \"nextjs\" && \"appDir\" in descriptor && typeof descriptor.appDir === \"string\";\n}\nfunction readServerFilesManifest(appDir) {\n\tconst manifestPath = path.join(appDir, \".next\", \"required-server-files.json\");\n\tif (!fs.existsSync(manifestPath)) throw new Error(`no ${path.join(\".next\", \"required-server-files.json\")} under ${appDir} — run \\`next build\\` with output: \"standalone\" first.`);\n\tconst manifest = JSON.parse(fs.readFileSync(manifestPath, \"utf8\"));\n\tconst relativeAppDir = manifest?.relativeAppDir;\n\tconst tracingRoot = manifest?.config?.outputFileTracingRoot;\n\treturn {\n\t\tpath: manifestPath,\n\t\trelativeAppDir: typeof relativeAppDir === \"string\" ? relativeAppDir : void 0,\n\t\ttracingRoot: typeof tracingRoot === \"string\" ? path.resolve(appDir, tracingRoot) : void 0\n\t};\n}\n/**\n* The app's own subpath within `.next/standalone`, as an OS-relative path. Next\n* mirrors the app's location under `outputFileTracingRoot` (deep, when that's the\n* monorepo root); rather than walk the tree for `server.js`, we read where Next\n* put it from `.next/required-server-files.json` — `relativeAppDir` is exactly\n* that subpath. Older Next lacks the field; fall back to computing it from the\n* same manifest's `config.outputFileTracingRoot`.\n*/\nfunction appRelFrom(manifest, appDir) {\n\tconst posixRel = manifest.relativeAppDir ?? (manifest.tracingRoot === void 0 ? void 0 : path.relative(manifest.tracingRoot, appDir).split(path.sep).join(\"/\"));\n\tif (posixRel === void 0) throw new Error(`${manifest.path} records neither relativeAppDir nor config.outputFileTracingRoot — cannot locate the standalone server`);\n\tconst rel = posixRel.split(\"/\").join(path.sep);\n\tif (path.isAbsolute(rel) || !isWithin(appDir, path.join(appDir, rel))) throw new Error(`${manifest.path} records an app location that escapes its tracing root (${posixRel}) — refusing to stage outside the bundle`);\n\treturn rel;\n}\nasync function lstatIfPresent(candidate) {\n\ttry {\n\t\treturn await fs.promises.lstat(candidate);\n\t} catch (error) {\n\t\tif (error instanceof Error && Reflect.get(error, \"code\") === \"ENOENT\") return void 0;\n\t\tthrow error;\n\t}\n}\n/** Do not write through an existing link while repairing a missing target. */\nasync function hasSymlinkAncestor(root, candidate) {\n\tconst relative = path.relative(root, path.dirname(candidate));\n\tlet cursor = root;\n\tfor (const segment of relative.split(path.sep).filter(Boolean)) {\n\t\tcursor = path.join(cursor, segment);\n\t\tconst stat = await lstatIfPresent(cursor);\n\t\tif (stat === void 0) return false;\n\t\tif (stat.isSymbolicLink()) return true;\n\t}\n\treturn false;\n}\nasync function collectSymlinks(root) {\n\tconst links = [];\n\tasync function visit(directory) {\n\t\tfor (const entry of await fs.promises.readdir(directory, { withFileTypes: true })) {\n\t\t\tconst entryPath = path.join(directory, entry.name);\n\t\t\tif (entry.isSymbolicLink()) links.push(entryPath);\n\t\t\telse if (entry.isDirectory()) await visit(entryPath);\n\t\t}\n\t}\n\tawait visit(root);\n\treturn links;\n}\n/** In-bundle link targets that the standalone tree does not contain — the\n* repairs staging has to make. */\nasync function missingLinkTargets(bundleDir) {\n\tconst missing = [];\n\tfor (const linkPath of await collectSymlinks(bundleDir)) {\n\t\tconst rawTarget = await fs.promises.readlink(linkPath);\n\t\tconst target = path.resolve(path.dirname(linkPath), rawTarget);\n\t\tif (!isWithin(bundleDir, target) || await lstatIfPresent(target) !== void 0) continue;\n\t\tif (await hasSymlinkAncestor(bundleDir, target)) continue;\n\t\tmissing.push(target);\n\t}\n\treturn missing;\n}\n/**\n* Absolute junctions (pnpm on Windows) often point from `.next/standalone`\n* straight into the app's `node_modules/.pnpm/...` under the tracing root —\n* outside the standalone copy root. After `copyTreeVerbatim` those links still\n* escape the assembled bundle; stage the real target under the bundle at the\n* same tracing-root-relative path and repoint the link.\n*/\nasync function stageEscapingTracingRootLinks(bundleDir, tracedRootReal) {\n\tconst nodeModulesRoot = path.join(tracedRootReal, \"node_modules\");\n\tconst stagedSources = /* @__PURE__ */ new Set();\n\tfor (const linkPath of await collectSymlinks(bundleDir)) {\n\t\tconst rawTarget = await fs.promises.readlink(linkPath);\n\t\tlet resolved = path.resolve(path.dirname(linkPath), rawTarget);\n\t\tif (await lstatIfPresent(resolved) === void 0) continue;\n\t\ttry {\n\t\t\tresolved = await fs.promises.realpath(resolved);\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t\tif (isWithin(bundleDir, resolved)) continue;\n\t\tif (!isWithin(nodeModulesRoot, resolved) && resolved !== nodeModulesRoot) continue;\n\t\tconst stagedAt = path.join(bundleDir, path.relative(tracedRootReal, resolved));\n\t\tif (await lstatIfPresent(stagedAt) === void 0) {\n\t\t\tawait fs.promises.mkdir(path.dirname(stagedAt), { recursive: true });\n\t\t\tif ((await fs.promises.stat(resolved)).isDirectory()) await copyTreeVerbatim(resolved, stagedAt);\n\t\t\telse await fs.promises.copyFile(resolved, stagedAt);\n\t\t\tstagedSources.add(resolved);\n\t\t}\n\t\tconst type = (await fs.promises.stat(stagedAt)).isDirectory() ? \"dir\" : \"file\";\n\t\tawait fs.promises.unlink(linkPath);\n\t\tawait createBundleLink(linkPath, path.relative(path.dirname(linkPath), stagedAt), type, {\n\t\t\tresolvedTarget: stagedAt,\n\t\t\tcopySource: stagedAt,\n\t\t\tcopyWithinRoot: bundleDir\n\t\t});\n\t}\n\treturn [...stagedSources];\n}\n/**\n* pnpm can leave a traced hoist link in standalone while omitting the virtual-\n* store directory it targets. The same target still exists at the corresponding\n* path under outputFileTracingRoot. Stage only that exact, real in-root target;\n* unsafe or genuinely unavailable links remain for the packager to reject.\n*/\nasync function stageMissingStandaloneLinkTargets(bundleDir, manifest) {\n\tconst tracingRoot = manifest.tracingRoot;\n\tif (tracingRoot === void 0) {\n\t\tif ((await missingLinkTargets(bundleDir)).length === 0) return [];\n\t\tthrow new Error(`${manifest.path} records no config.outputFileTracingRoot, but the standalone tree contains symlinks whose targets Next omitted — the source root those targets must be staged from is unknown. Rebuild with a Next version that records config.outputFileTracingRoot, or set outputFileTracingRoot in next.config.`);\n\t}\n\tif (await lstatIfPresent(tracingRoot) === void 0) return [];\n\tconst tracedRootReal = await fs.promises.realpath(tracingRoot);\n\tconst stagedSources = /* @__PURE__ */ new Set();\n\tlet staged = true;\n\twhile (staged) {\n\t\tstaged = false;\n\t\tfor (const target of await missingLinkTargets(bundleDir)) {\n\t\t\tconst standaloneRelative = path.relative(bundleDir, target);\n\t\t\tconst source = path.resolve(tracingRoot, standaloneRelative);\n\t\t\tif (await lstatIfPresent(source) === void 0) continue;\n\t\t\tif (!isWithin(tracedRootReal, await fs.promises.realpath(source))) continue;\n\t\t\tawait fs.promises.mkdir(path.dirname(target), { recursive: true });\n\t\t\tawait copyTreeVerbatim(source, target);\n\t\t\tstagedSources.add(source);\n\t\t\tstaged = true;\n\t\t}\n\t}\n\tfor (const source of await stageEscapingTracingRootLinks(bundleDir, tracedRootReal)) stagedSources.add(source);\n\treturn [...stagedSources];\n}\n/** The built standalone server.js for a nextjs build — `appDir`'s standalone root plus the app subpath Next recorded. Single-sourced so `assemble()` (deploy) and the integration-test seam can't drift. */\nfunction standaloneServerPath(build) {\n\tconst appDir = path.resolve(path.dirname(fileURLToPath(build.module)), build.appDir);\n\tconst manifest = readServerFilesManifest(appDir);\n\treturn path.join(appDir, \".next\", \"standalone\", appRelFrom(manifest, appDir), \"server.js\");\n}\nasync function assemble(input) {\n\tif (!isNextjsBuild(input.build)) throw new Error(`@prisma/composer/nextjs/control: expected a \"nextjs\" build adapter (with appDir), got \"${input.build.type}\".`);\n\tconst buildDescriptor = input.build;\n\tconst appDir = path.resolve(path.dirname(fileURLToPath(buildDescriptor.module)), buildDescriptor.appDir);\n\tconst standaloneRoot = path.join(appDir, \".next\", \"standalone\");\n\tif (!fs.existsSync(standaloneRoot)) throw new Error(`no ${path.join(\".next\", \"standalone\")} under ${appDir} — run \\`next build\\` with output: \"standalone\" first.`);\n\tconst manifest = readServerFilesManifest(appDir);\n\tconst appRel = appRelFrom(manifest, appDir);\n\tconst workDir = path.join(input.cwd, \".prisma-composer\", \"artifacts\", input.address);\n\tawait fs.promises.rm(workDir, {\n\t\trecursive: true,\n\t\tforce: true\n\t});\n\tawait fs.promises.mkdir(workDir, { recursive: true });\n\tconst bundleDir = path.join(workDir, \"bundle\");\n\tawait copyTreeVerbatim(standaloneRoot, bundleDir);\n\tconst stagedLinkTargets = await stageMissingStandaloneLinkTargets(bundleDir, manifest);\n\tawait repairWindowsDirectorySymlinks(bundleDir);\n\tconst appOut = path.join(bundleDir, appRel);\n\tconst staticSrc = path.join(appDir, \".next\", \"static\");\n\tif (fs.existsSync(staticSrc)) await copyTreeVerbatim(staticSrc, path.join(appOut, \".next\", \"static\"));\n\tconst publicSrc = path.join(appDir, \"public\");\n\tif (fs.existsSync(publicSrc)) await copyTreeVerbatim(publicSrc, path.join(appOut, \"public\"));\n\tawait assertBundleSymlinksStayInside(bundleDir);\n\tawait build({\n\t\tentryPoints: { main: fileURLToPath(buildDescriptor.module) },\n\t\toutdir: workDir,\n\t\tbundle: true,\n\t\tformat: \"esm\",\n\t\tplatform: \"node\",\n\t\texternal: [\"bun\", \"bun:*\"],\n\t\toutExtension: { \".js\": \".mjs\" }\n\t});\n\tif (!fs.existsSync(path.join(workDir, \"main.mjs\"))) throw new Error(`esbuild produced no main.mjs in ${workDir}`);\n\treturn {\n\t\tdir: workDir,\n\t\tentry: path.posix.join(\"bundle\", appRel.split(path.sep).join(\"/\"), \"server.js\"),\n\t\twatch: [standaloneRoot, ...stagedLinkTargets]\n\t};\n}\n/** The nextjs build extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */\nconst nextjsBuild = () => ({\n\tid: \"@prisma/composer/nextjs\",\n\tnodes: { nextjs: {\n\t\tkind: \"build\",\n\t\tassemble\n\t} }\n});\n//#endregion\nexport { assemble, nextjsBuild, standaloneServerPath };\n\n//# sourceMappingURL=control.mjs.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAS,cAAc,YAAY;CAClC,OAAO,WAAW,SAAS,YAAY,YAAY,cAAc,OAAO,WAAW,WAAW;AAC/F;AACA,SAAS,wBAAwB,QAAQ;CACxC,MAAM,eAAeA,OAAK,KAAK,QAAQ,SAAS,4BAA4B;CAC5E,IAAI,CAACC,KAAG,WAAW,YAAY,GAAG,MAAM,IAAI,MAAM,MAAMD,OAAK,KAAK,SAAS,4BAA4B,EAAE,SAAS,OAAO,uDAAuD;CAChL,MAAM,WAAW,KAAK,MAAMC,KAAG,aAAa,cAAc,MAAM,CAAC;CACjE,MAAM,iBAAiB,UAAU;CACjC,MAAM,cAAc,UAAU,QAAQ;CACtC,OAAO;EACN,MAAM;EACN,gBAAgB,OAAO,mBAAmB,WAAW,iBAAiB,KAAK;EAC3E,aAAa,OAAO,gBAAgB,WAAWD,OAAK,QAAQ,QAAQ,WAAW,IAAI,KAAK;CACzF;AACD;;;;;;;;;AASA,SAAS,WAAW,UAAU,QAAQ;CACrC,MAAM,WAAW,SAAS,mBAAmB,SAAS,gBAAgB,KAAK,IAAI,KAAK,IAAIA,OAAK,SAAS,SAAS,aAAa,MAAM,CAAC,CAAC,MAAMA,OAAK,GAAG,CAAC,CAAC,KAAK,GAAG;CAC5J,IAAI,aAAa,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,SAAS,KAAK,uGAAuG;CACjK,MAAM,MAAM,SAAS,MAAM,GAAG,CAAC,CAAC,KAAKA,OAAK,GAAG;CAC7C,IAAIA,OAAK,WAAW,GAAG,KAAK,CAAC,SAAS,QAAQA,OAAK,KAAK,QAAQ,GAAG,CAAC,GAAG,MAAM,IAAI,MAAM,GAAG,SAAS,KAAK,0DAA0D,SAAS,yCAAyC;CACpN,OAAO;AACR;AACA,eAAe,eAAe,WAAW;CACxC,IAAI;EACH,OAAO,MAAMC,KAAG,SAAS,MAAM,SAAS;CACzC,SAAS,OAAO;EACf,IAAI,iBAAiB,SAAS,QAAQ,IAAI,OAAO,MAAM,MAAM,UAAU,OAAO,KAAK;EACnF,MAAM;CACP;AACD;;AAEA,eAAe,mBAAmB,MAAM,WAAW;CAClD,MAAM,WAAWD,OAAK,SAAS,MAAMA,OAAK,QAAQ,SAAS,CAAC;CAC5D,IAAI,SAAS;CACb,KAAK,MAAM,WAAW,SAAS,MAAMA,OAAK,GAAG,CAAC,CAAC,OAAO,OAAO,GAAG;EAC/D,SAASA,OAAK,KAAK,QAAQ,OAAO;EAClC,MAAM,OAAO,MAAM,eAAe,MAAM;EACxC,IAAI,SAAS,KAAK,GAAG,OAAO;EAC5B,IAAI,KAAK,eAAe,GAAG,OAAO;CACnC;CACA,OAAO;AACR;AACA,eAAe,gBAAgB,MAAM;CACpC,MAAM,QAAQ,CAAC;CACf,eAAe,MAAM,WAAW;EAC/B,KAAK,MAAM,SAAS,MAAMC,KAAG,SAAS,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG;GAClF,MAAM,YAAYD,OAAK,KAAK,WAAW,MAAM,IAAI;GACjD,IAAI,MAAM,eAAe,GAAG,MAAM,KAAK,SAAS;QAC3C,IAAI,MAAM,YAAY,GAAG,MAAM,MAAM,SAAS;EACpD;CACD;CACA,MAAM,MAAM,IAAI;CAChB,OAAO;AACR;;;AAGA,eAAe,mBAAmB,WAAW;CAC5C,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,YAAY,MAAM,gBAAgB,SAAS,GAAG;EACxD,MAAM,YAAY,MAAMC,KAAG,SAAS,SAAS,QAAQ;EACrD,MAAM,SAASD,OAAK,QAAQA,OAAK,QAAQ,QAAQ,GAAG,SAAS;EAC7D,IAAI,CAAC,SAAS,WAAW,MAAM,KAAK,MAAM,eAAe,MAAM,MAAM,KAAK,GAAG;EAC7E,IAAI,MAAM,mBAAmB,WAAW,MAAM,GAAG;EACjD,QAAQ,KAAK,MAAM;CACpB;CACA,OAAO;AACR;;;;;;;;AAQA,eAAe,8BAA8B,WAAW,gBAAgB;CACvE,MAAM,kBAAkBA,OAAK,KAAK,gBAAgB,cAAc;CAChE,MAAM,gCAAgC,IAAI,IAAI;CAC9C,KAAK,MAAM,YAAY,MAAM,gBAAgB,SAAS,GAAG;EACxD,MAAM,YAAY,MAAMC,KAAG,SAAS,SAAS,QAAQ;EACrD,IAAI,WAAWD,OAAK,QAAQA,OAAK,QAAQ,QAAQ,GAAG,SAAS;EAC7D,IAAI,MAAM,eAAe,QAAQ,MAAM,KAAK,GAAG;EAC/C,IAAI;GACH,WAAW,MAAMC,KAAG,SAAS,SAAS,QAAQ;EAC/C,QAAQ;GACP;EACD;EACA,IAAI,SAAS,WAAW,QAAQ,GAAG;EACnC,IAAI,CAAC,SAAS,iBAAiB,QAAQ,KAAK,aAAa,iBAAiB;EAC1E,MAAM,WAAWD,OAAK,KAAK,WAAWA,OAAK,SAAS,gBAAgB,QAAQ,CAAC;EAC7E,IAAI,MAAM,eAAe,QAAQ,MAAM,KAAK,GAAG;GAC9C,MAAMC,KAAG,SAAS,MAAMD,OAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;GACnE,KAAK,MAAMC,KAAG,SAAS,KAAK,QAAQ,EAAA,CAAG,YAAY,GAAG,MAAM,iBAAiB,UAAU,QAAQ;QAC1F,MAAMA,KAAG,SAAS,SAAS,UAAU,QAAQ;GAClD,cAAc,IAAI,QAAQ;EAC3B;EACA,MAAM,QAAQ,MAAMA,KAAG,SAAS,KAAK,QAAQ,EAAA,CAAG,YAAY,IAAI,QAAQ;EACxE,MAAMA,KAAG,SAAS,OAAO,QAAQ;EACjC,MAAM,iBAAiB,UAAUD,OAAK,SAASA,OAAK,QAAQ,QAAQ,GAAG,QAAQ,GAAG,MAAM;GACvF,gBAAgB;GAChB,YAAY;GACZ,gBAAgB;EACjB,CAAC;CACF;CACA,OAAO,CAAC,GAAG,aAAa;AACzB;;;;;;;AAOA,eAAe,kCAAkC,WAAW,UAAU;CACrE,MAAM,cAAc,SAAS;CAC7B,IAAI,gBAAgB,KAAK,GAAG;EAC3B,KAAK,MAAM,mBAAmB,SAAS,EAAA,CAAG,WAAW,GAAG,OAAO,CAAC;EAChE,MAAM,IAAI,MAAM,GAAG,SAAS,KAAK,mSAAmS;CACrU;CACA,IAAI,MAAM,eAAe,WAAW,MAAM,KAAK,GAAG,OAAO,CAAC;CAC1D,MAAM,iBAAiB,MAAMC,KAAG,SAAS,SAAS,WAAW;CAC7D,MAAM,gCAAgC,IAAI,IAAI;CAC9C,IAAI,SAAS;CACb,OAAO,QAAQ;EACd,SAAS;EACT,KAAK,MAAM,UAAU,MAAM,mBAAmB,SAAS,GAAG;GACzD,MAAM,qBAAqBD,OAAK,SAAS,WAAW,MAAM;GAC1D,MAAM,SAASA,OAAK,QAAQ,aAAa,kBAAkB;GAC3D,IAAI,MAAM,eAAe,MAAM,MAAM,KAAK,GAAG;GAC7C,IAAI,CAAC,SAAS,gBAAgB,MAAMC,KAAG,SAAS,SAAS,MAAM,CAAC,GAAG;GACnE,MAAMA,KAAG,SAAS,MAAMD,OAAK,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;GACjE,MAAM,iBAAiB,QAAQ,MAAM;GACrC,cAAc,IAAI,MAAM;GACxB,SAAS;EACV;CACD;CACA,KAAK,MAAM,UAAU,MAAM,8BAA8B,WAAW,cAAc,GAAG,cAAc,IAAI,MAAM;CAC7G,OAAO,CAAC,GAAG,aAAa;AACzB;;AAEA,SAAS,qBAAqB,OAAO;CACpC,MAAM,SAASA,OAAK,QAAQA,OAAK,QAAQ,cAAc,MAAM,MAAM,CAAC,GAAG,MAAM,MAAM;CACnF,MAAM,WAAW,wBAAwB,MAAM;CAC/C,OAAOA,OAAK,KAAK,QAAQ,SAAS,cAAc,WAAW,UAAU,MAAM,GAAG,WAAW;AAC1F;AACA,eAAe,SAAS,OAAO;CAC9B,IAAI,CAAC,cAAc,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,0FAA0F,MAAM,MAAM,KAAK,GAAG;CAC/J,MAAM,kBAAkB,MAAM;CAC9B,MAAM,SAASA,OAAK,QAAQA,OAAK,QAAQ,cAAc,gBAAgB,MAAM,CAAC,GAAG,gBAAgB,MAAM;CACvG,MAAM,iBAAiBA,OAAK,KAAK,QAAQ,SAAS,YAAY;CAC9D,IAAI,CAACC,KAAG,WAAW,cAAc,GAAG,MAAM,IAAI,MAAM,MAAMD,OAAK,KAAK,SAAS,YAAY,EAAE,SAAS,OAAO,uDAAuD;CAClK,MAAM,WAAW,wBAAwB,MAAM;CAC/C,MAAM,SAAS,WAAW,UAAU,MAAM;CAC1C,MAAM,UAAUA,OAAK,KAAK,MAAM,KAAK,oBAAoB,aAAa,MAAM,OAAO;CACnF,MAAMC,KAAG,SAAS,GAAG,SAAS;EAC7B,WAAW;EACX,OAAO;CACR,CAAC;CACD,MAAMA,KAAG,SAAS,MAAM,SAAS,EAAE,WAAW,KAAK,CAAC;CACpD,MAAM,YAAYD,OAAK,KAAK,SAAS,QAAQ;CAC7C,MAAM,iBAAiB,gBAAgB,SAAS;CAChD,MAAM,oBAAoB,MAAM,kCAAkC,WAAW,QAAQ;CACrF,MAAM,+BAA+B,SAAS;CAC9C,MAAM,SAASA,OAAK,KAAK,WAAW,MAAM;CAC1C,MAAM,YAAYA,OAAK,KAAK,QAAQ,SAAS,QAAQ;CACrD,IAAIC,KAAG,WAAW,SAAS,GAAG,MAAM,iBAAiB,WAAWD,OAAK,KAAK,QAAQ,SAAS,QAAQ,CAAC;CACpG,MAAM,YAAYA,OAAK,KAAK,QAAQ,QAAQ;CAC5C,IAAIC,KAAG,WAAW,SAAS,GAAG,MAAM,iBAAiB,WAAWD,OAAK,KAAK,QAAQ,QAAQ,CAAC;CAC3F,MAAM,+BAA+B,SAAS;CAC9C,MAAM,MAAM;EACX,aAAa,EAAE,MAAM,cAAc,gBAAgB,MAAM,EAAE;EAC3D,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,UAAU,CAAC,OAAO,OAAO;EACzB,cAAc,EAAE,OAAO,OAAO;CAC/B,CAAC;CACD,IAAI,CAACC,KAAG,WAAWD,OAAK,KAAK,SAAS,UAAU,CAAC,GAAG,MAAM,IAAI,MAAM,mCAAmC,SAAS;CAChH,OAAO;EACN,KAAK;EACL,OAAOA,OAAK,MAAM,KAAK,UAAU,OAAO,MAAMA,OAAK,GAAG,CAAC,CAAC,KAAK,GAAG,GAAG,WAAW;EAC9E,OAAO,CAAC,gBAAgB,GAAG,iBAAiB;CAC7C;AACD;;AAEA,MAAM,qBAAqB;CAC1B,IAAI;CACJ,OAAO,EAAE,QAAQ;EAChB,MAAM;EACN;CACD,EAAE;AACH"}

package/dist/node-control.mjs

@@ -1,4 +1,4 @@
-import { n as copyTreeVerbatim, r as isWithin, t as assertBundleSymlinksStayInside } from "./dist-D1TA1xGC.mjs";
+import { i as isWithin, n as copyTreeVerbatim, r as createBundleLink, t as assertBundleSymlinksStayInside } from "./dist-DiYPSVUE.mjs";
 import { createRequire } from "node:module";
 import * as fs$1 from "node:fs";
 import * as path$1 from "node:path";
@@ -21783,9 +21783,11 @@ async function copyTracedEntry(source, destination, stagingRoot, bundleDir, dirP
 		const realTarget = await fs$1.promises.realpath(source);
 		if (!isWithin(stagingRoot, realTarget)) throw new Error(`the runtime dependency trace found a symlink outside its staging root: ${source} -> ${realTarget}`);
 		const stagedTarget = isWithin(dirPath, realTarget) ? path$1.join(bundleDir, path$1.relative(dirPath, realTarget)) : stagedRuntimePath(realTarget, stagingRoot, bundleDir);
-		const linkTarget = path$1.relative(path$1.dirname(destination), stagedTarget);
-		const linkType = (await fs$1.promises.stat(realTarget)).isDirectory() ? "dir" : "file";
-		await fs$1.promises.symlink(linkTarget, destination, linkType);
+		await createBundleLink(destination, path$1.relative(path$1.dirname(destination), stagedTarget), (await fs$1.promises.stat(realTarget)).isDirectory() ? "dir" : "file", {
+			resolvedTarget: stagedTarget,
+			copySource: realTarget,
+			copyWithinRoot: bundleDir
+		});
 		return;
 	}
 	if (stat.isDirectory()) {