@prisma/composer 0.3.0-dev.8 → 0.3.0

package/dist/graph-CP16cJyH-D5IW87Y-.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-CP16cJyH-D5IW87Y-.mjs","names":[],"sources":["../../../0-framework/1-core/core/dist/graph-CP16cJyH.mjs"],"sourcesContent":["import { blindCast } from \"@internal/foundation/casts\";\n//#region src/graph-types.ts\n/** Thrown by Load when the graph is malformed. */\nvar LoadError = class extends Error {\n\tconstructor(message) {\n\t\tsuper(message);\n\t\tthis.name = \"LoadError\";\n\t}\n};\n//#endregion\n//#region src/node.ts\n/**\n* Core model: node types and the factories that construct them, plain frozen\n* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).\n*/\nconst NODE = Symbol.for(\"prisma:node\");\nconst SECRET_NEED = blindCast(Symbol.for(\"prisma:secret-need\"));\nconst SECRET_SOURCE = blindCast(Symbol.for(\"prisma:secret-source\"));\n/** Declares a secret NEED. Nameless — the platform name is bound at the root via `envSecret`. */\nfunction secret() {\n\treturn Object.freeze({\n\t\t[SECRET_NEED]: true,\n\t\tkind: \"secret\"\n\t});\n}\n/** Builds an opaque secret source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envSecret`) calls. Core forwards the source and never inspects the payload. */\nfunction secretSource(payload) {\n\treturn Object.freeze({\n\t\t[SECRET_SOURCE]: true,\n\t\tpayload\n\t});\n}\n/** True if `value` is a secret source (an `envSecret` result or a forwarded ctx.secrets ref). */\nfunction isSecretSource(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[SECRET_SOURCE] === true;\n}\nconst PROVISION_NEED = blindCast(Symbol.for(\"prisma:provision-need\"));\n/** Builds an opaque provisioning need — the declaring package's own brand plus whatever payload its provisioner reads back. */\nfunction provisionNeed(brand, payload) {\n\treturn blindCast(Object.freeze({\n\t\t[PROVISION_NEED]: true,\n\t\tbrand,\n\t\tpayload\n\t}));\n}\n/** True if `value` is a provisioning need (a `provisionNeed()` result). */\nfunction isProvisionNeed(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[PROVISION_NEED] === true;\n}\nconst PARAM_SOURCE = blindCast(Symbol.for(\"prisma:param-source\"));\nconst PARAM_NEED = blindCast(Symbol.for(\"prisma:param-need\"));\n/** Builds an opaque param source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envParam`) calls. Core forwards the source and never inspects the payload. */\nfunction paramSource(payload) {\n\treturn Object.freeze({\n\t\t[PARAM_SOURCE]: true,\n\t\tpayload\n\t});\n}\n/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */\nfunction isParamSource(value) {\n\treturn typeof value === \"object\" && value !== null && blindCast(value)[PARAM_SOURCE] === true;\n}\n/** Declares a module param-forwarding NEED. Nameless — bound to a `ParamSource` by an enclosing scope and forwarded into a child's real param. */\nfunction paramNeed() {\n\treturn Object.freeze({\n\t\t[PARAM_NEED]: true,\n\t\tkind: \"param\"\n\t});\n}\nfunction requireType(type, factory) {\n\tif (typeof type !== \"string\" || type.length === 0) throw new Error(`${factory}() requires a non-empty node type.`);\n}\nfunction requireName(name, factory) {\n\tif (typeof name !== \"string\" || name.length === 0) throw new Error(`${factory}() requires a non-empty name.`);\n}\nfunction requireExtension(extension, factory) {\n\tif (typeof extension !== \"string\" || extension.length === 0) throw new Error(`${factory}() requires a non-empty extension (the authoring extension's package name).`);\n}\n/**\n* Core's grammar for every name that becomes a config-key segment —\n* addresses, input/param/secret names: ASCII letters and digits only.\n* Conservative by design so any target medium — POSIX env-var keys\n* included — can uppercase and \"_\"-join segments without escaping.\n*/\nfunction isConfigKeySegment(name) {\n\treturn /^[A-Za-z0-9]+$/.test(name);\n}\nfunction requireConfigKeySegmentName(name, kind, factory) {\n\tif (!isConfigKeySegment(name)) throw new Error(`${factory}() ${kind} name \"${name}\" must contain only ASCII letters and digits ([A-Za-z0-9]) — declared names derive deterministic config keys, uppercased and joined with \"_\" (an input \"db\"'s param \"url\" becomes config key \"DB_URL\"), so an underscore inside a name collides with that separator and any other character has no place in a config key. \"${name}\" would put \"${name.toUpperCase()}\" inside the derived key.`);\n}\nfunction requireConfigKeySegmentNames(names, kind, factory) {\n\tfor (const name of names) requireConfigKeySegmentName(name, kind, factory);\n}\nfunction freezeParams(params) {\n\tconst frozen = {};\n\tfor (const [name, param] of Object.entries(params)) frozen[name] = Object.freeze({ ...param });\n\treturn Object.freeze(frozen);\n}\nfunction freezeSecrets(secrets) {\n\tconst frozen = {};\n\tfor (const [name, need] of Object.entries(secrets)) frozen[name] = Object.freeze({ ...need });\n\treturn blindCast(Object.freeze(frozen));\n}\n/** A frozen shallow copy that keeps the caller's declared type. */\nfunction frozenShallowCopy(obj) {\n\treturn blindCast(Object.freeze({ ...obj }));\n}\n/**\n* Seals a node instance after its constructor has assigned all fields — the\n* last statement of a concrete node class's constructor. A free function, not\n* a base-class method, so an instance stays structurally a plain frozen node.\n*/\nfunction freezeNode(node) {\n\tObject.freeze(node);\n\treturn node;\n}\n/**\n* Everything `resource()` establishes, minus the freeze — an extension\n* whose resource node carries extra fields extends this, assigns them, and\n* calls `freezeNode(this)` as its constructor's last statement.\n*/\nvar ResourceNodeBase = class {\n\t[NODE] = true;\n\tkind = \"resource\";\n\tname;\n\textension;\n\ttype;\n\tprovides;\n\tconstructor(def) {\n\t\trequireName(def.name, \"resource\");\n\t\trequireExtension(def.extension, \"resource\");\n\t\tconst provides = def.provides;\n\t\tif (typeof provides !== \"object\" || provides === null || typeof provides.kind !== \"string\" || provides.kind.length === 0 || typeof provides.satisfies !== \"function\") throw new Error(\"resource() requires `provides` — the Contract this resource offers (a non-empty `kind` plus its `satisfies()`).\");\n\t\tthis.name = def.name;\n\t\tthis.extension = def.extension;\n\t\tthis.type = provides.kind;\n\t\tthis.provides = provides;\n\t}\n};\n/** The core leaf: exactly the base, frozen. */\nvar FrozenResourceNode = class extends ResourceNodeBase {\n\tconstructor(def) {\n\t\tsuper(def);\n\t\tfreezeNode(this);\n\t}\n};\n/**\n* Constructs a branded, frozen Resource node — an identity plus the Contract\n* it provides; the routing `type` is the contract's `kind`. Pure — nothing\n* is provisioned until a module provisions it.\n*/\nfunction resource(def) {\n\treturn new FrozenResourceNode(def);\n}\n/**\n* Constructs a branded, frozen Service node — declarations only (inputs,\n* params, build adapter, and the ports it exposes). Pure; carries no runtime behavior.\n*/\nfunction service(def) {\n\trequireName(def.name, \"service\");\n\trequireExtension(def.extension, \"service\");\n\trequireType(def.type, \"service\");\n\trequireConfigKeySegmentNames(Object.keys(def.inputs), \"input\", \"service\");\n\trequireConfigKeySegmentNames(Object.keys(def.params), \"param\", \"service\");\n\trequireConfigKeySegmentNames(Object.keys(def.secrets ?? {}), \"secret\", \"service\");\n\tfor (const slot of Object.keys(def.secrets ?? {})) if (Object.hasOwn(def.params, slot)) throw new Error(`service() secret slot \"${slot}\" collides with a param of the same name — a secret slot and a service param derive the same config key (COMPOSER_<addr>_${slot.toUpperCase()}); rename one.`);\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"service\",\n\t\tname: def.name,\n\t\textension: def.extension,\n\t\ttype: def.type,\n\t\tinputs: frozenShallowCopy(def.inputs),\n\t\tparams: freezeParams(def.params),\n\t\tsecretSlots: freezeSecrets(def.secrets ?? blindCast({})),\n\t\tbuild: Object.freeze({ ...def.build }),\n\t\texpose: def.expose !== void 0 ? frozenShallowCopy(def.expose) : void 0\n\t});\n}\n/**\n* Constructs a branded, frozen DependencyEnd. `required` (if given) is the\n* contract Load compares a wired ref against via `satisfies()`; an unnamed\n* end's diagnostic `name` falls back to its `type`.\n*/\nfunction dependency(def) {\n\trequireType(def.type, \"dependency\");\n\trequireConfigKeySegmentNames(Object.keys(def.connection.params), \"param\", \"dependency\");\n\tconst connection = Object.freeze({\n\t\tparams: freezeParams(def.connection.params),\n\t\thydrate: def.connection.hydrate\n\t});\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"dependency\",\n\t\tname: def.name !== void 0 && def.name.length > 0 ? def.name : def.type,\n\t\ttype: def.type,\n\t\tconnection,\n\t\trequired: def.required\n\t});\n}\n/**\n* Constructs a branded, frozen Module node. Construction is INERT — the body is\n* wiring, not user code, and runs only when the module is Loaded.\n*/\nfunction module(name, boundaryOrBody, maybeBody) {\n\trequireName(name, \"module\");\n\tconst closedRoot = typeof boundaryOrBody === \"function\";\n\tconst boundary = closedRoot ? {} : boundaryOrBody;\n\tconst deps = frozenShallowCopy(boundary.deps ?? {});\n\tconst secretSlots = frozenShallowCopy(boundary.secrets ?? {});\n\tconst paramSlots = frozenShallowCopy(boundary.params ?? {});\n\tconst expose = frozenShallowCopy(boundary.expose ?? {});\n\tconst body = closedRoot ? (ctx) => {\n\t\tboundaryOrBody(ctx);\n\t\treturn {};\n\t} : maybeBody;\n\treturn Object.freeze({\n\t\t[NODE]: true,\n\t\tkind: \"module\",\n\t\tname,\n\t\tdeps,\n\t\tsecretSlots,\n\t\tparamSlots,\n\t\texpose,\n\t\tbody\n\t});\n}\n/**\n* True if `value` was constructed by this module's factories. Checks the\n* brand only, never a prototype — a graph may mix nodes from a different\n* installed copy of core (dual-package hazard).\n*/\nfunction isNode(value) {\n\treturn typeof value === \"object\" && value !== null && value[NODE] === true;\n}\n//#endregion\n//#region src/toposort.ts\n/**\n* Stable topological sort: every edge's `from` precedes its `to` in the\n* result. Ties (nodes with no ordering constraint between them) keep their\n* relative order from `nodes` — so a graph already authored producer-first\n* comes out byte-identical to its pre-sort layout; only a graph that\n* genuinely needs reordering (e.g. a module wired via a forged ref pointing at a\n* not-yet-provisioned producer) actually moves. A Kahn's-algorithm variant\n* that always picks the ready node with the smallest original index. Edges\n* whose endpoint falls outside `nodes` (e.g. a service-root's input edges\n* targeting the root, which is appended separately) are ignored. Cycles\n* cannot reach here: `assertDependencyDag` already rejects them for\n* dependency edges, and input edges never cycle.\n*/\nfunction topoSort(nodes, edges) {\n\tconst byId = new Map(nodes.map((n) => [n.id, n]));\n\tconst indexOf = new Map(nodes.map((n, i) => [n.id, i]));\n\tconst indegree = new Map(nodes.map((n) => [n.id, 0]));\n\tconst successors = /* @__PURE__ */ new Map();\n\tfor (const edge of edges) {\n\t\tif (!byId.has(edge.from) || !byId.has(edge.to)) continue;\n\t\tconst targets = successors.get(edge.from) ?? [];\n\t\ttargets.push(edge.to);\n\t\tsuccessors.set(edge.from, targets);\n\t\tindegree.set(edge.to, (indegree.get(edge.to) ?? 0) + 1);\n\t}\n\tconst ready = new Set(nodes.filter((n) => indegree.get(n.id) === 0).map((n) => n.id));\n\tconst order = [];\n\twhile (ready.size > 0) {\n\t\tlet next;\n\t\tlet bestIndex = Number.POSITIVE_INFINITY;\n\t\tfor (const id of ready) {\n\t\t\tconst index = indexOf.get(id) ?? Number.POSITIVE_INFINITY;\n\t\t\tif (index < bestIndex) {\n\t\t\t\tbestIndex = index;\n\t\t\t\tnext = id;\n\t\t\t}\n\t\t}\n\t\tif (next === void 0) break;\n\t\tready.delete(next);\n\t\torder.push(next);\n\t\tfor (const target of successors.get(next) ?? []) {\n\t\t\tconst remaining = (indegree.get(target) ?? 0) - 1;\n\t\t\tindegree.set(target, remaining);\n\t\t\tif (remaining === 0) ready.add(target);\n\t\t}\n\t}\n\tif (order.length !== nodes.length) throw new LoadError(`topological sort processed ${order.length} of ${nodes.length} nodes — the graph contains a cycle that slipped past the DAG validation.`);\n\treturn order.map((id) => byId.get(id)).filter((n) => n !== void 0);\n}\n//#endregion\n//#region src/load-service.ts\nfunction serviceInputs(service, serviceId) {\n\tif (typeof service.inputs !== \"object\" || service.inputs === null) throw new LoadError(`Service \"${serviceId}\" has no inputs map.`);\n\tconst nodes = [];\n\tconst edges = [];\n\tfor (const [input, value] of Object.entries(service.inputs)) {\n\t\tconst kind = isNode(value) ? value.kind : void 0;\n\t\tif (kind === \"resource\") throw new LoadError(`Input \"${input}\" of \"${serviceId}\" is a resource node — a resource is provisioned by the composing module, never created for a service that mentions it. Declare the input as a dependency (the pack's dependency factory) and wire the module-provisioned resource's ref into it.`);\n\t\tif (kind !== \"dependency\") throw new LoadError(`Input \"${input}\" of \"${serviceId}\" is not a branded dependency end (construct it with the dependency() factory).`);\n\t\tif (value.type.length === 0) throw new LoadError(`Input \"${input}\" of \"${serviceId}\" has an empty node type.`);\n\t\tconst id = `${serviceId}.${input}`;\n\t\tnodes.push({\n\t\t\tid,\n\t\t\tnode: value\n\t\t});\n\t\tedges.push({\n\t\t\tfrom: id,\n\t\t\tto: serviceId,\n\t\t\tinput,\n\t\t\tkind: \"input\"\n\t\t});\n\t}\n\treturn {\n\t\tnodes,\n\t\tedges\n\t};\n}\nfunction loadService(root, rootId) {\n\tfor (const [input, value] of Object.entries(root.inputs)) if (isNode(value) && value.kind === \"dependency\") throw new LoadError(`Service \"${rootId}\" has an unwired dependency input \"${input}\" — this service is composed by a module; deploy the module instead of loading \"${rootId}\" directly.`);\n\tconst secretSlots = Object.keys(root.secretSlots);\n\tif (secretSlots.length > 0) {\n\t\tconst names = secretSlots.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Service \"${rootId}\" declares secret slot${secretSlots.length > 1 ? \"s\" : \"\"} ${names} but is being loaded directly — a lone service has no enclosing scope to bind them. Compose it inside a module that binds each with envSecret('NAME').`);\n\t}\n\tconst rootGraphNode = {\n\t\tid: rootId,\n\t\tnode: root\n\t};\n\tconst { nodes, edges } = serviceInputs(root, rootId);\n\treturn {\n\t\troot: rootGraphNode,\n\t\tnodes: [...topoSort(nodes, edges), rootGraphNode],\n\t\tedges,\n\t\tsecrets: [],\n\t\tparams: []\n\t};\n}\n//#endregion\n//#region src/load-module.ts\n/**\n* Builds the ref a provision() call hands back: the id (so a producer with no\n* exposed ports — or an untyped slot — can still be wired wholesale) plus one\n* ref-port per exposed contract, each the contract's own runtime value (so\n* its `satisfies()` still works) tagged with the provider's id.\n*/\nfunction refFor(id, service) {\n\tconst ports = {};\n\tfor (const [port, contract] of Object.entries(service.expose ?? {})) ports[port] = {\n\t\t...contract,\n\t\t__providerId: id\n\t};\n\treturn blindCast({\n\t\tid,\n\t\t...ports\n\t});\n}\n/**\n* The resource variant of refFor: a resource has exactly one port — the\n* contract it provides — flattened onto the ref itself, tagged with the\n* provider id. `id` is written last so a hostile contract value cannot\n* clobber it.\n*/\nfunction refForResource(id, resource) {\n\treturn blindCast({\n\t\t...resource.provides,\n\t\t__providerId: id,\n\t\tid\n\t});\n}\n/** A wired value's producer id: a ref-port's `__providerId`, or a bare ref's `id`. */\nfunction producerIdOf(ref) {\n\tif (typeof ref !== \"object\" || ref === null) return void 0;\n\tif (\"__providerId\" in ref && typeof ref.__providerId === \"string\") return ref.__providerId;\n\tif (\"id\" in ref && typeof ref.id === \"string\") return ref.id;\n}\n/**\n* Brands each `ctx.inputs` entry with the input key it stands for (see\n* flatten): diagnostic only — usage attribution relies on the per-key object\n* identity the branding copy creates, never on reading this back.\n*/\nconst MODULE_INPUT_KEY = Symbol(\"prisma:module-input-key\");\n/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.secrets` forwarding channel. */\nconst MODULE_SECRET_KEY = Symbol(\"prisma:module-secret-key\");\n/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.params` forwarding channel. */\nconst MODULE_PARAM_KEY = Symbol(\"prisma:module-param-key\");\n/** Whether `ref` carries a callable `satisfies` that accepts `required` truthily. */\nfunction satisfiesRequired(ref, required) {\n\treturn typeof ref === \"object\" && ref !== null && \"satisfies\" in ref && typeof ref.satisfies === \"function\" && ref.satisfies(required);\n}\n/**\n* Checks one recorded `wiring` object against the Deps it was wired against:\n* every named input exists and is a dependency slot, every referenced\n* producer is a real (by-now-provisioned) address, and a wired ref whose\n* slot declares a required contract must satisfy() it — no producer-kind\n* branching, the contract alone determines validity, whether the producer is\n* a service port or a resource. Shared by both provisioned kinds so a\n* module-as-child gets exactly the checks a service gets, and run once per\n* entry against the one `byId` shared by the whole recursive flatten, so a\n* forwarded ref resolves through to its real producer address regardless of\n* which ancestor scope provisioned it.\n*/\nfunction validateWiring(pending, byId) {\n\tconst { deps, wiring, targetId, targetKind, enclosingModuleName } = pending;\n\tfor (const [input, ref] of Object.entries(wiring)) {\n\t\tconst declared = blindCast(deps[input]);\n\t\tif (declared === void 0 || !isNode(declared) || declared.kind !== \"dependency\") throw new LoadError(`The deps for \"${targetId}\" name \"${input}\", which is not a dependency slot of that ${targetKind}.`);\n\t\tconst producerId = producerIdOf(ref);\n\t\tconst producer = producerId !== void 0 ? byId.get(producerId) : void 0;\n\t\tif (producerId === void 0 || producer === void 0) throw new LoadError(`The deps for \"${targetId}.${input}\" reference \"${String(producerId)}\", which is not provisioned in module \"${enclosingModuleName}\".`);\n\t\tconst required = declared.required;\n\t\tif (required !== void 0 && !satisfiesRequired(ref, required)) throw new LoadError(`The deps for \"${targetId}.${input}\" do not satisfy the slot's required contract.`);\n\t}\n\tfor (const [input, rawValue] of Object.entries(deps)) {\n\t\tconst value = blindCast(rawValue);\n\t\tif (!isNode(value) || wiring[input] !== void 0) continue;\n\t\tif (value.kind === \"dependency\") throw new LoadError(`Dependency input \"${input}\" of provisioned ${targetKind} \"${targetId}\" is not wired to a producer (module \"${enclosingModuleName}\").`);\n\t}\n}\n/** The (unvalidated) edges a `wiring` object implies — one dependency edge per entry; `validateWiring` does the real checking. */\nfunction wiringEdges(wiring, targetId) {\n\treturn Object.entries(wiring).map(([input, ref]) => ({\n\t\tfrom: producerIdOf(ref) ?? \"\",\n\t\tto: targetId,\n\t\tinput,\n\t\tkind: \"dependency\"\n\t}));\n}\n/**\n* Checks the secrets wired into one provisioned child: every declared slot is\n* bound to a real secret source (an `envSecret` or a forwarded ctx.secrets\n* ref), and no wired key names a slot the child doesn't declare — the secret\n* analog of `validateWiring`'s per-input checks, but resolved inline (a source\n* carries its own name, so no whole-graph pass is needed).\n*/\nfunction validateSecretBinding(child, id, secretWiring, enclosingModuleName) {\n\tconst { kind } = child;\n\tfor (const slot of Object.keys(child.secretSlots)) {\n\t\tconst bound = secretWiring[slot];\n\t\tif (bound === void 0) throw new LoadError(`Secret slot \"${slot}\" of provisioned ${kind} \"${id}\" is not bound (module \"${enclosingModuleName}\") — bind it with envSecret('NAME') or forward ctx.secrets.`);\n\t\tif (!isSecretSource(bound)) throw new LoadError(`Secret slot \"${slot}\" of \"${id}\" (module \"${enclosingModuleName}\") was wired with a non-secret value — use envSecret('NAME') or a forwarded ctx.secrets ref.`);\n\t}\n\tfor (const slot of Object.keys(secretWiring)) if (!Object.hasOwn(child.secretSlots, slot)) throw new LoadError(`The secrets for \"${id}\" name \"${slot}\", which is not a secret slot of that ${kind} (module \"${enclosingModuleName}\").`);\n}\n/**\n* Checks the params wired into a provisioned SERVICE: unlike a secret slot, a\n* declared param is never required to be bound here — it may fall back to its\n* own `default` (checked later, at `buildConfig`) — so this only rejects a\n* wired key that names something other than a real declared param.\n*/\nfunction validateServiceParamBinding(child, id, paramWiring, enclosingModuleName) {\n\tfor (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.params, slot)) throw new LoadError(`The params for \"${id}\" name \"${slot}\", which is not a param of that service (module \"${enclosingModuleName}\").`);\n}\n/**\n* Checks the params wired into a provisioned MODULE: every declared\n* param-forwarding slot must be bound to a real `ParamSource` — a slot has no\n* schema of its own, so (unlike a service param) it cannot fall back to a\n* literal or a default; the param analog of `validateSecretBinding`.\n*/\nfunction validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {\n\tfor (const slot of Object.keys(child.paramSlots)) {\n\t\tconst bound = paramWiring[slot];\n\t\tif (bound === void 0) throw new LoadError(`Param slot \"${slot}\" of provisioned module \"${id}\" is not bound (module \"${enclosingModuleName}\") — bind it with a param source (e.g. envParam('NAME')) or forward ctx.params.`);\n\t\tif (!isParamSource(bound)) throw new LoadError(`Param slot \"${slot}\" of \"${id}\" (module \"${enclosingModuleName}\") was wired with a non-source value — a module param-forwarding slot carries no schema to validate a literal against; use envParam('NAME') or a forwarded ctx.params ref.`);\n\t}\n\tfor (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.paramSlots, slot)) throw new LoadError(`The params for \"${id}\" name \"${slot}\", which is not a param slot of that module (module \"${enclosingModuleName}\").`);\n}\n/**\n* Recursively flattens one module's body into the shared graph state and\n* returns its resolved ModuleOutputs (one ref-port per expose key) for the\n* caller (the enclosing provision() call, or Load itself for the root) to\n* use. `address` is this module's OWN full address, or `undefined` for the root\n* scope — its direct children then get bare (unprefixed) addresses, keeping\n* a single-level module identical to before nesting existed. `wiring` supplies a\n* resolved producer ref-port for each of this module's OWN declared deps (empty\n* for the root, which may not declare any — see the root non-empty-deps\n* check in loadModule). `nodes`, `edges`, `pending`, and `byId` are shared\n* across the ENTIRE recursive flatten, not per scope — a nested module may\n* forward in a producer provisioned by an ancestor scope, and it is the\n* shared `byId` (keyed by full address) that lets that resolve.\n*/\nfunction flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes, edges, pending, secretBindings, paramBindings, byId) {\n\tconst localIds = /* @__PURE__ */ new Set();\n\tconst used = /* @__PURE__ */ new Set();\n\tconst usedSecrets = /* @__PURE__ */ new Set();\n\tconst usedParams = /* @__PURE__ */ new Set();\n\tconst ctxInputs = {};\n\tfor (const key of Object.keys(moduleNode.deps)) {\n\t\tconst wired = wiring[key];\n\t\tctxInputs[key] = typeof wired === \"object\" && wired !== null ? {\n\t\t\t...wired,\n\t\t\t[MODULE_INPUT_KEY]: key\n\t\t} : wired;\n\t}\n\tconst markUsed = (values) => {\n\t\tfor (const value of Object.values(values)) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);\n\t};\n\tconst ctxSecrets = {};\n\tfor (const key of Object.keys(moduleNode.secretSlots)) {\n\t\tconst bound = secretWiring[key];\n\t\tctxSecrets[key] = typeof bound === \"object\" && bound !== null ? {\n\t\t\t...bound,\n\t\t\t[MODULE_SECRET_KEY]: key\n\t\t} : bound;\n\t}\n\tconst markSecretsUsed = (values) => {\n\t\tfor (const value of Object.values(values)) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);\n\t};\n\tconst ctxParams = {};\n\tfor (const key of Object.keys(moduleNode.paramSlots)) {\n\t\tconst bound = paramWiring[key];\n\t\tctxParams[key] = typeof bound === \"object\" && bound !== null ? {\n\t\t\t...bound,\n\t\t\t[MODULE_PARAM_KEY]: key\n\t\t} : bound;\n\t}\n\tconst markParamsUsed = (values) => {\n\t\tfor (const value of Object.values(values)) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);\n\t};\n\tconst provision = (child, opts) => {\n\t\tconst id = opts?.id ?? child.name;\n\t\tconst provisionWiring = opts?.deps;\n\t\tconst provisionSecrets = opts?.secrets;\n\t\tconst provisionParams = opts?.params;\n\t\tif (typeof id !== \"string\" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module \"${moduleNode.name}\").`);\n\t\tif (!isConfigKeySegment(id)) throw new LoadError(`provision() id \"${id}\" (module \"${moduleNode.name}\") must contain only ASCII letters and digits ([A-Za-z0-9]) — the id becomes an address segment, and addresses derive deterministic config keys (segments uppercased and joined with \"_\"). \"${id}\" would put \"${id.toUpperCase()}\" inside the derived key. (\"_\" collides with the key separator and \".\" with the address separator.)`);\n\t\tif (localIds.has(id)) throw new LoadError(`Duplicate provision id \"${id}\" in module \"${moduleNode.name}\".`);\n\t\tconst untrusted = child;\n\t\tif (!isNode(untrusted) || untrusted.kind !== \"service\" && untrusted.kind !== \"resource\" && untrusted.kind !== \"module\") throw new LoadError(`provision(\"${id}\") expects a branded service, resource, or module node (construct it with the service()/resource()/module() factories or a pack's own).`);\n\t\tlocalIds.add(id);\n\t\tconst fullAddress = address === void 0 ? id : `${address}.${id}`;\n\t\tif (child.kind === \"resource\") {\n\t\t\tif (provisionWiring !== void 0) throw new LoadError(`provision(\"${id}\") received deps for a resource — a resource has no dependency slots to satisfy.`);\n\t\t\tif (provisionSecrets !== void 0) throw new LoadError(`provision(\"${id}\") received secrets for a resource — a resource has no secret slots to satisfy.`);\n\t\t\tif (provisionParams !== void 0) throw new LoadError(`provision(\"${id}\") received params for a resource — a resource has no params to satisfy.`);\n\t\t\tif (child.type.length === 0) throw new LoadError(`provision(\"${id}\") received a resource with an empty node type.`);\n\t\t\tbyId.set(fullAddress, child);\n\t\t\tnodes.push({\n\t\t\t\tid: fullAddress,\n\t\t\t\tnode: child\n\t\t\t});\n\t\t\treturn refForResource(fullAddress, child);\n\t\t}\n\t\tconst localWiring = { ...provisionWiring ?? {} };\n\t\tmarkUsed(localWiring);\n\t\tconst localSecrets = { ...provisionSecrets ?? {} };\n\t\tmarkSecretsUsed(localSecrets);\n\t\tvalidateSecretBinding(child, id, localSecrets, moduleNode.name);\n\t\tconst localParams = { ...provisionParams ?? {} };\n\t\tmarkParamsUsed(localParams);\n\t\tif (child.kind === \"service\") {\n\t\t\tfor (const slot of Object.keys(child.secretSlots)) {\n\t\t\t\tconst bound = localSecrets[slot];\n\t\t\t\tif (isSecretSource(bound)) secretBindings.push({\n\t\t\t\t\tserviceAddress: fullAddress,\n\t\t\t\t\tslot,\n\t\t\t\t\tsource: bound\n\t\t\t\t});\n\t\t\t}\n\t\t\tvalidateServiceParamBinding(child, id, localParams, moduleNode.name);\n\t\t\tfor (const [slot, binding] of Object.entries(localParams)) paramBindings.push({\n\t\t\t\tserviceAddress: fullAddress,\n\t\t\t\tslot,\n\t\t\t\tbinding\n\t\t\t});\n\t\t\tconst inputs = serviceInputs(child, fullAddress);\n\t\t\tnodes.push(...inputs.nodes, {\n\t\t\t\tid: fullAddress,\n\t\t\t\tnode: child\n\t\t\t});\n\t\t\tedges.push(...inputs.edges, ...wiringEdges(localWiring, fullAddress));\n\t\t\tpending.push({\n\t\t\t\tdeps: child.inputs,\n\t\t\t\twiring: localWiring,\n\t\t\t\ttargetId: fullAddress,\n\t\t\t\ttargetKind: \"service\",\n\t\t\t\tenclosingModuleName: moduleNode.name\n\t\t\t});\n\t\t\tbyId.set(fullAddress, child);\n\t\t\treturn refFor(fullAddress, child);\n\t\t}\n\t\tvalidateParamNeedBinding(child, id, localParams, moduleNode.name);\n\t\tedges.push(...wiringEdges(localWiring, fullAddress));\n\t\tpending.push({\n\t\t\tdeps: child.deps,\n\t\t\twiring: localWiring,\n\t\t\ttargetId: fullAddress,\n\t\t\ttargetKind: \"module\",\n\t\t\tenclosingModuleName: moduleNode.name\n\t\t});\n\t\tconst childOutputs = flatten(child, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, secretBindings, paramBindings, byId);\n\t\tnodes.push({\n\t\t\tid: fullAddress,\n\t\t\tnode: child\n\t\t});\n\t\tbyId.set(fullAddress, child);\n\t\treturn blindCast({\n\t\t\tid: fullAddress,\n\t\t\t...childOutputs\n\t\t});\n\t};\n\tconst ctx = blindCast({\n\t\tinputs: ctxInputs,\n\t\tsecrets: ctxSecrets,\n\t\tparams: ctxParams,\n\t\tprovision: blindCast(provision)\n\t});\n\tconst outputs = blindCast(moduleNode.body(ctx) ?? {});\n\tmarkUsed(outputs);\n\tfor (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares input \"${key}\" but never forwards it into a provision nor returns it as an output.`);\n\tfor (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares secret \"${key}\" but never forwards it into a provision.`);\n\tfor (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module \"${moduleNode.name}\" declares param \"${key}\" but never forwards it into a provision.`);\n\tfor (const [key, contract] of Object.entries(moduleNode.expose)) {\n\t\tconst port = outputs[key];\n\t\tif (port === void 0) throw new LoadError(`Module \"${moduleNode.name}\" declares expose \"${key}\" but its body did not return a port for it.`);\n\t\tif (!satisfiesRequired(port, contract)) throw new LoadError(`Module \"${moduleNode.name}\"'s returned port for expose \"${key}\" does not satisfy its declared contract.`);\n\t}\n\treturn outputs;\n}\nfunction loadModule(root, opts) {\n\tconst rootId = opts?.id ?? root.name;\n\tconst rootDepKeys = Object.keys(root.deps);\n\tif (rootDepKeys.length > 0) {\n\t\tconst names = rootDepKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares input${rootDepKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to wire them; compose \"${root.name}\" from another module that provisions and wires it instead.`);\n\t}\n\tconst rootSecretKeys = Object.keys(root.secretSlots);\n\tif (rootSecretKeys.length > 0) {\n\t\tconst names = rootSecretKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares secret${rootSecretKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds secrets with envSecret('NAME'), it does not declare secret slots of its own.`);\n\t}\n\tconst rootParamKeys = Object.keys(root.paramSlots);\n\tif (rootParamKeys.length > 0) {\n\t\tconst names = rootParamKeys.map((k) => `\"${k}\"`).join(\", \");\n\t\tthrow new LoadError(`Module \"${root.name}\" declares param${rootParamKeys.length > 1 ? \"s\" : \"\"} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds params directly on each provision() call, it does not declare param-forwarding slots of its own.`);\n\t}\n\tconst nodes = [];\n\tconst edges = [];\n\tconst pending = [];\n\tconst secretBindings = [];\n\tconst paramBindings = [];\n\tconst byId = /* @__PURE__ */ new Map();\n\tflatten(root, void 0, {}, {}, {}, nodes, edges, pending, secretBindings, paramBindings, byId);\n\tfor (const entry of pending) validateWiring(entry, byId);\n\tassertDependencyDag(edges);\n\tconst rootGraphNode = {\n\t\tid: rootId,\n\t\tnode: root\n\t};\n\treturn {\n\t\troot: rootGraphNode,\n\t\tnodes: [...topoSort(nodes, edges), rootGraphNode],\n\t\tedges,\n\t\tsecrets: secretBindings,\n\t\tparams: paramBindings\n\t};\n}\n/**\n* The dependency edges must form a DAG — a cycle means neither producer can\n* deploy first. Resources take no wiring, so only service/module-to-service/module\n* edges can ever participate in a cycle; no special-casing needed.\n*/\nfunction assertDependencyDag(edges) {\n\tconst adjacency = /* @__PURE__ */ new Map();\n\tfor (const edge of edges) {\n\t\tif (edge.kind !== \"dependency\") continue;\n\t\tconst targets = adjacency.get(edge.from) ?? [];\n\t\ttargets.push(edge.to);\n\t\tadjacency.set(edge.from, targets);\n\t}\n\tconst visiting = /* @__PURE__ */ new Set();\n\tconst done = /* @__PURE__ */ new Set();\n\tconst stack = [];\n\tconst visit = (id) => {\n\t\tif (done.has(id)) return;\n\t\tif (visiting.has(id)) throw new LoadError(`Dependency cycle: ${[...stack.slice(stack.indexOf(id)), id].join(\" → \")} — no deploy order exists.`);\n\t\tvisiting.add(id);\n\t\tstack.push(id);\n\t\tfor (const next of adjacency.get(id) ?? []) visit(next);\n\t\tstack.pop();\n\t\tvisiting.delete(id);\n\t\tdone.add(id);\n\t};\n\tfor (const id of adjacency.keys()) visit(id);\n}\n//#endregion\n//#region src/graph.ts\n/**\n* Builds the in-memory graph from a root node. A service root walks its own\n* `inputs`; a module root executes its body (wiring, not user code — the\n* designed exception to imports-run-nothing) and recursively flattens every\n* module it provisions into one graph of hierarchical addresses. A malformed\n* graph is a `LoadError` that names its fix; the individual validation rules\n* live with `loadService` / `loadModule` and are covered by name in the Load\n* tests. Executes nothing of the user's own code beyond module bodies.\n*/\nfunction Load(root, opts) {\n\tif (!isNode(root)) throw new LoadError(\"Load expects a branded service or module node (construct it with the service()/module() factories).\");\n\tif (root.kind === \"module\") return loadModule(root, opts);\n\tif (root.kind === \"service\") return loadService(root, opts?.id ?? \"root\");\n\tthrow new LoadError(\"Load expects a service or module root (received another node kind).\");\n}\n//#endregion\nexport { LoadError as _, isNode as a, isSecretSource as c, paramSource as d, provisionNeed as f, service as g, secretSource as h, freezeNode as i, module as l, secret as m, ResourceNodeBase as n, isParamSource as o, resource as p, dependency as r, isProvisionNeed as s, Load as t, paramNeed as u };\n\n//# sourceMappingURL=graph-CP16cJyH.mjs.map"],"mappings":";;;AAGA,IAAI,YAAY,cAAc,MAAM;CACnC,YAAY,SAAS;EACpB,MAAM,OAAO;EACb,KAAK,OAAO;CACb;AACD;;;;;AAOA,MAAM,OAAO,OAAO,IAAI,aAAa;AACrC,MAAM,cAAc,UAAU,OAAO,IAAI,oBAAoB,CAAC;AAC9D,MAAM,gBAAgB,UAAU,OAAO,IAAI,sBAAsB,CAAC;;AAElE,SAAS,SAAS;CACjB,OAAO,OAAO,OAAO;GACnB,cAAc;EACf,MAAM;CACP,CAAC;AACF;;AAEA,SAAS,aAAa,SAAS;CAC9B,OAAO,OAAO,OAAO;GACnB,gBAAgB;EACjB;CACD,CAAC;AACF;;AAEA,SAAS,eAAe,OAAO;CAC9B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,mBAAmB;AAC3F;AACA,MAAM,iBAAiB,UAAU,OAAO,IAAI,uBAAuB,CAAC;;AAEpE,SAAS,cAAc,OAAO,SAAS;CACtC,OAAO,UAAU,OAAO,OAAO;GAC7B,iBAAiB;EAClB;EACA;CACD,CAAC,CAAC;AACH;;AAEA,SAAS,gBAAgB,OAAO;CAC/B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,oBAAoB;AAC5F;AACA,MAAM,eAAe,UAAU,OAAO,IAAI,qBAAqB,CAAC;AAChE,MAAM,aAAa,UAAU,OAAO,IAAI,mBAAmB,CAAC;;AAE5D,SAAS,YAAY,SAAS;CAC7B,OAAO,OAAO,OAAO;GACnB,eAAe;EAChB;CACD,CAAC;AACF;;AAEA,SAAS,cAAc,OAAO;CAC7B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,kBAAkB;AAC1F;;AAEA,SAAS,YAAY;CACpB,OAAO,OAAO,OAAO;GACnB,aAAa;EACd,MAAM;CACP,CAAC;AACF;AACA,SAAS,YAAY,MAAM,SAAS;CACnC,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,mCAAmC;AAClH;AACA,SAAS,YAAY,MAAM,SAAS;CACnC,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,8BAA8B;AAC7G;AACA,SAAS,iBAAiB,WAAW,SAAS;CAC7C,IAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,4EAA4E;AACrK;;;;;;;AAOA,SAAS,mBAAmB,MAAM;CACjC,OAAO,iBAAiB,KAAK,IAAI;AAClC;AACA,SAAS,4BAA4B,MAAM,MAAM,SAAS;CACzD,IAAI,CAAC,mBAAmB,IAAI,GAAG,MAAM,IAAI,MAAM,GAAG,QAAQ,KAAK,KAAK,SAAS,KAAK,6TAA6T,KAAK,eAAe,KAAK,YAAY,EAAE,0BAA0B;AACjd;AACA,SAAS,6BAA6B,OAAO,MAAM,SAAS;CAC3D,KAAK,MAAM,QAAQ,OAAO,4BAA4B,MAAM,MAAM,OAAO;AAC1E;AACA,SAAS,aAAa,QAAQ;CAC7B,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAAG,OAAO,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,CAAC;CAC7F,OAAO,OAAO,OAAO,MAAM;AAC5B;AACA,SAAS,cAAc,SAAS;CAC/B,MAAM,SAAS,CAAC;CAChB,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG,OAAO,QAAQ,OAAO,OAAO,EAAE,GAAG,KAAK,CAAC;CAC5F,OAAO,UAAU,OAAO,OAAO,MAAM,CAAC;AACvC;;AAEA,SAAS,kBAAkB,KAAK;CAC/B,OAAO,UAAU,OAAO,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC3C;;;;;;AAMA,SAAS,WAAW,MAAM;CACzB,OAAO,OAAO,IAAI;CAClB,OAAO;AACR;;;;;;AAMA,IAAI,mBAAmB,MAAM;CAC5B,CAAC,QAAQ;CACT,OAAO;CACP;CACA;CACA;CACA;CACA,YAAY,KAAK;EAChB,YAAY,IAAI,MAAM,UAAU;EAChC,iBAAiB,IAAI,WAAW,UAAU;EAC1C,MAAM,WAAW,IAAI;EACrB,IAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,WAAW,KAAK,OAAO,SAAS,cAAc,YAAY,MAAM,IAAI,MAAM,iHAAiH;EACvS,KAAK,OAAO,IAAI;EAChB,KAAK,YAAY,IAAI;EACrB,KAAK,OAAO,SAAS;EACrB,KAAK,WAAW;CACjB;AACD;;AAEA,IAAI,qBAAqB,cAAc,iBAAiB;CACvD,YAAY,KAAK;EAChB,MAAM,GAAG;EACT,WAAW,IAAI;CAChB;AACD;;;;;;AAMA,SAAS,SAAS,KAAK;CACtB,OAAO,IAAI,mBAAmB,GAAG;AAClC;;;;;AAKA,SAAS,QAAQ,KAAK;CACrB,YAAY,IAAI,MAAM,SAAS;CAC/B,iBAAiB,IAAI,WAAW,SAAS;CACzC,YAAY,IAAI,MAAM,SAAS;CAC/B,6BAA6B,OAAO,KAAK,IAAI,MAAM,GAAG,SAAS,SAAS;CACxE,6BAA6B,OAAO,KAAK,IAAI,MAAM,GAAG,SAAS,SAAS;CACxE,6BAA6B,OAAO,KAAK,IAAI,WAAW,CAAC,CAAC,GAAG,UAAU,SAAS;CAChF,KAAK,MAAM,QAAQ,OAAO,KAAK,IAAI,WAAW,CAAC,CAAC,GAAG,IAAI,OAAO,OAAO,IAAI,QAAQ,IAAI,GAAG,MAAM,IAAI,MAAM,0BAA0B,KAAK,2HAA2H,KAAK,YAAY,EAAE,eAAe;CACpS,OAAO,OAAO,OAAO;GACnB,OAAO;EACR,MAAM;EACN,MAAM,IAAI;EACV,WAAW,IAAI;EACf,MAAM,IAAI;EACV,QAAQ,kBAAkB,IAAI,MAAM;EACpC,QAAQ,aAAa,IAAI,MAAM;EAC/B,aAAa,cAAc,IAAI,WAAW,UAAU,CAAC,CAAC,CAAC;EACvD,OAAO,OAAO,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC;EACrC,QAAQ,IAAI,WAAW,KAAK,IAAI,kBAAkB,IAAI,MAAM,IAAI,KAAK;CACtE,CAAC;AACF;;;;;;AAMA,SAAS,WAAW,KAAK;CACxB,YAAY,IAAI,MAAM,YAAY;CAClC,6BAA6B,OAAO,KAAK,IAAI,WAAW,MAAM,GAAG,SAAS,YAAY;CACtF,MAAM,aAAa,OAAO,OAAO;EAChC,QAAQ,aAAa,IAAI,WAAW,MAAM;EAC1C,SAAS,IAAI,WAAW;CACzB,CAAC;CACD,OAAO,OAAO,OAAO;GACnB,OAAO;EACR,MAAM;EACN,MAAM,IAAI,SAAS,KAAK,KAAK,IAAI,KAAK,SAAS,IAAI,IAAI,OAAO,IAAI;EAClE,MAAM,IAAI;EACV;EACA,UAAU,IAAI;CACf,CAAC;AACF;;;;;AAKA,SAAS,OAAO,MAAM,gBAAgB,WAAW;CAChD,YAAY,MAAM,QAAQ;CAC1B,MAAM,aAAa,OAAO,mBAAmB;CAC7C,MAAM,WAAW,aAAa,CAAC,IAAI;CACnC,MAAM,OAAO,kBAAkB,SAAS,QAAQ,CAAC,CAAC;CAClD,MAAM,cAAc,kBAAkB,SAAS,WAAW,CAAC,CAAC;CAC5D,MAAM,aAAa,kBAAkB,SAAS,UAAU,CAAC,CAAC;CAC1D,MAAM,SAAS,kBAAkB,SAAS,UAAU,CAAC,CAAC;CACtD,MAAM,OAAO,cAAc,QAAQ;EAClC,eAAe,GAAG;EAClB,OAAO,CAAC;CACT,IAAI;CACJ,OAAO,OAAO,OAAO;GACnB,OAAO;EACR,MAAM;EACN;EACA;EACA;EACA;EACA;EACA;CACD,CAAC;AACF;;;;;;AAMA,SAAS,OAAO,OAAO;CACtB,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,UAAU;AACvE;;;;;;;;;;;;;;AAgBA,SAAS,SAAS,OAAO,OAAO;CAC/B,MAAM,OAAO,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CAChD,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CACtD,MAAM,WAAW,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CACpD,MAAM,6BAA6B,IAAI,IAAI;CAC3C,KAAK,MAAM,QAAQ,OAAO;EACzB,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,EAAE,GAAG;EAChD,MAAM,UAAU,WAAW,IAAI,KAAK,IAAI,KAAK,CAAC;EAC9C,QAAQ,KAAK,KAAK,EAAE;EACpB,WAAW,IAAI,KAAK,MAAM,OAAO;EACjC,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,EAAE,KAAK,KAAK,CAAC;CACvD;CACA,MAAM,QAAQ,IAAI,IAAI,MAAM,QAAQ,MAAM,SAAS,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC;CACpF,MAAM,QAAQ,CAAC;CACf,OAAO,MAAM,OAAO,GAAG;EACtB,IAAI;EACJ,IAAI,YAAY,OAAO;EACvB,KAAK,MAAM,MAAM,OAAO;GACvB,MAAM,QAAQ,QAAQ,IAAI,EAAE,KAAK,OAAO;GACxC,IAAI,QAAQ,WAAW;IACtB,YAAY;IACZ,OAAO;GACR;EACD;EACA,IAAI,SAAS,KAAK,GAAG;EACrB,MAAM,OAAO,IAAI;EACjB,MAAM,KAAK,IAAI;EACf,KAAK,MAAM,UAAU,WAAW,IAAI,IAAI,KAAK,CAAC,GAAG;GAChD,MAAM,aAAa,SAAS,IAAI,MAAM,KAAK,KAAK;GAChD,SAAS,IAAI,QAAQ,SAAS;GAC9B,IAAI,cAAc,GAAG,MAAM,IAAI,MAAM;EACtC;CACD;CACA,IAAI,MAAM,WAAW,MAAM,QAAQ,MAAM,IAAI,UAAU,8BAA8B,MAAM,OAAO,MAAM,MAAM,OAAO,0EAA0E;CAC/L,OAAO,MAAM,KAAK,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,KAAK,CAAC;AAClE;AAGA,SAAS,cAAc,SAAS,WAAW;CAC1C,IAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,WAAW,MAAM,MAAM,IAAI,UAAU,YAAY,UAAU,qBAAqB;CAClI,MAAM,QAAQ,CAAC;CACf,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,QAAQ,MAAM,GAAG;EAC5D,MAAM,OAAO,OAAO,KAAK,IAAI,MAAM,OAAO,KAAK;EAC/C,IAAI,SAAS,YAAY,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,kPAAkP;EACjU,IAAI,SAAS,cAAc,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,gFAAgF;EACjK,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,UAAU,UAAU,MAAM,QAAQ,UAAU,0BAA0B;EAC7G,MAAM,KAAK,GAAG,UAAU,GAAG;EAC3B,MAAM,KAAK;GACV;GACA,MAAM;EACP,CAAC;EACD,MAAM,KAAK;GACV,MAAM;GACN,IAAI;GACJ;GACA,MAAM;EACP,CAAC;CACF;CACA,OAAO;EACN;EACA;CACD;AACD;AACA,SAAS,YAAY,MAAM,QAAQ;CAClC,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,MAAM,GAAG,IAAI,OAAO,KAAK,KAAK,MAAM,SAAS,cAAc,MAAM,IAAI,UAAU,YAAY,OAAO,qCAAqC,MAAM,kFAAkF,OAAO,YAAY;CACnS,MAAM,cAAc,OAAO,KAAK,KAAK,WAAW;CAChD,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,QAAQ,YAAY,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACxD,MAAM,IAAI,UAAU,YAAY,OAAO,wBAAwB,YAAY,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,uJAAuJ;CAClQ;CACA,MAAM,gBAAgB;EACrB,IAAI;EACJ,MAAM;CACP;CACA,MAAM,EAAE,OAAO,UAAU,cAAc,MAAM,MAAM;CACnD,OAAO;EACN,MAAM;EACN,OAAO,CAAC,GAAG,SAAS,OAAO,KAAK,GAAG,aAAa;EAChD;EACA,SAAS,CAAC;EACV,QAAQ,CAAC;CACV;AACD;;;;;;;AASA,SAAS,OAAO,IAAI,SAAS;CAC5B,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,GAAG,MAAM,QAAQ;EAClF,GAAG;EACH,cAAc;CACf;CACA,OAAO,UAAU;EAChB;EACA,GAAG;CACJ,CAAC;AACF;;;;;;;AAOA,SAAS,eAAe,IAAI,UAAU;CACrC,OAAO,UAAU;EAChB,GAAG,SAAS;EACZ,cAAc;EACd;CACD,CAAC;AACF;;AAEA,SAAS,aAAa,KAAK;CAC1B,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO,KAAK;CACzD,IAAI,kBAAkB,OAAO,OAAO,IAAI,iBAAiB,UAAU,OAAO,IAAI;CAC9E,IAAI,QAAQ,OAAO,OAAO,IAAI,OAAO,UAAU,OAAO,IAAI;AAC3D;;;;;;AAMA,MAAM,mBAAmB,OAAO,yBAAyB;;AAEzD,MAAM,oBAAoB,OAAO,0BAA0B;;AAE3D,MAAM,mBAAmB,OAAO,yBAAyB;;AAEzD,SAAS,kBAAkB,KAAK,UAAU;CACzC,OAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,eAAe,OAAO,OAAO,IAAI,cAAc,cAAc,IAAI,UAAU,QAAQ;AACtI;;;;;;;;;;;;;AAaA,SAAS,eAAe,SAAS,MAAM;CACtC,MAAM,EAAE,MAAM,QAAQ,UAAU,YAAY,wBAAwB;CACpE,KAAK,MAAM,CAAC,OAAO,QAAQ,OAAO,QAAQ,MAAM,GAAG;EAClD,MAAM,WAAW,UAAU,KAAK,MAAM;EACtC,IAAI,aAAa,KAAK,KAAK,CAAC,OAAO,QAAQ,KAAK,SAAS,SAAS,cAAc,MAAM,IAAI,UAAU,iBAAiB,SAAS,UAAU,MAAM,4CAA4C,WAAW,EAAE;EACvM,MAAM,aAAa,aAAa,GAAG;EACnC,MAAM,WAAW,eAAe,KAAK,IAAI,KAAK,IAAI,UAAU,IAAI,KAAK;EACrE,IAAI,eAAe,KAAK,KAAK,aAAa,KAAK,GAAG,MAAM,IAAI,UAAU,iBAAiB,SAAS,GAAG,MAAM,eAAe,OAAO,UAAU,EAAE,yCAAyC,oBAAoB,GAAG;EAC3M,MAAM,WAAW,SAAS;EAC1B,IAAI,aAAa,KAAK,KAAK,CAAC,kBAAkB,KAAK,QAAQ,GAAG,MAAM,IAAI,UAAU,iBAAiB,SAAS,GAAG,MAAM,+CAA+C;CACrK;CACA,KAAK,MAAM,CAAC,OAAO,aAAa,OAAO,QAAQ,IAAI,GAAG;EACrD,MAAM,QAAQ,UAAU,QAAQ;EAChC,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,WAAW,KAAK,GAAG;EAChD,IAAI,MAAM,SAAS,cAAc,MAAM,IAAI,UAAU,qBAAqB,MAAM,mBAAmB,WAAW,IAAI,SAAS,wCAAwC,oBAAoB,IAAI;CAC5L;AACD;;AAEA,SAAS,YAAY,QAAQ,UAAU;CACtC,OAAO,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU;EACpD,MAAM,aAAa,GAAG,KAAK;EAC3B,IAAI;EACJ;EACA,MAAM;CACP,EAAE;AACH;;;;;;;;AAQA,SAAS,sBAAsB,OAAO,IAAI,cAAc,qBAAqB;CAC5E,MAAM,EAAE,SAAS;CACjB,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,WAAW,GAAG;EAClD,MAAM,QAAQ,aAAa;EAC3B,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,UAAU,gBAAgB,KAAK,mBAAmB,KAAK,IAAI,GAAG,0BAA0B,oBAAoB,4DAA4D;EACxM,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM,IAAI,UAAU,gBAAgB,KAAK,QAAQ,GAAG,aAAa,oBAAoB,6FAA6F;CAC/M;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,aAAa,IAAI,GAAG,MAAM,IAAI,UAAU,oBAAoB,GAAG,UAAU,KAAK,wCAAwC,KAAK,YAAY,oBAAoB,IAAI;AACvO;;;;;;;AAOA,SAAS,4BAA4B,OAAO,IAAI,aAAa,qBAAqB;CACjF,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,QAAQ,IAAI,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,UAAU,KAAK,mDAAmD,oBAAoB,IAAI;AAC1N;;;;;;;AAOA,SAAS,yBAAyB,OAAO,IAAI,aAAa,qBAAqB;CAC9E,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,UAAU,GAAG;EACjD,MAAM,QAAQ,YAAY;EAC1B,IAAI,UAAU,KAAK,GAAG,MAAM,IAAI,UAAU,eAAe,KAAK,2BAA2B,GAAG,0BAA0B,oBAAoB,gFAAgF;EAC1N,IAAI,CAAC,cAAc,KAAK,GAAG,MAAM,IAAI,UAAU,eAAe,KAAK,QAAQ,GAAG,aAAa,oBAAoB,2KAA2K;CAC3R;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,YAAY,IAAI,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,UAAU,KAAK,uDAAuD,oBAAoB,IAAI;AAClO;;;;;;;;;;;;;;;AAeA,SAAS,QAAQ,YAAY,SAAS,QAAQ,cAAc,aAAa,OAAO,OAAO,SAAS,gBAAgB,eAAe,MAAM;CACpI,MAAM,2BAA2B,IAAI,IAAI;CACzC,MAAM,uBAAuB,IAAI,IAAI;CACrC,MAAM,8BAA8B,IAAI,IAAI;CAC5C,MAAM,6BAA6B,IAAI,IAAI;CAC3C,MAAM,YAAY,CAAC;CACnB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,IAAI,GAAG;EAC/C,MAAM,QAAQ,OAAO;EACrB,UAAU,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC9D,GAAG;IACF,mBAAmB;EACrB,IAAI;CACL;CACA,MAAM,YAAY,WAAW;EAC5B,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GAAG,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAAG,IAAI,UAAU,UAAU,MAAM,KAAK,IAAI,GAAG;CAChI;CACA,MAAM,aAAa,CAAC;CACpB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,WAAW,GAAG;EACtD,MAAM,QAAQ,aAAa;EAC3B,WAAW,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC/D,GAAG;IACF,oBAAoB;EACtB,IAAI;CACL;CACA,MAAM,mBAAmB,WAAW;EACnC,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GAAG,KAAK,MAAM,OAAO,OAAO,KAAK,UAAU,GAAG,IAAI,UAAU,WAAW,MAAM,YAAY,IAAI,GAAG;CACzI;CACA,MAAM,YAAY,CAAC;CACnB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,GAAG;EACrD,MAAM,QAAQ,YAAY;EAC1B,UAAU,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO;GAC9D,GAAG;IACF,mBAAmB;EACrB,IAAI;CACL;CACA,MAAM,kBAAkB,WAAW;EAClC,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GAAG,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAAG,IAAI,UAAU,UAAU,MAAM,WAAW,IAAI,GAAG;CACtI;CACA,MAAM,aAAa,OAAO,SAAS;EAClC,MAAM,KAAK,MAAM,MAAM,MAAM;EAC7B,MAAM,kBAAkB,MAAM;EAC9B,MAAM,mBAAmB,MAAM;EAC/B,MAAM,kBAAkB,MAAM;EAC9B,IAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG,MAAM,IAAI,UAAU,gDAAgD,WAAW,KAAK,IAAI;EACvI,IAAI,CAAC,mBAAmB,EAAE,GAAG,MAAM,IAAI,UAAU,mBAAmB,GAAG,aAAa,WAAW,KAAK,8LAA8L,GAAG,eAAe,GAAG,YAAY,EAAE,oGAAoG;EACza,IAAI,SAAS,IAAI,EAAE,GAAG,MAAM,IAAI,UAAU,2BAA2B,GAAG,eAAe,WAAW,KAAK,GAAG;EAC1G,MAAM,YAAY;EAClB,IAAI,CAAC,OAAO,SAAS,KAAK,UAAU,SAAS,aAAa,UAAU,SAAS,cAAc,UAAU,SAAS,UAAU,MAAM,IAAI,UAAU,cAAc,GAAG,wIAAwI;EACrS,SAAS,IAAI,EAAE;EACf,MAAM,cAAc,YAAY,KAAK,IAAI,KAAK,GAAG,QAAQ,GAAG;EAC5D,IAAI,MAAM,SAAS,YAAY;GAC9B,IAAI,oBAAoB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,iFAAiF;GACtJ,IAAI,qBAAqB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,gFAAgF;GACtJ,IAAI,oBAAoB,KAAK,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,yEAAyE;GAC9I,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,UAAU,cAAc,GAAG,gDAAgD;GAClH,KAAK,IAAI,aAAa,KAAK;GAC3B,MAAM,KAAK;IACV,IAAI;IACJ,MAAM;GACP,CAAC;GACD,OAAO,eAAe,aAAa,KAAK;EACzC;EACA,MAAM,cAAc,EAAE,GAAG,mBAAmB,CAAC,EAAE;EAC/C,SAAS,WAAW;EACpB,MAAM,eAAe,EAAE,GAAG,oBAAoB,CAAC,EAAE;EACjD,gBAAgB,YAAY;EAC5B,sBAAsB,OAAO,IAAI,cAAc,WAAW,IAAI;EAC9D,MAAM,cAAc,EAAE,GAAG,mBAAmB,CAAC,EAAE;EAC/C,eAAe,WAAW;EAC1B,IAAI,MAAM,SAAS,WAAW;GAC7B,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,WAAW,GAAG;IAClD,MAAM,QAAQ,aAAa;IAC3B,IAAI,eAAe,KAAK,GAAG,eAAe,KAAK;KAC9C,gBAAgB;KAChB;KACA,QAAQ;IACT,CAAC;GACF;GACA,4BAA4B,OAAO,IAAI,aAAa,WAAW,IAAI;GACnE,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,WAAW,GAAG,cAAc,KAAK;IAC7E,gBAAgB;IAChB;IACA;GACD,CAAC;GACD,MAAM,SAAS,cAAc,OAAO,WAAW;GAC/C,MAAM,KAAK,GAAG,OAAO,OAAO;IAC3B,IAAI;IACJ,MAAM;GACP,CAAC;GACD,MAAM,KAAK,GAAG,OAAO,OAAO,GAAG,YAAY,aAAa,WAAW,CAAC;GACpE,QAAQ,KAAK;IACZ,MAAM,MAAM;IACZ,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,qBAAqB,WAAW;GACjC,CAAC;GACD,KAAK,IAAI,aAAa,KAAK;GAC3B,OAAO,OAAO,aAAa,KAAK;EACjC;EACA,yBAAyB,OAAO,IAAI,aAAa,WAAW,IAAI;EAChE,MAAM,KAAK,GAAG,YAAY,aAAa,WAAW,CAAC;EACnD,QAAQ,KAAK;GACZ,MAAM,MAAM;GACZ,QAAQ;GACR,UAAU;GACV,YAAY;GACZ,qBAAqB,WAAW;EACjC,CAAC;EACD,MAAM,eAAe,QAAQ,OAAO,aAAa,aAAa,cAAc,aAAa,OAAO,OAAO,SAAS,gBAAgB,eAAe,IAAI;EACnJ,MAAM,KAAK;GACV,IAAI;GACJ,MAAM;EACP,CAAC;EACD,KAAK,IAAI,aAAa,KAAK;EAC3B,OAAO,UAAU;GAChB,IAAI;GACJ,GAAG;EACJ,CAAC;CACF;CACA,MAAM,MAAM,UAAU;EACrB,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,WAAW,UAAU,SAAS;CAC/B,CAAC;CACD,MAAM,UAAU,UAAU,WAAW,KAAK,GAAG,KAAK,CAAC,CAAC;CACpD,SAAS,OAAO;CAChB,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,oBAAoB,IAAI,sEAAsE;CACjN,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,qBAAqB,IAAI,0CAA0C;CACpM,KAAK,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,oBAAoB,IAAI,0CAA0C;CACjM,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,WAAW,MAAM,GAAG;EAChE,MAAM,OAAO,QAAQ;EACrB,IAAI,SAAS,KAAK,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,qBAAqB,IAAI,6CAA6C;EAC1I,IAAI,CAAC,kBAAkB,MAAM,QAAQ,GAAG,MAAM,IAAI,UAAU,WAAW,WAAW,KAAK,gCAAgC,IAAI,0CAA0C;CACtK;CACA,OAAO;AACR;AACA,SAAS,WAAW,MAAM,MAAM;CAC/B,MAAM,SAAS,MAAM,MAAM,KAAK;CAChC,MAAM,cAAc,OAAO,KAAK,KAAK,IAAI;CACzC,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,QAAQ,YAAY,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACxD,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,kBAAkB,YAAY,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,4FAA4F,KAAK,KAAK,4DAA4D;CACzQ;CACA,MAAM,iBAAiB,OAAO,KAAK,KAAK,WAAW;CACnD,IAAI,eAAe,SAAS,GAAG;EAC9B,MAAM,QAAQ,eAAe,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EAC3D,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,mBAAmB,eAAe,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,6KAA6K;CACxR;CACA,MAAM,gBAAgB,OAAO,KAAK,KAAK,UAAU;CACjD,IAAI,cAAc,SAAS,GAAG;EAC7B,MAAM,QAAQ,cAAc,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EAC1D,MAAM,IAAI,UAAU,WAAW,KAAK,KAAK,kBAAkB,cAAc,SAAS,IAAI,MAAM,GAAG,GAAG,MAAM,iMAAiM;CAC1S;CACA,MAAM,QAAQ,CAAC;CACf,MAAM,QAAQ,CAAC;CACf,MAAM,UAAU,CAAC;CACjB,MAAM,iBAAiB,CAAC;CACxB,MAAM,gBAAgB,CAAC;CACvB,MAAM,uBAAuB,IAAI,IAAI;CACrC,QAAQ,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,OAAO,SAAS,gBAAgB,eAAe,IAAI;CAC5F,KAAK,MAAM,SAAS,SAAS,eAAe,OAAO,IAAI;CACvD,oBAAoB,KAAK;CACzB,MAAM,gBAAgB;EACrB,IAAI;EACJ,MAAM;CACP;CACA,OAAO;EACN,MAAM;EACN,OAAO,CAAC,GAAG,SAAS,OAAO,KAAK,GAAG,aAAa;EAChD;EACA,SAAS;EACT,QAAQ;CACT;AACD;;;;;;AAMA,SAAS,oBAAoB,OAAO;CACnC,MAAM,4BAA4B,IAAI,IAAI;CAC1C,KAAK,MAAM,QAAQ,OAAO;EACzB,IAAI,KAAK,SAAS,cAAc;EAChC,MAAM,UAAU,UAAU,IAAI,KAAK,IAAI,KAAK,CAAC;EAC7C,QAAQ,KAAK,KAAK,EAAE;EACpB,UAAU,IAAI,KAAK,MAAM,OAAO;CACjC;CACA,MAAM,2BAA2B,IAAI,IAAI;CACzC,MAAM,uBAAuB,IAAI,IAAI;CACrC,MAAM,QAAQ,CAAC;CACf,MAAM,SAAS,OAAO;EACrB,IAAI,KAAK,IAAI,EAAE,GAAG;EAClB,IAAI,SAAS,IAAI,EAAE,GAAG,MAAM,IAAI,UAAU,qBAAqB,CAAC,GAAG,MAAM,MAAM,MAAM,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,2BAA2B;EAC9I,SAAS,IAAI,EAAE;EACf,MAAM,KAAK,EAAE;EACb,KAAK,MAAM,QAAQ,UAAU,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI;EACtD,MAAM,IAAI;EACV,SAAS,OAAO,EAAE;EAClB,KAAK,IAAI,EAAE;CACZ;CACA,KAAK,MAAM,MAAM,UAAU,KAAK,GAAG,MAAM,EAAE;AAC5C;;;;;;;;;;AAYA,SAAS,KAAK,MAAM,MAAM;CACzB,IAAI,CAAC,OAAO,IAAI,GAAG,MAAM,IAAI,UAAU,qGAAqG;CAC5I,IAAI,KAAK,SAAS,UAAU,OAAO,WAAW,MAAM,IAAI;CACxD,IAAI,KAAK,SAAS,WAAW,OAAO,YAAY,MAAM,MAAM,MAAM,MAAM;CACxE,MAAM,IAAI,UAAU,qEAAqE;AAC1F"}

package/dist/{graph-CNZcSnM6-Do0zmuzA.d.mts → graph-DUSgjmzA-DhtkTqoz.d.mts}

@@ -1,5 +1,5 @@
-import { U as ServiceNode, d as Graph, w as NodeId, x as ModuleNode } from "./graph-types-DcBX92Gs-Dnhu7wre.mjs";
-//#region ../../0-framework/1-core/core/dist/graph-CNZcSnM6.d.mts
+import { H as ServiceNode, S as NodeId, d as Graph, y as ModuleNode } from "./graph-types-BcbVhojU-C3fhxjPK.mjs";
+//#region ../../0-framework/1-core/core/dist/graph-DUSgjmzA.d.mts
 //#region src/graph.d.ts
 /**
  * Builds the in-memory graph from a root node. A service root walks its own
@@ -15,4 +15,4 @@ declare function Load(root: ServiceNode | ModuleNode, opts?: {
 }): Graph;
 //#endregion
 export { Load as t };
-//# sourceMappingURL=graph-CNZcSnM6-Do0zmuzA.d.mts.map
+//# sourceMappingURL=graph-DUSgjmzA-DhtkTqoz.d.mts.map

package/dist/graph-DUSgjmzA-DhtkTqoz.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-DUSgjmzA-DhtkTqoz.d.mts","names":[],"sources":["../../../0-framework/1-core/core/dist/graph-DUSgjmzA.d.mts"],"mappings":";;;;;;;;;;;;iBAWiB,KAAK,MAAM,cAAc,YAAY;EACpD,KAAK;IACH"}

package/dist/{graph-types-DcBX92Gs-Dnhu7wre.d.mts → graph-types-BcbVhojU-C3fhxjPK.d.mts}

@@ -1,5 +1,30 @@
 import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region ../../0-framework/1-core/core/dist/graph-types-DcBX92Gs.d.mts
+//#region ../../0-framework/0-foundation/foundation/dist/secret.d.mts
+//#region src/secret.d.ts
+/**
+ * A value wrapper that redacts everywhere except the one explicit reader,
+ * `expose()`. Sensitivity is carried by the TYPE (`SecretBox<T>`), not a flag a
+ * sink must remember to check: `String(box)`, template interpolation,
+ * `JSON.stringify`, and `console.log`/`util.inspect` all print `[REDACTED]`, so
+ * a secret can't leak through an accidental log or serialization.
+ *
+ * Shape matches the platform's own `secrecy` type (pdp-control-plane). The class
+ * is nominal enough on its own — no phantom brand.
+ */
+declare class SecretBox<T> {
+  #private;
+  constructor(value: T);
+  /** The sole explicit door to the wrapped value. */
+  expose(): T;
+  toString(): string;
+  toJSON(): string;
+  valueOf(): string;
+  [Symbol.toPrimitive](): string;
+}
+/** The common case: a secret string. */
+type SecretString = SecretBox<string>;
+//#endregion
+//#region ../../0-framework/1-core/core/dist/graph-types-BcbVhojU.d.mts
 //#region src/config.d.ts
 /**
  * A declared config param — pure data: a caller-owned Standard Schema
@@ -74,13 +99,13 @@ interface Config {
  */
 declare function configOf(root: ServiceNode): readonly ConfigDeclaration[];
 /**
- * The app's input manifest: every service input binding a `provision()` call
- * supplied (ADR-0042). Pure graph introspection, TARGET-AGNOSTIC — a deploy
- * target's recursive descent classifies the binding's leaves (its preflight
- * verifies each `envSecret` leaf's platform var exists before deploy; the
- * values are provisioned out-of-band).
+ * The app's provision manifest: every secret binding the root resolved across
+ * the graph (ADR-0029) — an opaque, target-defined source per service secret
+ * slot; a deploy target's preflight reads its own payload. Pure graph
+ * introspection, TARGET-AGNOSTIC — the target consumes it to verify each secret
+ * exists on the platform before deploy. The values are provisioned out-of-band.
  */
-declare function inputManifest(graph: Graph): readonly ServiceInputBinding[];
+declare function provisionManifest(graph: Graph): readonly SecretBinding[];
 /**
  * The app's param-binding manifest: every param a `provision()` call bound —
  * literal or an opaque, target-defined `ParamSource` — at the address that
@@ -127,7 +152,7 @@ interface SecretNeed {
   readonly [SECRET_NEED]: true;
   readonly kind: 'secret';
 }
-/** A module's secret-forwarding slots: name → the need it declares. */
+/** A service/module's secret slots: name → the need it declares. */
 type Secrets = Record<string, SecretNeed>;
 /** The wiring value bound to a secret slot: a target-defined payload core forwards but never inspects. A target (e.g. @prisma/composer-prisma-cloud's `envSecret`) builds one via `secretSource()`. */
 interface SecretSource<T = unknown> {
@@ -135,8 +160,10 @@ interface SecretSource<T = unknown> {
   /** Target-defined. Core never reads this; the target that authored the source reads it back. */
   readonly payload: T;
 }
-/** What `provision(moduleChild, { secrets })` supplies: one source per declared secret slot. */
+/** What `provision(node, { secrets })` supplies: one source per declared secret slot. */
 type SecretBindings<S extends Secrets> = { [K in keyof S]: SecretSource; };
+/** What `secrets()` returns: one redacting SecretBox per declared slot. */
+type SecretValues<S extends Secrets> = { readonly [K in keyof S]: SecretString; };
 /** Declares a secret NEED. Nameless — the platform name is bound at the root via `envSecret`. */
 declare function secret(): SecretNeed;
 /** Builds an opaque secret source from a target-defined payload — the SPI a deploy target's own source constructor (e.g. `envSecret`) calls. Core forwards the source and never inspects the payload. */
@@ -181,19 +208,6 @@ declare function paramNeed(): ParamNeed;
 type ParamBindings<P extends Params> = { readonly [K in keyof P]?: StandardSchemaV1.InferOutput<P[K]['schema']> | ParamSource; };
 /** What `provision(moduleChild, { params })` accepts per declared `ParamNeed`: a `ParamSource` only — a need carries no schema to validate a literal against. */
 type ParamNeedBindings<PN extends ParamNeeds> = { readonly [K in keyof PN]?: ParamSource; };
-/**
- * What `provision(service, { input })` accepts (ADR-0042): a plain object
- * mirroring the service's input schema, whose leaves are literals,
- * `envParam(...)` sources, or `envSecret(...)` sources. Deliberately a
- * best-effort structural type: the framework never introspects a Standard
- * Schema, so the binding's exact shape cannot be derived from it — deploy-time
- * validation of the resolved binding is the real check.
- */
-type InputBinding = string | number | boolean | null | ParamSource | SecretSource | readonly InputBinding[] | {
-  readonly [key: string]: InputBinding;
-};
-/** What `input()` returns: the schema's validated output type; `never` on a service that declares no input schema. */
-type InputValueOf<I> = I extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<I> : never;
 /** Opaque `Contract<any, any>` bound shared by every node/port type that doesn't care which contract. */
 type AnyContract = Contract<any, any>;
 /** How a service's app becomes a runnable artifact — the build descriptor's routing key (`extension`/`type`) plus paths resolved relative to the authoring module. */
@@ -228,7 +242,7 @@ interface ResourceNode<C extends AnyContract = AnyContract> {
  * inert until run, and carries NO runtime behavior — an extension's factory
  * wraps it into a runnable/loadable shape (see RunnableServiceNode).
  */
-interface ServiceNode<D extends Deps = Deps, P extends Params = Params, E extends Expose = Expose, I extends StandardSchemaV1 | undefined = StandardSchemaV1 | undefined> {
+interface ServiceNode<D extends Deps = Deps, P extends Params = Params, E extends Expose = Expose, S extends Secrets = Secrets> {
   readonly [NODE]: true;
   readonly kind: 'service';
   /** Human-readable, given at authoring — logs/diagnostics only; identity remains the deploy address (ADR-0006). */
@@ -237,10 +251,10 @@ interface ServiceNode<D extends Deps = Deps, P extends Params = Params, E extend
   readonly extension: string;
   readonly type: string;
   readonly inputs: D;
-  /** Extension-reserved config declarations (e.g. compute's `port`) — never user-authored (ADR-0042). */
+  /** Service-level config declarations (e.g. port). */
   readonly params: P;
-  /** The service's whole incoming configuration as ONE Standard Schema (authored as `input`, ADR-0042), or `undefined` when it takes none. The framework never introspects it — it only calls `~standard.validate`. Named `inputSchema` on the node so the data field does not collide with the `input()` accessor. */
-  readonly inputSchema: I;
+  /** Declared secret input slots (authored as `secrets`) — bound at the root via `envSecret`, read via the `secrets()` accessor (ADR-0029). Named `secretSlots` on the node so the data field does not collide with that accessor. */
+  readonly secretSlots: S;
   /** How the app's entry is built + assembled. */
   readonly build: BuildAdapter;
   /** Named output ports this service exposes — the Contracts a consumer's `rpc(contract)` can require. `undefined` when the service exposes nothing. */
@@ -248,14 +262,15 @@ interface ServiceNode<D extends Deps = Deps, P extends Params = Params, E extend
 }
 /**
  * The extension's runnable/loadable service node. `run` boots the app after
- * deserializing its environment; `load` reads the hydrated deps and `input`
- * the validated, typed input object (ADR-0042).
+ * deserializing its Config; `load`/`config` then read deps/params back out
+ * (kept separate per ADR-0021 so a same-named dep and param never collide).
  */
-interface RunnableServiceNode<D extends Deps = Deps, P extends Params = Params, E extends Expose = Expose, I extends StandardSchemaV1 | undefined = StandardSchemaV1 | undefined> extends ServiceNode<D, P, E, I> {
+interface RunnableServiceNode<D extends Deps = Deps, P extends Params = Params, E extends Expose = Expose, S extends Secrets = Secrets> extends ServiceNode<D, P, E, S> {
   run(address: string, boot: () => Promise<unknown>): Promise<unknown>;
   load(): HydratedDeps<D>;
-  /** The service's validated input — one typed object, secrets as redacting `SecretString` boxes (ADR-0042). */
-  input(): InputValueOf<I>;
+  config(): Values<P>;
+  /** The service's secrets, each a redacting SecretBox — a third accessor beside load()/config() (ADR-0021). */
+  secrets(): SecretValues<S>;
 }
 /**
  * A service's dependency slot. At Load the enclosing module wires a
@@ -334,36 +349,19 @@ type ReqOf<DE> = DE extends DependencyEnd<any, infer Req> ? Req : never;
  */
 type DepBindings<D extends Deps> = { [K in keyof D]: NoInfer<ReqOf<D[K]>> | InputRef<D[K]>; };
 /**
- * A SERVICE provision's trailing options: an explicit `id` (default: the
- * node's own `name`); `deps` required exactly when the node declares
- * dependency slots (`[keyof D] extends [never]` is the "no slots" test);
- * `input` required exactly when the node declares an input schema (ADR-0042).
- * `params` is always optional — it binds only extension-reserved params (e.g.
- * compute's `port`), which fall back to their own defaults.
- */
-type ServiceProvisionArgs<D extends Deps, I extends StandardSchemaV1 | undefined, PB> = [keyof D] extends [never] ? I extends undefined ? [opts?: {
-  id?: string;
-  params?: PB;
-}] : [opts: {
-  id?: string;
-  input: InputBinding;
-  params?: PB;
-}] : I extends undefined ? [opts: {
-  id?: string;
-  deps: DepBindings<D>;
-  params?: PB;
-}] : [opts: {
-  id?: string;
-  deps: DepBindings<D>;
-  input: InputBinding;
-  params?: PB;
-}];
-/**
- * A child-MODULE provision's trailing options: `deps`/`secrets` required
- * exactly when the module declares the slots; a declared param-forwarding
- * slot may be bound to a `ParamSource`.
+ * `provision`'s trailing options: an explicit `id` (default: the node's own
+ * `name`) plus, for a node that declares dependency slots, the `deps` that
+ * satisfy them. `deps` is required exactly when the node has slots —
+ * `[keyof D] extends [never]` is the "no slots" test — so a dependency can
+ * never be left unwired at compile time. The whole object is therefore
+ * optional for a slot-less node and required for one with slots. `params` is
+ * always optional — a bound value overrides `param.default`, but a param may
+ * fall back to its default (or be `optional`) instead, unlike `deps`/`secrets`.
+ * `PB` is the params-binding map appropriate to the target: `ParamBindings<P>`
+ * for a service's real, schema-bearing params; `ParamNeedBindings<PN>` for a
+ * child module's nameless forwarding slots.
  */
-type ModuleProvisionArgs<D extends Deps, S extends Secrets, PB> = [keyof D] extends [never] ? [keyof S] extends [never] ? [opts?: {
+type ProvisionArgs<D extends Deps, S extends Secrets, PB> = [keyof D] extends [never] ? [keyof S] extends [never] ? [opts?: {
   id?: string;
   params?: PB;
 }] : [opts: {
@@ -387,22 +385,22 @@ interface ModuleBuilder {
   }): {
     readonly id: string;
   } & RefPort<C>;
-  /** Registers an owned service; its id defaults to the node's `name`; `deps`/`input` are required iff it declares them; a reserved param may be bound (literal or `ParamSource`), overriding its default. */
-  provision<D extends Deps, P extends Params, E extends Expose, I extends StandardSchemaV1 | undefined>(service: ServiceNode<D, P, E, I>, ...args: ServiceProvisionArgs<D, I, ParamBindings<P>>): ProvisionedRef<E>;
+  /** Registers an owned service; its id defaults to the node's `name`; `deps`/`secrets` are required iff it declares them; a declared param may be bound (literal or `ParamSource`), overriding its default. */
+  provision<D extends Deps, P extends Params, E extends Expose, S extends Secrets>(service: ServiceNode<D, P, E, S>, ...args: ProvisionArgs<D, S, ParamBindings<P>>): ProvisionedRef<E>;
   /**
-   * The service call with `deps`/`input` spelled out. `ServiceProvisionArgs`
-   * above cannot resolve while `D`/`I` are still unbound type parameters — a
-   * generic wrapper like `cron()` provisioning a caller-supplied service — so
-   * that call site resolves to this concrete overload instead.
+   * The service call with `deps`/`secrets` spelled out. `ProvisionArgs` above
+   * cannot resolve while `D`/`S` are still unbound type parameters — a generic
+   * wrapper like `cron()` provisioning a caller-supplied service — so that call
+   * site resolves to this concrete overload instead.
    */
-  provision<D extends Deps, P extends Params, E extends Expose, I extends StandardSchemaV1 | undefined>(service: ServiceNode<D, P, E, I>, opts: {
+  provision<D extends Deps, P extends Params, E extends Expose, S extends Secrets>(service: ServiceNode<D, P, E, S>, opts: {
     id?: string;
     deps: DepBindings<D>;
-    input?: InputBinding;
+    secrets?: SecretBindings<S>;
     params?: ParamBindings<P>;
   }): ProvisionedRef<E>;
   /** Registers an owned child module; its id defaults to the node's `name`; `deps`/`secrets` are required iff it declares them; a declared param-forwarding slot may be bound to a `ParamSource`. */
-  provision<D extends Deps, E extends Expose, S extends Secrets, PN extends ParamNeeds>(child: ModuleNode<D, E, S, PN>, ...args: ModuleProvisionArgs<D, S, ParamNeedBindings<PN>>): ProvisionedRef<E>;
+  provision<D extends Deps, E extends Expose, S extends Secrets, PN extends ParamNeeds>(child: ModuleNode<D, E, S, PN>, ...args: ProvisionArgs<D, S, ParamNeedBindings<PN>>): ProvisionedRef<E>;
   /** The child-module call with `deps`/`secrets` spelled out — the same generic-wrapper escape as the service overload above. */
   provision<D extends Deps, E extends Expose, S extends Secrets, PN extends ParamNeeds>(child: ModuleNode<D, E, S, PN>, opts: {
     id?: string;
@@ -453,19 +451,18 @@ declare function resource<C extends AnyContract>(def: {
 }): ResourceNode<C>;
 /**
  * Constructs a branded, frozen Service node — declarations only (inputs,
- * params, the input schema, build adapter, and the ports it exposes). Pure;
- * carries no runtime behavior.
+ * params, build adapter, and the ports it exposes). Pure; carries no runtime behavior.
  */
-declare function service<D extends Deps, P extends Params, E extends Expose = Record<never, never>, I extends StandardSchemaV1 | undefined = undefined>(def: {
+declare function service<D extends Deps, P extends Params, E extends Expose = Record<never, never>, S extends Secrets = Record<never, never>>(def: {
   name: string;
   extension: string;
   type: string;
   inputs: D;
   params: P;
-  input?: I;
+  secrets?: S;
   build: BuildAdapter;
   expose?: E;
-}): ServiceNode<D, P, E, I>;
+}): ServiceNode<D, P, E, S>;
 /**
  * Constructs a branded, frozen DependencyEnd. `required` (if given) is the
  * contract Load compares a wired ref against via `satisfies()`; an unnamed
@@ -522,16 +519,19 @@ interface Edge {
   readonly kind: 'input' | 'dependency';
 }
 /**
- * A service's provision-time input binding (ADR-0042): the plain object a
- * `provision(service, { input })` call supplied, recorded at that service's
- * address. Core never walks it beyond usage tracking; the deploy target's
- * recursive descent classifies its leaves (literals, `envParam`, `envSecret`).
+ * A resolved secret binding: the root bound a service's secret slot to an
+ * opaque, target-defined source, and the wiring forwarded it to that service's
+ * address (ADR-0029). Core never inspects the source; the deploy target reads
+ * its own payload. A target's serializer keys the pointer row off this; the
+ * preflight manifest aggregates the sources.
  */
-interface ServiceInputBinding {
-  /** The graph address of the service that declares the input schema. */
+interface SecretBinding {
+  /** The graph address of the service that declares the secret slot. */
   readonly serviceAddress: NodeId;
-  /** The binding object supplied at provision. */
-  readonly binding: InputBinding;
+  /** The secret slot key on that service. */
+  readonly slot: string;
+  /** The opaque source the root bound the slot to. Core never inspects it; the deploy target reads back its own payload. */
+  readonly source: SecretSource;
 }
 /**
  * A resolved param binding: a `provision()` call bound a service's param
@@ -554,8 +554,8 @@ interface Graph {
   /** Root + one per input, topo-ordered (deps first). */
   readonly nodes: readonly GraphNode[];
   readonly edges: readonly Edge[];
-  /** Every service input binding a `provision()` call supplied (ADR-0042). */
-  readonly inputBindings: readonly ServiceInputBinding[];
+  /** Every service secret slot resolved to its root-bound opaque source. */
+  readonly secrets: readonly SecretBinding[];
   /** Every service param bound at provision — literal or source; unbound params are absent here and fall back to their `default` (see `buildConfig`). */
   readonly params: readonly ParamBinding[];
 }
@@ -564,5 +564,5 @@ declare class LoadError extends Error {
   constructor(message: string);
 }
 //#endregion
-export { module as $, ParamSource as A, SecretSource as B, NODE as C, ParamNeed as D, ParamBindings as E, ResourceNode as F, configOf as G, ServiceInputBinding as H, ResourceNodeBase as I, inputManifest as J, dependency as K, RunnableServiceNode as L, ProvisionNeed as M, ProvisionedRef as N, ParamNeedBindings as O, RefPort as P, isSecretSource as Q, SecretBindings as R, ModuleOutputs as S, ParamBinding as T, ServiceNode as U, Secrets as V, Values as W, isParamSource as X, isNode as Y, isProvisionNeed as Z, InputValueOf as _, Connection as a, provisionNeed as at, ModuleContext as b, Deps as c, secretSource as ct, Graph as d, number as et, GraphNode as f, InputRef as g, InputBinding as h, ConfigParam as i, paramSource as it, Params as j, ParamNeeds as k, Edge as l, service as lt, HydratedDeps as m, Config as n, paramManifest as nt, Contract as o, resource as ot, Hydrated as p, freezeNode as q, ConfigDeclaration as r, paramNeed as rt, DependencyEnd as s, secret as st, BuildAdapter as t, param as tt, Expose as u, string as ut, LoadError as v, NodeId as w, ModuleNode as x, ModuleBuilder as y, SecretNeed as z };
-//# sourceMappingURL=graph-types-DcBX92Gs-Dnhu7wre.d.mts.map
+export { param as $, ProvisionNeed as A, SecretValues as B, ParamBinding as C, ParamNeeds as D, ParamNeedBindings as E, RunnableServiceNode as F, dependency as G, ServiceNode as H, SecretBinding as I, isParamSource as J, freezeNode as K, SecretBindings as L, RefPort as M, ResourceNode as N, ParamSource as O, ResourceNodeBase as P, number as Q, SecretNeed as R, NodeId as S, ParamNeed as T, Values as U, Secrets as V, configOf as W, isSecretSource as X, isProvisionNeed as Y, module as Z, ModuleBuilder as _, Connection as a, resource as at, ModuleOutputs as b, Deps as c, service as ct, Graph as d, SecretString as dt, paramManifest as et, GraphNode as f, LoadError as g, InputRef as h, ConfigParam as i, provisionNeed as it, ProvisionedRef as j, Params as k, Edge as l, string as lt, HydratedDeps as m, Config as n, paramSource as nt, Contract as o, secret as ot, Hydrated as p, isNode as q, ConfigDeclaration as r, provisionManifest as rt, DependencyEnd as s, secretSource as st, BuildAdapter as t, paramNeed as tt, Expose as u, SecretBox as ut, ModuleContext as v, ParamBindings as w, NODE as x, ModuleNode as y, SecretSource as z };
+//# sourceMappingURL=graph-types-BcbVhojU-C3fhxjPK.d.mts.map

package/dist/graph-types-BcbVhojU-C3fhxjPK.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-types-BcbVhojU-C3fhxjPK.d.mts","names":[],"sources":["../../../0-framework/0-foundation/foundation/dist/secret.d.mts","../../../0-framework/1-core/core/dist/graph-types-BcbVhojU.d.mts"],"mappings":";;;;;;;;;;;;;cAWc,UAAU;;EAEtB,YAAY,OAAO;;EAEnB,UAAU;EACV;EACA;EACA;GACC,OAAO;;;KAGL,eAAe;;;;;;;;;;;;UCXV,YAAY,UAAU,mBAAmB;WACxC,QAAQ;WACR;WACA,UAAU,iBAAiB,YAAY;;;;;;;WAOvC,YAAY;;KAElB,SAAS,eAAe;;KAExB,OAAO,UAAU,sBAAsB,WAAW,IAAI,EAAE,gDAAgD,EAAE,gBAAgB,iBAAiB,YAAY,EAAE,4BAA4B,iBAAiB,YAAY,EAAE,gBAAgB,iBAAiB,YAAY,EAAE;;;;;;;UAO9P,WAAW,UAAU,SAAS,QAAQ;WACrC,QAAQ;EACjB,QAAQ,QAAQ,OAAO,KAAK,IAAI,QAAQ;;;;;;;;;;UAUhC;WACC;aACE;;WAEF;WACA,QAAQ,SAAS;WACjB;WACA;;;;;;;;;;UAUD;WACC,SAAS,SAAS;WAClB,QAAQ,SAAS,eAAe,SAAS;;;;;;;;;;;iBAWnC,SAAS,MAAM,uBAAuB;;;;;;;;iBAQtC,kBAAkB,OAAO,iBAAiB;;;;;;;;;iBAS1C,cAAc,OAAO,iBAAiB;UAC7C,aAAa;WACZ;WACA,UAAU;WACV,YAAY;;;iBAGN,OAAO,OAAO,uBAAuB,YAAY;;iBAEjD,OAAO,OAAO,uBAAuB,YAAY;;iBAEjD,MAAM,UAAU,kBAAkB,QAAQ,GAAG,OAAO,aAAa,iBAAiB,YAAY,MAAM,YAAY;;;;;;;;;;;;UAYvH,SAAS,qBAAqB;WAC7B,MAAM;WACN,OAAO;EAChB,UAAU,UAAU,SAAS;;;;cAIjB;cACA;cACA;;UAEJ;YACE;WACD;;;KAGN,UAAU,eAAe;;UAEpB,aAAa;YACX;;WAED,SAAS;;;KAGf,eAAe,UAAU,cAAc,WAAW,IAAI;;KAEtD,aAAa,UAAU,uBAAuB,WAAW,IAAI;;iBAEjD,UAAU;;iBAEV,aAAa,GAAG,SAAS,IAAI,aAAa;;iBAE1C,eAAe,iBAAiB,SAAS;cAC5C;;UAEJ,cAAc;YACZ;;WAED;;WAEA,SAAS;;;iBAGH,cAAc,eAAe,eAAe,UAAU,IAAI,cAAc;;iBAExE,gBAAgB,iBAAiB,SAAS;cAC7C;cACA;;UAEJ,YAAY;YACV;;WAED,SAAS;;;iBAGH,YAAY,GAAG,SAAS,IAAI,YAAY;;iBAExC,cAAc,iBAAiB,SAAS;;UAE/C;YACE;WACD;;;KAGN,aAAa,eAAe;;iBAEhB,aAAa;;KAEzB,cAAc,UAAU,sBAAsB,WAAW,KAAK,iBAAiB,YAAY,EAAE,gBAAgB;;KAE7G,kBAAkB,WAAW,0BAA0B,WAAW,MAAM;;KAExE,cAAc;;UAET;;WAEC;;WAEA;;WAEA;;WAEA;;;;;;;UAOD,aAAa,UAAU,cAAc;YACnC;WACD;;WAEA;;WAEA;WACA,MAAM;;WAEN,UAAU;;;;;;;UAOX,YAAY,UAAU,OAAO,MAAM,UAAU,SAAS,QAAQ,UAAU,SAAS,QAAQ,UAAU,UAAU;YAC3G;WACD;;WAEA;;WAEA;WACA;WACA,QAAQ;;WAER,QAAQ;;WAER,aAAa;;WAEb,OAAO;;WAEP,QAAQ;;;;;;;UAOT,oBAAoB,UAAU,OAAO,MAAM,UAAU,SAAS,QAAQ,UAAU,SAAS,QAAQ,UAAU,UAAU,iBAAiB,YAAY,GAAG,GAAG,GAAG;EACnK,IAAI,iBAAiB,YAAY,mBAAmB;EACpD,QAAQ,aAAa;EACrB,UAAU,OAAO;;EAEjB,WAAW,aAAa;;;;;;;UAOhB,cAAc,aAAa;YACzB;WACD;;WAEA;WACA;WACA,YAAY,WAAW,QAAQ;;WAE/B,UAAU;;;UAGX,WAAW,UAAU,OAAO,MAAM,UAAU,SAAS,QAAQ,UAAU,UAAU,SAAS,WAAW,aAAa;YAChH;WACD;;WAEA;WACA,MAAM;;WAEN,aAAa;;WAEb,YAAY;WACZ,QAAQ;EACjB,KAAK,KAAK,cAAc,GAAG,GAAG,MAAM,cAAc;;;;;;UAM1C,cAAc,UAAU,MAAM,UAAU,UAAU,SAAS,WAAW,aAAa;;WAElF,WAAW,WAAW,IAAI,SAAS,EAAE;;WAErC,qBAAqB,WAAW,IAAI;;WAEpC,oBAAoB,WAAW,KAAK;;WAEpC,WAAW;;;;;;;KAOjB,SAAS,MAAM,WAAW,yBAAyB,YAAY,eAAe,QAAQ;;KAEtF,cAAc,UAAU,aAAa,WAAW,IAAI,QAAQ,QAAQ,EAAE;;;;;KAKtE,QAAQ,UAAU,eAAe;WAC3B;;;;;;;KAON,eAAe,UAAU,SAAS;WAC5B;gBACK,WAAW,IAAI,QAAQ,EAAE;;KAEpC,MAAM,MAAM,WAAW,yBAAyB,OAAO;;;;;;;;KAQvD,YAAY,UAAU,WAAW,WAAW,IAAI,QAAQ,MAAM,EAAE,OAAO,SAAS,EAAE;;;;;;;;;;;;;;KAclF,cAAc,UAAU,MAAM,UAAU,SAAS,aAAa,4BAA4B,sBAAsB;EACnH;EACA,SAAS;MACL;EACJ;EACA,SAAS,eAAe;EACxB,SAAS;YACC,sBAAsB;EAChC;EACA,MAAM,YAAY;EAClB,SAAS;MACL;EACJ;EACA,MAAM,YAAY;EAClB,SAAS,eAAe;EACxB,SAAS;;UAED;;EAER,UAAU,UAAU,aAAa,UAAU,aAAa,IAAI;IAC1D;;aAES;MACP,QAAQ;;EAEZ,UAAU,UAAU,MAAM,UAAU,QAAQ,UAAU,QAAQ,UAAU,SAAS,SAAS,YAAY,GAAG,GAAG,GAAG,OAAO,MAAM,cAAc,GAAG,GAAG,cAAc,MAAM,eAAe;;;;;;;EAOnL,UAAU,UAAU,MAAM,UAAU,QAAQ,UAAU,QAAQ,UAAU,SAAS,SAAS,YAAY,GAAG,GAAG,GAAG,IAAI;IACjH;IACA,MAAM,YAAY;IAClB,UAAU,eAAe;IACzB,SAAS,cAAc;MACrB,eAAe;;EAEnB,UAAU,UAAU,MAAM,UAAU,QAAQ,UAAU,SAAS,WAAW,YAAY,OAAO,WAAW,GAAG,GAAG,GAAG,QAAQ,MAAM,cAAc,GAAG,GAAG,kBAAkB,OAAO,eAAe;;EAE3L,UAAU,UAAU,MAAM,UAAU,QAAQ,UAAU,SAAS,WAAW,YAAY,OAAO,WAAW,GAAG,GAAG,GAAG,KAAK;IACpH;IACA,MAAM,YAAY;IAClB,UAAU,eAAe;IACzB,SAAS,kBAAkB;MACzB,eAAe;;;KAGhB,OAAO,eAAe;;KAEtB,SAAS,SAAS,eAAe;KACjC,SAAS,KAAK,UAAU,oBAAoB,UAAU;KACtD,aAAa,UAAU,oBAAoB,WAAW,IAAI,SAAS,EAAE;;;;;;iBAMzD,WAAW,kBAAkB,MAAM,IAAI;;;;;;uBAMjC,iBAAiB,UAAU,cAAc,wBAAwB,aAAa;YACzF;WACD;WACA;WACA;WACA,MAAM;WACN,UAAU;EACnB,YAAY;IACV;IACA;IACA,UAAU;;;;;;;;iBAQG,SAAS,UAAU,aAAa;EAC/C;EACA;EACA,UAAU;IACR,aAAa;;;;;iBAKA,QAAQ,UAAU,MAAM,UAAU,QAAQ,UAAU,SAAS,sBAAsB,UAAU,UAAU,sBAAsB;EAC5I;EACA;EACA;EACA,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,OAAO;EACP,SAAS;IACP,YAAY,GAAG,GAAG,GAAG;;;;;;iBAMR,WAAW,UAAU,QAAQ,GAAG,eAAe;EAC9D;EACA;EACA,YAAY,WAAW,GAAG;EAC1B,WAAW;IACT,cAAc,GAAG;;;;;;;iBAOJ,OAAO,cAAc,OAAO,KAAK,cAAc,sBAAsB,sBAAsB,iCAAiC,WAAW,sBAAsB,sBAAsB,sBAAsB;;;;;iBAKzM,OAAO,UAAU,OAAO,sBAAsB,UAAU,SAAS,sBAAsB,UAAU,UAAU,sBAAsB,WAAW,aAAa,sBAAsB,cAAc;EAC5M,OAAO;EACP,UAAU;EACV,SAAS;EACT,SAAS;GACR,OAAO,KAAK,cAAc,GAAG,GAAG,QAAQ,cAAc,YAAY,WAAW,GAAG,GAAG,GAAG;;;;;;iBAMxE,OAAO,iBAAiB,SAAS,cAAc,eAAe,gBAAgB;;;;KAI1F;UACK;WACC,IAAI;WACJ,MAAM,cAAc,eAAe,gBAAgB;;;;;;;;;UASpD;WACC,MAAM;WACN,IAAI;WACJ;WACA;;;;;;;;;UASD;;WAEC,gBAAgB;;WAEhB;;WAEA,QAAQ;;;;;;;;;;UAUT;;WAEC,gBAAgB;;WAEhB;;WAEA;;UAED;WACC,MAAM;;WAEN,gBAAgB;WAChB,gBAAgB;;WAEhB,kBAAkB;;WAElB,iBAAiB;;;cAGd,kBAAkB;EAC9B,YAAY"}

package/dist/index-BFBNz7Aw.d.mts

@@ -0,0 +1,32 @@
+import { B as SecretValues, H as ServiceNode, V as Secrets, c as Deps, m as HydratedDeps, n as Config } from "./graph-types-BcbVhojU-C3fhxjPK.mjs";
+import "./graph-DUSgjmzA-DhtkTqoz.mjs";
+//#region ../../0-framework/1-core/core/dist/index.d.mts
+//#region src/hydrate.d.ts
+/**
+ * Given a service and a concrete typed Config, hydrate every input
+ * (connection.hydrate with its typed value slice). A resource dep and a
+ * connection dep hydrate through identical machinery — the loaded client is
+ * indistinguishable. The service's own params ride alongside in
+ * `config.service`; the node's `load()` merges the two.
+ */
+declare function hydrate(root: ServiceNode, config: Config): Promise<HydratedDeps<Deps>>;
+/**
+ * Synchronous hydrate — what the node's `load()` uses so
+ * `const { db } = service.load()` reads without `await`. Requires every
+ * connection.hydrate to return synchronously; a Promise return is a loud error
+ * naming the input (an async client factory must use the async `hydrate` path).
+ */
+declare function hydrateSync(root: ServiceNode, config: Config): HydratedDeps<Deps>;
+/**
+ * Wraps each of a service's resolved secret values in a redacting `SecretBox`
+ * — what the node's `secrets()` accessor returns (ADR-0021, sibling to
+ * `load()`/`config()`). The RESOLUTION of a secret's value (the boot
+ * double-lookup that reads the platform var the pointer names) is the target
+ * pack's job; core is handed the already-resolved strings and only boxes them,
+ * so a secret is redacted by TYPE from here on. A declared slot missing from
+ * `values` is a target contract violation, named loudly.
+ */
+declare function hydrateSecrets(root: ServiceNode, values: Record<string, string>): SecretValues<Secrets>;
+//#endregion
+export { hydrateSecrets as n, hydrateSync as r, hydrate as t };
+//# sourceMappingURL=index-BFBNz7Aw.d.mts.map

package/dist/index-BFBNz7Aw.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-BFBNz7Aw.d.mts","names":[],"sources":["../../../0-framework/1-core/core/dist/index.d.mts"],"mappings":";;;;;;;;;;;iBAWiB,QAAQ,MAAM,aAAa,QAAQ,SAAS,QAAQ,aAAa;;;;;;;iBAOjE,YAAY,MAAM,aAAa,QAAQ,SAAS,aAAa;;;;;;;;;;iBAU7D,eAAe,MAAM,aAAa,QAAQ,yBAAyB,aAAa"}

package/dist/index.d.mts

@@ -1,5 +1,4 @@
-import { n as SecretString, r as isSecretString, t as SecretBox } from "./secret-CHOw4LBU-C8yXoC9N.mjs";
-import { $ as module, A as ParamSource, B as SecretSource, C as NODE, D as ParamNeed, E as ParamBindings, F as ResourceNode, G as configOf, H as ServiceInputBinding, I as ResourceNodeBase, J as inputManifest, K as dependency, L as RunnableServiceNode, M as ProvisionNeed, N as ProvisionedRef, O as ParamNeedBindings, P as RefPort, Q as isSecretSource, R as SecretBindings, S as ModuleOutputs, T as ParamBinding, U as ServiceNode, V as Secrets, W as Values, X as isParamSource, Y as isNode, Z as isProvisionNeed, _ as InputValueOf, a as Connection, at as provisionNeed, b as ModuleContext, c as Deps, ct as secretSource, d as Graph, et as number, f as GraphNode, g as InputRef, h as InputBinding, i as ConfigParam, it as paramSource, j as Params, k as ParamNeeds, l as Edge, lt as service, m as HydratedDeps, n as Config, nt as paramManifest, o as Contract, ot as resource, p as Hydrated, q as freezeNode, r as ConfigDeclaration, rt as paramNeed, s as DependencyEnd, st as secret, t as BuildAdapter, tt as param, u as Expose, ut as string, v as LoadError, w as NodeId, x as ModuleNode, y as ModuleBuilder, z as SecretNeed } from "./graph-types-DcBX92Gs-Dnhu7wre.mjs";
-import { t as Load } from "./graph-CNZcSnM6-Do0zmuzA.mjs";
-import { n as hydrateSync, t as hydrate } from "./index-BkJ2OjXF.mjs";
-export { type BuildAdapter, type Config, type ConfigDeclaration, type ConfigParam, type Connection, type Contract, type DependencyEnd, type Deps, type Edge, type Expose, type Graph, type GraphNode, type Hydrated, type HydratedDeps, type InputBinding, type InputRef, type InputValueOf, Load, LoadError, type ModuleBuilder, type ModuleContext, type ModuleNode, type ModuleOutputs, type NODE, type NodeId, type ParamBinding, type ParamBindings, type ParamNeed, type ParamNeedBindings, type ParamNeeds, type ParamSource, type Params, type ProvisionNeed, type ProvisionedRef, type RefPort, type ResourceNode, ResourceNodeBase, type RunnableServiceNode, type SecretBindings, SecretBox, type SecretNeed, type SecretSource, type SecretString, type Secrets, type ServiceInputBinding, type ServiceNode, type Values, configOf, dependency, freezeNode, hydrate, hydrateSync, inputManifest, isNode, isParamSource, isProvisionNeed, isSecretSource, isSecretString, module, number, param, paramManifest, paramNeed, paramSource, provisionNeed, resource, secret, secretSource, service, string };
+import { $ as param, A as ProvisionNeed, B as SecretValues, C as ParamBinding, D as ParamNeeds, E as ParamNeedBindings, F as RunnableServiceNode, G as dependency, H as ServiceNode, I as SecretBinding, J as isParamSource, K as freezeNode, L as SecretBindings, M as RefPort, N as ResourceNode, O as ParamSource, P as ResourceNodeBase, Q as number, R as SecretNeed, S as NodeId, T as ParamNeed, U as Values, V as Secrets, W as configOf, X as isSecretSource, Y as isProvisionNeed, Z as module, _ as ModuleBuilder, a as Connection, at as resource, b as ModuleOutputs, c as Deps, ct as service, d as Graph, dt as SecretString, et as paramManifest, f as GraphNode, g as LoadError, h as InputRef, i as ConfigParam, it as provisionNeed, j as ProvisionedRef, k as Params, l as Edge, lt as string, m as HydratedDeps, n as Config, nt as paramSource, o as Contract, ot as secret, p as Hydrated, q as isNode, r as ConfigDeclaration, rt as provisionManifest, s as DependencyEnd, st as secretSource, t as BuildAdapter, tt as paramNeed, u as Expose, ut as SecretBox, v as ModuleContext, w as ParamBindings, x as NODE, y as ModuleNode, z as SecretSource } from "./graph-types-BcbVhojU-C3fhxjPK.mjs";
+import { t as Load } from "./graph-DUSgjmzA-DhtkTqoz.mjs";
+import { n as hydrateSecrets, r as hydrateSync, t as hydrate } from "./index-BFBNz7Aw.mjs";
+export { type BuildAdapter, type Config, type ConfigDeclaration, type ConfigParam, type Connection, type Contract, type DependencyEnd, type Deps, type Edge, type Expose, type Graph, type GraphNode, type Hydrated, type HydratedDeps, type InputRef, Load, LoadError, type ModuleBuilder, type ModuleContext, type ModuleNode, type ModuleOutputs, type NODE, type NodeId, type ParamBinding, type ParamBindings, type ParamNeed, type ParamNeedBindings, type ParamNeeds, type ParamSource, type Params, type ProvisionNeed, type ProvisionedRef, type RefPort, type ResourceNode, ResourceNodeBase, type RunnableServiceNode, type SecretBinding, type SecretBindings, SecretBox, type SecretNeed, type SecretSource, type SecretString, type SecretValues, type Secrets, type ServiceNode, type Values, configOf, dependency, freezeNode, hydrate, hydrateSecrets, hydrateSync, isNode, isParamSource, isProvisionNeed, isSecretSource, module, number, param, paramManifest, paramNeed, paramSource, provisionManifest, provisionNeed, resource, secret, secretSource, service, string };

package/dist/index.mjs

@@ -1,4 +1,3 @@
-import { _ as service, a as freezeNode, c as isProvisionNeed, d as paramNeed, f as paramSource, g as secretSource, h as secret, i as dependency, l as isSecretSource, m as resource, n as LoadError, o as isNode, p as provisionNeed, r as ResourceNodeBase, s as isParamSource, t as Load, u as module } from "./graph-DgbALPDo-BEHF94BN.mjs";
-import { n as isSecretString, t as SecretBox } from "./secret-DoWGmN7m-DO5Brq1Y.mjs";
-import { a as number, c as string, i as inputManifest, n as hydrate, o as param, r as hydrateSync, s as paramManifest, t as configOf } from "./dist-CG0jqp27.mjs";
-export { Load, LoadError, ResourceNodeBase, SecretBox, configOf, dependency, freezeNode, hydrate, hydrateSync, inputManifest, isNode, isParamSource, isProvisionNeed, isSecretSource, isSecretString, module, number, param, paramManifest, paramNeed, paramSource, provisionNeed, resource, secret, secretSource, service, string };
+import { _ as service, a as freezeNode, c as isProvisionNeed, d as paramNeed, f as paramSource, g as secretSource, h as secret, i as dependency, l as isSecretSource, m as resource, n as LoadError, o as isNode, p as provisionNeed, r as ResourceNodeBase, s as isParamSource, t as Load, u as module } from "./graph-CP16cJyH-D5IW87Y-.mjs";
+import { a as number, c as provisionManifest, i as hydrateSync, l as string, n as hydrate, o as param, r as hydrateSecrets, s as paramManifest, t as configOf, u as SecretBox } from "./dist-BkSJOwTm.mjs";
+export { Load, LoadError, ResourceNodeBase, SecretBox, configOf, dependency, freezeNode, hydrate, hydrateSecrets, hydrateSync, isNode, isParamSource, isProvisionNeed, isSecretSource, module, number, param, paramManifest, paramNeed, paramSource, provisionManifest, provisionNeed, resource, secret, secretSource, service, string };

package/dist/local-target.d.mts

@@ -1,4 +1,4 @@
-import { O as PrismaAppConfig, _ as LocalTargetProvidersInput, c as DEV_DIR, g as LocalTargetEmulatorsInput, h as LocalTargetDescriptor, m as LocalTargetAttachment, p as LocalTargetAttachInput, s as ContainerInstance } from "./app-config-C_AkdBtt-D0rtdLlj.mjs";
+import { O as PrismaAppConfig, _ as LocalTargetProvidersInput, c as DEV_DIR, g as LocalTargetEmulatorsInput, h as LocalTargetDescriptor, m as LocalTargetAttachment, p as LocalTargetAttachInput, s as ContainerInstance } from "./app-config-Dw3r7sUa-D3dr8rg2.mjs";
 import * as Layer from "effect/Layer";
 //#region ../../0-framework/1-core/core/dist/local-target.d.mts
 //#region src/control/local-target.d.ts

package/dist/local-target.mjs

@@ -1,5 +1,5 @@
 import { r as isBuildOnlyExtension, t as DEV_DIR } from "./app-config-joXc-BKm-CdcXqNMD.mjs";
-import { t as LowerError } from "./deploy-C4DxNkJ9-D73lmBqy.mjs";
+import { t as LowerError } from "./deploy-H3PKi0ZR-Chgm12Bn.mjs";
 import * as Layer from "effect/Layer";
 //#region ../../0-framework/1-core/core/dist/local-target.mjs
 /** The local-target stack's own provider aggregation (ADR-0041; naming, operator 2026-07-23 — the seam is `localTarget`, "dev" names the user-facing feature only) — the local-target counterpart of `deploy.ts`'s `mergedProviders`, kept in its own module so `lower()` learns nothing about it (deploy.ts's REVISED — operator review of #162). */

package/dist/local-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"local-target.mjs","names":[],"sources":["../../../0-framework/1-core/core/dist/local-target.mjs"],"sourcesContent":["import { t as LowerError } from \"./deploy-C4DxNkJ9.mjs\";\nimport { r as isBuildOnlyExtension, t as DEV_DIR } from \"./app-config-joXc-BKm.mjs\";\nimport * as Layer from \"effect/Layer\";\n//#region src/control/local-target.ts\n/** The local-target stack's own provider aggregation (ADR-0041; naming, operator 2026-07-23 — the seam is `localTarget`, \"dev\" names the user-facing feature only) — the local-target counterpart of `deploy.ts`'s `mergedProviders`, kept in its own module so `lower()` learns nothing about it (deploy.ts's REVISED — operator review of #162). */\nfunction noLocalTargetSupportError(id) {\n\treturn new LowerError(`extension \"${id}\" has no dev support — it declares no \\`localTarget\\` descriptor (ADR-0041).`);\n}\n/**\n* Resolves every non-build-only configured extension's lazy `localTarget`\n* thunk, once (ADR-0041's lazy local-target reference — operator directive:\n* the production control entry carries only the thunk, never the\n* descriptor, so resolving it is this module's job, not something a deploy\n* path ever does). A build-only extension (`isBuildOnlyExtension`) owns no\n* resources or services and is skipped entirely — never even checked for a\n* `localTarget` thunk. Every other configured extension must be\n* local-target-capable, or the dev command cannot bring the app up at all,\n* so a missing thunk throws naming the extension. The generated dev stack\n* module calls this once and threads the resolved map through every\n* subsequent hook, including `localTargetProviders`.\n*/\nasync function resolveLocalTargets(config) {\n\tconst entries = await Promise.all(config.extensions.flatMap((extension) => {\n\t\tif (isBuildOnlyExtension(extension)) return [];\n\t\tif (extension.localTarget === void 0) throw noLocalTargetSupportError(extension.id);\n\t\treturn [extension.localTarget().then((descriptor) => [extension.id, descriptor])];\n\t}));\n\treturn new Map(entries);\n}\n/**\n* All configured extensions' local-target providers merged, config array\n* order (ADR-0041), from the ALREADY-RESOLVED descriptor map\n* (`resolveLocalTargets`'s product — this function itself never touches a\n* `localTarget` thunk). The generated dev stack module is this\n* aggregator's one caller, passing the result as `LowerOptions.providers`.\n*/\nfunction localTargetProviders(resolved, containers, devDir) {\n\tconst [first, ...rest] = [...resolved.entries()].map(([id, descriptor]) => descriptor.providers({\n\t\tcontainer: containers.get(id),\n\t\tdevDir\n\t}));\n\treturn first === void 0 ? Layer.empty : Layer.mergeAll(first, ...rest);\n}\n//#endregion\nexport { DEV_DIR, localTargetProviders, resolveLocalTargets };\n\n//# sourceMappingURL=local-target.mjs.map"],"mappings":";;;;;AAKA,SAAS,0BAA0B,IAAI;CACtC,OAAO,IAAI,WAAW,cAAc,GAAG,6EAA6E;AACrH;;;;;;;;;;;;;;AAcA,eAAe,oBAAoB,QAAQ;CAC1C,MAAM,UAAU,MAAM,QAAQ,IAAI,OAAO,WAAW,SAAS,cAAc;EAC1E,IAAI,qBAAqB,SAAS,GAAG,OAAO,CAAC;EAC7C,IAAI,UAAU,gBAAgB,KAAK,GAAG,MAAM,0BAA0B,UAAU,EAAE;EAClF,OAAO,CAAC,UAAU,YAAY,CAAC,CAAC,MAAM,eAAe,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC;CACjF,CAAC,CAAC;CACF,OAAO,IAAI,IAAI,OAAO;AACvB;;;;;;;;AAQA,SAAS,qBAAqB,UAAU,YAAY,QAAQ;CAC3D,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,gBAAgB,WAAW,UAAU;EAC/F,WAAW,WAAW,IAAI,EAAE;EAC5B;CACD,CAAC,CAAC;CACF,OAAO,UAAU,KAAK,IAAI,MAAM,QAAQ,MAAM,SAAS,OAAO,GAAG,IAAI;AACtE"}
+{"version":3,"file":"local-target.mjs","names":[],"sources":["../../../0-framework/1-core/core/dist/local-target.mjs"],"sourcesContent":["import { t as LowerError } from \"./deploy-H3PKi0ZR.mjs\";\nimport { r as isBuildOnlyExtension, t as DEV_DIR } from \"./app-config-joXc-BKm.mjs\";\nimport * as Layer from \"effect/Layer\";\n//#region src/control/local-target.ts\n/** The local-target stack's own provider aggregation (ADR-0041; naming, operator 2026-07-23 — the seam is `localTarget`, \"dev\" names the user-facing feature only) — the local-target counterpart of `deploy.ts`'s `mergedProviders`, kept in its own module so `lower()` learns nothing about it (deploy.ts's REVISED — operator review of #162). */\nfunction noLocalTargetSupportError(id) {\n\treturn new LowerError(`extension \"${id}\" has no dev support — it declares no \\`localTarget\\` descriptor (ADR-0041).`);\n}\n/**\n* Resolves every non-build-only configured extension's lazy `localTarget`\n* thunk, once (ADR-0041's lazy local-target reference — operator directive:\n* the production control entry carries only the thunk, never the\n* descriptor, so resolving it is this module's job, not something a deploy\n* path ever does). A build-only extension (`isBuildOnlyExtension`) owns no\n* resources or services and is skipped entirely — never even checked for a\n* `localTarget` thunk. Every other configured extension must be\n* local-target-capable, or the dev command cannot bring the app up at all,\n* so a missing thunk throws naming the extension. The generated dev stack\n* module calls this once and threads the resolved map through every\n* subsequent hook, including `localTargetProviders`.\n*/\nasync function resolveLocalTargets(config) {\n\tconst entries = await Promise.all(config.extensions.flatMap((extension) => {\n\t\tif (isBuildOnlyExtension(extension)) return [];\n\t\tif (extension.localTarget === void 0) throw noLocalTargetSupportError(extension.id);\n\t\treturn [extension.localTarget().then((descriptor) => [extension.id, descriptor])];\n\t}));\n\treturn new Map(entries);\n}\n/**\n* All configured extensions' local-target providers merged, config array\n* order (ADR-0041), from the ALREADY-RESOLVED descriptor map\n* (`resolveLocalTargets`'s product — this function itself never touches a\n* `localTarget` thunk). The generated dev stack module is this\n* aggregator's one caller, passing the result as `LowerOptions.providers`.\n*/\nfunction localTargetProviders(resolved, containers, devDir) {\n\tconst [first, ...rest] = [...resolved.entries()].map(([id, descriptor]) => descriptor.providers({\n\t\tcontainer: containers.get(id),\n\t\tdevDir\n\t}));\n\treturn first === void 0 ? Layer.empty : Layer.mergeAll(first, ...rest);\n}\n//#endregion\nexport { DEV_DIR, localTargetProviders, resolveLocalTargets };\n\n//# sourceMappingURL=local-target.mjs.map"],"mappings":";;;;;AAKA,SAAS,0BAA0B,IAAI;CACtC,OAAO,IAAI,WAAW,cAAc,GAAG,6EAA6E;AACrH;;;;;;;;;;;;;;AAcA,eAAe,oBAAoB,QAAQ;CAC1C,MAAM,UAAU,MAAM,QAAQ,IAAI,OAAO,WAAW,SAAS,cAAc;EAC1E,IAAI,qBAAqB,SAAS,GAAG,OAAO,CAAC;EAC7C,IAAI,UAAU,gBAAgB,KAAK,GAAG,MAAM,0BAA0B,UAAU,EAAE;EAClF,OAAO,CAAC,UAAU,YAAY,CAAC,CAAC,MAAM,eAAe,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC;CACjF,CAAC,CAAC;CACF,OAAO,IAAI,IAAI,OAAO;AACvB;;;;;;;;AAQA,SAAS,qBAAqB,UAAU,YAAY,QAAQ;CAC3D,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,gBAAgB,WAAW,UAAU;EAC/F,WAAW,WAAW,IAAI,EAAE;EAC5B;CACD,CAAC,CAAC;CACF,OAAO,UAAU,KAAK,IAAI,MAAM,QAAQ,MAAM,SAAS,OAAO,GAAG,IAAI;AACtE"}

package/dist/{nextjs-DLyeRR7M-xWd8GKgK.d.mts → nextjs-DLyeRR7M-DwnBjryZ.d.mts}

@@ -1,5 +1,5 @@
-import { t as BuildAdapter } from "./graph-types-DcBX92Gs-Dnhu7wre.mjs";
-import "./index-BkJ2OjXF.mjs";
+import { t as BuildAdapter } from "./graph-types-BcbVhojU-C3fhxjPK.mjs";
+import "./index-BFBNz7Aw.mjs";
 //#region ../../0-framework/2-authoring/nextjs/dist/nextjs-DLyeRR7M.d.mts
 //#region src/nextjs.d.ts
 /** The nextjs build adapter's descriptor — `appDir` is this kind's own extra path input (the Next app root), beyond the shared `{ extension, type, module, entry }`. `entry` is a placeholder; the assembler locates `server.js` in the standalone tree. */
@@ -13,4 +13,4 @@ declare const nextjsBuild: (opts: {
 }) => NextjsBuildAdapter;
 //#endregion
 export { nextjsBuild as n, NextjsBuildAdapter as t };
-//# sourceMappingURL=nextjs-DLyeRR7M-xWd8GKgK.d.mts.map
+//# sourceMappingURL=nextjs-DLyeRR7M-DwnBjryZ.d.mts.map

package/dist/{nextjs-DLyeRR7M-xWd8GKgK.d.mts.map → nextjs-DLyeRR7M-DwnBjryZ.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"nextjs-DLyeRR7M-xWd8GKgK.d.mts","names":[],"sources":["../../../0-framework/2-authoring/nextjs/dist/nextjs-DLyeRR7M.d.mts"],"mappings":";;;;;UAGU,2BAA2B;WAC1B;WACA;;cAEG,cAAc;EAC1B;EACA;MACI"}
+{"version":3,"file":"nextjs-DLyeRR7M-DwnBjryZ.d.mts","names":[],"sources":["../../../0-framework/2-authoring/nextjs/dist/nextjs-DLyeRR7M.d.mts"],"mappings":";;;;;UAGU,2BAA2B;WAC1B;WACA;;cAEG,cAAc;EAC1B;EACA;MACI"}

package/dist/nextjs-control.d.mts

@@ -1,7 +1,7 @@
-import { a as Bundle, f as ExtensionDescriptor, i as AssembleInput } from "./app-config-C_AkdBtt-D0rtdLlj.mjs";
-import "./config-B1rI-XeI.mjs";
-import "./deploy-B1rI-XeI.mjs";
-import { t as NextjsBuildAdapter } from "./nextjs-DLyeRR7M-xWd8GKgK.mjs";
+import { a as Bundle, f as ExtensionDescriptor, i as AssembleInput } from "./app-config-Dw3r7sUa-D3dr8rg2.mjs";
+import "./config-121C4hAb.mjs";
+import "./deploy-121C4hAb.mjs";
+import { t as NextjsBuildAdapter } from "./nextjs-DLyeRR7M-DwnBjryZ.mjs";
 //#region ../../0-framework/2-authoring/nextjs/dist/control.d.mts
 //#region src/control/build.d.ts
 /** The built standalone server.js for a nextjs build — `appDir`'s standalone root plus the app subpath Next recorded. Single-sourced so `assemble()` (deploy) and the integration-test seam can't drift. */

package/dist/nextjs.d.mts

@@ -1,2 +1,2 @@
-import { n as nextjsBuild, t as NextjsBuildAdapter } from "./nextjs-DLyeRR7M-xWd8GKgK.mjs";
+import { n as nextjsBuild, t as NextjsBuildAdapter } from "./nextjs-DLyeRR7M-DwnBjryZ.mjs";
 export { type NextjsBuildAdapter, nextjsBuild as default };