@prisma/composer 0.3.0 → 0.4.0-dev.2

package/dist/{app-config-Dw3r7sUa-D3dr8rg2.d.mts → app-config-bsTo57A8-BfG21wAI.d.mts}

@@ -1,11 +1,11 @@
-import { A as ProvisionNeed, H as ServiceNode, N as ResourceNode, S as NodeId, d as Graph, n as Config, t as BuildAdapter, y as ModuleNode } from "./graph-types-BcbVhojU-C3fhxjPK.mjs";
-import "./graph-DUSgjmzA-DhtkTqoz.mjs";
+import { F as ResourceNode, M as ProvisionNeed, U as ServiceNode, d as Graph, n as Config, t as BuildAdapter, w as NodeId, x as ModuleNode } from "./graph-types-C3FOaaXm-C6_rGzfn.mjs";
+import "./graph-DDpXh7S8-b-93BcHn.mjs";
 import * as Alchemy from "alchemy";
 import { Input, StackServices } from "alchemy";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { State } from "alchemy/State/State";
-//#region ../../0-framework/1-core/core/dist/app-config-Dw3r7sUa.d.mts
+//#region ../../0-framework/1-core/core/dist/app-config-bsTo57A8.d.mts
 //#region src/container-transport.d.ts
 /**
  * Carries resolved containers from the CLI process into the alchemy process
@@ -492,4 +492,4 @@ interface PrismaAppConfig {
 declare function defineConfig(config: PrismaAppConfig): PrismaAppConfig;
 //#endregion
 export { ProvisionerDescriptor as A, joinDeployment as B, Lowering as C, PreflightInput as D, PackageInput as E, containerEnv as F, lowering as H, containerEnvVarName as I, defineConfig as L, StateDescriptor as M, TeardownInput as N, PrismaAppConfig as O, buildConfig as P, deserializeContainers as R, LoweredResult as S, Outputs as T, mergedProviders as U, lower as V, resolveStateLayer as W, LocalTargetProvidersInput as _, Bundle as a, LowerError as b, DEV_DIR as c, DeploymentResult as d, ExtensionDescriptor as f, LocalTargetEmulatorsInput as g, LocalTargetDescriptor as h, AssembleInput as i, ServiceLowering as j, ProvisionEdge as k, DeployedEntity as l, LocalTargetAttachment as m, ApplicationDescriptor as n, ContainerDescriptor as o, LocalTargetAttachInput as p, Artifact as r, ContainerInstance as s, AlchemyStateLayer as t, DeployedNode as u, LocateContainerInput as v, NodeDescriptor as w, LowerOptions as x, LowerContext as y, isBuildOnlyExtension as z };
-//# sourceMappingURL=app-config-Dw3r7sUa-D3dr8rg2.d.mts.map
+//# sourceMappingURL=app-config-bsTo57A8-BfG21wAI.d.mts.map

package/dist/{app-config-Dw3r7sUa-D3dr8rg2.d.mts.map → app-config-bsTo57A8-BfG21wAI.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"app-config-Dw3r7sUa-D3dr8rg2.d.mts","names":[],"sources":["../../../0-framework/1-core/core/dist/app-config-Dw3r7sUa.d.mts"],"mappings":";;;;;;;;;;;;;;;;;;;;UAmBU;;WAEC;;WAEA;;;;;;;UAOD;WACC,OAAO;;EAEhB;;;;;;;;;;;;UAYQ,oBAAoB,UAAU,oBAAoB;;EAE1D,OAAO,OAAO,uBAAuB,QAAQ;;EAE7C,OAAO,OAAO,uBAAuB,QAAQ;;EAE7C,OAAO,UAAU,IAAI;;EAErB,YAAY,qBAAqB;;;iBAGlB,oBAAoB;;iBAEpB,aAAa,WAAW,oBAAoB,qBAAqB;;UAExE;WACC;WACA,YAAY;;;;;;iBAMN,sBAAsB,qBAAqB,+BAA+B,KAAK,SAAS,sCAAsC,oBAAoB;;;;KAI9J,oBAAoB,MAAM,MAAM,cAAc;;;;;;UAMzC;EACR,UAAU,KAAK,eAAe,OAAO;;;;;;;;UAQ7B;WACC;WACA;WACA;WACA;;WAEA,MAAM;;;UAGP;;EAER,UAAU,MAAM,gBAAgB,OAAO;;;;;;;;;;;;;;UAc/B,gBAAgB,aAAa;;EAErC,UAAU,KAAK,eAAe,OAAO,OAAO;;;;;;EAM5C,UAAU,KAAK,cAAc,aAAa,GAAG,QAAQ,SAAS,OAAO,OAAO;;;;;;EAM5E,QAAQ,KAAK,cAAc,OAAO,eAAe,OAAO,OAAO;;EAE/D,OAAO,KAAK,cAAc,aAAa,GAAG,UAAU,UAAU,YAAY,IAAI,OAAO,OAAO;;;UAGpF;;WAEC,WAAW;;WAEX;;;KAGN,YAAY,KAAK,iBAAiB,OAAO,OAAO;UAC3C;WACC,IAAI;;;;;;WAMJ;WACA,MAAM,cAAc;WACpB,OAAO;WACP,MAAM;;;;;;WAMN;;;;;;;WAOA,WAAW;;WAEX,SAAS,YAAY,QAAQ;;WAE7B,aAAa;;;;;;;;;KASnB,UAAU,SAAS;;;;;;;;;;;;;UAad;WACC;WACA;WACA;WACA,UAAU,SAAS;;;;;;;;;;;;;;UAcpB;WACC,SAAS;WACT,mBAAmB,MAAM;;;UAG1B;WACC;WACA,MAAM,cAAc;WACpB,mBAAmB;;;UAGpB;WACC;WACA,gBAAgB;;UAEjB;;WAEC;WACA,SAAS,eAAe;WACxB;;WAEA,QAAQ;;WAER,YAAY,MAAM;;;;;;;;WAQlB,UAAU,QAAQ;;;UAGnB;WACC;WACA;;;;;;;;WAQA;;;UAGD;WACC,OAAO;;WAEP;;WAEA;;;UAGD;WACC;WACA;;cAEG,mBAAmB;EAC/B,YAAY;;;;;;;;;;;;;;iBAcG,YAAY,MAAM,aAAa,IAAI,QAAQ,OAAO,OAAO,SAAS,YAAY,QAAQ,UAAU,aAAa,+BAA+B;;;;;;;;;;;;;;iBAc5I,eAAe,OAAO,OAAO;EAC5C;EACA,mBAAmB;eACN;;;;;;;;iBAQE,kBAAkB,MAAM,cAAc,QAAQ,iBAAiB,YAAY,oBAAoB,qBAAqB;;;;;;iBAMpH,gBAAgB,QAAQ,kBAAkB,MAAM;;;;;iBAKhD,SAAS,MAAM,YAAY,QAAQ,iBAAiB,MAAM,eAAe,OAAO,kBAAkB;;;;;;iBAMlG,MAAM,MAAM,YAAY,QAAQ,iBAAiB,MAAM,eAAe,OAAO,OAAO,QAAQ,uDAAuD;;;;;;;;UAQ1J;;WAEC;;WAEA,OAAO,eAAe;;WAEtB,aAAa,oBAAoB;;WAEjC,cAAc;;WAEd,kBAAkB,MAAM;;;;;;;;WAQxB,aAAa,OAAO,mBAAmB;;;;;;;;;WASvC,YAAY,OAAO,kBAAkB;;;;;;;;WAQrC,YAAY;;;;;;;;;;;;;WAaZ,oBAAoB,QAAQ;;;;;;UAM7B;;WAEC;;EAET,OAAO,WAAW,gCAAgC;;;UAG1C;;WAEC,OAAO;;WAEP,WAAW;;WAEX;;;UAGD;;WAEC,WAAW;;WAEX;;;UAGD;;EAER,UAAU,OAAO,4BAA4B,MAAM;;WAE1C,WAAW;;EAEpB,WAAW,OAAO,iBAAiB;;EAEnC,WAAW,OAAO,4BAA4B;;EAE9C,OAAO,OAAO,yBAAyB,QAAQ;;EAE/C,UAAU,OAAO,gBAAgB;;UAEzB;;WAEC,WAAW;;WAEX;;UAED;;WAEC,OAAO;WACP,WAAW;;WAEX;;UAED;WACC,WAAW;WACX;;UAED;;EAER,iBAAiB;;EAEjB,aAAa;aACF;aACA;;;EAGX,KAAK,QAAQ,aAAa;aACf;MACP;aACO;aACA;;;EAGX,gBAAgB;;;cAGJ;;;;;;;;;iBASG,qBAAqB,WAAW;;;;;;KAM5C;WACM;IACP;WACO;IACP;WACO;EACT,SAAS,OAAO,gBAAgB,QAAQ;;;;;;;UAOhC;WACC,YAAY;WACZ,OAAO;;;iBAGD,aAAa,QAAQ,kBAAkB"}
+{"version":3,"file":"app-config-bsTo57A8-BfG21wAI.d.mts","names":[],"sources":["../../../0-framework/1-core/core/dist/app-config-bsTo57A8.d.mts"],"mappings":";;;;;;;;;;;;;;;;;;;;UAmBU;;WAEC;;WAEA;;;;;;;UAOD;WACC,OAAO;;EAEhB;;;;;;;;;;;;UAYQ,oBAAoB,UAAU,oBAAoB;;EAE1D,OAAO,OAAO,uBAAuB,QAAQ;;EAE7C,OAAO,OAAO,uBAAuB,QAAQ;;EAE7C,OAAO,UAAU,IAAI;;EAErB,YAAY,qBAAqB;;;iBAGlB,oBAAoB;;iBAEpB,aAAa,WAAW,oBAAoB,qBAAqB;;UAExE;WACC;WACA,YAAY;;;;;;iBAMN,sBAAsB,qBAAqB,+BAA+B,KAAK,SAAS,sCAAsC,oBAAoB;;;;KAI9J,oBAAoB,MAAM,MAAM,cAAc;;;;;;UAMzC;EACR,UAAU,KAAK,eAAe,OAAO;;;;;;;;UAQ7B;WACC;WACA;WACA;WACA;;WAEA,MAAM;;;UAGP;;EAER,UAAU,MAAM,gBAAgB,OAAO;;;;;;;;;;;;;;UAc/B,gBAAgB,aAAa;;EAErC,UAAU,KAAK,eAAe,OAAO,OAAO;;;;;;EAM5C,UAAU,KAAK,cAAc,aAAa,GAAG,QAAQ,SAAS,OAAO,OAAO;;;;;;EAM5E,QAAQ,KAAK,cAAc,OAAO,eAAe,OAAO,OAAO;;EAE/D,OAAO,KAAK,cAAc,aAAa,GAAG,UAAU,UAAU,YAAY,IAAI,OAAO,OAAO;;;UAGpF;;WAEC,WAAW;;WAEX;;;KAGN,YAAY,KAAK,iBAAiB,OAAO,OAAO;UAC3C;WACC,IAAI;;;;;;WAMJ;WACA,MAAM,cAAc;WACpB,OAAO;WACP,MAAM;;;;;;WAMN;;;;;;;WAOA,WAAW;;WAEX,SAAS,YAAY,QAAQ;;WAE7B,aAAa;;;;;;;;;KASnB,UAAU,SAAS;;;;;;;;;;;;;UAad;WACC;WACA;WACA;WACA,UAAU,SAAS;;;;;;;;;;;;;;UAcpB;WACC,SAAS;WACT,mBAAmB,MAAM;;;UAG1B;WACC;WACA,MAAM,cAAc;WACpB,mBAAmB;;;UAGpB;WACC;WACA,gBAAgB;;UAEjB;;WAEC;WACA,SAAS,eAAe;WACxB;;WAEA,QAAQ;;WAER,YAAY,MAAM;;;;;;;;WAQlB,UAAU,QAAQ;;;UAGnB;WACC;WACA;;;;;;;;WAQA;;;UAGD;WACC,OAAO;;WAEP;;WAEA;;;UAGD;WACC;WACA;;cAEG,mBAAmB;EAC/B,YAAY;;;;;;;;;;;;;;iBAcG,YAAY,MAAM,aAAa,IAAI,QAAQ,OAAO,OAAO,SAAS,YAAY,QAAQ,UAAU,aAAa,+BAA+B;;;;;;;;;;;;;;iBAc5I,eAAe,OAAO,OAAO;EAC5C;EACA,mBAAmB;eACN;;;;;;;;iBAQE,kBAAkB,MAAM,cAAc,QAAQ,iBAAiB,YAAY,oBAAoB,qBAAqB;;;;;;iBAMpH,gBAAgB,QAAQ,kBAAkB,MAAM;;;;;iBAKhD,SAAS,MAAM,YAAY,QAAQ,iBAAiB,MAAM,eAAe,OAAO,kBAAkB;;;;;;iBAMlG,MAAM,MAAM,YAAY,QAAQ,iBAAiB,MAAM,eAAe,OAAO,OAAO,QAAQ,uDAAuD;;;;;;;;UAQ1J;;WAEC;;WAEA,OAAO,eAAe;;WAEtB,aAAa,oBAAoB;;WAEjC,cAAc;;WAEd,kBAAkB,MAAM;;;;;;;;WAQxB,aAAa,OAAO,mBAAmB;;;;;;;;;WASvC,YAAY,OAAO,kBAAkB;;;;;;;;WAQrC,YAAY;;;;;;;;;;;;;WAaZ,oBAAoB,QAAQ;;;;;;UAM7B;;WAEC;;EAET,OAAO,WAAW,gCAAgC;;;UAG1C;;WAEC,OAAO;;WAEP,WAAW;;WAEX;;;UAGD;;WAEC,WAAW;;WAEX;;;UAGD;;EAER,UAAU,OAAO,4BAA4B,MAAM;;WAE1C,WAAW;;EAEpB,WAAW,OAAO,iBAAiB;;EAEnC,WAAW,OAAO,4BAA4B;;EAE9C,OAAO,OAAO,yBAAyB,QAAQ;;EAE/C,UAAU,OAAO,gBAAgB;;UAEzB;;WAEC,WAAW;;WAEX;;UAED;;WAEC,OAAO;WACP,WAAW;;WAEX;;UAED;WACC,WAAW;WACX;;UAED;;EAER,iBAAiB;;EAEjB,aAAa;aACF;aACA;;;EAGX,KAAK,QAAQ,aAAa;aACf;MACP;aACO;aACA;;;EAGX,gBAAgB;;;cAGJ;;;;;;;;;iBASG,qBAAqB,WAAW;;;;;;KAM5C;WACM;IACP;WACO;IACP;WACO;EACT,SAAS,OAAO,gBAAgB,QAAQ;;;;;;;UAOhC;WACC,YAAY;WACZ,OAAO;;;iBAGD,aAAa,QAAQ,kBAAkB"}

package/dist/arktype.d.mts

@@ -0,0 +1,16 @@
+import { n as SecretString } from "./secret-CHOw4LBU-C8yXoC9N.mjs";
+//#region ../../0-framework/0-foundation/foundation/dist/arktype.d.mts
+//#region src/arktype.d.ts
+/**
+ * A schema leaf that accepts only a redacting `SecretString` box, so
+ * `input().<field>.expose()` type-checks and binding a plain literal there
+ * fails the deploy (ADR-0042).
+ *
+ * ```ts
+ * input: type({ signingKey: secretString() })
+ * ```
+ */
+declare const secretString: () => import("arktype/internal/variants/object.ts").ObjectType<SecretString, {}>;
+//#endregion
+export { secretString };
+//# sourceMappingURL=arktype.d.mts.map

package/dist/arktype.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arktype.d.mts","names":[],"sources":["../../../0-framework/0-foundation/foundation/dist/arktype.d.mts"],"mappings":";;;;;;;;;;;;cAWc,kEAAkE,WAAW"}

package/dist/arktype.mjs

@@ -0,0 +1,22 @@
+import { n as isSecretString } from "./secret-DoWGmN7m-DO5Brq1Y.mjs";
+import { type } from "arktype";
+//#region ../../0-framework/0-foundation/foundation/dist/arktype.mjs
+/**
+* ArkType spellings of the framework's schema leaves. Opt-in: the framework
+* accepts any Standard Schema library (ADR-0042) and nothing outside this
+* module imports arktype, so an app that uses Zod never loads it.
+*/
+/**
+* A schema leaf that accepts only a redacting `SecretString` box, so
+* `input().<field>.expose()` type-checks and binding a plain literal there
+* fails the deploy (ADR-0042).
+*
+* ```ts
+* input: type({ signingKey: secretString() })
+* ```
+*/
+const secretString = () => type("unknown").narrow((value, ctx) => isSecretString(value) || ctx.mustBe("a SecretString box — bind this field to a secret"));
+//#endregion
+export { secretString };
+
+//# sourceMappingURL=arktype.mjs.map

package/dist/arktype.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"arktype.mjs","names":[],"sources":["../../../0-framework/0-foundation/foundation/dist/arktype.mjs"],"sourcesContent":["import { n as isSecretString } from \"./secret-DoWGmN7m.mjs\";\nimport { type } from \"arktype\";\n//#region src/arktype.ts\n/**\n* ArkType spellings of the framework's schema leaves. Opt-in: the framework\n* accepts any Standard Schema library (ADR-0042) and nothing outside this\n* module imports arktype, so an app that uses Zod never loads it.\n*/\n/**\n* A schema leaf that accepts only a redacting `SecretString` box, so\n* `input().<field>.expose()` type-checks and binding a plain literal there\n* fails the deploy (ADR-0042).\n*\n* ```ts\n* input: type({ signingKey: secretString() })\n* ```\n*/\nconst secretString = () => type(\"unknown\").narrow((value, ctx) => isSecretString(value) || ctx.mustBe(\"a SecretString box — bind this field to a secret\"));\n//#endregion\nexport { secretString };\n\n//# sourceMappingURL=arktype.mjs.map"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAM,qBAAqB,KAAK,SAAS,CAAC,CAAC,QAAQ,OAAO,QAAQ,eAAe,KAAK,KAAK,IAAI,OAAO,kDAAkD,CAAC"}

package/dist/bin.mjs

@@ -58,7 +58,7 @@ function isBuildOnlyExtension(extension) {
 	return Object.values(extension.nodes).every((node) => node.kind === "build") && extension.providers === void 0 && extension.application === void 0 && extension.provisions === void 0 && extension.container === void 0;
 }
 //#endregion
-//#region ../../0-framework/0-foundation/foundation/dist/casts.mjs
+//#region ../../0-framework/0-foundation/foundation/dist/casts-DpaahrlC.mjs
 /**
 * **Last-resort escape hatch for unsafe type assertions. Not a sanctioned tool to reach for.**
 *
@@ -98,7 +98,7 @@ function blindCast(input) {
 	return input;
 }
 //#endregion
-//#region ../../0-framework/1-core/core/dist/graph-CP16cJyH.mjs
+//#region ../../0-framework/1-core/core/dist/graph-DgbALPDo.mjs
 /** Thrown by Load when the graph is malformed. */
 var LoadError = class extends Error {
 	constructor(message) {
@@ -215,11 +215,7 @@ function serviceInputs(service, serviceId) {
 }
 function loadService(root, rootId) {
 	for (const [input, value] of Object.entries(root.inputs)) if (isNode(value) && value.kind === "dependency") throw new LoadError(`Service "${rootId}" has an unwired dependency input "${input}" — this service is composed by a module; deploy the module instead of loading "${rootId}" directly.`);
-	const secretSlots = Object.keys(root.secretSlots);
-	if (secretSlots.length > 0) {
-		const names = secretSlots.map((k) => `"${k}"`).join(", ");
-		throw new LoadError(`Service "${rootId}" declares secret slot${secretSlots.length > 1 ? "s" : ""} ${names} but is being loaded directly — a lone service has no enclosing scope to bind them. Compose it inside a module that binds each with envSecret('NAME').`);
-	}
+	if (root.inputSchema !== void 0) throw new LoadError(`Service "${rootId}" declares an input schema but is being loaded directly — a lone service has no enclosing scope to bind its input. Compose it inside a module whose provision() call binds \`input: { … }\` (ADR-0042).`);
 	const rootGraphNode = {
 		id: rootId,
 		node: root
@@ -229,7 +225,7 @@ function loadService(root, rootId) {
 		root: rootGraphNode,
 		nodes: [...topoSort(nodes, edges), rootGraphNode],
 		edges,
-		secrets: [],
+		inputBindings: [],
 		params: []
 	};
 }
@@ -312,6 +308,25 @@ function validateWiring(pending, byId) {
 		if (value.kind === "dependency") throw new LoadError(`Dependency input "${input}" of provisioned ${targetKind} "${targetId}" is not wired to a producer (module "${enclosingModuleName}").`);
 	}
 }
+/**
+* Flattens a value into itself plus every nested object/array member value —
+* identity fodder for the ctx.secrets/ctx.params usage marking, which must
+* see a forwarded source wherever it sits inside an input binding (ADR-0042).
+* A secret/param source is an opaque leaf: it is pushed (a forwarded ref IS
+* such a source, so identity-matching still needs it) but never descended
+* into, so a ref buried in an unrelated source's payload is not falsely seen
+* as used. `seen` guards object cycles so a self-referential binding cannot
+* recurse forever.
+*/
+function deepValues(value, out, seen = /* @__PURE__ */ new WeakSet()) {
+	out.push(value);
+	if (typeof value !== "object" || value === null) return;
+	if (isSecretSource(value) || isParamSource(value)) return;
+	if (seen.has(value)) return;
+	seen.add(value);
+	const members = Array.isArray(value) ? value : Object.values(value);
+	for (const member of members) deepValues(member, out, seen);
+}
 /** The (unvalidated) edges a `wiring` object implies — one dependency edge per entry; `validateWiring` does the real checking. */
 function wiringEdges(wiring, targetId) {
 	return Object.entries(wiring).map(([input, ref]) => ({
@@ -322,11 +337,12 @@ function wiringEdges(wiring, targetId) {
 	}));
 }
 /**
-* Checks the secrets wired into one provisioned child: every declared slot is
-* bound to a real secret source (an `envSecret` or a forwarded ctx.secrets
-* ref), and no wired key names a slot the child doesn't declare — the secret
-* analog of `validateWiring`'s per-input checks, but resolved inline (a source
-* carries its own name, so no whole-graph pass is needed).
+* Checks the secrets wired into one provisioned child MODULE: every declared
+* forwarding slot is bound to a real secret source (an `envSecret` or a
+* forwarded ctx.secrets ref), and no wired key names a slot the module
+* doesn't declare — the secret analog of `validateWiring`'s per-input checks,
+* but resolved inline (a source carries its own name, so no whole-graph pass
+* is needed).
 */
 function validateSecretBinding(child, id, secretWiring, enclosingModuleName) {
 	const { kind } = child;
@@ -374,7 +390,7 @@ function validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {
 * forward in a producer provisioned by an ancestor scope, and it is the
 * shared `byId` (keyed by full address) that lets that resolve.
 */
-function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes, edges, pending, secretBindings, paramBindings, byId) {
+function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes, edges, pending, inputBindings, paramBindings, byId) {
 	const localIds = /* @__PURE__ */ new Set();
 	const used = /* @__PURE__ */ new Set();
 	const usedSecrets = /* @__PURE__ */ new Set();
@@ -388,7 +404,7 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 		} : wired;
 	}
 	const markUsed = (values) => {
-		for (const value of Object.values(values)) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);
+		for (const value of values) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);
 	};
 	const ctxSecrets = {};
 	for (const key of Object.keys(moduleNode.secretSlots)) {
@@ -399,7 +415,7 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 		} : bound;
 	}
 	const markSecretsUsed = (values) => {
-		for (const value of Object.values(values)) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);
+		for (const value of values) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);
 	};
 	const ctxParams = {};
 	for (const key of Object.keys(moduleNode.paramSlots)) {
@@ -410,12 +426,13 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 		} : bound;
 	}
 	const markParamsUsed = (values) => {
-		for (const value of Object.values(values)) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);
+		for (const value of values) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);
 	};
 	const provision = (child, opts) => {
 		const id = opts?.id ?? child.name;
 		const provisionWiring = opts?.deps;
 		const provisionSecrets = opts?.secrets;
+		const provisionInput = opts?.input;
 		const provisionParams = opts?.params;
 		if (typeof id !== "string" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module "${moduleNode.name}").`);
 		if (!isConfigKeySegment(id)) throw new LoadError(`provision() id "${id}" (module "${moduleNode.name}") must contain only ASCII letters and digits ([A-Za-z0-9]) — the id becomes an address segment, and addresses derive deterministic config keys (segments uppercased and joined with "_"). "${id}" would put "${id.toUpperCase()}" inside the derived key. ("_" collides with the key separator and "." with the address separator.)`);
@@ -427,6 +444,7 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 		if (child.kind === "resource") {
 			if (provisionWiring !== void 0) throw new LoadError(`provision("${id}") received deps for a resource — a resource has no dependency slots to satisfy.`);
 			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a resource — a resource has no secret slots to satisfy.`);
+			if (provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding for a resource — a resource declares no input schema.`);
 			if (provisionParams !== void 0) throw new LoadError(`provision("${id}") received params for a resource — a resource has no params to satisfy.`);
 			if (child.type.length === 0) throw new LoadError(`provision("${id}") received a resource with an empty node type.`);
 			byId.set(fullAddress, child);
@@ -437,19 +455,23 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 			return refForResource(fullAddress, child);
 		}
 		const localWiring = { ...provisionWiring ?? {} };
-		markUsed(localWiring);
+		markUsed(Object.values(localWiring));
 		const localSecrets = { ...provisionSecrets ?? {} };
-		markSecretsUsed(localSecrets);
-		validateSecretBinding(child, id, localSecrets, moduleNode.name);
+		markSecretsUsed(Object.values(localSecrets));
 		const localParams = { ...provisionParams ?? {} };
-		markParamsUsed(localParams);
+		markParamsUsed(Object.values(localParams));
 		if (child.kind === "service") {
-			for (const slot of Object.keys(child.secretSlots)) {
-				const bound = localSecrets[slot];
-				if (isSecretSource(bound)) secretBindings.push({
+			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a service — a service takes its secrets as envSecret(...) leaves of its \`input\` binding (ADR-0042), not a secrets map.`);
+			if (child.inputSchema !== void 0 && provisionInput === void 0) throw new LoadError(`Input of provisioned service "${id}" is not bound (module "${moduleNode.name}") — the service declares an input schema; bind it with \`input: { … }\` on its provision() call.`);
+			if (child.inputSchema === void 0 && provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding, but the service declares no input schema (module "${moduleNode.name}").`);
+			if (provisionInput !== void 0) {
+				const leaves = [];
+				deepValues(provisionInput, leaves);
+				markSecretsUsed(leaves);
+				markParamsUsed(leaves);
+				inputBindings.push({
 					serviceAddress: fullAddress,
-					slot,
-					source: bound
+					binding: blindCast(provisionInput)
 				});
 			}
 			validateServiceParamBinding(child, id, localParams, moduleNode.name);
@@ -474,6 +496,8 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 			byId.set(fullAddress, child);
 			return refFor(fullAddress, child);
 		}
+		if (provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding for a module — a module has no input schema; bind the input on the service that declares it.`);
+		validateSecretBinding(child, id, localSecrets, moduleNode.name);
 		validateParamNeedBinding(child, id, localParams, moduleNode.name);
 		edges.push(...wiringEdges(localWiring, fullAddress));
 		pending.push({
@@ -483,7 +507,7 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 			targetKind: "module",
 			enclosingModuleName: moduleNode.name
 		});
-		const childOutputs = flatten(child, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, secretBindings, paramBindings, byId);
+		const childOutputs = flatten(child, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, inputBindings, paramBindings, byId);
 		nodes.push({
 			id: fullAddress,
 			node: child
@@ -501,7 +525,7 @@ function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes,
 		provision: blindCast(provision)
 	});
 	const outputs = blindCast(moduleNode.body(ctx) ?? {});
-	markUsed(outputs);
+	markUsed(Object.values(outputs));
 	for (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares input "${key}" but never forwards it into a provision nor returns it as an output.`);
 	for (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares secret "${key}" but never forwards it into a provision.`);
 	for (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares param "${key}" but never forwards it into a provision.`);
@@ -532,10 +556,10 @@ function loadModule(root, opts) {
 	const nodes = [];
 	const edges = [];
 	const pending = [];
-	const secretBindings = [];
+	const inputBindings = [];
 	const paramBindings = [];
 	const byId = /* @__PURE__ */ new Map();
-	flatten(root, void 0, {}, {}, {}, nodes, edges, pending, secretBindings, paramBindings, byId);
+	flatten(root, void 0, {}, {}, {}, nodes, edges, pending, inputBindings, paramBindings, byId);
 	for (const entry of pending) validateWiring(entry, byId);
 	assertDependencyDag(edges);
 	const rootGraphNode = {
@@ -546,7 +570,7 @@ function loadModule(root, opts) {
 		root: rootGraphNode,
 		nodes: [...topoSort(nodes, edges), rootGraphNode],
 		edges,
-		secrets: secretBindings,
+		inputBindings,
 		params: paramBindings
 	};
 }
@@ -594,7 +618,7 @@ function Load(root, opts) {
 	throw new LoadError("Load expects a service or module root (received another node kind).");
 }
 //#endregion
-//#region ../../0-framework/1-core/core/dist/deploy-H3PKi0ZR.mjs
+//#region ../../0-framework/1-core/core/dist/deploy-C4DxNkJ9.mjs
 var LowerError = class extends Error {
 	constructor(message) {
 		super(message);