@prisma/composer 0.5.0 → 0.6.0-dev.10

package/dist/bin.mjs

@@ -1,3280 +1,17 @@
 #!/usr/bin/env node
-import { Cli, Command, Option, UsageError } from "clipanion";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { join, relative, resolve, sep } from "node:path";
-import "alchemy";
-import "effect/Effect";
-import "effect/Layer";
-import * as c12 from "c12";
-import { pathToFileURL } from "node:url";
-import { spawnSync } from "node:child_process";
-import { stat, unwatchFile, watch, watchFile } from "fs";
-import { lstat, open, readdir, realpath, stat as stat$1 } from "fs/promises";
-import { EventEmitter } from "events";
-import * as sysPath from "path";
-import { lstat as lstat$1, readdir as readdir$1, realpath as realpath$1, stat as stat$2 } from "node:fs/promises";
-import { Readable } from "node:stream";
-import { type } from "os";
-//#region ../../0-framework/1-core/core/dist/container-transport-DKmKg5JQ.mjs
-/** '@prisma/composer-prisma-cloud' → 'PRISMA_COMPOSER_CONTAINER_PRISMA_COMPOSER_PRISMA_CLOUD' */
-function containerEnvVarName(extensionId) {
-	return `PRISMA_COMPOSER_CONTAINER_${extensionId.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "")}`;
-}
-function collisionError(a, b, varName) {
-	return /* @__PURE__ */ new Error(`Extension ids "${a}" and "${b}" both mangle to the container transport variable "${varName}" — rename one of the extensions.`);
-}
-function emptySerializeError(extensionId) {
-	return /* @__PURE__ */ new Error(`Extension "${extensionId}"'s container instance serialized to an empty string — ContainerInstance.serialize() must return a non-empty string.`);
-}
-/** The env entries the CLI sets on the alchemy process: `{ [containerEnvVarName(id)]: instance.serialize() }` for every resolved instance. */
-function containerEnv(instances) {
-	const env = {};
-	const ownerByVarName = /* @__PURE__ */ new Map();
-	for (const [extensionId, instance] of instances) {
-		const varName = containerEnvVarName(extensionId);
-		const owner = ownerByVarName.get(varName);
-		if (owner !== void 0) throw collisionError(owner, extensionId, varName);
-		ownerByVarName.set(varName, extensionId);
-		const serialized = instance.serialize();
-		if (serialized.length === 0) throw emptySerializeError(extensionId);
-		env[varName] = serialized;
-	}
-	return env;
-}
-//#endregion
-//#region ../../0-framework/1-core/core/dist/app-config-joXc-BKm.mjs
-/** `<cwd>/.prisma-composer/dev` — the dev instance's app-scoped state directory (ADR-0041, ADR-0004's tool-state rule). "dev" names the user-facing feature/dir (naming, operator 2026-07-23) — this constant's name and value are unchanged by the localTarget rename. */
-const DEV_DIR = ".prisma-composer/dev";
-/**
-* True when an extension only participates in assembly (every `nodes` entry
-* is `kind: 'build'`, and it declares none of `providers`/`application`/
-* `provisions`/`container`) — it owns no resources or services, so it has
-* nothing to emulate and is exempt from local-target-capability requirements
-* (ADR-0041). Shared by `localTargetProviders` and every local-target hook
-* iteration.
-*/
-function isBuildOnlyExtension(extension) {
-	return Object.values(extension.nodes).every((node) => node.kind === "build") && extension.providers === void 0 && extension.application === void 0 && extension.provisions === void 0 && extension.container === void 0;
-}
-//#endregion
-//#region ../../0-framework/0-foundation/foundation/dist/casts-DpaahrlC.mjs
-/**
-* **Last-resort escape hatch for unsafe type assertions. Not a sanctioned tool to reach for.**
-*
-* Before reaching for `blindCast`, **rewrite the surrounding code so the cast becomes
-* unnecessary**: tighten an input type, add a runtime check that narrows via a type
-* predicate, restructure a generic so the compiler can see the relationship you're
-* asserting, or use {@link castAs} when the value already satisfies the target type.
-* Only when no rewrite is feasible does `blindCast` become the right answer — and at
-* that point, the `Reason` literal you supply must articulate the compromise in
-* language a reviewer can evaluate.
-*
-* The reviewer **will** validate the `Reason`. If it doesn't hold up under scrutiny,
-* that is not a signal to soften the reason; it is a signal to go back and solve the
-* underlying type-system problem properly. An unconvincing justification is rework,
-* not a free pass.
-*
-* `blindCast` is the auditable form of `as Foo` / `as unknown as Foo`: it bypasses
-* the compiler's checks (the input type is `unknown`, the output type is whatever the
-* caller asks for), but it forces the unsafety to be named at the call site instead of
-* smuggled in via a bare `as`. The `Reason` type parameter exists only at compile
-* time — it is not present in the emitted JavaScript — but it is grep-able and
-* visible to future readers.
-*
-* @example
-* ```typescript
-* const stringValue = blindCast<
-*   string,
-*   "JSON.parse returns `unknown`; this field is documented to be a string in the API contract"
-* >(parsed[key]);
-* ```
-*
-* @typeParam TargetType - The type the caller is asserting the input has.
-* @typeParam _Reason - A string literal describing why bypassing the type system is necessary here.
-*                     Only meaningful at compile time. The reviewer evaluates whether it justifies the unsafety.
-*/
-function blindCast(input) {
-	return input;
-}
-//#endregion
-//#region ../../0-framework/1-core/core/dist/graph-DgbALPDo.mjs
-/** Thrown by Load when the graph is malformed. */
-var LoadError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "LoadError";
-	}
-};
-/**
-* Core model: node types and the factories that construct them, plain frozen
-* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).
-*/
-const NODE = Symbol.for("prisma:node");
-const SECRET_SOURCE = blindCast(Symbol.for("prisma:secret-source"));
-/** True if `value` is a secret source (an `envSecret` result or a forwarded ctx.secrets ref). */
-function isSecretSource(value) {
-	return typeof value === "object" && value !== null && blindCast(value)[SECRET_SOURCE] === true;
-}
-const PARAM_SOURCE = blindCast(Symbol.for("prisma:param-source"));
-/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */
-function isParamSource(value) {
-	return typeof value === "object" && value !== null && blindCast(value)[PARAM_SOURCE] === true;
-}
-/**
-* Core's grammar for every name that becomes a config-key segment —
-* addresses, input/param/secret names: ASCII letters and digits only.
-* Conservative by design so any target medium — POSIX env-var keys
-* included — can uppercase and "_"-join segments without escaping.
-*/
-function isConfigKeySegment(name) {
-	return /^[A-Za-z0-9]+$/.test(name);
-}
-/**
-* True if `value` was constructed by this module's factories. Checks the
-* brand only, never a prototype — a graph may mix nodes from a different
-* installed copy of core (dual-package hazard).
-*/
-function isNode(value) {
-	return typeof value === "object" && value !== null && value[NODE] === true;
-}
-/**
-* Stable topological sort: every edge's `from` precedes its `to` in the
-* result. Ties (nodes with no ordering constraint between them) keep their
-* relative order from `nodes` — so a graph already authored producer-first
-* comes out byte-identical to its pre-sort layout; only a graph that
-* genuinely needs reordering (e.g. a module wired via a forged ref pointing at a
-* not-yet-provisioned producer) actually moves. A Kahn's-algorithm variant
-* that always picks the ready node with the smallest original index. Edges
-* whose endpoint falls outside `nodes` (e.g. a service-root's input edges
-* targeting the root, which is appended separately) are ignored. Cycles
-* cannot reach here: `assertDependencyDag` already rejects them for
-* dependency edges, and input edges never cycle.
-*/
-function topoSort(nodes, edges) {
-	const byId = new Map(nodes.map((n) => [n.id, n]));
-	const indexOf = new Map(nodes.map((n, i) => [n.id, i]));
-	const indegree = new Map(nodes.map((n) => [n.id, 0]));
-	const successors = /* @__PURE__ */ new Map();
-	for (const edge of edges) {
-		if (!byId.has(edge.from) || !byId.has(edge.to)) continue;
-		const targets = successors.get(edge.from) ?? [];
-		targets.push(edge.to);
-		successors.set(edge.from, targets);
-		indegree.set(edge.to, (indegree.get(edge.to) ?? 0) + 1);
-	}
-	const ready = new Set(nodes.filter((n) => indegree.get(n.id) === 0).map((n) => n.id));
-	const order = [];
-	while (ready.size > 0) {
-		let next;
-		let bestIndex = Number.POSITIVE_INFINITY;
-		for (const id of ready) {
-			const index = indexOf.get(id) ?? Number.POSITIVE_INFINITY;
-			if (index < bestIndex) {
-				bestIndex = index;
-				next = id;
-			}
-		}
-		if (next === void 0) break;
-		ready.delete(next);
-		order.push(next);
-		for (const target of successors.get(next) ?? []) {
-			const remaining = (indegree.get(target) ?? 0) - 1;
-			indegree.set(target, remaining);
-			if (remaining === 0) ready.add(target);
-		}
-	}
-	if (order.length !== nodes.length) throw new LoadError(`topological sort processed ${order.length} of ${nodes.length} nodes — the graph contains a cycle that slipped past the DAG validation.`);
-	return order.map((id) => byId.get(id)).filter((n) => n !== void 0);
-}
-function serviceInputs(service, serviceId) {
-	if (typeof service.inputs !== "object" || service.inputs === null) throw new LoadError(`Service "${serviceId}" has no inputs map.`);
-	const nodes = [];
-	const edges = [];
-	for (const [input, value] of Object.entries(service.inputs)) {
-		const kind = isNode(value) ? value.kind : void 0;
-		if (kind === "resource") throw new LoadError(`Input "${input}" of "${serviceId}" is a resource node — a resource is provisioned by the composing module, never created for a service that mentions it. Declare the input as a dependency (the pack's dependency factory) and wire the module-provisioned resource's ref into it.`);
-		if (kind !== "dependency") throw new LoadError(`Input "${input}" of "${serviceId}" is not a branded dependency end (construct it with the dependency() factory).`);
-		if (value.type.length === 0) throw new LoadError(`Input "${input}" of "${serviceId}" has an empty node type.`);
-		const id = `${serviceId}.${input}`;
-		nodes.push({
-			id,
-			node: value
-		});
-		edges.push({
-			from: id,
-			to: serviceId,
-			input,
-			kind: "input"
-		});
-	}
-	return {
-		nodes,
-		edges
-	};
-}
-function loadService(root, rootId) {
-	for (const [input, value] of Object.entries(root.inputs)) if (isNode(value) && value.kind === "dependency") throw new LoadError(`Service "${rootId}" has an unwired dependency input "${input}" — this service is composed by a module; deploy the module instead of loading "${rootId}" directly.`);
-	if (root.inputSchema !== void 0) throw new LoadError(`Service "${rootId}" declares an input schema but is being loaded directly — a lone service has no enclosing scope to bind its input. Compose it inside a module whose provision() call binds \`input: { … }\` (ADR-0042).`);
-	const rootGraphNode = {
-		id: rootId,
-		node: root
-	};
-	const { nodes, edges } = serviceInputs(root, rootId);
-	return {
-		root: rootGraphNode,
-		nodes: [...topoSort(nodes, edges), rootGraphNode],
-		edges,
-		inputBindings: [],
-		params: []
-	};
-}
-/**
-* Builds the ref a provision() call hands back: the id (so a producer with no
-* exposed ports — or an untyped slot — can still be wired wholesale) plus one
-* ref-port per exposed contract, each the contract's own runtime value (so
-* its `satisfies()` still works) tagged with the provider's id.
-*/
-function refFor(id, service) {
-	const ports = {};
-	for (const [port, contract] of Object.entries(service.expose ?? {})) ports[port] = {
-		...contract,
-		__providerId: id
-	};
-	return blindCast({
-		id,
-		...ports
-	});
-}
-/**
-* The resource variant of refFor: a resource has exactly one port — the
-* contract it provides — flattened onto the ref itself, tagged with the
-* provider id. `id` is written last so a hostile contract value cannot
-* clobber it.
-*/
-function refForResource(id, resource) {
-	return blindCast({
-		...resource.provides,
-		__providerId: id,
-		id
-	});
-}
-/** A wired value's producer id: a ref-port's `__providerId`, or a bare ref's `id`. */
-function producerIdOf(ref) {
-	if (typeof ref !== "object" || ref === null) return void 0;
-	if ("__providerId" in ref && typeof ref.__providerId === "string") return ref.__providerId;
-	if ("id" in ref && typeof ref.id === "string") return ref.id;
-}
-/**
-* Brands each `ctx.inputs` entry with the input key it stands for (see
-* flatten): diagnostic only — usage attribution relies on the per-key object
-* identity the branding copy creates, never on reading this back.
-*/
-const MODULE_INPUT_KEY = Symbol("prisma:module-input-key");
-/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.secrets` forwarding channel. */
-const MODULE_SECRET_KEY = Symbol("prisma:module-secret-key");
-/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.params` forwarding channel. */
-const MODULE_PARAM_KEY = Symbol("prisma:module-param-key");
-/** Whether `ref` carries a callable `satisfies` that accepts `required` truthily. */
-function satisfiesRequired(ref, required) {
-	return typeof ref === "object" && ref !== null && "satisfies" in ref && typeof ref.satisfies === "function" && ref.satisfies(required);
-}
-/**
-* Checks one recorded `wiring` object against the Deps it was wired against:
-* every named input exists and is a dependency slot, every referenced
-* producer is a real (by-now-provisioned) address, and a wired ref whose
-* slot declares a required contract must satisfy() it — no producer-kind
-* branching, the contract alone determines validity, whether the producer is
-* a service port or a resource. Shared by both provisioned kinds so a
-* module-as-child gets exactly the checks a service gets, and run once per
-* entry against the one `byId` shared by the whole recursive flatten, so a
-* forwarded ref resolves through to its real producer address regardless of
-* which ancestor scope provisioned it.
-*/
-function validateWiring(pending, byId) {
-	const { deps, wiring, targetId, targetKind, enclosingModuleName } = pending;
-	for (const [input, ref] of Object.entries(wiring)) {
-		const declared = blindCast(deps[input]);
-		if (declared === void 0 || !isNode(declared) || declared.kind !== "dependency") throw new LoadError(`The deps for "${targetId}" name "${input}", which is not a dependency slot of that ${targetKind}.`);
-		const producerId = producerIdOf(ref);
-		const producer = producerId !== void 0 ? byId.get(producerId) : void 0;
-		if (producerId === void 0 || producer === void 0) throw new LoadError(`The deps for "${targetId}.${input}" reference "${String(producerId)}", which is not provisioned in module "${enclosingModuleName}".`);
-		const required = declared.required;
-		if (required !== void 0 && !satisfiesRequired(ref, required)) throw new LoadError(`The deps for "${targetId}.${input}" do not satisfy the slot's required contract.`);
-	}
-	for (const [input, rawValue] of Object.entries(deps)) {
-		const value = blindCast(rawValue);
-		if (!isNode(value) || wiring[input] !== void 0) continue;
-		if (value.kind === "dependency") throw new LoadError(`Dependency input "${input}" of provisioned ${targetKind} "${targetId}" is not wired to a producer (module "${enclosingModuleName}").`);
-	}
-}
-/**
-* Flattens a value into itself plus every nested object/array member value —
-* identity fodder for the ctx.secrets/ctx.params usage marking, which must
-* see a forwarded source wherever it sits inside an input binding (ADR-0042).
-* A secret/param source is an opaque leaf: it is pushed (a forwarded ref IS
-* such a source, so identity-matching still needs it) but never descended
-* into, so a ref buried in an unrelated source's payload is not falsely seen
-* as used. `seen` guards object cycles so a self-referential binding cannot
-* recurse forever.
-*/
-function deepValues(value, out, seen = /* @__PURE__ */ new WeakSet()) {
-	out.push(value);
-	if (typeof value !== "object" || value === null) return;
-	if (isSecretSource(value) || isParamSource(value)) return;
-	if (seen.has(value)) return;
-	seen.add(value);
-	const members = Array.isArray(value) ? value : Object.values(value);
-	for (const member of members) deepValues(member, out, seen);
-}
-/** The (unvalidated) edges a `wiring` object implies — one dependency edge per entry; `validateWiring` does the real checking. */
-function wiringEdges(wiring, targetId) {
-	return Object.entries(wiring).map(([input, ref]) => ({
-		from: producerIdOf(ref) ?? "",
-		to: targetId,
-		input,
-		kind: "dependency"
-	}));
-}
-/**
-* Checks the secrets wired into one provisioned child MODULE: every declared
-* forwarding slot is bound to a real secret source (an `envSecret` or a
-* forwarded ctx.secrets ref), and no wired key names a slot the module
-* doesn't declare — the secret analog of `validateWiring`'s per-input checks,
-* but resolved inline (a source carries its own name, so no whole-graph pass
-* is needed).
-*/
-function validateSecretBinding(child, id, secretWiring, enclosingModuleName) {
-	const { kind } = child;
-	for (const slot of Object.keys(child.secretSlots)) {
-		const bound = secretWiring[slot];
-		if (bound === void 0) throw new LoadError(`Secret slot "${slot}" of provisioned ${kind} "${id}" is not bound (module "${enclosingModuleName}") — bind it with envSecret('NAME') or forward ctx.secrets.`);
-		if (!isSecretSource(bound)) throw new LoadError(`Secret slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-secret value — use envSecret('NAME') or a forwarded ctx.secrets ref.`);
-	}
-	for (const slot of Object.keys(secretWiring)) if (!Object.hasOwn(child.secretSlots, slot)) throw new LoadError(`The secrets for "${id}" name "${slot}", which is not a secret slot of that ${kind} (module "${enclosingModuleName}").`);
-}
-/**
-* Checks the params wired into a provisioned SERVICE: unlike a secret slot, a
-* declared param is never required to be bound here — it may fall back to its
-* own `default` (checked later, at `buildConfig`) — so this only rejects a
-* wired key that names something other than a real declared param.
-*/
-function validateServiceParamBinding(child, id, paramWiring, enclosingModuleName) {
-	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.params, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param of that service (module "${enclosingModuleName}").`);
-}
-/**
-* Checks the params wired into a provisioned MODULE: every declared
-* param-forwarding slot must be bound to a real `ParamSource` — a slot has no
-* schema of its own, so (unlike a service param) it cannot fall back to a
-* literal or a default; the param analog of `validateSecretBinding`.
-*/
-function validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {
-	for (const slot of Object.keys(child.paramSlots)) {
-		const bound = paramWiring[slot];
-		if (bound === void 0) throw new LoadError(`Param slot "${slot}" of provisioned module "${id}" is not bound (module "${enclosingModuleName}") — bind it with a param source (e.g. envParam('NAME')) or forward ctx.params.`);
-		if (!isParamSource(bound)) throw new LoadError(`Param slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-source value — a module param-forwarding slot carries no schema to validate a literal against; use envParam('NAME') or a forwarded ctx.params ref.`);
-	}
-	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.paramSlots, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param slot of that module (module "${enclosingModuleName}").`);
-}
-/**
-* Recursively flattens one module's body into the shared graph state and
-* returns its resolved ModuleOutputs (one ref-port per expose key) for the
-* caller (the enclosing provision() call, or Load itself for the root) to
-* use. `address` is this module's OWN full address, or `undefined` for the root
-* scope — its direct children then get bare (unprefixed) addresses, keeping
-* a single-level module identical to before nesting existed. `wiring` supplies a
-* resolved producer ref-port for each of this module's OWN declared deps (empty
-* for the root, which may not declare any — see the root non-empty-deps
-* check in loadModule). `nodes`, `edges`, `pending`, and `byId` are shared
-* across the ENTIRE recursive flatten, not per scope — a nested module may
-* forward in a producer provisioned by an ancestor scope, and it is the
-* shared `byId` (keyed by full address) that lets that resolve.
-*/
-function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes, edges, pending, inputBindings, paramBindings, byId) {
-	const localIds = /* @__PURE__ */ new Set();
-	const used = /* @__PURE__ */ new Set();
-	const usedSecrets = /* @__PURE__ */ new Set();
-	const usedParams = /* @__PURE__ */ new Set();
-	const ctxInputs = {};
-	for (const key of Object.keys(moduleNode.deps)) {
-		const wired = wiring[key];
-		ctxInputs[key] = typeof wired === "object" && wired !== null ? {
-			...wired,
-			[MODULE_INPUT_KEY]: key
-		} : wired;
-	}
-	const markUsed = (values) => {
-		for (const value of values) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);
-	};
-	const ctxSecrets = {};
-	for (const key of Object.keys(moduleNode.secretSlots)) {
-		const bound = secretWiring[key];
-		ctxSecrets[key] = typeof bound === "object" && bound !== null ? {
-			...bound,
-			[MODULE_SECRET_KEY]: key
-		} : bound;
-	}
-	const markSecretsUsed = (values) => {
-		for (const value of values) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);
-	};
-	const ctxParams = {};
-	for (const key of Object.keys(moduleNode.paramSlots)) {
-		const bound = paramWiring[key];
-		ctxParams[key] = typeof bound === "object" && bound !== null ? {
-			...bound,
-			[MODULE_PARAM_KEY]: key
-		} : bound;
-	}
-	const markParamsUsed = (values) => {
-		for (const value of values) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);
-	};
-	const provision = (child, opts) => {
-		const id = opts?.id ?? child.name;
-		const provisionWiring = opts?.deps;
-		const provisionSecrets = opts?.secrets;
-		const provisionInput = opts?.input;
-		const provisionParams = opts?.params;
-		if (typeof id !== "string" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module "${moduleNode.name}").`);
-		if (!isConfigKeySegment(id)) throw new LoadError(`provision() id "${id}" (module "${moduleNode.name}") must contain only ASCII letters and digits ([A-Za-z0-9]) — the id becomes an address segment, and addresses derive deterministic config keys (segments uppercased and joined with "_"). "${id}" would put "${id.toUpperCase()}" inside the derived key. ("_" collides with the key separator and "." with the address separator.)`);
-		if (localIds.has(id)) throw new LoadError(`Duplicate provision id "${id}" in module "${moduleNode.name}".`);
-		const untrusted = child;
-		if (!isNode(untrusted) || untrusted.kind !== "service" && untrusted.kind !== "resource" && untrusted.kind !== "module") throw new LoadError(`provision("${id}") expects a branded service, resource, or module node (construct it with the service()/resource()/module() factories or a pack's own).`);
-		localIds.add(id);
-		const fullAddress = address === void 0 ? id : `${address}.${id}`;
-		if (child.kind === "resource") {
-			if (provisionWiring !== void 0) throw new LoadError(`provision("${id}") received deps for a resource — a resource has no dependency slots to satisfy.`);
-			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a resource — a resource has no secret slots to satisfy.`);
-			if (provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding for a resource — a resource declares no input schema.`);
-			if (provisionParams !== void 0) throw new LoadError(`provision("${id}") received params for a resource — a resource has no params to satisfy.`);
-			if (child.type.length === 0) throw new LoadError(`provision("${id}") received a resource with an empty node type.`);
-			byId.set(fullAddress, child);
-			nodes.push({
-				id: fullAddress,
-				node: child
-			});
-			return refForResource(fullAddress, child);
-		}
-		const localWiring = { ...provisionWiring ?? {} };
-		markUsed(Object.values(localWiring));
-		const localSecrets = { ...provisionSecrets ?? {} };
-		markSecretsUsed(Object.values(localSecrets));
-		const localParams = { ...provisionParams ?? {} };
-		markParamsUsed(Object.values(localParams));
-		if (child.kind === "service") {
-			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a service — a service takes its secrets as envSecret(...) leaves of its \`input\` binding (ADR-0042), not a secrets map.`);
-			if (child.inputSchema !== void 0 && provisionInput === void 0) throw new LoadError(`Input of provisioned service "${id}" is not bound (module "${moduleNode.name}") — the service declares an input schema; bind it with \`input: { … }\` on its provision() call.`);
-			if (child.inputSchema === void 0 && provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding, but the service declares no input schema (module "${moduleNode.name}").`);
-			if (provisionInput !== void 0) {
-				const leaves = [];
-				deepValues(provisionInput, leaves);
-				markSecretsUsed(leaves);
-				markParamsUsed(leaves);
-				inputBindings.push({
-					serviceAddress: fullAddress,
-					binding: blindCast(provisionInput)
-				});
-			}
-			validateServiceParamBinding(child, id, localParams, moduleNode.name);
-			for (const [slot, binding] of Object.entries(localParams)) paramBindings.push({
-				serviceAddress: fullAddress,
-				slot,
-				binding
-			});
-			const inputs = serviceInputs(child, fullAddress);
-			nodes.push(...inputs.nodes, {
-				id: fullAddress,
-				node: child
-			});
-			edges.push(...inputs.edges, ...wiringEdges(localWiring, fullAddress));
-			pending.push({
-				deps: child.inputs,
-				wiring: localWiring,
-				targetId: fullAddress,
-				targetKind: "service",
-				enclosingModuleName: moduleNode.name
-			});
-			byId.set(fullAddress, child);
-			return refFor(fullAddress, child);
-		}
-		if (provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding for a module — a module has no input schema; bind the input on the service that declares it.`);
-		validateSecretBinding(child, id, localSecrets, moduleNode.name);
-		validateParamNeedBinding(child, id, localParams, moduleNode.name);
-		edges.push(...wiringEdges(localWiring, fullAddress));
-		pending.push({
-			deps: child.deps,
-			wiring: localWiring,
-			targetId: fullAddress,
-			targetKind: "module",
-			enclosingModuleName: moduleNode.name
-		});
-		const childOutputs = flatten(child, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, inputBindings, paramBindings, byId);
-		nodes.push({
-			id: fullAddress,
-			node: child
-		});
-		byId.set(fullAddress, child);
-		return blindCast({
-			id: fullAddress,
-			...childOutputs
-		});
-	};
-	const ctx = blindCast({
-		inputs: ctxInputs,
-		secrets: ctxSecrets,
-		params: ctxParams,
-		provision: blindCast(provision)
-	});
-	const outputs = blindCast(moduleNode.body(ctx) ?? {});
-	markUsed(Object.values(outputs));
-	for (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares input "${key}" but never forwards it into a provision nor returns it as an output.`);
-	for (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares secret "${key}" but never forwards it into a provision.`);
-	for (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares param "${key}" but never forwards it into a provision.`);
-	for (const [key, contract] of Object.entries(moduleNode.expose)) {
-		const port = outputs[key];
-		if (port === void 0) throw new LoadError(`Module "${moduleNode.name}" declares expose "${key}" but its body did not return a port for it.`);
-		if (!satisfiesRequired(port, contract)) throw new LoadError(`Module "${moduleNode.name}"'s returned port for expose "${key}" does not satisfy its declared contract.`);
-	}
-	return outputs;
-}
-function loadModule(root, opts) {
-	const rootId = opts?.id ?? root.name;
-	const rootDepKeys = Object.keys(root.deps);
-	if (rootDepKeys.length > 0) {
-		const names = rootDepKeys.map((k) => `"${k}"`).join(", ");
-		throw new LoadError(`Module "${root.name}" declares input${rootDepKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to wire them; compose "${root.name}" from another module that provisions and wires it instead.`);
-	}
-	const rootSecretKeys = Object.keys(root.secretSlots);
-	if (rootSecretKeys.length > 0) {
-		const names = rootSecretKeys.map((k) => `"${k}"`).join(", ");
-		throw new LoadError(`Module "${root.name}" declares secret${rootSecretKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds secrets with envSecret('NAME'), it does not declare secret slots of its own.`);
-	}
-	const rootParamKeys = Object.keys(root.paramSlots);
-	if (rootParamKeys.length > 0) {
-		const names = rootParamKeys.map((k) => `"${k}"`).join(", ");
-		throw new LoadError(`Module "${root.name}" declares param${rootParamKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds params directly on each provision() call, it does not declare param-forwarding slots of its own.`);
-	}
-	const nodes = [];
-	const edges = [];
-	const pending = [];
-	const inputBindings = [];
-	const paramBindings = [];
-	const byId = /* @__PURE__ */ new Map();
-	flatten(root, void 0, {}, {}, {}, nodes, edges, pending, inputBindings, paramBindings, byId);
-	for (const entry of pending) validateWiring(entry, byId);
-	assertDependencyDag(edges);
-	const rootGraphNode = {
-		id: rootId,
-		node: root
-	};
-	return {
-		root: rootGraphNode,
-		nodes: [...topoSort(nodes, edges), rootGraphNode],
-		edges,
-		inputBindings,
-		params: paramBindings
-	};
-}
-/**
-* The dependency edges must form a DAG — a cycle means neither producer can
-* deploy first. Resources take no wiring, so only service/module-to-service/module
-* edges can ever participate in a cycle; no special-casing needed.
-*/
-function assertDependencyDag(edges) {
-	const adjacency = /* @__PURE__ */ new Map();
-	for (const edge of edges) {
-		if (edge.kind !== "dependency") continue;
-		const targets = adjacency.get(edge.from) ?? [];
-		targets.push(edge.to);
-		adjacency.set(edge.from, targets);
-	}
-	const visiting = /* @__PURE__ */ new Set();
-	const done = /* @__PURE__ */ new Set();
-	const stack = [];
-	const visit = (id) => {
-		if (done.has(id)) return;
-		if (visiting.has(id)) throw new LoadError(`Dependency cycle: ${[...stack.slice(stack.indexOf(id)), id].join(" → ")} — no deploy order exists.`);
-		visiting.add(id);
-		stack.push(id);
-		for (const next of adjacency.get(id) ?? []) visit(next);
-		stack.pop();
-		visiting.delete(id);
-		done.add(id);
-	};
-	for (const id of adjacency.keys()) visit(id);
-}
-/**
-* Builds the in-memory graph from a root node. A service root walks its own
-* `inputs`; a module root executes its body (wiring, not user code — the
-* designed exception to imports-run-nothing) and recursively flattens every
-* module it provisions into one graph of hierarchical addresses. A malformed
-* graph is a `LoadError` that names its fix; the individual validation rules
-* live with `loadService` / `loadModule` and are covered by name in the Load
-* tests. Executes nothing of the user's own code beyond module bodies.
-*/
-function Load(root, opts) {
-	if (!isNode(root)) throw new LoadError("Load expects a branded service or module node (construct it with the service()/module() factories).");
-	if (root.kind === "module") return loadModule(root, opts);
-	if (root.kind === "service") return loadService(root, opts?.id ?? "root");
-	throw new LoadError("Load expects a service or module root (received another node kind).");
-}
-//#endregion
-//#region ../../0-framework/1-core/core/dist/deploy-C4DxNkJ9.mjs
-var LowerError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "LowerError";
-	}
-};
-//#endregion
-//#region ../../0-framework/1-core/core/dist/local-target.mjs
-/** The local-target stack's own provider aggregation (ADR-0041; naming, operator 2026-07-23 — the seam is `localTarget`, "dev" names the user-facing feature only) — the local-target counterpart of `deploy.ts`'s `mergedProviders`, kept in its own module so `lower()` learns nothing about it (deploy.ts's REVISED — operator review of #162). */
-function noLocalTargetSupportError(id) {
-	return new LowerError(`extension "${id}" has no dev support — it declares no \`localTarget\` descriptor (ADR-0041).`);
-}
-/**
-* Resolves every non-build-only configured extension's lazy `localTarget`
-* thunk, once (ADR-0041's lazy local-target reference — operator directive:
-* the production control entry carries only the thunk, never the
-* descriptor, so resolving it is this module's job, not something a deploy
-* path ever does). A build-only extension (`isBuildOnlyExtension`) owns no
-* resources or services and is skipped entirely — never even checked for a
-* `localTarget` thunk. Every other configured extension must be
-* local-target-capable, or the dev command cannot bring the app up at all,
-* so a missing thunk throws naming the extension. The generated dev stack
-* module calls this once and threads the resolved map through every
-* subsequent hook, including `localTargetProviders`.
-*/
-async function resolveLocalTargets(config) {
-	const entries = await Promise.all(config.extensions.flatMap((extension) => {
-		if (isBuildOnlyExtension(extension)) return [];
-		if (extension.localTarget === void 0) throw noLocalTargetSupportError(extension.id);
-		return [extension.localTarget().then((descriptor) => [extension.id, descriptor])];
-	}));
-	return new Map(entries);
-}
-//#endregion
-//#region ../../0-framework/3-tooling/assemble/dist/index.mjs
-/**
-* A user-facing assembly failure with a message that already names the fix
-* (mirrors @internal/cli's CliError contract). This package must not import
-* CliError — its second consumer is the future programmatic deploy API, not
-* just the CLI — so it throws its own typed error; the CLI maps it (or lets
-* it propagate, since bin.ts already treats every Error uniformly: print the
-* message, exit nonzero).
-*/
-var AssembleError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "AssembleError";
-	}
-};
-/**
-* The registry route for one service's build: extension by
-* `build.extension`, node descriptor by `build.type`, kind must be "build".
-* The CLI's coverage validation reports the same misses earlier with the
-* config fix; these errors are the backstop for programmatic callers.
-*/
-function buildDescriptorAssemble(config, node, address, cwd) {
-	const { extension, type } = node.build;
-	const extensionDescriptor = config.extensions.find((candidate) => candidate.id === extension);
-	if (extensionDescriptor === void 0) throw new AssembleError(`No extension "${extension}" is configured (needed by service "${node.name}"'s build) — add it to prisma-composer.config.ts's \`extensions\`.`);
-	const nodeDescriptor = extensionDescriptor.nodes[type];
-	if (nodeDescriptor === void 0) throw new AssembleError(`Extension "${extension}" has no descriptor for build type "${type}" (known: ${Object.keys(extensionDescriptor.nodes).join(", ")}).`);
-	if (nodeDescriptor.kind !== "build") throw new AssembleError(`Extension "${extension}"'s descriptor for type "${type}" is a "${nodeDescriptor.kind}" descriptor — assembling a service build needs a "build" descriptor.`);
-	return nodeDescriptor.assemble({
-		build: node.build,
-		address,
-		cwd
-	});
-}
-async function assembleServices(graph, config, cwd, run) {
-	const runAssembler = run ?? ((node, address, nodeCwd) => buildDescriptorAssemble(config, node, address, nodeCwd));
-	const serviceNodes = graph.nodes.filter((n) => n.node.kind === "service");
-	if (serviceNodes.length === 0) throw new AssembleError("The loaded graph has no service to assemble.");
-	const bundles = {};
-	for (const { id, node } of serviceNodes) bundles[id] = await runAssembler(node, id, cwd);
-	return { bundles };
-}
-//#endregion
-//#region ../../0-framework/3-tooling/cli/node_modules/readdirp/esm/index.js
-const EntryTypes = {
-	FILE_TYPE: "files",
-	DIR_TYPE: "directories",
-	FILE_DIR_TYPE: "files_directories",
-	EVERYTHING_TYPE: "all"
-};
-const defaultOptions = {
-	root: ".",
-	fileFilter: (_entryInfo) => true,
-	directoryFilter: (_entryInfo) => true,
-	type: EntryTypes.FILE_TYPE,
-	lstat: false,
-	depth: 2147483648,
-	alwaysStat: false,
-	highWaterMark: 4096
-};
-Object.freeze(defaultOptions);
-const RECURSIVE_ERROR_CODE = "READDIRP_RECURSIVE_ERROR";
-const NORMAL_FLOW_ERRORS = /* @__PURE__ */ new Set([
-	"ENOENT",
-	"EPERM",
-	"EACCES",
-	"ELOOP",
-	RECURSIVE_ERROR_CODE
-]);
-const ALL_TYPES = [
-	EntryTypes.DIR_TYPE,
-	EntryTypes.EVERYTHING_TYPE,
-	EntryTypes.FILE_DIR_TYPE,
-	EntryTypes.FILE_TYPE
-];
-const DIR_TYPES = /* @__PURE__ */ new Set([
-	EntryTypes.DIR_TYPE,
-	EntryTypes.EVERYTHING_TYPE,
-	EntryTypes.FILE_DIR_TYPE
-]);
-const FILE_TYPES = /* @__PURE__ */ new Set([
-	EntryTypes.EVERYTHING_TYPE,
-	EntryTypes.FILE_DIR_TYPE,
-	EntryTypes.FILE_TYPE
-]);
-const isNormalFlowError = (error) => NORMAL_FLOW_ERRORS.has(error.code);
-const wantBigintFsStats = process.platform === "win32";
-const emptyFn = (_entryInfo) => true;
-const normalizeFilter = (filter) => {
-	if (filter === void 0) return emptyFn;
-	if (typeof filter === "function") return filter;
-	if (typeof filter === "string") {
-		const fl = filter.trim();
-		return (entry) => entry.basename === fl;
-	}
-	if (Array.isArray(filter)) {
-		const trItems = filter.map((item) => item.trim());
-		return (entry) => trItems.some((f) => entry.basename === f);
-	}
-	return emptyFn;
-};
-/** Readable readdir stream, emitting new files as they're being listed. */
-var ReaddirpStream = class extends Readable {
-	constructor(options = {}) {
-		super({
-			objectMode: true,
-			autoDestroy: true,
-			highWaterMark: options.highWaterMark
-		});
-		const opts = {
-			...defaultOptions,
-			...options
-		};
-		const { root, type } = opts;
-		this._fileFilter = normalizeFilter(opts.fileFilter);
-		this._directoryFilter = normalizeFilter(opts.directoryFilter);
-		const statMethod = opts.lstat ? lstat$1 : stat$2;
-		if (wantBigintFsStats) this._stat = (path) => statMethod(path, { bigint: true });
-		else this._stat = statMethod;
-		this._maxDepth = opts.depth ?? defaultOptions.depth;
-		this._wantsDir = type ? DIR_TYPES.has(type) : false;
-		this._wantsFile = type ? FILE_TYPES.has(type) : false;
-		this._wantsEverything = type === EntryTypes.EVERYTHING_TYPE;
-		this._root = resolve(root);
-		this._isDirent = !opts.alwaysStat;
-		this._statsProp = this._isDirent ? "dirent" : "stats";
-		this._rdOptions = {
-			encoding: "utf8",
-			withFileTypes: this._isDirent
-		};
-		this.parents = [this._exploreDir(root, 1)];
-		this.reading = false;
-		this.parent = void 0;
-	}
-	async _read(batch) {
-		if (this.reading) return;
-		this.reading = true;
-		try {
-			while (!this.destroyed && batch > 0) {
-				const par = this.parent;
-				const fil = par && par.files;
-				if (fil && fil.length > 0) {
-					const { path, depth } = par;
-					const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path));
-					const awaited = await Promise.all(slice);
-					for (const entry of awaited) {
-						if (!entry) continue;
-						if (this.destroyed) return;
-						const entryType = await this._getEntryType(entry);
-						if (entryType === "directory" && this._directoryFilter(entry)) {
-							if (depth <= this._maxDepth) this.parents.push(this._exploreDir(entry.fullPath, depth + 1));
-							if (this._wantsDir) {
-								this.push(entry);
-								batch--;
-							}
-						} else if ((entryType === "file" || this._includeAsFile(entry)) && this._fileFilter(entry)) {
-							if (this._wantsFile) {
-								this.push(entry);
-								batch--;
-							}
-						}
-					}
-				} else {
-					const parent = this.parents.pop();
-					if (!parent) {
-						this.push(null);
-						break;
-					}
-					this.parent = await parent;
-					if (this.destroyed) return;
-				}
-			}
-		} catch (error) {
-			this.destroy(error);
-		} finally {
-			this.reading = false;
-		}
-	}
-	async _exploreDir(path, depth) {
-		let files;
-		try {
-			files = await readdir$1(path, this._rdOptions);
-		} catch (error) {
-			this._onError(error);
-		}
-		return {
-			files,
-			depth,
-			path
-		};
-	}
-	async _formatEntry(dirent, path) {
-		let entry;
-		const basename = this._isDirent ? dirent.name : dirent;
-		try {
-			const fullPath = resolve(join(path, basename));
-			entry = {
-				path: relative(this._root, fullPath),
-				fullPath,
-				basename
-			};
-			entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
-		} catch (err) {
-			this._onError(err);
-			return;
-		}
-		return entry;
-	}
-	_onError(err) {
-		if (isNormalFlowError(err) && !this.destroyed) this.emit("warn", err);
-		else this.destroy(err);
-	}
-	async _getEntryType(entry) {
-		if (!entry && this._statsProp in entry) return "";
-		const stats = entry[this._statsProp];
-		if (stats.isFile()) return "file";
-		if (stats.isDirectory()) return "directory";
-		if (stats && stats.isSymbolicLink()) {
-			const full = entry.fullPath;
-			try {
-				const entryRealPath = await realpath$1(full);
-				const entryRealPathStats = await lstat$1(entryRealPath);
-				if (entryRealPathStats.isFile()) return "file";
-				if (entryRealPathStats.isDirectory()) {
-					const len = entryRealPath.length;
-					if (full.startsWith(entryRealPath) && full.substr(len, 1) === sep) {
-						const recursiveError = /* @__PURE__ */ new Error(`Circular symlink detected: "${full}" points to "${entryRealPath}"`);
-						recursiveError.code = RECURSIVE_ERROR_CODE;
-						return this._onError(recursiveError);
-					}
-					return "directory";
-				}
-			} catch (error) {
-				this._onError(error);
-				return "";
-			}
-		}
-	}
-	_includeAsFile(entry) {
-		const stats = entry && entry[this._statsProp];
-		return stats && this._wantsEverything && !stats.isDirectory();
-	}
-};
-/**
-* Streaming version: Reads all files and directories in given root recursively.
-* Consumes ~constant small amount of RAM.
-* @param root Root directory
-* @param options Options to specify root (start directory), filters and recursion depth
-*/
-function readdirp(root, options = {}) {
-	let type = options.entryType || options.type;
-	if (type === "both") type = EntryTypes.FILE_DIR_TYPE;
-	if (type) options.type = type;
-	if (!root) throw new Error("readdirp: root argument is required. Usage: readdirp(root, options)");
-	else if (typeof root !== "string") throw new TypeError("readdirp: root argument must be a string. Usage: readdirp(root, options)");
-	else if (type && !ALL_TYPES.includes(type)) throw new Error(`readdirp: Invalid type passed. Use one of ${ALL_TYPES.join(", ")}`);
-	options.root = root;
-	return new ReaddirpStream(options);
-}
-//#endregion
-//#region ../../0-framework/3-tooling/cli/node_modules/chokidar/esm/handler.js
-const STR_DATA = "data";
-const STR_CLOSE = "close";
-const EMPTY_FN = () => {};
-const pl = process.platform;
-const isWindows = pl === "win32";
-const isMacos = pl === "darwin";
-const isLinux = pl === "linux";
-const isFreeBSD = pl === "freebsd";
-const isIBMi = type() === "OS400";
-const EVENTS = {
-	ALL: "all",
-	READY: "ready",
-	ADD: "add",
-	CHANGE: "change",
-	ADD_DIR: "addDir",
-	UNLINK: "unlink",
-	UNLINK_DIR: "unlinkDir",
-	RAW: "raw",
-	ERROR: "error"
-};
-const EV = EVENTS;
-const THROTTLE_MODE_WATCH = "watch";
-const statMethods = {
-	lstat,
-	stat: stat$1
-};
-const KEY_LISTENERS = "listeners";
-const KEY_ERR = "errHandlers";
-const KEY_RAW = "rawEmitters";
-const HANDLER_KEYS = [
-	KEY_LISTENERS,
-	KEY_ERR,
-	KEY_RAW
-];
-const binaryExtensions = /* @__PURE__ */ new Set([
-	"3dm",
-	"3ds",
-	"3g2",
-	"3gp",
-	"7z",
-	"a",
-	"aac",
-	"adp",
-	"afdesign",
-	"afphoto",
-	"afpub",
-	"ai",
-	"aif",
-	"aiff",
-	"alz",
-	"ape",
-	"apk",
-	"appimage",
-	"ar",
-	"arj",
-	"asf",
-	"au",
-	"avi",
-	"bak",
-	"baml",
-	"bh",
-	"bin",
-	"bk",
-	"bmp",
-	"btif",
-	"bz2",
-	"bzip2",
-	"cab",
-	"caf",
-	"cgm",
-	"class",
-	"cmx",
-	"cpio",
-	"cr2",
-	"cur",
-	"dat",
-	"dcm",
-	"deb",
-	"dex",
-	"djvu",
-	"dll",
-	"dmg",
-	"dng",
-	"doc",
-	"docm",
-	"docx",
-	"dot",
-	"dotm",
-	"dra",
-	"DS_Store",
-	"dsk",
-	"dts",
-	"dtshd",
-	"dvb",
-	"dwg",
-	"dxf",
-	"ecelp4800",
-	"ecelp7470",
-	"ecelp9600",
-	"egg",
-	"eol",
-	"eot",
-	"epub",
-	"exe",
-	"f4v",
-	"fbs",
-	"fh",
-	"fla",
-	"flac",
-	"flatpak",
-	"fli",
-	"flv",
-	"fpx",
-	"fst",
-	"fvt",
-	"g3",
-	"gh",
-	"gif",
-	"graffle",
-	"gz",
-	"gzip",
-	"h261",
-	"h263",
-	"h264",
-	"icns",
-	"ico",
-	"ief",
-	"img",
-	"ipa",
-	"iso",
-	"jar",
-	"jpeg",
-	"jpg",
-	"jpgv",
-	"jpm",
-	"jxr",
-	"key",
-	"ktx",
-	"lha",
-	"lib",
-	"lvp",
-	"lz",
-	"lzh",
-	"lzma",
-	"lzo",
-	"m3u",
-	"m4a",
-	"m4v",
-	"mar",
-	"mdi",
-	"mht",
-	"mid",
-	"midi",
-	"mj2",
-	"mka",
-	"mkv",
-	"mmr",
-	"mng",
-	"mobi",
-	"mov",
-	"movie",
-	"mp3",
-	"mp4",
-	"mp4a",
-	"mpeg",
-	"mpg",
-	"mpga",
-	"mxu",
-	"nef",
-	"npx",
-	"numbers",
-	"nupkg",
-	"o",
-	"odp",
-	"ods",
-	"odt",
-	"oga",
-	"ogg",
-	"ogv",
-	"otf",
-	"ott",
-	"pages",
-	"pbm",
-	"pcx",
-	"pdb",
-	"pdf",
-	"pea",
-	"pgm",
-	"pic",
-	"png",
-	"pnm",
-	"pot",
-	"potm",
-	"potx",
-	"ppa",
-	"ppam",
-	"ppm",
-	"pps",
-	"ppsm",
-	"ppsx",
-	"ppt",
-	"pptm",
-	"pptx",
-	"psd",
-	"pya",
-	"pyc",
-	"pyo",
-	"pyv",
-	"qt",
-	"rar",
-	"ras",
-	"raw",
-	"resources",
-	"rgb",
-	"rip",
-	"rlc",
-	"rmf",
-	"rmvb",
-	"rpm",
-	"rtf",
-	"rz",
-	"s3m",
-	"s7z",
-	"scpt",
-	"sgi",
-	"shar",
-	"snap",
-	"sil",
-	"sketch",
-	"slk",
-	"smv",
-	"snk",
-	"so",
-	"stl",
-	"suo",
-	"sub",
-	"swf",
-	"tar",
-	"tbz",
-	"tbz2",
-	"tga",
-	"tgz",
-	"thmx",
-	"tif",
-	"tiff",
-	"tlz",
-	"ttc",
-	"ttf",
-	"txz",
-	"udf",
-	"uvh",
-	"uvi",
-	"uvm",
-	"uvp",
-	"uvs",
-	"uvu",
-	"viv",
-	"vob",
-	"war",
-	"wav",
-	"wax",
-	"wbmp",
-	"wdp",
-	"weba",
-	"webm",
-	"webp",
-	"whl",
-	"wim",
-	"wm",
-	"wma",
-	"wmv",
-	"wmx",
-	"woff",
-	"woff2",
-	"wrm",
-	"wvx",
-	"xbm",
-	"xif",
-	"xla",
-	"xlam",
-	"xls",
-	"xlsb",
-	"xlsm",
-	"xlsx",
-	"xlt",
-	"xltm",
-	"xltx",
-	"xm",
-	"xmind",
-	"xpi",
-	"xpm",
-	"xwd",
-	"xz",
-	"z",
-	"zip",
-	"zipx"
-]);
-const isBinaryPath = (filePath) => binaryExtensions.has(sysPath.extname(filePath).slice(1).toLowerCase());
-const foreach = (val, fn) => {
-	if (val instanceof Set) val.forEach(fn);
-	else fn(val);
-};
-const addAndConvert = (main, prop, item) => {
-	let container = main[prop];
-	if (!(container instanceof Set)) main[prop] = container = /* @__PURE__ */ new Set([container]);
-	container.add(item);
-};
-const clearItem = (cont) => (key) => {
-	const set = cont[key];
-	if (set instanceof Set) set.clear();
-	else delete cont[key];
-};
-const delFromSet = (main, prop, item) => {
-	const container = main[prop];
-	if (container instanceof Set) container.delete(item);
-	else if (container === item) delete main[prop];
-};
-const isEmptySet = (val) => val instanceof Set ? val.size === 0 : !val;
-const FsWatchInstances = /* @__PURE__ */ new Map();
-/**
-* Instantiates the fs_watch interface
-* @param path to be watched
-* @param options to be passed to fs_watch
-* @param listener main event handler
-* @param errHandler emits info about errors
-* @param emitRaw emits raw event data
-* @returns {NativeFsWatcher}
-*/
-function createFsWatchInstance(path, options, listener, errHandler, emitRaw) {
-	const handleEvent = (rawEvent, evPath) => {
-		listener(path);
-		emitRaw(rawEvent, evPath, { watchedPath: path });
-		if (evPath && path !== evPath) fsWatchBroadcast(sysPath.resolve(path, evPath), KEY_LISTENERS, sysPath.join(path, evPath));
-	};
-	try {
-		return watch(path, { persistent: options.persistent }, handleEvent);
-	} catch (error) {
-		errHandler(error);
-		return;
-	}
-}
-/**
-* Helper for passing fs_watch event data to a collection of listeners
-* @param fullPath absolute path bound to fs_watch instance
-*/
-const fsWatchBroadcast = (fullPath, listenerType, val1, val2, val3) => {
-	const cont = FsWatchInstances.get(fullPath);
-	if (!cont) return;
-	foreach(cont[listenerType], (listener) => {
-		listener(val1, val2, val3);
-	});
-};
-/**
-* Instantiates the fs_watch interface or binds listeners
-* to an existing one covering the same file system entry
-* @param path
-* @param fullPath absolute path
-* @param options to be passed to fs_watch
-* @param handlers container for event listener functions
-*/
-const setFsWatchListener = (path, fullPath, options, handlers) => {
-	const { listener, errHandler, rawEmitter } = handlers;
-	let cont = FsWatchInstances.get(fullPath);
-	let watcher;
-	if (!options.persistent) {
-		watcher = createFsWatchInstance(path, options, listener, errHandler, rawEmitter);
-		if (!watcher) return;
-		return watcher.close.bind(watcher);
-	}
-	if (cont) {
-		addAndConvert(cont, KEY_LISTENERS, listener);
-		addAndConvert(cont, KEY_ERR, errHandler);
-		addAndConvert(cont, KEY_RAW, rawEmitter);
-	} else {
-		watcher = createFsWatchInstance(path, options, fsWatchBroadcast.bind(null, fullPath, KEY_LISTENERS), errHandler, fsWatchBroadcast.bind(null, fullPath, KEY_RAW));
-		if (!watcher) return;
-		watcher.on(EV.ERROR, async (error) => {
-			const broadcastErr = fsWatchBroadcast.bind(null, fullPath, KEY_ERR);
-			if (cont) cont.watcherUnusable = true;
-			if (isWindows && error.code === "EPERM") try {
-				await (await open(path, "r")).close();
-				broadcastErr(error);
-			} catch (err) {}
-			else broadcastErr(error);
-		});
-		cont = {
-			listeners: listener,
-			errHandlers: errHandler,
-			rawEmitters: rawEmitter,
-			watcher
-		};
-		FsWatchInstances.set(fullPath, cont);
-	}
-	return () => {
-		delFromSet(cont, KEY_LISTENERS, listener);
-		delFromSet(cont, KEY_ERR, errHandler);
-		delFromSet(cont, KEY_RAW, rawEmitter);
-		if (isEmptySet(cont.listeners)) {
-			cont.watcher.close();
-			FsWatchInstances.delete(fullPath);
-			HANDLER_KEYS.forEach(clearItem(cont));
-			cont.watcher = void 0;
-			Object.freeze(cont);
-		}
-	};
-};
-const FsWatchFileInstances = /* @__PURE__ */ new Map();
-/**
-* Instantiates the fs_watchFile interface or binds listeners
-* to an existing one covering the same file system entry
-* @param path to be watched
-* @param fullPath absolute path
-* @param options options to be passed to fs_watchFile
-* @param handlers container for event listener functions
-* @returns closer
-*/
-const setFsWatchFileListener = (path, fullPath, options, handlers) => {
-	const { listener, rawEmitter } = handlers;
-	let cont = FsWatchFileInstances.get(fullPath);
-	const copts = cont && cont.options;
-	if (copts && (copts.persistent < options.persistent || copts.interval > options.interval)) {
-		unwatchFile(fullPath);
-		cont = void 0;
-	}
-	if (cont) {
-		addAndConvert(cont, KEY_LISTENERS, listener);
-		addAndConvert(cont, KEY_RAW, rawEmitter);
-	} else {
-		cont = {
-			listeners: listener,
-			rawEmitters: rawEmitter,
-			options,
-			watcher: watchFile(fullPath, options, (curr, prev) => {
-				foreach(cont.rawEmitters, (rawEmitter) => {
-					rawEmitter(EV.CHANGE, fullPath, {
-						curr,
-						prev
-					});
-				});
-				const currmtime = curr.mtimeMs;
-				if (curr.size !== prev.size || currmtime > prev.mtimeMs || currmtime === 0) foreach(cont.listeners, (listener) => listener(path, curr));
-			})
-		};
-		FsWatchFileInstances.set(fullPath, cont);
-	}
-	return () => {
-		delFromSet(cont, KEY_LISTENERS, listener);
-		delFromSet(cont, KEY_RAW, rawEmitter);
-		if (isEmptySet(cont.listeners)) {
-			FsWatchFileInstances.delete(fullPath);
-			unwatchFile(fullPath);
-			cont.options = cont.watcher = void 0;
-			Object.freeze(cont);
-		}
-	};
-};
-/**
-* @mixin
-*/
-var NodeFsHandler = class {
-	constructor(fsW) {
-		this.fsw = fsW;
-		this._boundHandleError = (error) => fsW._handleError(error);
-	}
-	/**
-	* Watch file for changes with fs_watchFile or fs_watch.
-	* @param path to file or dir
-	* @param listener on fs change
-	* @returns closer for the watcher instance
-	*/
-	_watchWithNodeFs(path, listener) {
-		const opts = this.fsw.options;
-		const directory = sysPath.dirname(path);
-		const basename = sysPath.basename(path);
-		this.fsw._getWatchedDir(directory).add(basename);
-		const absolutePath = sysPath.resolve(path);
-		const options = { persistent: opts.persistent };
-		if (!listener) listener = EMPTY_FN;
-		let closer;
-		if (opts.usePolling) {
-			options.interval = opts.interval !== opts.binaryInterval && isBinaryPath(basename) ? opts.binaryInterval : opts.interval;
-			closer = setFsWatchFileListener(path, absolutePath, options, {
-				listener,
-				rawEmitter: this.fsw._emitRaw
-			});
-		} else closer = setFsWatchListener(path, absolutePath, options, {
-			listener,
-			errHandler: this._boundHandleError,
-			rawEmitter: this.fsw._emitRaw
-		});
-		return closer;
-	}
-	/**
-	* Watch a file and emit add event if warranted.
-	* @returns closer for the watcher instance
-	*/
-	_handleFile(file, stats, initialAdd) {
-		if (this.fsw.closed) return;
-		const dirname = sysPath.dirname(file);
-		const basename = sysPath.basename(file);
-		const parent = this.fsw._getWatchedDir(dirname);
-		let prevStats = stats;
-		if (parent.has(basename)) return;
-		const listener = async (path, newStats) => {
-			if (!this.fsw._throttle(THROTTLE_MODE_WATCH, file, 5)) return;
-			if (!newStats || newStats.mtimeMs === 0) try {
-				const newStats = await stat$1(file);
-				if (this.fsw.closed) return;
-				const at = newStats.atimeMs;
-				const mt = newStats.mtimeMs;
-				if (!at || at <= mt || mt !== prevStats.mtimeMs) this.fsw._emit(EV.CHANGE, file, newStats);
-				if ((isMacos || isLinux || isFreeBSD) && prevStats.ino !== newStats.ino) {
-					this.fsw._closeFile(path);
-					prevStats = newStats;
-					const closer = this._watchWithNodeFs(file, listener);
-					if (closer) this.fsw._addPathCloser(path, closer);
-				} else prevStats = newStats;
-			} catch (error) {
-				this.fsw._remove(dirname, basename);
-			}
-			else if (parent.has(basename)) {
-				const at = newStats.atimeMs;
-				const mt = newStats.mtimeMs;
-				if (!at || at <= mt || mt !== prevStats.mtimeMs) this.fsw._emit(EV.CHANGE, file, newStats);
-				prevStats = newStats;
-			}
-		};
-		const closer = this._watchWithNodeFs(file, listener);
-		if (!(initialAdd && this.fsw.options.ignoreInitial) && this.fsw._isntIgnored(file)) {
-			if (!this.fsw._throttle(EV.ADD, file, 0)) return;
-			this.fsw._emit(EV.ADD, file, stats);
-		}
-		return closer;
-	}
-	/**
-	* Handle symlinks encountered while reading a dir.
-	* @param entry returned by readdirp
-	* @param directory path of dir being read
-	* @param path of this item
-	* @param item basename of this item
-	* @returns true if no more processing is needed for this entry.
-	*/
-	async _handleSymlink(entry, directory, path, item) {
-		if (this.fsw.closed) return;
-		const full = entry.fullPath;
-		const dir = this.fsw._getWatchedDir(directory);
-		if (!this.fsw.options.followSymlinks) {
-			this.fsw._incrReadyCount();
-			let linkPath;
-			try {
-				linkPath = await realpath(path);
-			} catch (e) {
-				this.fsw._emitReady();
-				return true;
-			}
-			if (this.fsw.closed) return;
-			if (dir.has(item)) {
-				if (this.fsw._symlinkPaths.get(full) !== linkPath) {
-					this.fsw._symlinkPaths.set(full, linkPath);
-					this.fsw._emit(EV.CHANGE, path, entry.stats);
-				}
-			} else {
-				dir.add(item);
-				this.fsw._symlinkPaths.set(full, linkPath);
-				this.fsw._emit(EV.ADD, path, entry.stats);
-			}
-			this.fsw._emitReady();
-			return true;
-		}
-		if (this.fsw._symlinkPaths.has(full)) return true;
-		this.fsw._symlinkPaths.set(full, true);
-	}
-	_handleRead(directory, initialAdd, wh, target, dir, depth, throttler) {
-		directory = sysPath.join(directory, "");
-		throttler = this.fsw._throttle("readdir", directory, 1e3);
-		if (!throttler) return;
-		const previous = this.fsw._getWatchedDir(wh.path);
-		const current = /* @__PURE__ */ new Set();
-		let stream = this.fsw._readdirp(directory, {
-			fileFilter: (entry) => wh.filterPath(entry),
-			directoryFilter: (entry) => wh.filterDir(entry)
-		});
-		if (!stream) return;
-		stream.on(STR_DATA, async (entry) => {
-			if (this.fsw.closed) {
-				stream = void 0;
-				return;
-			}
-			const item = entry.path;
-			let path = sysPath.join(directory, item);
-			current.add(item);
-			if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path, item)) return;
-			if (this.fsw.closed) {
-				stream = void 0;
-				return;
-			}
-			if (item === target || !target && !previous.has(item)) {
-				this.fsw._incrReadyCount();
-				path = sysPath.join(dir, sysPath.relative(dir, path));
-				this._addToNodeFs(path, initialAdd, wh, depth + 1);
-			}
-		}).on(EV.ERROR, this._boundHandleError);
-		return new Promise((resolve, reject) => {
-			if (!stream) return reject();
-			stream.once("end", () => {
-				if (this.fsw.closed) {
-					stream = void 0;
-					return;
-				}
-				const wasThrottled = throttler ? throttler.clear() : false;
-				resolve(void 0);
-				previous.getChildren().filter((item) => {
-					return item !== directory && !current.has(item);
-				}).forEach((item) => {
-					this.fsw._remove(directory, item);
-				});
-				stream = void 0;
-				if (wasThrottled) this._handleRead(directory, false, wh, target, dir, depth, throttler);
-			});
-		});
-	}
-	/**
-	* Read directory to add / remove files from `@watched` list and re-read it on change.
-	* @param dir fs path
-	* @param stats
-	* @param initialAdd
-	* @param depth relative to user-supplied path
-	* @param target child path targeted for watch
-	* @param wh Common watch helpers for this path
-	* @param realpath
-	* @returns closer for the watcher instance.
-	*/
-	async _handleDir(dir, stats, initialAdd, depth, target, wh, realpath) {
-		const parentDir = this.fsw._getWatchedDir(sysPath.dirname(dir));
-		const tracked = parentDir.has(sysPath.basename(dir));
-		if (!(initialAdd && this.fsw.options.ignoreInitial) && !target && !tracked) this.fsw._emit(EV.ADD_DIR, dir, stats);
-		parentDir.add(sysPath.basename(dir));
-		this.fsw._getWatchedDir(dir);
-		let throttler;
-		let closer;
-		const oDepth = this.fsw.options.depth;
-		if ((oDepth == null || depth <= oDepth) && !this.fsw._symlinkPaths.has(realpath)) {
-			if (!target) {
-				await this._handleRead(dir, initialAdd, wh, target, dir, depth, throttler);
-				if (this.fsw.closed) return;
-			}
-			closer = this._watchWithNodeFs(dir, (dirPath, stats) => {
-				if (stats && stats.mtimeMs === 0) return;
-				this._handleRead(dirPath, false, wh, target, dir, depth, throttler);
-			});
-		}
-		return closer;
-	}
-	/**
-	* Handle added file, directory, or glob pattern.
-	* Delegates call to _handleFile / _handleDir after checks.
-	* @param path to file or ir
-	* @param initialAdd was the file added at watch instantiation?
-	* @param priorWh depth relative to user-supplied path
-	* @param depth Child path actually targeted for watch
-	* @param target Child path actually targeted for watch
-	*/
-	async _addToNodeFs(path, initialAdd, priorWh, depth, target) {
-		const ready = this.fsw._emitReady;
-		if (this.fsw._isIgnored(path) || this.fsw.closed) {
-			ready();
-			return false;
-		}
-		const wh = this.fsw._getWatchHelpers(path);
-		if (priorWh) {
-			wh.filterPath = (entry) => priorWh.filterPath(entry);
-			wh.filterDir = (entry) => priorWh.filterDir(entry);
-		}
-		try {
-			const stats = await statMethods[wh.statMethod](wh.watchPath);
-			if (this.fsw.closed) return;
-			if (this.fsw._isIgnored(wh.watchPath, stats)) {
-				ready();
-				return false;
-			}
-			const follow = this.fsw.options.followSymlinks;
-			let closer;
-			if (stats.isDirectory()) {
-				const absPath = sysPath.resolve(path);
-				const targetPath = follow ? await realpath(path) : path;
-				if (this.fsw.closed) return;
-				closer = await this._handleDir(wh.watchPath, stats, initialAdd, depth, target, wh, targetPath);
-				if (this.fsw.closed) return;
-				if (absPath !== targetPath && targetPath !== void 0) this.fsw._symlinkPaths.set(absPath, targetPath);
-			} else if (stats.isSymbolicLink()) {
-				const targetPath = follow ? await realpath(path) : path;
-				if (this.fsw.closed) return;
-				const parent = sysPath.dirname(wh.watchPath);
-				this.fsw._getWatchedDir(parent).add(wh.watchPath);
-				this.fsw._emit(EV.ADD, wh.watchPath, stats);
-				closer = await this._handleDir(parent, stats, initialAdd, depth, path, wh, targetPath);
-				if (this.fsw.closed) return;
-				if (targetPath !== void 0) this.fsw._symlinkPaths.set(sysPath.resolve(path), targetPath);
-			} else closer = this._handleFile(wh.watchPath, stats, initialAdd);
-			ready();
-			if (closer) this.fsw._addPathCloser(path, closer);
-			return false;
-		} catch (error) {
-			if (this.fsw._handleError(error)) {
-				ready();
-				return path;
-			}
-		}
-	}
-};
-//#endregion
-//#region ../../0-framework/3-tooling/cli/node_modules/chokidar/esm/index.js
-/*! chokidar - MIT License (c) 2012 Paul Miller (paulmillr.com) */
-const SLASH = "/";
-const SLASH_SLASH = "//";
-const ONE_DOT = ".";
-const TWO_DOTS = "..";
-const STRING_TYPE = "string";
-const BACK_SLASH_RE = /\\/g;
-const DOUBLE_SLASH_RE = /\/\//;
-const DOT_RE = /\..*\.(sw[px])$|~$|\.subl.*\.tmp/;
-const REPLACER_RE = /^\.[/\\]/;
-function arrify(item) {
-	return Array.isArray(item) ? item : [item];
-}
-const isMatcherObject = (matcher) => typeof matcher === "object" && matcher !== null && !(matcher instanceof RegExp);
-function createPattern(matcher) {
-	if (typeof matcher === "function") return matcher;
-	if (typeof matcher === "string") return (string) => matcher === string;
-	if (matcher instanceof RegExp) return (string) => matcher.test(string);
-	if (typeof matcher === "object" && matcher !== null) return (string) => {
-		if (matcher.path === string) return true;
-		if (matcher.recursive) {
-			const relative = sysPath.relative(matcher.path, string);
-			if (!relative) return false;
-			return !relative.startsWith("..") && !sysPath.isAbsolute(relative);
-		}
-		return false;
-	};
-	return () => false;
-}
-function normalizePath(path) {
-	if (typeof path !== "string") throw new Error("string expected");
-	path = sysPath.normalize(path);
-	path = path.replace(/\\/g, "/");
-	let prepend = false;
-	if (path.startsWith("//")) prepend = true;
-	const DOUBLE_SLASH_RE = /\/\//;
-	while (path.match(DOUBLE_SLASH_RE)) path = path.replace(DOUBLE_SLASH_RE, "/");
-	if (prepend) path = "/" + path;
-	return path;
-}
-function matchPatterns(patterns, testString, stats) {
-	const path = normalizePath(testString);
-	for (let index = 0; index < patterns.length; index++) {
-		const pattern = patterns[index];
-		if (pattern(path, stats)) return true;
-	}
-	return false;
-}
-function anymatch(matchers, testString) {
-	if (matchers == null) throw new TypeError("anymatch: specify first argument");
-	const patterns = arrify(matchers).map((matcher) => createPattern(matcher));
-	if (testString == null) return (testString, stats) => {
-		return matchPatterns(patterns, testString, stats);
-	};
-	return matchPatterns(patterns, testString);
-}
-const unifyPaths = (paths_) => {
-	const paths = arrify(paths_).flat();
-	if (!paths.every((p) => typeof p === STRING_TYPE)) throw new TypeError(`Non-string provided as watch path: ${paths}`);
-	return paths.map(normalizePathToUnix);
-};
-const toUnix = (string) => {
-	let str = string.replace(BACK_SLASH_RE, SLASH);
-	let prepend = false;
-	if (str.startsWith(SLASH_SLASH)) prepend = true;
-	while (str.match(DOUBLE_SLASH_RE)) str = str.replace(DOUBLE_SLASH_RE, SLASH);
-	if (prepend) str = SLASH + str;
-	return str;
-};
-const normalizePathToUnix = (path) => toUnix(sysPath.normalize(toUnix(path)));
-const normalizeIgnored = (cwd = "") => (path) => {
-	if (typeof path === "string") return normalizePathToUnix(sysPath.isAbsolute(path) ? path : sysPath.join(cwd, path));
-	else return path;
-};
-const getAbsolutePath = (path, cwd) => {
-	if (sysPath.isAbsolute(path)) return path;
-	return sysPath.join(cwd, path);
-};
-const EMPTY_SET = Object.freeze(/* @__PURE__ */ new Set());
-/**
-* Directory entry.
-*/
-var DirEntry = class {
-	constructor(dir, removeWatcher) {
-		this.path = dir;
-		this._removeWatcher = removeWatcher;
-		this.items = /* @__PURE__ */ new Set();
-	}
-	add(item) {
-		const { items } = this;
-		if (!items) return;
-		if (item !== ONE_DOT && item !== TWO_DOTS) items.add(item);
-	}
-	async remove(item) {
-		const { items } = this;
-		if (!items) return;
-		items.delete(item);
-		if (items.size > 0) return;
-		const dir = this.path;
-		try {
-			await readdir(dir);
-		} catch (err) {
-			if (this._removeWatcher) this._removeWatcher(sysPath.dirname(dir), sysPath.basename(dir));
-		}
-	}
-	has(item) {
-		const { items } = this;
-		if (!items) return;
-		return items.has(item);
-	}
-	getChildren() {
-		const { items } = this;
-		if (!items) return [];
-		return [...items.values()];
-	}
-	dispose() {
-		this.items.clear();
-		this.path = "";
-		this._removeWatcher = EMPTY_FN;
-		this.items = EMPTY_SET;
-		Object.freeze(this);
-	}
-};
-const STAT_METHOD_F = "stat";
-const STAT_METHOD_L = "lstat";
-var WatchHelper = class {
-	constructor(path, follow, fsw) {
-		this.fsw = fsw;
-		const watchPath = path;
-		this.path = path = path.replace(REPLACER_RE, "");
-		this.watchPath = watchPath;
-		this.fullWatchPath = sysPath.resolve(watchPath);
-		this.dirParts = [];
-		this.dirParts.forEach((parts) => {
-			if (parts.length > 1) parts.pop();
-		});
-		this.followSymlinks = follow;
-		this.statMethod = follow ? STAT_METHOD_F : STAT_METHOD_L;
-	}
-	entryPath(entry) {
-		return sysPath.join(this.watchPath, sysPath.relative(this.watchPath, entry.fullPath));
-	}
-	filterPath(entry) {
-		const { stats } = entry;
-		if (stats && stats.isSymbolicLink()) return this.filterDir(entry);
-		const resolvedPath = this.entryPath(entry);
-		return this.fsw._isntIgnored(resolvedPath, stats) && this.fsw._hasReadPermissions(stats);
-	}
-	filterDir(entry) {
-		return this.fsw._isntIgnored(this.entryPath(entry), entry.stats);
-	}
-};
-/**
-* Watches files & directories for changes. Emitted events:
-* `add`, `addDir`, `change`, `unlink`, `unlinkDir`, `all`, `error`
-*
-*     new FSWatcher()
-*       .add(directories)
-*       .on('add', path => log('File', path, 'was added'))
-*/
-var FSWatcher = class extends EventEmitter {
-	constructor(_opts = {}) {
-		super();
-		this.closed = false;
-		this._closers = /* @__PURE__ */ new Map();
-		this._ignoredPaths = /* @__PURE__ */ new Set();
-		this._throttled = /* @__PURE__ */ new Map();
-		this._streams = /* @__PURE__ */ new Set();
-		this._symlinkPaths = /* @__PURE__ */ new Map();
-		this._watched = /* @__PURE__ */ new Map();
-		this._pendingWrites = /* @__PURE__ */ new Map();
-		this._pendingUnlinks = /* @__PURE__ */ new Map();
-		this._readyCount = 0;
-		this._readyEmitted = false;
-		const awf = _opts.awaitWriteFinish;
-		const DEF_AWF = {
-			stabilityThreshold: 2e3,
-			pollInterval: 100
-		};
-		const opts = {
-			persistent: true,
-			ignoreInitial: false,
-			ignorePermissionErrors: false,
-			interval: 100,
-			binaryInterval: 300,
-			followSymlinks: true,
-			usePolling: false,
-			atomic: true,
-			..._opts,
-			ignored: _opts.ignored ? arrify(_opts.ignored) : arrify([]),
-			awaitWriteFinish: awf === true ? DEF_AWF : typeof awf === "object" ? {
-				...DEF_AWF,
-				...awf
-			} : false
-		};
-		if (isIBMi) opts.usePolling = true;
-		if (opts.atomic === void 0) opts.atomic = !opts.usePolling;
-		const envPoll = process.env.CHOKIDAR_USEPOLLING;
-		if (envPoll !== void 0) {
-			const envLower = envPoll.toLowerCase();
-			if (envLower === "false" || envLower === "0") opts.usePolling = false;
-			else if (envLower === "true" || envLower === "1") opts.usePolling = true;
-			else opts.usePolling = !!envLower;
-		}
-		const envInterval = process.env.CHOKIDAR_INTERVAL;
-		if (envInterval) opts.interval = Number.parseInt(envInterval, 10);
-		let readyCalls = 0;
-		this._emitReady = () => {
-			readyCalls++;
-			if (readyCalls >= this._readyCount) {
-				this._emitReady = EMPTY_FN;
-				this._readyEmitted = true;
-				process.nextTick(() => this.emit(EVENTS.READY));
-			}
-		};
-		this._emitRaw = (...args) => this.emit(EVENTS.RAW, ...args);
-		this._boundRemove = this._remove.bind(this);
-		this.options = opts;
-		this._nodeFsHandler = new NodeFsHandler(this);
-		Object.freeze(opts);
-	}
-	_addIgnoredPath(matcher) {
-		if (isMatcherObject(matcher)) {
-			for (const ignored of this._ignoredPaths) if (isMatcherObject(ignored) && ignored.path === matcher.path && ignored.recursive === matcher.recursive) return;
-		}
-		this._ignoredPaths.add(matcher);
-	}
-	_removeIgnoredPath(matcher) {
-		this._ignoredPaths.delete(matcher);
-		if (typeof matcher === "string") {
-			for (const ignored of this._ignoredPaths) if (isMatcherObject(ignored) && ignored.path === matcher) this._ignoredPaths.delete(ignored);
-		}
-	}
-	/**
-	* Adds paths to be watched on an existing FSWatcher instance.
-	* @param paths_ file or file list. Other arguments are unused
-	*/
-	add(paths_, _origAdd, _internal) {
-		const { cwd } = this.options;
-		this.closed = false;
-		this._closePromise = void 0;
-		let paths = unifyPaths(paths_);
-		if (cwd) paths = paths.map((path) => {
-			return getAbsolutePath(path, cwd);
-		});
-		paths.forEach((path) => {
-			this._removeIgnoredPath(path);
-		});
-		this._userIgnored = void 0;
-		if (!this._readyCount) this._readyCount = 0;
-		this._readyCount += paths.length;
-		Promise.all(paths.map(async (path) => {
-			const res = await this._nodeFsHandler._addToNodeFs(path, !_internal, void 0, 0, _origAdd);
-			if (res) this._emitReady();
-			return res;
-		})).then((results) => {
-			if (this.closed) return;
-			results.forEach((item) => {
-				if (item) this.add(sysPath.dirname(item), sysPath.basename(_origAdd || item));
-			});
-		});
-		return this;
-	}
-	/**
-	* Close watchers or start ignoring events from specified paths.
-	*/
-	unwatch(paths_) {
-		if (this.closed) return this;
-		const paths = unifyPaths(paths_);
-		const { cwd } = this.options;
-		paths.forEach((path) => {
-			if (!sysPath.isAbsolute(path) && !this._closers.has(path)) {
-				if (cwd) path = sysPath.join(cwd, path);
-				path = sysPath.resolve(path);
-			}
-			this._closePath(path);
-			this._addIgnoredPath(path);
-			if (this._watched.has(path)) this._addIgnoredPath({
-				path,
-				recursive: true
-			});
-			this._userIgnored = void 0;
-		});
-		return this;
-	}
-	/**
-	* Close watchers and remove all listeners from watched paths.
-	*/
-	close() {
-		if (this._closePromise) return this._closePromise;
-		this.closed = true;
-		this.removeAllListeners();
-		const closers = [];
-		this._closers.forEach((closerList) => closerList.forEach((closer) => {
-			const promise = closer();
-			if (promise instanceof Promise) closers.push(promise);
-		}));
-		this._streams.forEach((stream) => stream.destroy());
-		this._userIgnored = void 0;
-		this._readyCount = 0;
-		this._readyEmitted = false;
-		this._watched.forEach((dirent) => dirent.dispose());
-		this._closers.clear();
-		this._watched.clear();
-		this._streams.clear();
-		this._symlinkPaths.clear();
-		this._throttled.clear();
-		this._closePromise = closers.length ? Promise.all(closers).then(() => void 0) : Promise.resolve();
-		return this._closePromise;
-	}
-	/**
-	* Expose list of watched paths
-	* @returns for chaining
-	*/
-	getWatched() {
-		const watchList = {};
-		this._watched.forEach((entry, dir) => {
-			const index = (this.options.cwd ? sysPath.relative(this.options.cwd, dir) : dir) || ONE_DOT;
-			watchList[index] = entry.getChildren().sort();
-		});
-		return watchList;
-	}
-	emitWithAll(event, args) {
-		this.emit(event, ...args);
-		if (event !== EVENTS.ERROR) this.emit(EVENTS.ALL, event, ...args);
-	}
-	/**
-	* Normalize and emit events.
-	* Calling _emit DOES NOT MEAN emit() would be called!
-	* @param event Type of event
-	* @param path File or directory path
-	* @param stats arguments to be passed with event
-	* @returns the error if defined, otherwise the value of the FSWatcher instance's `closed` flag
-	*/
-	async _emit(event, path, stats) {
-		if (this.closed) return;
-		const opts = this.options;
-		if (isWindows) path = sysPath.normalize(path);
-		if (opts.cwd) path = sysPath.relative(opts.cwd, path);
-		const args = [path];
-		if (stats != null) args.push(stats);
-		const awf = opts.awaitWriteFinish;
-		let pw;
-		if (awf && (pw = this._pendingWrites.get(path))) {
-			pw.lastChange = /* @__PURE__ */ new Date();
-			return this;
-		}
-		if (opts.atomic) {
-			if (event === EVENTS.UNLINK) {
-				this._pendingUnlinks.set(path, [event, ...args]);
-				setTimeout(() => {
-					this._pendingUnlinks.forEach((entry, path) => {
-						this.emit(...entry);
-						this.emit(EVENTS.ALL, ...entry);
-						this._pendingUnlinks.delete(path);
-					});
-				}, typeof opts.atomic === "number" ? opts.atomic : 100);
-				return this;
-			}
-			if (event === EVENTS.ADD && this._pendingUnlinks.has(path)) {
-				event = EVENTS.CHANGE;
-				this._pendingUnlinks.delete(path);
-			}
-		}
-		if (awf && (event === EVENTS.ADD || event === EVENTS.CHANGE) && this._readyEmitted) {
-			const awfEmit = (err, stats) => {
-				if (err) {
-					event = EVENTS.ERROR;
-					args[0] = err;
-					this.emitWithAll(event, args);
-				} else if (stats) {
-					if (args.length > 1) args[1] = stats;
-					else args.push(stats);
-					this.emitWithAll(event, args);
-				}
-			};
-			this._awaitWriteFinish(path, awf.stabilityThreshold, event, awfEmit);
-			return this;
-		}
-		if (event === EVENTS.CHANGE) {
-			if (!this._throttle(EVENTS.CHANGE, path, 50)) return this;
-		}
-		if (opts.alwaysStat && stats === void 0 && (event === EVENTS.ADD || event === EVENTS.ADD_DIR || event === EVENTS.CHANGE)) {
-			const fullPath = opts.cwd ? sysPath.join(opts.cwd, path) : path;
-			let stats;
-			try {
-				stats = await stat$1(fullPath);
-			} catch (err) {}
-			if (!stats || this.closed) return;
-			args.push(stats);
-		}
-		this.emitWithAll(event, args);
-		return this;
-	}
-	/**
-	* Common handler for errors
-	* @returns The error if defined, otherwise the value of the FSWatcher instance's `closed` flag
-	*/
-	_handleError(error) {
-		const code = error && error.code;
-		if (error && code !== "ENOENT" && code !== "ENOTDIR" && (!this.options.ignorePermissionErrors || code !== "EPERM" && code !== "EACCES")) this.emit(EVENTS.ERROR, error);
-		return error || this.closed;
-	}
-	/**
-	* Helper utility for throttling
-	* @param actionType type being throttled
-	* @param path being acted upon
-	* @param timeout duration of time to suppress duplicate actions
-	* @returns tracking object or false if action should be suppressed
-	*/
-	_throttle(actionType, path, timeout) {
-		if (!this._throttled.has(actionType)) this._throttled.set(actionType, /* @__PURE__ */ new Map());
-		const action = this._throttled.get(actionType);
-		if (!action) throw new Error("invalid throttle");
-		const actionPath = action.get(path);
-		if (actionPath) {
-			actionPath.count++;
-			return false;
-		}
-		let timeoutObject;
-		const clear = () => {
-			const item = action.get(path);
-			const count = item ? item.count : 0;
-			action.delete(path);
-			clearTimeout(timeoutObject);
-			if (item) clearTimeout(item.timeoutObject);
-			return count;
-		};
-		timeoutObject = setTimeout(clear, timeout);
-		const thr = {
-			timeoutObject,
-			clear,
-			count: 0
-		};
-		action.set(path, thr);
-		return thr;
-	}
-	_incrReadyCount() {
-		return this._readyCount++;
-	}
-	/**
-	* Awaits write operation to finish.
-	* Polls a newly created file for size variations. When files size does not change for 'threshold' milliseconds calls callback.
-	* @param path being acted upon
-	* @param threshold Time in milliseconds a file size must be fixed before acknowledging write OP is finished
-	* @param event
-	* @param awfEmit Callback to be called when ready for event to be emitted.
-	*/
-	_awaitWriteFinish(path, threshold, event, awfEmit) {
-		const awf = this.options.awaitWriteFinish;
-		if (typeof awf !== "object") return;
-		const pollInterval = awf.pollInterval;
-		let timeoutHandler;
-		let fullPath = path;
-		if (this.options.cwd && !sysPath.isAbsolute(path)) fullPath = sysPath.join(this.options.cwd, path);
-		const now = /* @__PURE__ */ new Date();
-		const writes = this._pendingWrites;
-		function awaitWriteFinishFn(prevStat) {
-			stat(fullPath, (err, curStat) => {
-				if (err || !writes.has(path)) {
-					if (err && err.code !== "ENOENT") awfEmit(err);
-					return;
-				}
-				const now = Number(/* @__PURE__ */ new Date());
-				if (prevStat && curStat.size !== prevStat.size) writes.get(path).lastChange = now;
-				if (now - writes.get(path).lastChange >= threshold) {
-					writes.delete(path);
-					awfEmit(void 0, curStat);
-				} else timeoutHandler = setTimeout(awaitWriteFinishFn, pollInterval, curStat);
-			});
-		}
-		if (!writes.has(path)) {
-			writes.set(path, {
-				lastChange: now,
-				cancelWait: () => {
-					writes.delete(path);
-					clearTimeout(timeoutHandler);
-					return event;
-				}
-			});
-			timeoutHandler = setTimeout(awaitWriteFinishFn, pollInterval);
-		}
-	}
-	/**
-	* Determines whether user has asked to ignore this path.
-	*/
-	_isIgnored(path, stats) {
-		if (this.options.atomic && DOT_RE.test(path)) return true;
-		if (!this._userIgnored) {
-			const { cwd } = this.options;
-			const ignored = (this.options.ignored || []).map(normalizeIgnored(cwd));
-			const list = [...[...this._ignoredPaths].map(normalizeIgnored(cwd)), ...ignored];
-			this._userIgnored = anymatch(list, void 0);
-		}
-		return this._userIgnored(path, stats);
-	}
-	_isntIgnored(path, stat) {
-		return !this._isIgnored(path, stat);
-	}
-	/**
-	* Provides a set of common helpers and properties relating to symlink handling.
-	* @param path file or directory pattern being watched
-	*/
-	_getWatchHelpers(path) {
-		return new WatchHelper(path, this.options.followSymlinks, this);
-	}
-	/**
-	* Provides directory tracking objects
-	* @param directory path of the directory
-	*/
-	_getWatchedDir(directory) {
-		const dir = sysPath.resolve(directory);
-		if (!this._watched.has(dir)) this._watched.set(dir, new DirEntry(dir, this._boundRemove));
-		return this._watched.get(dir);
-	}
-	/**
-	* Check for read permissions: https://stackoverflow.com/a/11781404/1358405
-	*/
-	_hasReadPermissions(stats) {
-		if (this.options.ignorePermissionErrors) return true;
-		return Boolean(Number(stats.mode) & 256);
-	}
-	/**
-	* Handles emitting unlink events for
-	* files and directories, and via recursion, for
-	* files and directories within directories that are unlinked
-	* @param directory within which the following item is located
-	* @param item      base path of item/directory
-	*/
-	_remove(directory, item, isDirectory) {
-		const path = sysPath.join(directory, item);
-		const fullPath = sysPath.resolve(path);
-		isDirectory = isDirectory != null ? isDirectory : this._watched.has(path) || this._watched.has(fullPath);
-		if (!this._throttle("remove", path, 100)) return;
-		if (!isDirectory && this._watched.size === 1) this.add(directory, item, true);
-		this._getWatchedDir(path).getChildren().forEach((nested) => this._remove(path, nested));
-		const parent = this._getWatchedDir(directory);
-		const wasTracked = parent.has(item);
-		parent.remove(item);
-		if (this._symlinkPaths.has(fullPath)) this._symlinkPaths.delete(fullPath);
-		let relPath = path;
-		if (this.options.cwd) relPath = sysPath.relative(this.options.cwd, path);
-		if (this.options.awaitWriteFinish && this._pendingWrites.has(relPath)) {
-			if (this._pendingWrites.get(relPath).cancelWait() === EVENTS.ADD) return;
-		}
-		this._watched.delete(path);
-		this._watched.delete(fullPath);
-		const eventName = isDirectory ? EVENTS.UNLINK_DIR : EVENTS.UNLINK;
-		if (wasTracked && !this._isIgnored(path)) this._emit(eventName, path);
-		this._closePath(path);
-	}
-	/**
-	* Closes all watchers for a path
-	*/
-	_closePath(path) {
-		this._closeFile(path);
-		const dir = sysPath.dirname(path);
-		this._getWatchedDir(dir).remove(sysPath.basename(path));
-	}
-	/**
-	* Closes only file-specific watchers
-	*/
-	_closeFile(path) {
-		const closers = this._closers.get(path);
-		if (!closers) return;
-		closers.forEach((closer) => closer());
-		this._closers.delete(path);
-	}
-	_addPathCloser(path, closer) {
-		if (!closer) return;
-		let list = this._closers.get(path);
-		if (!list) {
-			list = [];
-			this._closers.set(path, list);
-		}
-		list.push(closer);
-	}
-	_readdirp(root, opts) {
-		if (this.closed) return;
-		let stream = readdirp(root, {
-			type: EVENTS.ALL,
-			alwaysStat: true,
-			lstat: true,
-			...opts,
-			depth: 0
-		});
-		this._streams.add(stream);
-		stream.once(STR_CLOSE, () => {
-			stream = void 0;
-		});
-		stream.once("end", () => {
-			if (stream) {
-				this._streams.delete(stream);
-				stream = void 0;
-			}
-		});
-		return stream;
-	}
-};
-/**
-* Instantiates watcher with paths to be tracked.
-* @param paths file / directory paths
-* @param options opts, such as `atomic`, `awaitWriteFinish`, `ignored`, and others
-* @returns an instance of FSWatcher for chaining.
-* @example
-* const watcher = watch('.').on('all', (event, path) => { console.log(event, path); });
-* watch('.', { atomic: true, awaitWriteFinish: true, ignored: (f, stats) => stats?.isFile() && !f.endsWith('.js') })
-*/
-function watch$1(paths, options = {}) {
-	const watcher = new FSWatcher(options);
-	watcher.add(paths);
-	return watcher;
-}
-var esm_default = {
-	watch: watch$1,
-	FSWatcher
-};
-//#endregion
-//#region ../../0-framework/3-tooling/cli/dist/cli-CH8Ewf_a.mjs
-/**
-* A user-facing failure with a message that already names the fix (deploy-cli.md
-* § Error surface). `bin.ts` catches this — and any other Error, including
-* core's LoadError/LowerError — uniformly: print the message, exit nonzero.
-*/
-var CliError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "CliError";
-	}
-};
-/**
-* Pipeline step: find and load `prisma-composer.config.ts` (ADR-0017) — the ONE
-* file that imports control-plane code. Discovery is the standard walk-up
-* from the deploy entry's directory (mirrors prisma-next's config-loader);
-* loading is c12 with that explicit path (rc/global/package.json lookups
-* disabled), so the config file's own static imports resolve from the app
-* root by whatever package manager runs — no specifier construction, no
-* anchoring. The loaded shape is validated field-by-field with CliErrors
-* naming the field.
-*/
-const CONFIG_FILENAME = "prisma-composer.config.ts";
-/** Walks UP from the entry file's directory looking for the literal CONFIG_FILENAME; undefined when the walk hits the filesystem root. */
-function findConfigPathForEntry(entryPath) {
-	let current = path.dirname(path.resolve(entryPath));
-	while (true) {
-		const candidate = path.join(current, CONFIG_FILENAME);
-		if (fs.existsSync(candidate)) return candidate;
-		const parent = path.dirname(current);
-		if (parent === current) return void 0;
-		current = parent;
-	}
-}
-function missingConfigError(entryPath) {
-	return new CliError(`No ${CONFIG_FILENAME} found walking up from "${path.dirname(path.resolve(entryPath))}" — the deploy needs the app's config file. Create one next to (or above) the entry, default-exporting defineConfig({ extensions: [...], state: ... }) from '@prisma/composer/config'.`);
-}
-function fieldError(field, requirement) {
-	return new CliError(`${CONFIG_FILENAME}: \`${field}\` ${requirement} — see defineConfig() in '@prisma/composer/config'.`);
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-/**
-* Field-by-field validation of the loaded default export — deliberately no
-* schema library: each check is a CliError naming the offending field.
-* Returns the same object, typed.
-*/
-function validateConfigShape(loaded, configPath) {
-	if (!isRecord(loaded) || Object.keys(loaded).length === 0) throw new CliError(`"${configPath}" exported no config — it must default-export defineConfig({ extensions: [...], state: ... }) from '@prisma/composer/config'.`);
-	const extensions = loaded["extensions"];
-	if (!Array.isArray(extensions)) throw fieldError("extensions", "must be an array");
-	const seen = /* @__PURE__ */ new Set();
-	for (const [index, entry] of extensions.entries()) {
-		if (!isRecord(entry)) throw fieldError(`extensions[${index}]`, "must be an extension descriptor object");
-		const id = entry["id"];
-		if (typeof id !== "string" || id.length === 0) throw fieldError(`extensions[${index}].id`, "must be a non-empty string (the extension package name)");
-		if (!isRecord(entry["nodes"])) throw fieldError(`extensions[${index}].nodes`, "must be an object (the node-ID → control registry)");
-		if (seen.has(id)) throw new CliError(`${CONFIG_FILENAME}: extension "${id}" is listed more than once in \`extensions\`.`);
-		seen.add(id);
-	}
-	const state = loaded["state"];
-	if (!isRecord(state) || typeof state["extension"] !== "string" || typeof state["create"] !== "function") throw fieldError("state", "must be a state descriptor (e.g. prismaState())");
-	return blindCast(loaded);
-}
-/**
-* Loads + validates the config at `configPath` via c12 (explicit file; rc /
-* global-rc / package.json lookups disabled — discovery already happened in
-* findConfigPathForEntry).
-*/
-async function loadAppConfig(configPath) {
-	const result = await c12.loadConfig({
-		name: "prisma-composer",
-		configFile: configPath,
-		cwd: path.dirname(configPath),
-		rcFile: false,
-		globalRc: false,
-		packageJson: false
-	});
-	const loadedFile = result.configFile;
-	if (typeof loadedFile !== "string" || fs.realpathSync(loadedFile) !== fs.realpathSync(configPath)) throw new CliError(`Config loading resolved "${String(loadedFile)}" instead of the discovered "${configPath}" — refusing to deploy against a different file.`);
-	return {
-		path: configPath,
-		config: validateConfigShape(result.config, configPath)
-	};
-}
-/**
-* `loadEntry` imports a user's topology with the host runtime's own module
-* loader — under node (the CLI's shebang runtime), that loader strips
-* TypeScript types but has no JSX transform (ADR-0005: the framework
-* doesn't bundle or transform the app's code; deploy loading is no
-* exception). A `.tsx`/`.jsx` file anywhere in the topology's import graph
-* dies with node's raw `ERR_UNKNOWN_FILE_EXTENSION`, which names the file
-* but not the cause or the fix. This turns that one case into a CliError
-* message that does — every other load failure (syntax errors, missing
-* files, non-JSX unknown extensions) is untouched, re-thrown as-is.
-*/
-const UNKNOWN_EXTENSION_CODE = "ERR_UNKNOWN_FILE_EXTENSION";
-const JSX_EXTENSIONS = [".tsx", ".jsx"];
-function errorCode(error) {
-	return "code" in error && typeof error.code === "string" ? error.code : void 0;
-}
-function unknownExtensionPath(error) {
-	if (!(error instanceof Error)) return void 0;
-	if (errorCode(error) !== UNKNOWN_EXTENSION_CODE) return void 0;
-	return /Unknown file extension "\.\w+" for (.+)$/.exec(error.message)?.[1];
-}
-/**
-* Returns a CliError-ready message when `error` is node's
-* `ERR_UNKNOWN_FILE_EXTENSION` for a `.tsx`/`.jsx` file — `undefined` for
-* every other error (including unknown-extension failures for some other
-* extension), so the caller can fall through to its normal rethrow.
-*/
-function explainJsxLoadError(error, entryPath) {
-	const offendingPath = unknownExtensionPath(error);
-	if (offendingPath === void 0) return void 0;
-	if (!JSX_EXTENSIONS.some((ext) => offendingPath.endsWith(ext))) return void 0;
-	return `"${offendingPath}" can't be loaded: deploy loads "${entryPath}"'s topology with node's own module loader, which strips TypeScript types but has no JSX transform — so a .tsx/.jsx file can't sit anywhere in that import graph.
-
-Precompile that file in your own build (transform the JSX away, keep the real npm packages external) and import the compiled output instead of the raw .tsx/.jsx — see examples/email/scripts/build.ts in the prisma/composer repo for a worked example.`;
-}
-/**
-* Pipeline step 1 (deploy-cli.md § The pipeline): import the entry module
-* (resolved against cwd) and require its default export to be a node — a
-* service or module, branded by core's factories. Whatever this module exports
-* IS the application; nothing else marks a root (ADR-0003).
-*/
-async function loadEntry(entryArg, cwd) {
-	const resolvedPath = path.resolve(cwd, entryArg);
-	let mod;
-	try {
-		mod = await import(pathToFileURL(resolvedPath).href);
-	} catch (error) {
-		const explained = explainJsxLoadError(error, resolvedPath);
-		if (explained !== void 0) throw new CliError(explained);
-		throw error;
-	}
-	const root = blindCast(mod).default;
-	if (!isNode(root) || root.kind === "dependency" || root.kind === "resource") throw new CliError(`Entry module "${resolvedPath}" must default-export a node (a service or a module) — construct it with service() or module() from @prisma/composer.`);
-	return {
-		path: resolvedPath,
-		root: blindCast(root)
-	};
-}
-function lookup(extensions, extension, type, expectedKind, what) {
-	const ext = extensions.get(extension);
-	if (ext === void 0) throw new CliError(`No extension "${extension}" is configured (needed by ${what}) — add it to ${CONFIG_FILENAME}'s \`extensions\` (import its /control entry and list its descriptor).`);
-	const descriptor = ext.nodes[type];
-	if (descriptor === void 0) throw new CliError(`Extension "${extension}" has no descriptor for node type "${type}" (needed by ${what}; known: ${Object.keys(ext.nodes).join(", ")}).`);
-	if (descriptor.kind !== expectedKind) throw new CliError(`Extension "${extension}"'s descriptor for node type "${type}" is a "${descriptor.kind}" descriptor — ${what} needs a "${expectedKind}" descriptor.`);
-}
-/** Throws a CliError on the first uncovered `(extension, type)`; silent when the config covers the whole graph. */
-function validateRegistryCoverage(graph, config) {
-	const extensions = new Map(config.extensions.map((descriptor) => [descriptor.id, descriptor]));
-	for (const { id, node } of graph.nodes) {
-		if (node.kind === "resource") {
-			lookup(extensions, node.extension, node.type, "resource", `resource node "${id}"`);
-			continue;
-		}
-		if (node.kind !== "service") continue;
-		lookup(extensions, node.extension, node.type, "service", `service node "${id}"`);
-		lookup(extensions, node.build.extension, node.build.type, "build", `service node "${id}"'s build descriptor`);
-	}
-}
-/**
-* The shared prefix of `deploy`/`destroy`/`dev` (deploy-cli.md § The
-* pipeline; local-dev spec § 6): config discovery/load, entry load, Load,
-* registry coverage validation, name resolution, assemble. Deploy and dev
-* diverge after this — deploy resolves containers/preflight/stack file
-* against the hosted providers, dev against the local ones — so everything
-* up to and including assemble lives here once, consumed verbatim by both
-* `run()` (main.ts) and `runDev()` (dev/run-dev.ts), so the two pipelines
-* cannot drift.
-*/
-/**
-* The pipeline's front — config discovery/load, entry load, name resolution —
-* WITHOUT Load, coverage, or assemble. `log` needs only who the app is (its
-* config and resolved name) to reach the already-running local instance; it
-* neither builds nor provisions, so it must not require the user's built
-* output the way the full pipeline does.
-*/
-async function resolveAppIdentity(entry, overrideName, cwd, deps = {}) {
-	const resolvedEntryPath = path.resolve(cwd, entry);
-	const configPath = findConfigPathForEntry(resolvedEntryPath);
-	if (configPath === void 0) throw missingConfigError(resolvedEntryPath);
-	const config = deps.config ?? (await loadAppConfig(configPath)).config;
-	const entryModule = await loadEntry(entry, cwd);
-	const name = overrideName ?? entryModule.root.name;
-	if (name.length === 0) throw new CliError("The root node has no name — name it at authoring, or pass --name.");
-	return {
-		configPath,
-		config,
-		name
-	};
-}
-/**
-* Runs config discovery/load, entry load, Load, registry coverage, name
-* resolution, and assemble — steps 1–6 of `run()`. `onAssembleError`, when
-* given, lets a caller decorate an assemble failure with command-specific
-* guidance (destroy's "build first" hint) without this shared step knowing
-* about any one command.
-*/
-async function runPipeline(entry, overrideName, cwd, deps = {}, onAssembleError) {
-	const resolvedEntryPath = path.resolve(cwd, entry);
-	const configPath = findConfigPathForEntry(resolvedEntryPath);
-	if (configPath === void 0) throw missingConfigError(resolvedEntryPath);
-	const config = deps.config ?? (await loadAppConfig(configPath)).config;
-	const entryModule = await loadEntry(entry, cwd);
-	const graph = Load(entryModule.root);
-	if (graph.root.node.kind !== "module") throw new CliError("The deploy root must be a module — wrap your service, e.g. export default module('name', ({ provision }) => { provision(service); }).");
-	validateRegistryCoverage(graph, config);
-	const name = overrideName ?? entryModule.root.name;
-	if (name.length === 0) throw new CliError("The root node has no name — name it at authoring, or pass --name.");
-	let assembled;
-	try {
-		assembled = await assembleServices(graph, config, cwd, deps.runAssembler);
-	} catch (error) {
-		if (onAssembleError !== void 0 && error instanceof Error) throw onAssembleError(error);
-		throw error;
-	}
-	return {
-		configPath,
-		config,
-		entryModule,
-		graph,
-		name,
-		assembled
-	};
-}
-/**
-* Pipeline step 7 (deploy-cli.md § The pipeline; design-notes.md's "Driving
-* Alchemy" call): shell out to the generated stack file. Resolves the
-* workspace's own installed `alchemy` bin (walking up `node_modules/.bin`
-* from the generated file's package dir) rather than going through
-* `bunx`/`npx`, so this works the same under node and bun — the resolved
-* bin's own launcher (`alchemy/bin/cli.js`) does its own node/bun dispatch
-* from there, driven by the env it inherits.
-*/
-/** Walks up from `startDir` looking for `node_modules/.bin/alchemy`. */
-function resolveAlchemyBin(startDir) {
-	let dir = startDir;
-	while (true) {
-		const candidate = path.join(dir, "node_modules", ".bin", "alchemy");
-		if (fs.existsSync(candidate)) return candidate;
-		const parent = path.dirname(dir);
-		if (parent === dir) throw new CliError(`Could not find an installed \`alchemy\` bin above "${startDir}" — add "alchemy" as a dependency of your app.`);
-		dir = parent;
-	}
-}
-/** Runs `alchemy deploy|destroy <stack file> --yes [--stage <stage>]`, inheriting stdio + env, plus every extension's resolved container. */
-function runAlchemy(input) {
-	const bin = resolveAlchemyBin(input.cwd);
-	const args = [
-		input.command,
-		input.stackFileRelativePath,
-		"--yes"
-	];
-	if (input.stage !== void 0) args.push("--stage", input.stage);
-	const result = spawnSync(bin, args, {
-		cwd: input.cwd,
-		stdio: "inherit",
-		env: {
-			...input.env ?? process.env,
-			...input.containerEnv
-		}
-	});
-	if (result.error !== void 0) throw result.error;
-	return result.status ?? 1;
-}
-/**
-* Local-dev spec § 6 `generate-dev-stack.ts`: like generate-stack.ts but at
-* `.prisma-composer/dev/alchemy.run.ts`, always Alchemy stage `dev`, using
-* Alchemy's own `localState()` and no `report` — dev prints its own front
-* door (run-dev.ts), so core's presentation-free lower() gets nothing to
-* call back into. The generated module IS the one orchestration point where
-* dev provenance is resolved (spec § 3 REVISED): it deserializes the
-* containers, top-level-awaits `resolveLocalTargets(config)` (the lazy
-* `localTarget` thunks, ADR-0041), and passes
-* `providers: localTargetProviders(...)` + `state: localState()` explicitly
-* — `lower()` learns nothing about dev.
-*/
-const DEV_GENERATED_DIR = ".prisma-composer/dev";
-const DEV_GENERATED_FILE = "alchemy.run.ts";
-/** A relative import specifier from `.prisma-composer/dev/alchemy.run.ts` to `target` (posix separators). */
-function relativeImportSpecifier$1(generatedDir, target) {
-	const rel = path.relative(generatedDir, target).split(path.sep).join("/");
-	return rel.startsWith(".") ? rel : `./${rel}`;
-}
-function quote$1(value) {
-	return JSON.stringify(value);
-}
-function renderBundle$1(bundle) {
-	return `{ dir: ${quote$1(bundle.dir)}, entry: ${quote$1(bundle.entry)} }`;
-}
-function renderOptions$1(input) {
-	const lines = [];
-	lines.push(`  name: ${quote$1(input.name)},`);
-	lines.push("  bundles: {");
-	for (const [id, bundle] of Object.entries(input.assembled.bundles)) lines.push(`    ${quote$1(id)}: ${renderBundle$1(bundle)},`);
-	lines.push("  },");
-	lines.push("  providers: localTargetProviders(resolved, containers, devDir),");
-	lines.push("  state: localState(),");
-	return lines.join("\n");
-}
-/** Renders the dev stack module's source (tests assert on it without touching disk). */
-function renderDevStackFile(input) {
-	const generatedDir = path.join(input.cwd, DEV_GENERATED_DIR);
-	const appImport = relativeImportSpecifier$1(generatedDir, input.entryPath);
-	const configImport = relativeImportSpecifier$1(generatedDir, input.configPath);
-	return `// Generated by \`prisma-composer dev\` — overwritten on every run; do not
-// edit by hand. Independently runnable from ${quote$1(input.cwd)}:
-//
-//   alchemy deploy ${DEV_GENERATED_DIR}/${DEV_GENERATED_FILE} --stage dev
-//
-// bisects a CLI bug from an Alchemy bug (deploy-cli.md § Implementation decisions).
-import * as path from 'node:path';
-import { deserializeContainers } from '@prisma/composer/config';
-import { lower } from '@prisma/composer/deploy';
-import { DEV_DIR, localTargetProviders, resolveLocalTargets } from '@prisma/composer/local-target';
-import { localState } from 'alchemy/State/LocalState';
-import config from ${quote$1(configImport)};
-import app from ${quote$1(appImport)};
-
-const containers = deserializeContainers(config.extensions, process.env);
-const resolved = await resolveLocalTargets(config);
-const devDir = path.join(process.cwd(), DEV_DIR);
-
-export default lower(app, config, {
-${renderOptions$1(input)}
-});
-`;
-}
-/** Writes the dev stack file, returning its absolute path. */
-function writeDevStackFile(input) {
-	const generatedDir = path.join(input.cwd, DEV_GENERATED_DIR);
-	fs.mkdirSync(generatedDir, { recursive: true });
-	const filePath = path.join(generatedDir, DEV_GENERATED_FILE);
-	fs.writeFileSync(filePath, renderDevStackFile(input));
-	return filePath;
-}
-const DEV_STACK_RELATIVE_PATH = path.join(DEV_GENERATED_DIR, DEV_GENERATED_FILE);
-/**
-* Local-dev spec § 6 `watch.ts`: watches each assembled bundle's declared
-* `watch` paths (a directory watched recursively, a file watched through
-* its parent — see `startWatch`), debounced 300 ms and coalesced across
-* every service — one edit across several files/services still fires
-* exactly one rebuild.
-*
-* The watch ENGINE is `chokidar` v4 (operator decision, design tip 74272d8:
-* don't-reinvent-the-wheel beats the no-new-deps contract here — it absorbs
-* the atomic-rename class and the cross-platform recursive-watch
-* differences; v4 is pure JS, no native code, no glob surface — irrelevant
-* here anyway, since every target is a literal file or directory path,
-* never a pattern). The parent-directory indirection for FILE targets stays
-* OURS (`startWatch` explains why), as does the debounce: chokidar's own
-* `awaitWriteFinish` is a per-file "has this file's size stopped changing"
-* poll, a different semantic from "coalesce a burst across many files into
-* one callback," which is what the dev loop actually needs.
-*/
-const DEBOUNCE_MS = 300;
-/** Bundles → watch targets, plus the addresses with nothing watchable (the pinned one-line startup note). */
-function watchTargetsFrom(bundles) {
-	const targets = [];
-	const unwatchable = [];
-	for (const [address, bundle] of Object.entries(bundles)) {
-		const paths = bundle.watch;
-		if (paths === void 0 || paths.length === 0) {
-			unwatchable.push(address);
-			continue;
-		}
-		targets.push({
-			address,
-			paths
-		});
-	}
-	return {
-		targets,
-		unwatchable
-	};
-}
-/**
-* Watches every target's paths via chokidar, debounced 300 ms and coalesced
-* across every service, invoking `onChange` once per burst.
-*
-* File targets are watched THROUGH their parent directory, filtered to the
-* exact path: a watch bound directly to a file dies with the file's inode
-* on Linux, so `rm -rf dist && bun build --outfile dist/x.mjs` — every
-* rebuild's shape — would go silently unobserved after the first delete
-* (chokidar absorbs atomic renames, not unlink+recreate of a directly
-* watched file; proven by the delete-recreate test failing on Linux CI
-* only). Directory targets are watched recursively as themselves; a
-* nonexistent path is treated as a file target, so it starts reporting the
-* moment something creates it.
-*/
-function startWatch(targets, onChange) {
-	let timer;
-	const trigger = () => {
-		if (timer !== void 0) clearTimeout(timer);
-		timer = setTimeout(() => {
-			timer = void 0;
-			onChange();
-		}, DEBOUNCE_MS);
-	};
-	const fileTargets = /* @__PURE__ */ new Set();
-	const directoryRoots = /* @__PURE__ */ new Set();
-	const parentRoots = /* @__PURE__ */ new Set();
-	for (const target of targets) for (const p of target.paths) {
-		const abs = path.resolve(p);
-		let isDirectory = false;
-		try {
-			isDirectory = fs.statSync(abs).isDirectory();
-		} catch {}
-		if (isDirectory) directoryRoots.add(abs);
-		else {
-			fileTargets.add(abs);
-			parentRoots.add(path.dirname(abs));
-		}
-	}
-	const reportError = (error) => {
-		console.error(`[dev] watch error: ${error instanceof Error ? error.message : String(error)}`);
-	};
-	const watchers = [];
-	if (directoryRoots.size > 0) {
-		const directoryWatcher = esm_default.watch([...directoryRoots], { ignoreInitial: true });
-		directoryWatcher.on("all", () => trigger());
-		directoryWatcher.on("error", reportError);
-		watchers.push(directoryWatcher);
-	}
-	if (parentRoots.size > 0) {
-		const parentWatcher = esm_default.watch([...parentRoots], {
-			ignoreInitial: true,
-			depth: 0
-		});
-		parentWatcher.on("all", (_event, eventPath) => {
-			if (fileTargets.has(path.resolve(eventPath))) trigger();
-		});
-		parentWatcher.on("error", reportError);
-		watchers.push(parentWatcher);
-	}
-	let markReady = () => {};
-	const allReady = Promise.all(watchers.map((watcher) => new Promise((resolve) => watcher.on("ready", () => resolve())))).then(() => {});
-	return {
-		ready: Promise.race([allReady, new Promise((resolve) => markReady = resolve)]),
-		stop: () => {
-			if (timer !== void 0) clearTimeout(timer);
-			markReady();
-			for (const watcher of watchers) watcher.close();
-		}
-	};
-}
-/**
-* Local-dev spec § 6 `run-dev.ts`: `prisma-composer dev <entry>` — steps 1–6
-* of `run()` reused via pipeline.ts, then the dev-only pipeline: capability
-* check, containers, `--fresh` teardown, preflight, emulators, converge
-* against a generated dev stack file, attach (front door + merged logs),
-* watch loop until interrupted.
-*/
-function toCliError$1(error) {
-	return error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
-}
-/** `[dev] ready:` then one line per endpoint, ordered by address depth (fewest dots first) then lexicographic. Exported for tests. */
-function renderFrontDoor(endpoints) {
-	return ["[dev] ready:", ...[...endpoints].sort((a, b) => {
-		const depthA = a.address.split(".").length;
-		const depthB = b.address.split(".").length;
-		if (depthA !== depthB) return depthA - depthB;
-		return a.address < b.address ? -1 : a.address > b.address ? 1 : 0;
-	}).map((e) => `[dev] ${e.address}  ${e.url}`)];
-}
-function printFrontDoor(endpoints) {
-	for (const line of renderFrontDoor(endpoints)) console.log(line);
-}
-const EMULATOR_RETRY_ATTEMPTS = 5;
-const EMULATOR_RETRY_DELAY_MS = 500;
-/** An emulator admin call right after a converge that just PUT dozens of resources through the same daemon can hit a transient refused/reset connection — a brief loopback hiccup under load, not a real failure. Retried before giving up. Applies to every attach admin call the dev session makes (`startServices`, `endpoints`). */
-async function withEmulatorRetry(call) {
-	let lastError;
-	for (let attempt = 1; attempt <= EMULATOR_RETRY_ATTEMPTS; attempt += 1) try {
-		return await call();
-	} catch (error) {
-		lastError = error;
-		if (attempt < EMULATOR_RETRY_ATTEMPTS) await new Promise((resolve) => setTimeout(resolve, EMULATOR_RETRY_DELAY_MS));
-	}
-	throw lastError instanceof Error ? lastError : new Error(String(lastError));
-}
-async function mergedEndpoints(attachments) {
-	return (await Promise.all(attachments.map((a) => withEmulatorRetry(() => a.endpoints())))).flat();
-}
-/** Runs the full dev pipeline; returns the process exit code. */
-async function runDev(args, deps = {}) {
-	if (process.platform === "win32") throw new CliError("local dev is not supported on Windows yet.");
-	const cwd = process.cwd();
-	const devDir = path.join(cwd, DEV_DIR);
-	const pipelineDeps = {
-		runAssembler: deps.runAssembler,
-		config: deps.config
-	};
-	const { configPath, config, entryModule, graph, name, assembled } = await runPipeline(args.entry, args.name, cwd, pipelineDeps);
-	let resolved;
-	try {
-		resolved = await resolveLocalTargets(config);
-	} catch (error) {
-		throw toCliError$1(error);
-	}
-	const containers = /* @__PURE__ */ new Map();
-	for (const [id, dev] of resolved) try {
-		containers.set(id, await dev.container.ensure({
-			appName: name,
-			stage: void 0
-		}));
-	} catch (error) {
-		throw toCliError$1(error);
-	}
-	if (args.fresh) for (const [id, dev] of resolved) {
-		if (dev.teardown === void 0) continue;
-		try {
-			await dev.teardown({
-				container: containers.get(id),
-				stage: void 0
-			});
-		} catch (error) {
-			throw toCliError$1(error);
-		}
-	}
-	for (const [id, dev] of resolved) {
-		if (dev.preflight === void 0) continue;
-		try {
-			await dev.preflight({
-				graph,
-				container: containers.get(id),
-				stage: void 0
-			});
-		} catch (error) {
-			throw toCliError$1(error);
-		}
-	}
-	for (const [id, dev] of resolved) {
-		if (dev.emulators === void 0) continue;
-		try {
-			await dev.emulators({
-				graph,
-				container: containers.get(id),
-				devDir
-			});
-		} catch (error) {
-			throw toCliError$1(error);
-		}
-	}
-	const converge = () => {
-		const stackPath = writeDevStackFile({
-			entryPath: entryModule.path,
-			cwd,
-			configPath,
-			name,
-			assembled
-		});
-		const status = (deps.alchemy ?? runAlchemy)({
-			command: "deploy",
-			stackFileRelativePath: DEV_STACK_RELATIVE_PATH,
-			cwd,
-			stage: "dev",
-			containerEnv: containerEnv(containers)
-		});
-		if (status !== 0) {
-			console.error(`\nGenerated stack file: ${stackPath}`);
-			console.error(`Run \`alchemy deploy ${DEV_STACK_RELATIVE_PATH} --yes --stage dev\` from ${cwd} to reproduce this directly.`);
-		}
-		return status;
-	};
-	const firstStatus = converge();
-	if (firstStatus !== 0) return firstStatus;
-	const attachments = [];
-	for (const [id, dev] of resolved) attachments.push(await dev.attach({
-		container: containers.get(id),
-		devDir
-	}));
-	const started = [];
-	for (const attachment of attachments) try {
-		await withEmulatorRetry(() => attachment.startServices());
-		started.push(attachment);
-	} catch (error) {
-		await Promise.all(started.map((a) => a.stopServices().catch(() => void 0)));
-		throw toCliError$1(error);
-	}
-	printFrontDoor(await mergedEndpoints(attachments));
-	console.log(`[dev] logs: prisma-composer log ${args.entry}`);
-	const { targets, unwatchable } = watchTargetsFrom(assembled.bundles);
-	for (const address of unwatchable) console.log(`[dev] ${address} has no watchable inputs`);
-	const watch = startWatch(targets, () => {
-		(async () => {
-			try {
-				const rePipeline = await runPipeline(args.entry, args.name, cwd, pipelineDeps);
-				writeDevStackFile({
-					entryPath: rePipeline.entryModule.path,
-					cwd,
-					configPath: rePipeline.configPath,
-					name: rePipeline.name,
-					assembled: rePipeline.assembled
-				});
-				if ((deps.alchemy ?? runAlchemy)({
-					command: "deploy",
-					stackFileRelativePath: DEV_STACK_RELATIVE_PATH,
-					cwd,
-					stage: "dev",
-					containerEnv: containerEnv(containers)
-				}) !== 0) {
-					console.error("[dev] converge failed — the running app is untouched; still watching.");
-					return;
-				}
-				printFrontDoor(await mergedEndpoints(attachments));
-			} catch (error) {
-				console.error(`[dev] rebuild failed: ${error instanceof Error ? error.message : String(error)}`);
-			}
-		})();
-	});
-	await watch.ready;
-	await new Promise((resolve) => {
-		let stopping = false;
-		const finish = () => {
-			if (stopping) return;
-			stopping = true;
-			console.log("[dev] stopping — the app's services are stopping; emulators and data stay up.");
-			watch.stop();
-			(async () => {
-				for (const attachment of attachments) await attachment.stopServices().catch(() => void 0);
-				console.log("[dev] stopped.");
-				resolve();
-			})();
-		};
-		process.removeAllListeners("SIGINT");
-		process.removeAllListeners("SIGTERM");
-		process.on("SIGINT", finish);
-		process.on("SIGTERM", finish);
-	});
-	return 0;
-}
-/** Pipeline step 6: writes a regenerated-every-run, independently runnable stack module at `.prisma-composer/alchemy.run.ts`. */
-const GENERATED_DIR = ".prisma-composer";
-const GENERATED_FILE = "alchemy.run.ts";
-/** A relative import specifier from `.prisma-composer/alchemy.run.ts` to `target` (posix separators). */
-function relativeImportSpecifier(generatedDir, target) {
-	const rel = path.relative(generatedDir, target).split(path.sep).join("/");
-	return rel.startsWith(".") ? rel : `./${rel}`;
-}
-function quote(value) {
-	return JSON.stringify(value);
-}
-function renderBundle(bundle) {
-	return `{ dir: ${quote(bundle.dir)}, entry: ${quote(bundle.entry)} }`;
-}
-function renderOptions(input) {
-	const lines = [];
-	lines.push(`  name: ${quote(input.name)},`);
-	lines.push("  bundles: {");
-	for (const [id, bundle] of Object.entries(input.assembled.bundles)) lines.push(`    ${quote(id)}: ${renderBundle(bundle)},`);
-	lines.push("  },");
-	lines.push("  report: deploymentReport,");
-	return lines.join("\n");
-}
-/** Renders the stack module's source (tests assert on it without touching disk) — uses `//` headers, not a block comment, since a cwd path with a star-slash could close one early. */
-function renderStackFile(input) {
-	const generatedDir = path.join(input.cwd, GENERATED_DIR);
-	const appImport = relativeImportSpecifier(generatedDir, input.entryPath);
-	const configImport = relativeImportSpecifier(generatedDir, input.configPath);
-	return `// Generated by \`prisma-composer deploy\`/\`prisma-composer destroy\` — overwritten on every
-// run; do not edit by hand. Independently runnable from ${quote(input.cwd)}:
-//
-//   alchemy deploy ${GENERATED_DIR}/${GENERATED_FILE}
-//
-// bisects a CLI bug from an Alchemy bug (deploy-cli.md § Implementation decisions).
-import { lower } from '@prisma/composer/deploy';
-import { deploymentReport } from '@prisma/composer/report';
-import config from ${quote(configImport)};
-import app from ${quote(appImport)};
-
-export default lower(app, config, {
-${renderOptions(input)}
-});
-`;
-}
-/** Writes the stack file, returning its absolute path. */
-function writeStackFile(input) {
-	const generatedDir = path.join(input.cwd, GENERATED_DIR);
-	fs.mkdirSync(generatedDir, { recursive: true });
-	const filePath = path.join(generatedDir, GENERATED_FILE);
-	fs.writeFileSync(filePath, renderStackFile(input));
-	return filePath;
-}
-const GENERATED_STACK_RELATIVE_PATH = path.join(GENERATED_DIR, GENERATED_FILE);
-/**
-* `prisma-composer log <entry> [address]` — tail the merged logs of an
-* already-running local app. It resolves the app the way `dev` does (config →
-* localTarget → container → attach) but calls only the attachment's `logs()`
-* view: it neither builds, provisions, starts, nor stops anything. `dev` no
-* longer streams logs inline (that drowned the front door once it supervises
-* more than one service); this is where logs live.
-*/
-function toCliError(error) {
-	return error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
-}
-/** Runs the log tail until interrupted; returns the process exit code. */
-async function runLog(args, deps = {}) {
-	if (process.platform === "win32") throw new CliError("local dev is not supported on Windows yet.");
-	const cwd = process.cwd();
-	const devDir = path.join(cwd, DEV_DIR);
-	const { config, name } = deps.identity ?? await resolveAppIdentity(args.entry, args.name, cwd, { config: deps.config });
-	let resolved;
-	try {
-		resolved = await resolveLocalTargets(config);
-	} catch (error) {
-		throw toCliError(error);
-	}
-	const attachments = [];
-	for (const target of resolved.values()) try {
-		const container = await target.container.ensure({
-			appName: name,
-			stage: void 0
-		});
-		attachments.push(await target.attach({
-			container,
-			devDir
-		}));
-	} catch (error) {
-		throw toCliError(error);
-	}
-	const services = (await Promise.all(attachments.map((a) => a.endpoints()))).flat();
-	if (services.length === 0) {
-		console.error(`[log] no running services for "${name}" — start it first with \`prisma-composer dev ${args.entry}\`.`);
-		return 0;
-	}
-	if (args.address !== void 0 && !services.some((s) => s.address === args.address)) throw new CliError(`no service "${args.address}" in "${name}" — running services: ${services.map((s) => s.address).join(", ")}.`);
-	const controller = new AbortController();
-	const finish = () => controller.abort();
-	process.on("SIGINT", finish);
-	process.on("SIGTERM", finish);
-	try {
-		await Promise.all(attachments.map(async (attachment) => {
-			try {
-				for await (const { service, line } of attachment.logs(controller.signal, { tail: args.tail })) {
-					if (controller.signal.aborted) return;
-					if (args.address !== void 0 && service !== args.address) continue;
-					console.log(`[${service}] ${line}`);
-				}
-			} catch (error) {
-				if (!controller.signal.aborted) console.error(`[log] stream failed: ${error instanceof Error ? error.message : String(error)}`);
-			}
-		}));
-	} finally {
-		process.off("SIGINT", finish);
-		process.off("SIGTERM", finish);
-	}
-	return 0;
-}
-/** A stage name must be a valid git ref (deploy-cli.md) — checked via `git check-ref-format`, never silently normalized. Runs before anything platform-specific. */
-function validateStageName(stage) {
-	const result = spawnSync("git", ["check-ref-format", `refs/heads/${stage}`], { stdio: "ignore" });
-	if (result.error) throw new CliError(`git is required to validate --stage "${stage}" (git check-ref-format): ${result.error.message}.`);
-	if (result.status !== 0) throw new CliError(`Invalid --stage "${stage}": must be a valid git ref name (git check-ref-format rejected "refs/heads/${stage}").`);
-}
-/**
-* Argument parsing (clipanion — prisma-next's CLI idiom, see
-* prisma-next/packages/1-framework/3-tooling/cli/src/migration-cli.ts) +
-* orchestration of deploy-cli.md § The pipeline.
-*/
-const BINARY_NAME = "prisma-composer";
-/** The <entry>/--name/--stage surface shared by deploy and destroy; execute() is unused — run() drives the pipeline directly so error handling stays under this module's control. */
-var DeployCliCommand = class extends Command {
-	entry = Option.String({ name: "entry" });
-	name = Option.String("--name", { description: "Override the root node's name — the deploy's application name." });
-	stage = Option.String("--stage", { description: "Alchemy stage to target." });
-	production = Option.Boolean("--production", false, { description: "destroy: tear down the project-level production environment (required to destroy production)." });
-	async execute() {
-		return 0;
-	}
-};
-var DeployCommand = class extends DeployCliCommand {
-	static paths = [["deploy"]];
-	static usage = Command.Usage({
-		description: "Deploy the application whose root node is <entry>'s default export.",
-		examples: [["Deploy an app", "$0 deploy src/service.ts"]]
-	});
-	action = "deploy";
-};
-var DestroyCommand = class extends DeployCliCommand {
-	static paths = [["destroy"]];
-	static usage = Command.Usage({
-		description: "Tear down the application whose root node is <entry>'s default export — same derivation as deploy, Alchemy destroy.",
-		examples: [["Destroy an app", "$0 destroy src/service.ts"]]
-	});
-	action = "destroy";
-};
-/** `<entry>`/`--name`/`--fresh` only — no `--stage`/`--production` (local-dev spec § 6: a working directory has exactly one dev instance, no stages). */
-var DevCommand = class extends Command {
-	static paths = [["dev"]];
-	static usage = Command.Usage({
-		description: "Bring up the application whose root node is <entry>'s default export, entirely on this machine, credential-free.",
-		examples: [["Run an app locally", "$0 dev src/service.ts"]]
-	});
-	entry = Option.String({ name: "entry" });
-	name = Option.String("--name", { description: "Override the root node's name — the dev instance's application name." });
-	fresh = Option.Boolean("--fresh", false, { description: "Destroy the dev stack and wipe the dev state directory before starting." });
-	async execute() {
-		return 0;
-	}
-};
-var LogCommand = class extends Command {
-	static paths = [["log"]];
-	static usage = Command.Usage({
-		description: "Tail the merged logs of the locally-running application whose root node is <entry>'s default export.",
-		examples: [["Tail every service", "$0 log src/service.ts"], ["Tail one service", "$0 log src/service.ts catalog.service"]]
-	});
-	entry = Option.String({ name: "entry" });
-	address = Option.String({
-		name: "address",
-		required: false
-	});
-	name = Option.String("--name", { description: "Override the root node's name — the dev instance's application name." });
-	tail = Option.String("--tail", { description: `How many trailing history lines to show before live output (default ${String(DEFAULT_LOG_TAIL)}).` });
-	async execute() {
-		return 0;
-	}
-};
-function buildCli() {
-	return Cli.from([
-		DeployCommand,
-		DestroyCommand,
-		DevCommand,
-		LogCommand
-	], {
-		binaryName: BINARY_NAME,
-		binaryLabel: "The prisma-composer deploy CLI"
-	});
-}
-/** Thrown internally when the user explicitly asked for `--help`/`-h` — run() prints it to stdout and exits 0; not a usage error. */
-var HelpRequested = class extends Error {};
-/** Duck-typed: clipanion's UnknownSyntaxError isn't re-exported, so match its name + clipanion.type discriminator (mirrors prisma-next's migration-cli.ts). */
-function isUnknownSyntaxError(error) {
-	if (!(error instanceof Error) || error.name !== "UnknownSyntaxError") return false;
-	const meta = error.clipanion;
-	return typeof meta === "object" && meta !== null && meta.type === "none";
-}
-/** `log`'s default backlog: an empty screen reads as broken, so show a little recent history before going live. */
-const DEFAULT_LOG_TAIL = 20;
-/** Exported for direct testing (main.test.ts) — not part of the package's public barrel (see index.ts). */
-function parseArgs(argv) {
-	const cli = buildCli();
-	let command;
-	try {
-		command = cli.process([...argv]);
-	} catch (error) {
-		if (isUnknownSyntaxError(error) || error instanceof UsageError) throw new UsageError(cli.usage(null, { detailed: true }));
-		throw error;
-	}
-	if (command instanceof DeployCommand || command instanceof DestroyCommand) return {
-		command: command.action,
-		entry: command.entry,
-		name: command.name,
-		stage: command.stage,
-		production: command.production,
-		fresh: false
-	};
-	if (command instanceof DevCommand) return {
-		command: "dev",
-		entry: command.entry,
-		name: command.name,
-		stage: void 0,
-		production: false,
-		fresh: command.fresh
-	};
-	if (command instanceof LogCommand) {
-		const tail = command.tail === void 0 ? DEFAULT_LOG_TAIL : Number.parseInt(command.tail, 10);
-		if (Number.isNaN(tail) || tail < 0) throw new UsageError("`--tail` must be a non-negative integer.");
-		return {
-			command: "log",
-			entry: command.entry,
-			name: command.name,
-			stage: void 0,
-			production: false,
-			fresh: false,
-			address: command.address,
-			tail
-		};
-	}
-	if (argv.includes("--help") || argv.includes("-h")) throw new HelpRequested(cli.usage(null, { detailed: true }));
-	throw new UsageError(cli.usage(null, { detailed: true }));
-}
-/** Destroy must name its target explicitly — no silent default to production (spec §10). */
-function effectiveStage(args) {
-	if (args.command === "deploy") {
-		if (args.production) throw new CliError("--production is only valid with `destroy`; `deploy` targets production by default (omit --stage).");
-		return args.stage;
-	}
-	if (args.stage !== void 0 && args.production) throw new CliError("Pass either --stage <name> or --production to `destroy`, not both.");
-	if (args.stage === void 0 && !args.production) throw new CliError("`destroy` requires an explicit target: --stage <name> to tear down a branch environment, or --production to tear down the production environment.");
-	return args.production ? void 0 : args.stage;
-}
-const ALCHEMY_STATE_DIR = ".alchemy";
-/** Warns (doesn't fail) when destroy finds no local deploy state under cwd — likely wrong directory or nothing deployed yet. */
-function warnIfNoLocalDeployState(cwd) {
-	const stateDir = path.join(cwd, ALCHEMY_STATE_DIR);
-	if (!(fs.existsSync(stateDir) && fs.readdirSync(stateDir).length > 0)) console.warn(`\nNo prior deploy state under ${cwd} — if you deployed from a different directory, run destroy from there; otherwise this is a no-op.`);
-}
-/** Runs the full pipeline; returns the process exit code. */
-async function run(argv, deps = {}) {
-	let args;
-	try {
-		args = parseArgs(argv);
-	} catch (error) {
-		if (error instanceof HelpRequested) {
-			console.log(error.message);
-			return 0;
-		}
-		throw error;
-	}
-	if (args.command === "dev") return runDev(args, deps);
-	if (args.command === "log") return runLog({
-		entry: args.entry,
-		name: args.name,
-		address: args.address,
-		tail: args.tail ?? DEFAULT_LOG_TAIL
-	}, { config: deps.config });
-	const stage = effectiveStage(args);
-	if (stage !== void 0) validateStageName(stage);
-	const cwd = process.cwd();
-	if (args.command === "destroy") warnIfNoLocalDeployState(cwd);
-	const pipelineDeps = {
-		runAssembler: deps.runAssembler,
-		config: deps.config
-	};
-	const onAssembleError = args.command === "destroy" ? (error) => new CliError(`${error.message}\n\ndestroy evaluates the same stack program as deploy, which packages the built artifacts — so the app must be built first. Run the build, then retry the destroy.`) : void 0;
-	const { configPath, config, entryModule, graph, name, assembled } = await runPipeline(args.entry, args.name, cwd, pipelineDeps, onAssembleError);
-	const containers = /* @__PURE__ */ new Map();
-	for (const extension of config.extensions) {
-		if (extension.container === void 0) continue;
-		try {
-			if (args.command === "deploy") containers.set(extension.id, await extension.container.ensure({
-				appName: name,
-				stage
-			}));
-			else {
-				const instance = await extension.container.locate({
-					appName: name,
-					stage
-				});
-				if (instance === void 0) throw new CliError(`Nothing deployed for ${name}${stage !== void 0 ? `/${stage}` : ""} — deploy it first.`);
-				containers.set(extension.id, instance);
-			}
-		} catch (error) {
-			throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
-		}
-	}
-	if (args.command === "deploy") for (const extension of config.extensions) {
-		if (extension.preflight === void 0) continue;
-		try {
-			await extension.preflight({
-				graph,
-				container: containers.get(extension.id),
-				stage
-			});
-		} catch (error) {
-			throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
-		}
-	}
-	const stackPath = writeStackFile({
-		entryPath: entryModule.path,
-		cwd,
-		configPath,
-		name,
-		assembled
-	});
-	try {
-		const status = (deps.alchemy ?? runAlchemy)({
-			command: args.command,
-			stackFileRelativePath: GENERATED_STACK_RELATIVE_PATH,
-			cwd,
-			stage,
-			containerEnv: containerEnv(containers)
-		});
-		if (status !== 0) {
-			console.error(`\nGenerated stack file: ${stackPath}`);
-			console.error(`Run \`alchemy ${args.command} ${GENERATED_STACK_RELATIVE_PATH} --yes\` from ${cwd} to reproduce this directly.`);
-			return status;
-		}
-		if (args.command === "destroy") {
-			for (const extension of config.extensions) {
-				if (extension.teardown === void 0) continue;
-				try {
-					await extension.teardown({
-						container: containers.get(extension.id),
-						stage
-					});
-				} catch (error) {
-					throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
-				}
-			}
-			for (const extension of config.extensions) {
-				if (extension.container === void 0) continue;
-				const instance = containers.get(extension.id);
-				if (instance === void 0) continue;
-				try {
-					await extension.container.remove(instance);
-				} catch (error) {
-					throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
-				}
-			}
-		}
-		return status;
-	} catch (error) {
-		console.error(`\nGenerated stack file: ${stackPath}`);
-		throw error;
-	}
-}
-/**
-* Run the `prisma-composer` CLI end to end: dispatch `argv`, map errors to exit
-* codes. Shared by this package's `bin` and the unscoped `prisma-composer` launcher.
-*/
-async function cli(argv = process.argv.slice(2)) {
-	try {
-		process.exitCode = await run(argv);
-	} catch (error) {
-		if (error instanceof UsageError) {
-			console.error(error.message);
-			process.exitCode = 1;
-			return;
-		}
-		console.error(`Error: ${error instanceof Error ? error.message : String(error)}`);
-		process.exitCode = 1;
+import { a as CliStructuredError, t as checkEffectResolution } from "./shared-CCaR42wo-BvegvmA_.mjs";
+import { n as renderErrorEnvelope } from "./render-error-DsPN5qfr-CkVGj9uP.mjs";
+//#region ../../0-framework/3-tooling/cli/dist/bin.mjs
+try {
+	checkEffectResolution(process.cwd());
+} catch (error) {
+	if (CliStructuredError.is(error)) {
+		console.error(renderErrorEnvelope(error.toEnvelope()));
+		process.exit(2);
 	}
+	throw error;
 }
-//#endregion
-//#region ../../0-framework/3-tooling/cli/dist/bin.mjs
+const { cli } = await import("./cli-B3sWzFlb-CxEIzKsQ.mjs");
 cli();
 //#endregion
 export {};