@prisma/composer 0.6.0-dev.7 → 0.6.0-dev.9

package/dist/pipeline-D3QoVzAB-D_ufjg3N.mjs

@@ -0,0 +1,857 @@
+import { a as CliStructuredError, o as blindCast } from "./shared-CCaR42wo-BvegvmA_.mjs";
+import { i as InternalError } from "./result-CFqJKiqg.mjs";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { pathToFileURL } from "node:url";
+import * as c12 from "c12";
+//#region ../../0-framework/1-core/core/dist/graph-BJgUfGB0.mjs
+/**
+* Thrown by Load when the graph is malformed. Structured at origin
+* (base-type rule 6): one type-level code covers every raise site until a
+* finer per-site taxonomy is carved out. The `name` stays
+* `CliStructuredError` — structural recognition depends on it.
+*/
+var LoadError = class extends CliStructuredError {
+	constructor(message) {
+		super("COMPOSE.GRAPH_INVALID", message);
+	}
+};
+/**
+* Core model: node types and the factories that construct them, plain frozen
+* data objects. A node's `extension` + `type` form its deploy-time registry key (ADR-0017).
+*/
+const NODE = Symbol.for("prisma:node");
+blindCast(Symbol.for("prisma:secret-need"));
+const SECRET_SOURCE = blindCast(Symbol.for("prisma:secret-source"));
+/** True if `value` is a secret source (an `envSecret` result or a forwarded ctx.secrets ref). */
+function isSecretSource(value) {
+	return typeof value === "object" && value !== null && blindCast(value)[SECRET_SOURCE] === true;
+}
+blindCast(Symbol.for("prisma:provision-need"));
+const PARAM_SOURCE = blindCast(Symbol.for("prisma:param-source"));
+blindCast(Symbol.for("prisma:param-need"));
+/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */
+function isParamSource(value) {
+	return typeof value === "object" && value !== null && blindCast(value)[PARAM_SOURCE] === true;
+}
+/**
+* Core's grammar for every name that becomes a config-key segment —
+* addresses, input/param/secret names: ASCII letters and digits only.
+* Conservative by design so any target medium — POSIX env-var keys
+* included — can uppercase and "_"-join segments without escaping.
+*/
+function isConfigKeySegment(name) {
+	return /^[A-Za-z0-9]+$/.test(name);
+}
+/**
+* True if `value` was constructed by this module's factories. Checks the
+* brand only, never a prototype — a graph may mix nodes from a different
+* installed copy of core (dual-package hazard).
+*/
+function isNode(value) {
+	return typeof value === "object" && value !== null && value[NODE] === true;
+}
+/**
+* Stable topological sort: every edge's `from` precedes its `to` in the
+* result. Ties (nodes with no ordering constraint between them) keep their
+* relative order from `nodes` — so a graph already authored producer-first
+* comes out byte-identical to its pre-sort layout; only a graph that
+* genuinely needs reordering (e.g. a module wired via a forged ref pointing at a
+* not-yet-provisioned producer) actually moves. A Kahn's-algorithm variant
+* that always picks the ready node with the smallest original index. Edges
+* whose endpoint falls outside `nodes` (e.g. a service-root's input edges
+* targeting the root, which is appended separately) are ignored. Cycles
+* cannot reach here: `assertDependencyDag` already rejects them for
+* dependency edges, and input edges never cycle.
+*/
+function topoSort(nodes, edges) {
+	const byId = new Map(nodes.map((n) => [n.id, n]));
+	const indexOf = new Map(nodes.map((n, i) => [n.id, i]));
+	const indegree = new Map(nodes.map((n) => [n.id, 0]));
+	const successors = /* @__PURE__ */ new Map();
+	for (const edge of edges) {
+		if (!byId.has(edge.from) || !byId.has(edge.to)) continue;
+		const targets = successors.get(edge.from) ?? [];
+		targets.push(edge.to);
+		successors.set(edge.from, targets);
+		indegree.set(edge.to, (indegree.get(edge.to) ?? 0) + 1);
+	}
+	const ready = new Set(nodes.filter((n) => indegree.get(n.id) === 0).map((n) => n.id));
+	const order = [];
+	while (ready.size > 0) {
+		let next;
+		let bestIndex = Number.POSITIVE_INFINITY;
+		for (const id of ready) {
+			const index = indexOf.get(id) ?? Number.POSITIVE_INFINITY;
+			if (index < bestIndex) {
+				bestIndex = index;
+				next = id;
+			}
+		}
+		if (next === void 0) break;
+		ready.delete(next);
+		order.push(next);
+		for (const target of successors.get(next) ?? []) {
+			const remaining = (indegree.get(target) ?? 0) - 1;
+			indegree.set(target, remaining);
+			if (remaining === 0) ready.add(target);
+		}
+	}
+	if (order.length !== nodes.length) throw new InternalError(`topological sort processed ${order.length} of ${nodes.length} nodes — the graph contains a cycle that slipped past the DAG validation.`);
+	return order.map((id) => byId.get(id)).filter((n) => n !== void 0);
+}
+function serviceInputs(service, serviceId) {
+	if (typeof service.inputs !== "object" || service.inputs === null) throw new LoadError(`Service "${serviceId}" has no inputs map.`);
+	const nodes = [];
+	const edges = [];
+	for (const [input, value] of Object.entries(service.inputs)) {
+		const kind = isNode(value) ? value.kind : void 0;
+		if (kind === "resource") throw new LoadError(`Input "${input}" of "${serviceId}" is a resource node — a resource is provisioned by the composing module, never created for a service that mentions it. Declare the input as a dependency (the pack's dependency factory) and wire the module-provisioned resource's ref into it.`);
+		if (kind !== "dependency") throw new LoadError(`Input "${input}" of "${serviceId}" is not a branded dependency end (construct it with the dependency() factory).`);
+		if (value.type.length === 0) throw new LoadError(`Input "${input}" of "${serviceId}" has an empty node type.`);
+		const id = `${serviceId}.${input}`;
+		nodes.push({
+			id,
+			node: value
+		});
+		edges.push({
+			from: id,
+			to: serviceId,
+			input,
+			kind: "input"
+		});
+	}
+	return {
+		nodes,
+		edges
+	};
+}
+function loadService(root, rootId) {
+	for (const [input, value] of Object.entries(root.inputs)) if (isNode(value) && value.kind === "dependency") throw new LoadError(`Service "${rootId}" has an unwired dependency input "${input}" — this service is composed by a module; deploy the module instead of loading "${rootId}" directly.`);
+	if (root.inputSchema !== void 0) throw new LoadError(`Service "${rootId}" declares an input schema but is being loaded directly — a lone service has no enclosing scope to bind its input. Compose it inside a module whose provision() call binds \`input: { … }\` (ADR-0042).`);
+	const rootGraphNode = {
+		id: rootId,
+		node: root
+	};
+	const { nodes, edges } = serviceInputs(root, rootId);
+	return {
+		root: rootGraphNode,
+		nodes: [...topoSort(nodes, edges), rootGraphNode],
+		edges,
+		inputBindings: [],
+		params: []
+	};
+}
+/**
+* Builds the ref a provision() call hands back: the id (so a producer with no
+* exposed ports — or an untyped slot — can still be wired wholesale) plus one
+* ref-port per exposed contract, each the contract's own runtime value (so
+* its `satisfies()` still works) tagged with the provider's id.
+*/
+function refFor(id, service) {
+	const ports = {};
+	for (const [port, contract] of Object.entries(service.expose ?? {})) ports[port] = {
+		...contract,
+		__providerId: id
+	};
+	return blindCast({
+		id,
+		...ports
+	});
+}
+/**
+* The resource variant of refFor: a resource has exactly one port — the
+* contract it provides — flattened onto the ref itself, tagged with the
+* provider id. `id` is written last so a hostile contract value cannot
+* clobber it.
+*/
+function refForResource(id, resource) {
+	return blindCast({
+		...resource.provides,
+		__providerId: id,
+		id
+	});
+}
+/** A wired value's producer id: a ref-port's `__providerId`, or a bare ref's `id`. */
+function producerIdOf(ref) {
+	if (typeof ref !== "object" || ref === null) return void 0;
+	if ("__providerId" in ref && typeof ref.__providerId === "string") return ref.__providerId;
+	if ("id" in ref && typeof ref.id === "string") return ref.id;
+}
+/**
+* Brands each `ctx.inputs` entry with the input key it stands for (see
+* flatten): diagnostic only — usage attribution relies on the per-key object
+* identity the branding copy creates, never on reading this back.
+*/
+const MODULE_INPUT_KEY = Symbol("prisma:module-input-key");
+/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.secrets` forwarding channel. */
+const MODULE_SECRET_KEY = Symbol("prisma:module-secret-key");
+/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.params` forwarding channel. */
+const MODULE_PARAM_KEY = Symbol("prisma:module-param-key");
+/** Whether `ref` carries a callable `satisfies` that accepts `required` truthily. */
+function satisfiesRequired(ref, required) {
+	return typeof ref === "object" && ref !== null && "satisfies" in ref && typeof ref.satisfies === "function" && ref.satisfies(required);
+}
+/**
+* Checks one recorded `wiring` object against the Deps it was wired against:
+* every named input exists and is a dependency slot, every referenced
+* producer is a real (by-now-provisioned) address, and a wired ref whose
+* slot declares a required contract must satisfy() it — no producer-kind
+* branching, the contract alone determines validity, whether the producer is
+* a service port or a resource. Shared by both provisioned kinds so a
+* module-as-child gets exactly the checks a service gets, and run once per
+* entry against the one `byId` shared by the whole recursive flatten, so a
+* forwarded ref resolves through to its real producer address regardless of
+* which ancestor scope provisioned it.
+*/
+function validateWiring(pending, byId) {
+	const { deps, wiring, targetId, targetKind, enclosingModuleName } = pending;
+	for (const [input, ref] of Object.entries(wiring)) {
+		const declared = blindCast(deps[input]);
+		if (declared === void 0 || !isNode(declared) || declared.kind !== "dependency") throw new LoadError(`The deps for "${targetId}" name "${input}", which is not a dependency slot of that ${targetKind}.`);
+		const producerId = producerIdOf(ref);
+		const producer = producerId !== void 0 ? byId.get(producerId) : void 0;
+		if (producerId === void 0 || producer === void 0) throw new LoadError(`The deps for "${targetId}.${input}" reference "${String(producerId)}", which is not provisioned in module "${enclosingModuleName}".`);
+		const required = declared.required;
+		if (required !== void 0 && !satisfiesRequired(ref, required)) throw new LoadError(`The deps for "${targetId}.${input}" do not satisfy the slot's required contract.`);
+	}
+	for (const [input, rawValue] of Object.entries(deps)) {
+		const value = blindCast(rawValue);
+		if (!isNode(value) || wiring[input] !== void 0) continue;
+		if (value.kind === "dependency") throw new LoadError(`Dependency input "${input}" of provisioned ${targetKind} "${targetId}" is not wired to a producer (module "${enclosingModuleName}").`);
+	}
+}
+/**
+* Flattens a value into itself plus every nested object/array member value —
+* identity fodder for the ctx.secrets/ctx.params usage marking, which must
+* see a forwarded source wherever it sits inside an input binding (ADR-0042).
+* A secret/param source is an opaque leaf: it is pushed (a forwarded ref IS
+* such a source, so identity-matching still needs it) but never descended
+* into, so a ref buried in an unrelated source's payload is not falsely seen
+* as used. `seen` guards object cycles so a self-referential binding cannot
+* recurse forever.
+*/
+function deepValues(value, out, seen = /* @__PURE__ */ new WeakSet()) {
+	out.push(value);
+	if (typeof value !== "object" || value === null) return;
+	if (isSecretSource(value) || isParamSource(value)) return;
+	if (seen.has(value)) return;
+	seen.add(value);
+	const members = Array.isArray(value) ? value : Object.values(value);
+	for (const member of members) deepValues(member, out, seen);
+}
+/** The (unvalidated) edges a `wiring` object implies — one dependency edge per entry; `validateWiring` does the real checking. */
+function wiringEdges(wiring, targetId) {
+	return Object.entries(wiring).map(([input, ref]) => ({
+		from: producerIdOf(ref) ?? "",
+		to: targetId,
+		input,
+		kind: "dependency"
+	}));
+}
+/**
+* Checks the secrets wired into one provisioned child MODULE: every declared
+* forwarding slot is bound to a real secret source (an `envSecret` or a
+* forwarded ctx.secrets ref), and no wired key names a slot the module
+* doesn't declare — the secret analog of `validateWiring`'s per-input checks,
+* but resolved inline (a source carries its own name, so no whole-graph pass
+* is needed).
+*/
+function validateSecretBinding(child, id, secretWiring, enclosingModuleName) {
+	const { kind } = child;
+	for (const slot of Object.keys(child.secretSlots)) {
+		const bound = secretWiring[slot];
+		if (bound === void 0) throw new LoadError(`Secret slot "${slot}" of provisioned ${kind} "${id}" is not bound (module "${enclosingModuleName}") — bind it with envSecret('NAME') or forward ctx.secrets.`);
+		if (!isSecretSource(bound)) throw new LoadError(`Secret slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-secret value — use envSecret('NAME') or a forwarded ctx.secrets ref.`);
+	}
+	for (const slot of Object.keys(secretWiring)) if (!Object.hasOwn(child.secretSlots, slot)) throw new LoadError(`The secrets for "${id}" name "${slot}", which is not a secret slot of that ${kind} (module "${enclosingModuleName}").`);
+}
+/**
+* Checks the params wired into a provisioned SERVICE: unlike a secret slot, a
+* declared param is never required to be bound here — it may fall back to its
+* own `default` (checked later, at `buildConfig`) — so this only rejects a
+* wired key that names something other than a real declared param.
+*/
+function validateServiceParamBinding(child, id, paramWiring, enclosingModuleName) {
+	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.params, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param of that service (module "${enclosingModuleName}").`);
+}
+/**
+* Checks the params wired into a provisioned MODULE: every declared
+* param-forwarding slot must be bound to a real `ParamSource` — a slot has no
+* schema of its own, so (unlike a service param) it cannot fall back to a
+* literal or a default; the param analog of `validateSecretBinding`.
+*/
+function validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {
+	for (const slot of Object.keys(child.paramSlots)) {
+		const bound = paramWiring[slot];
+		if (bound === void 0) throw new LoadError(`Param slot "${slot}" of provisioned module "${id}" is not bound (module "${enclosingModuleName}") — bind it with a param source (e.g. envParam('NAME')) or forward ctx.params.`);
+		if (!isParamSource(bound)) throw new LoadError(`Param slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-source value — a module param-forwarding slot carries no schema to validate a literal against; use envParam('NAME') or a forwarded ctx.params ref.`);
+	}
+	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.paramSlots, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param slot of that module (module "${enclosingModuleName}").`);
+}
+/**
+* Recursively flattens one module's body into the shared graph state and
+* returns its resolved ModuleOutputs (one ref-port per expose key) for the
+* caller (the enclosing provision() call, or Load itself for the root) to
+* use. `address` is this module's OWN full address, or `undefined` for the root
+* scope — its direct children then get bare (unprefixed) addresses, keeping
+* a single-level module identical to before nesting existed. `wiring` supplies a
+* resolved producer ref-port for each of this module's OWN declared deps (empty
+* for the root, which may not declare any — see the root non-empty-deps
+* check in loadModule). `nodes`, `edges`, `pending`, and `byId` are shared
+* across the ENTIRE recursive flatten, not per scope — a nested module may
+* forward in a producer provisioned by an ancestor scope, and it is the
+* shared `byId` (keyed by full address) that lets that resolve.
+*/
+function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes, edges, pending, inputBindings, paramBindings, byId) {
+	const localIds = /* @__PURE__ */ new Set();
+	const used = /* @__PURE__ */ new Set();
+	const usedSecrets = /* @__PURE__ */ new Set();
+	const usedParams = /* @__PURE__ */ new Set();
+	const ctxInputs = {};
+	for (const key of Object.keys(moduleNode.deps)) {
+		const wired = wiring[key];
+		ctxInputs[key] = typeof wired === "object" && wired !== null ? {
+			...wired,
+			[MODULE_INPUT_KEY]: key
+		} : wired;
+	}
+	const markUsed = (values) => {
+		for (const value of values) for (const key of Object.keys(ctxInputs)) if (value === ctxInputs[key]) used.add(key);
+	};
+	const ctxSecrets = {};
+	for (const key of Object.keys(moduleNode.secretSlots)) {
+		const bound = secretWiring[key];
+		ctxSecrets[key] = typeof bound === "object" && bound !== null ? {
+			...bound,
+			[MODULE_SECRET_KEY]: key
+		} : bound;
+	}
+	const markSecretsUsed = (values) => {
+		for (const value of values) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);
+	};
+	const ctxParams = {};
+	for (const key of Object.keys(moduleNode.paramSlots)) {
+		const bound = paramWiring[key];
+		ctxParams[key] = typeof bound === "object" && bound !== null ? {
+			...bound,
+			[MODULE_PARAM_KEY]: key
+		} : bound;
+	}
+	const markParamsUsed = (values) => {
+		for (const value of values) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);
+	};
+	const provision = (child, opts) => {
+		const id = opts?.id ?? child.name;
+		const provisionWiring = opts?.deps;
+		const provisionSecrets = opts?.secrets;
+		const provisionInput = opts?.input;
+		const provisionParams = opts?.params;
+		if (typeof id !== "string" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module "${moduleNode.name}").`);
+		if (!isConfigKeySegment(id)) throw new LoadError(`provision() id "${id}" (module "${moduleNode.name}") must contain only ASCII letters and digits ([A-Za-z0-9]) — the id becomes an address segment, and addresses derive deterministic config keys (segments uppercased and joined with "_"). "${id}" would put "${id.toUpperCase()}" inside the derived key. ("_" collides with the key separator and "." with the address separator.)`);
+		if (localIds.has(id)) throw new LoadError(`Duplicate provision id "${id}" in module "${moduleNode.name}".`);
+		const untrusted = child;
+		if (!isNode(untrusted) || untrusted.kind !== "service" && untrusted.kind !== "resource" && untrusted.kind !== "module") throw new LoadError(`provision("${id}") expects a branded service, resource, or module node (construct it with the service()/resource()/module() factories or a pack's own).`);
+		localIds.add(id);
+		const fullAddress = address === void 0 ? id : `${address}.${id}`;
+		if (child.kind === "resource") {
+			if (provisionWiring !== void 0) throw new LoadError(`provision("${id}") received deps for a resource — a resource has no dependency slots to satisfy.`);
+			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a resource — a resource has no secret slots to satisfy.`);
+			if (provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding for a resource — a resource declares no input schema.`);
+			if (provisionParams !== void 0) throw new LoadError(`provision("${id}") received params for a resource — a resource has no params to satisfy.`);
+			if (child.type.length === 0) throw new LoadError(`provision("${id}") received a resource with an empty node type.`);
+			byId.set(fullAddress, child);
+			nodes.push({
+				id: fullAddress,
+				node: child
+			});
+			return refForResource(fullAddress, child);
+		}
+		const localWiring = { ...provisionWiring ?? {} };
+		markUsed(Object.values(localWiring));
+		const localSecrets = { ...provisionSecrets ?? {} };
+		markSecretsUsed(Object.values(localSecrets));
+		const localParams = { ...provisionParams ?? {} };
+		markParamsUsed(Object.values(localParams));
+		if (child.kind === "service") {
+			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a service — a service takes its secrets as envSecret(...) leaves of its \`input\` binding (ADR-0042), not a secrets map.`);
+			if (child.inputSchema !== void 0 && provisionInput === void 0) throw new LoadError(`Input of provisioned service "${id}" is not bound (module "${moduleNode.name}") — the service declares an input schema; bind it with \`input: { … }\` on its provision() call.`);
+			if (child.inputSchema === void 0 && provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding, but the service declares no input schema (module "${moduleNode.name}").`);
+			if (provisionInput !== void 0) {
+				const leaves = [];
+				deepValues(provisionInput, leaves);
+				markSecretsUsed(leaves);
+				markParamsUsed(leaves);
+				inputBindings.push({
+					serviceAddress: fullAddress,
+					binding: blindCast(provisionInput)
+				});
+			}
+			validateServiceParamBinding(child, id, localParams, moduleNode.name);
+			for (const [slot, binding] of Object.entries(localParams)) paramBindings.push({
+				serviceAddress: fullAddress,
+				slot,
+				binding
+			});
+			const inputs = serviceInputs(child, fullAddress);
+			nodes.push(...inputs.nodes, {
+				id: fullAddress,
+				node: child
+			});
+			edges.push(...inputs.edges, ...wiringEdges(localWiring, fullAddress));
+			pending.push({
+				deps: child.inputs,
+				wiring: localWiring,
+				targetId: fullAddress,
+				targetKind: "service",
+				enclosingModuleName: moduleNode.name
+			});
+			byId.set(fullAddress, child);
+			return refFor(fullAddress, child);
+		}
+		if (provisionInput !== void 0) throw new LoadError(`provision("${id}") received an input binding for a module — a module has no input schema; bind the input on the service that declares it.`);
+		validateSecretBinding(child, id, localSecrets, moduleNode.name);
+		validateParamNeedBinding(child, id, localParams, moduleNode.name);
+		edges.push(...wiringEdges(localWiring, fullAddress));
+		pending.push({
+			deps: child.deps,
+			wiring: localWiring,
+			targetId: fullAddress,
+			targetKind: "module",
+			enclosingModuleName: moduleNode.name
+		});
+		const childOutputs = flatten(child, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, inputBindings, paramBindings, byId);
+		nodes.push({
+			id: fullAddress,
+			node: child
+		});
+		byId.set(fullAddress, child);
+		return blindCast({
+			id: fullAddress,
+			...childOutputs
+		});
+	};
+	const ctx = blindCast({
+		inputs: ctxInputs,
+		secrets: ctxSecrets,
+		params: ctxParams,
+		provision: blindCast(provision)
+	});
+	const outputs = blindCast(moduleNode.body(ctx) ?? {});
+	markUsed(Object.values(outputs));
+	for (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares input "${key}" but never forwards it into a provision nor returns it as an output.`);
+	for (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares secret "${key}" but never forwards it into a provision.`);
+	for (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares param "${key}" but never forwards it into a provision.`);
+	for (const [key, contract] of Object.entries(moduleNode.expose)) {
+		const port = outputs[key];
+		if (port === void 0) throw new LoadError(`Module "${moduleNode.name}" declares expose "${key}" but its body did not return a port for it.`);
+		if (!satisfiesRequired(port, contract)) throw new LoadError(`Module "${moduleNode.name}"'s returned port for expose "${key}" does not satisfy its declared contract.`);
+	}
+	return outputs;
+}
+function loadModule(root, opts) {
+	const rootId = opts?.id ?? root.name;
+	const rootDepKeys = Object.keys(root.deps);
+	if (rootDepKeys.length > 0) {
+		const names = rootDepKeys.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Module "${root.name}" declares input${rootDepKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to wire them; compose "${root.name}" from another module that provisions and wires it instead.`);
+	}
+	const rootSecretKeys = Object.keys(root.secretSlots);
+	if (rootSecretKeys.length > 0) {
+		const names = rootSecretKeys.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Module "${root.name}" declares secret${rootSecretKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds secrets with envSecret('NAME'), it does not declare secret slots of its own.`);
+	}
+	const rootParamKeys = Object.keys(root.paramSlots);
+	if (rootParamKeys.length > 0) {
+		const names = rootParamKeys.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Module "${root.name}" declares param${rootParamKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds params directly on each provision() call, it does not declare param-forwarding slots of its own.`);
+	}
+	const nodes = [];
+	const edges = [];
+	const pending = [];
+	const inputBindings = [];
+	const paramBindings = [];
+	const byId = /* @__PURE__ */ new Map();
+	flatten(root, void 0, {}, {}, {}, nodes, edges, pending, inputBindings, paramBindings, byId);
+	for (const entry of pending) validateWiring(entry, byId);
+	assertDependencyDag(edges);
+	const rootGraphNode = {
+		id: rootId,
+		node: root
+	};
+	return {
+		root: rootGraphNode,
+		nodes: [...topoSort(nodes, edges), rootGraphNode],
+		edges,
+		inputBindings,
+		params: paramBindings
+	};
+}
+/**
+* The dependency edges must form a DAG — a cycle means neither producer can
+* deploy first. Resources take no wiring, so only service/module-to-service/module
+* edges can ever participate in a cycle; no special-casing needed.
+*/
+function assertDependencyDag(edges) {
+	const adjacency = /* @__PURE__ */ new Map();
+	for (const edge of edges) {
+		if (edge.kind !== "dependency") continue;
+		const targets = adjacency.get(edge.from) ?? [];
+		targets.push(edge.to);
+		adjacency.set(edge.from, targets);
+	}
+	const visiting = /* @__PURE__ */ new Set();
+	const done = /* @__PURE__ */ new Set();
+	const stack = [];
+	const visit = (id) => {
+		if (done.has(id)) return;
+		if (visiting.has(id)) throw new LoadError(`Dependency cycle: ${[...stack.slice(stack.indexOf(id)), id].join(" → ")} — no deploy order exists.`);
+		visiting.add(id);
+		stack.push(id);
+		for (const next of adjacency.get(id) ?? []) visit(next);
+		stack.pop();
+		visiting.delete(id);
+		done.add(id);
+	};
+	for (const id of adjacency.keys()) visit(id);
+}
+/**
+* Builds the in-memory graph from a root node. A service root walks its own
+* `inputs`; a module root executes its body (wiring, not user code — the
+* designed exception to imports-run-nothing) and recursively flattens every
+* module it provisions into one graph of hierarchical addresses. A malformed
+* graph is a `LoadError` that names its fix; the individual validation rules
+* live with `loadService` / `loadModule` and are covered by name in the Load
+* tests. Executes nothing of the user's own code beyond module bodies.
+*/
+function Load(root, opts) {
+	if (!isNode(root)) throw new LoadError("Load expects a branded service or module node (construct it with the service()/module() factories).");
+	if (root.kind === "module") return loadModule(root, opts);
+	if (root.kind === "service") return loadService(root, opts?.id ?? "root");
+	throw new LoadError("Load expects a service or module root (received another node kind).");
+}
+blindCast(Symbol.for("prisma:secret-box"));
+//#endregion
+//#region ../../0-framework/3-tooling/cli/dist/load-entry-ZpkCjTxj.mjs
+/**
+* `loadEntry` imports a user's topology with the host runtime's own module
+* loader — under node (the CLI's shebang runtime), that loader strips
+* TypeScript types but has no JSX transform (ADR-0005: the framework
+* doesn't bundle or transform the app's code; deploy loading is no
+* exception). A `.tsx`/`.jsx` file anywhere in the topology's import graph
+* dies with node's raw `ERR_UNKNOWN_FILE_EXTENSION`, which names the file
+* but not the cause or the fix. This turns that one case into structured
+* error parts (summary/why/fix) that do — every other load failure (syntax
+* errors, missing files, non-JSX unknown extensions) is untouched.
+*/
+const UNKNOWN_EXTENSION_CODE = "ERR_UNKNOWN_FILE_EXTENSION";
+const JSX_EXTENSIONS = [".tsx", ".jsx"];
+function errorCode(error) {
+	return "code" in error && typeof error.code === "string" ? error.code : void 0;
+}
+function unknownExtensionPath(error) {
+	if (!(error instanceof Error)) return void 0;
+	if (errorCode(error) !== UNKNOWN_EXTENSION_CODE) return void 0;
+	return /Unknown file extension "\.\w+" for (.+)$/.exec(error.message)?.[1];
+}
+/**
+* Returns structured error parts when `error` is node's
+* `ERR_UNKNOWN_FILE_EXTENSION` for a `.tsx`/`.jsx` file — `undefined` for
+* every other error (including unknown-extension failures for some other
+* extension), so the caller can fall through to its normal rethrow.
+*/
+function explainJsxLoadError(error, entryPath) {
+	const offendingPath = unknownExtensionPath(error);
+	if (offendingPath === void 0) return void 0;
+	if (!JSX_EXTENSIONS.some((ext) => offendingPath.endsWith(ext))) return void 0;
+	return {
+		summary: `"${offendingPath}" can't be loaded.`,
+		why: `deploy loads "${entryPath}"'s topology with node's own module loader, which strips TypeScript types but has no JSX transform — so a .tsx/.jsx file can't sit anywhere in that import graph.`,
+		fix: "Precompile that file in your own build (transform the JSX away, keep the real npm packages external) and import the compiled output instead of the raw .tsx/.jsx — see examples/email/scripts/build.ts in the prisma/composer repo for a worked example."
+	};
+}
+/**
+* Pipeline step 1 (deploy-cli.md § The pipeline): import the entry module
+* (resolved against cwd) and require its default export to be a node — a
+* service or module, branded by core's factories. Whatever this module exports
+* IS the application; nothing else marks a root (ADR-0003).
+*/
+async function loadEntry(entryArg, cwd) {
+	const resolvedPath = path.resolve(cwd, entryArg);
+	let mod;
+	try {
+		mod = await import(pathToFileURL(resolvedPath).href);
+	} catch (error) {
+		const explained = explainJsxLoadError(error, resolvedPath);
+		if (explained !== void 0) throw new CliStructuredError("COMPOSE.ENTRY_UNLOADABLE", explained.summary, {
+			why: explained.why,
+			fix: explained.fix,
+			where: { path: resolvedPath },
+			cause: error
+		});
+		throw new CliStructuredError("COMPOSE.ENTRY_UNLOADABLE", `Failed to import entry module "${resolvedPath}": ${error instanceof Error ? error.message : String(error)}`, {
+			where: { path: resolvedPath },
+			cause: error
+		});
+	}
+	const root = blindCast(mod).default;
+	if (!isNode(root) || root.kind === "dependency" || root.kind === "resource") throw new CliStructuredError("COMPOSE.ENTRY_EXPORT_INVALID", `Entry module "${resolvedPath}" must default-export a node (a service or a module).`, {
+		fix: "Construct it with service() or module() from @prisma/composer.",
+		where: { path: resolvedPath }
+	});
+	return {
+		path: resolvedPath,
+		root: blindCast(root)
+	};
+}
+//#endregion
+//#region ../../0-framework/3-tooling/assemble/dist/index.mjs
+/**
+* A user-facing assembly failure, structured at origin (base-type rule 6):
+* a `CliStructuredError` whose code names which way assembly went wrong.
+* This package's second consumer is the programmatic deploy API, not just
+* the CLI — hosts branch on `error.code`, the CLI renders the envelope.
+*/
+var AssembleError = class extends CliStructuredError {
+	constructor(code, summary, options) {
+		super(code, summary, options);
+	}
+};
+/**
+* The registry route for one service's build: extension by
+* `build.extension`, node descriptor by `build.type`, kind must be "build".
+* The CLI's coverage validation reports the same misses earlier with the
+* config fix; these errors are the backstop for programmatic callers.
+*/
+function buildDescriptorAssemble(config, node, address, cwd) {
+	const { extension, type } = node.build;
+	const extensionDescriptor = config.extensions.find((candidate) => candidate.id === extension);
+	if (extensionDescriptor === void 0) throw new AssembleError("ASSEMBLE.EXTENSION_MISSING", `No extension "${extension}" is configured (needed by service "${node.name}"'s build).`, { fix: "Add it to prisma-composer.config.ts's `extensions`." });
+	const nodeDescriptor = extensionDescriptor.nodes[type];
+	if (nodeDescriptor === void 0) throw new AssembleError("ASSEMBLE.DESCRIPTOR_MISSING", `Extension "${extension}" has no descriptor for build type "${type}".`, { why: `Known types: ${Object.keys(extensionDescriptor.nodes).join(", ")}.` });
+	if (nodeDescriptor.kind !== "build") throw new AssembleError("ASSEMBLE.DESCRIPTOR_KIND_MISMATCH", `Extension "${extension}"'s descriptor for type "${type}" is a "${nodeDescriptor.kind}" descriptor.`, { why: "Assembling a service build needs a \"build\" descriptor." });
+	return nodeDescriptor.assemble({
+		build: node.build,
+		address,
+		cwd
+	});
+}
+async function assembleServices(graph, config, cwd, run) {
+	const runAssembler = run ?? ((node, address, nodeCwd) => buildDescriptorAssemble(config, node, address, nodeCwd));
+	const serviceNodes = graph.nodes.filter((n) => n.node.kind === "service");
+	if (serviceNodes.length === 0) throw new AssembleError("ASSEMBLE.SERVICE_MISSING", "The loaded graph has no service to assemble.");
+	const bundles = {};
+	for (const { id, node } of serviceNodes) try {
+		bundles[id] = await runAssembler(node, id, cwd);
+	} catch (error) {
+		if (CliStructuredError.is(error)) throw error;
+		throw new AssembleError("ASSEMBLE.BUILD_FAILED", error instanceof Error ? error.message : String(error), {
+			meta: { address: id },
+			cause: error
+		});
+	}
+	return { bundles };
+}
+//#endregion
+//#region ../../0-framework/3-tooling/cli/dist/pipeline-D3QoVzAB.mjs
+/**
+* Pipeline step: find and load `prisma-composer.config.ts` (ADR-0017) — the ONE
+* file that imports control-plane code. Discovery is the standard walk-up
+* from the deploy entry's directory (mirrors prisma-next's config-loader);
+* loading is c12 with that explicit path (rc/global/package.json lookups
+* disabled), so the config file's own static imports resolve from the app
+* root by whatever package manager runs — no specifier construction, no
+* anchoring. The loaded shape is validated field-by-field with structured
+* errors naming the field.
+*/
+const CONFIG_FILENAME = "prisma-composer.config.ts";
+/** Walks UP from the entry file's directory looking for the literal CONFIG_FILENAME; undefined when the walk hits the filesystem root. */
+function findConfigPathForEntry(entryPath) {
+	let current = path.dirname(path.resolve(entryPath));
+	while (true) {
+		const candidate = path.join(current, CONFIG_FILENAME);
+		if (fs.existsSync(candidate)) return candidate;
+		const parent = path.dirname(current);
+		if (parent === current) return void 0;
+		current = parent;
+	}
+}
+function missingConfigError(entryPath) {
+	const searchedFrom = path.dirname(path.resolve(entryPath));
+	return new CliStructuredError("CONFIG.FILE_MISSING", `No ${CONFIG_FILENAME} found walking up from "${searchedFrom}".`, {
+		why: "The deploy needs the app's config file.",
+		fix: "Create one next to (or above) the entry, default-exporting defineConfig({ extensions: [...], state: ... }) from '@prisma/composer/config'.",
+		where: { path: searchedFrom }
+	});
+}
+function fieldError(field, requirement) {
+	return new CliStructuredError("CONFIG.FIELD_INVALID", `${CONFIG_FILENAME}: \`${field}\` ${requirement}.`, {
+		fix: "See defineConfig() in '@prisma/composer/config'.",
+		meta: { field }
+	});
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+/**
+* Field-by-field validation of the loaded default export — deliberately no
+* schema library: each check is a structured error naming the offending field.
+* Returns the same object, typed.
+*/
+function validateConfigShape(loaded, configPath) {
+	if (!isRecord(loaded) || Object.keys(loaded).length === 0) throw new CliStructuredError("CONFIG.EXPORT_INVALID", `"${configPath}" exported no config.`, {
+		fix: "It must default-export defineConfig({ extensions: [...], state: ... }) from '@prisma/composer/config'.",
+		where: { path: configPath }
+	});
+	const extensions = loaded["extensions"];
+	if (!Array.isArray(extensions)) throw fieldError("extensions", "must be an array");
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, entry] of extensions.entries()) {
+		if (!isRecord(entry)) throw fieldError(`extensions[${index}]`, "must be an extension descriptor object");
+		const id = entry["id"];
+		if (typeof id !== "string" || id.length === 0) throw fieldError(`extensions[${index}].id`, "must be a non-empty string (the extension package name)");
+		if (!isRecord(entry["nodes"])) throw fieldError(`extensions[${index}].nodes`, "must be an object (the node-ID → control registry)");
+		if (seen.has(id)) throw new CliStructuredError("CONFIG.EXTENSION_DUPLICATE", `${CONFIG_FILENAME}: extension "${id}" is listed more than once in \`extensions\`.`);
+		seen.add(id);
+	}
+	const state = loaded["state"];
+	if (!isRecord(state) || typeof state["extension"] !== "string" || typeof state["create"] !== "function") throw fieldError("state", "must be a state descriptor (e.g. prismaState())");
+	return blindCast(loaded);
+}
+/**
+* Loads + validates the config at `configPath` via c12 (explicit file; rc /
+* global-rc / package.json lookups disabled — discovery already happened in
+* findConfigPathForEntry).
+*/
+async function loadAppConfig(configPath) {
+	let result;
+	try {
+		result = await c12.loadConfig({
+			name: "prisma-composer",
+			configFile: configPath,
+			cwd: path.dirname(configPath),
+			rcFile: false,
+			globalRc: false,
+			packageJson: false
+		});
+	} catch (error) {
+		throw new CliStructuredError("CONFIG.EVALUATION_FAILED", `Evaluating "${configPath}" failed: ${error instanceof Error ? error.message : String(error)}`, {
+			where: { path: configPath },
+			cause: error
+		});
+	}
+	const loadedFile = result.configFile;
+	if (typeof loadedFile !== "string" || fs.realpathSync(loadedFile) !== fs.realpathSync(configPath)) throw new CliStructuredError("CONFIG.PATH_MISMATCH", `Config loading resolved "${String(loadedFile)}" instead of the discovered "${configPath}".`, {
+		why: "Refusing to deploy against a different file.",
+		where: { path: configPath }
+	});
+	return {
+		path: configPath,
+		config: validateConfigShape(result.config, configPath)
+	};
+}
+function lookup(extensions, extension, type, expectedKind, what) {
+	const ext = extensions.get(extension);
+	if (ext === void 0) throw new CliStructuredError("CONFIG.EXTENSION_MISSING", `No extension "${extension}" is configured (needed by ${what}).`, {
+		fix: `Add it to ${CONFIG_FILENAME}'s \`extensions\` (import its /control entry and list its descriptor).`,
+		meta: {
+			extension,
+			type
+		}
+	});
+	const descriptor = ext.nodes[type];
+	if (descriptor === void 0) throw new CliStructuredError("CONFIG.DESCRIPTOR_MISSING", `Extension "${extension}" has no descriptor for node type "${type}" (needed by ${what}).`, {
+		why: `Known types: ${Object.keys(ext.nodes).join(", ")}.`,
+		meta: {
+			extension,
+			type
+		}
+	});
+	if (descriptor.kind !== expectedKind) throw new CliStructuredError("CONFIG.DESCRIPTOR_KIND_MISMATCH", `Extension "${extension}"'s descriptor for node type "${type}" is a "${descriptor.kind}" descriptor — ${what} needs a "${expectedKind}" descriptor.`, { meta: {
+		extension,
+		type,
+		kind: descriptor.kind
+	} });
+}
+/** Throws a structured CONFIG.* error on the first uncovered `(extension, type)`; silent when the config covers the whole graph. */
+function validateRegistryCoverage(graph, config) {
+	const extensions = new Map(config.extensions.map((descriptor) => [descriptor.id, descriptor]));
+	for (const { id, node } of graph.nodes) {
+		if (node.kind === "resource") {
+			lookup(extensions, node.extension, node.type, "resource", `resource node "${id}"`);
+			continue;
+		}
+		if (node.kind !== "service") continue;
+		lookup(extensions, node.extension, node.type, "service", `service node "${id}"`);
+		lookup(extensions, node.build.extension, node.build.type, "build", `service node "${id}"'s build descriptor`);
+	}
+}
+/**
+* The shared prefix of `deploy`/`destroy`/`dev` (deploy-cli.md § The
+* pipeline; local-dev spec § 6): config discovery/load, entry load, Load,
+* registry coverage validation, name resolution, assemble. Deploy and dev
+* diverge after this — deploy resolves containers/preflight/stack file
+* against the hosted providers, dev against the local ones — so everything
+* up to and including assemble lives here once, consumed verbatim by both
+* `run()` (main.ts) and `runDev()` (dev/run-dev.ts), so the two pipelines
+* cannot drift.
+*/
+/**
+* The pipeline's front — config discovery/load, entry load, name resolution —
+* WITHOUT Load, coverage, or assemble. `log` needs only who the app is (its
+* config and resolved name) to reach the already-running local instance; it
+* neither builds nor provisions, so it must not require the user's built
+* output the way the full pipeline does.
+*/
+async function resolveAppIdentity(entry, overrideName, cwd, deps = {}) {
+	const resolvedEntryPath = path.resolve(cwd, entry);
+	const configPath = findConfigPathForEntry(resolvedEntryPath);
+	if (configPath === void 0) throw missingConfigError(resolvedEntryPath);
+	const config = deps.config ?? (await loadAppConfig(configPath)).config;
+	const entryModule = await loadEntry(entry, cwd);
+	const name = overrideName ?? entryModule.root.name;
+	if (name.length === 0) throw new CliStructuredError("COMPOSE.NAME_MISSING", "The root node has no name.", { fix: "Name it at authoring, or pass --name." });
+	return {
+		configPath,
+		config,
+		name
+	};
+}
+/**
+* Runs config discovery/load, entry load, Load, registry coverage, name
+* resolution, and assemble — steps 1–6 of `run()`. `onAssembleError`, when
+* given, lets a caller decorate an assemble failure with command-specific
+* guidance (destroy's "build first" hint) without this shared step knowing
+* about any one command.
+*/
+async function runPipeline(entry, overrideName, cwd, deps = {}, onAssembleError) {
+	const resolvedEntryPath = path.resolve(cwd, entry);
+	const configPath = findConfigPathForEntry(resolvedEntryPath);
+	if (configPath === void 0) throw missingConfigError(resolvedEntryPath);
+	const config = deps.config ?? (await loadAppConfig(configPath)).config;
+	const entryModule = await loadEntry(entry, cwd);
+	const graph = Load(entryModule.root);
+	if (graph.root.node.kind !== "module") throw new CliStructuredError("COMPOSE.ROOT_NOT_MODULE", "The deploy root must be a module.", { fix: "Wrap your service, e.g. export default module('name', ({ provision }) => { provision(service); })." });
+	validateRegistryCoverage(graph, config);
+	const name = overrideName ?? entryModule.root.name;
+	if (name.length === 0) throw new CliStructuredError("COMPOSE.NAME_MISSING", "The root node has no name.", { fix: "Name it at authoring, or pass --name." });
+	let assembled;
+	try {
+		assembled = await assembleServices(graph, config, cwd, deps.runAssembler);
+	} catch (error) {
+		if (onAssembleError !== void 0 && error instanceof Error) throw onAssembleError(error);
+		throw error;
+	}
+	return {
+		configPath,
+		config,
+		entryModule,
+		graph,
+		name,
+		assembled
+	};
+}
+//#endregion
+export { runPipeline as n, resolveAppIdentity as t };
+
+//# sourceMappingURL=pipeline-D3QoVzAB-D_ufjg3N.mjs.map