@prisma/composer 0.6.0-dev.9 → 0.7.0

package/dist/{app-config-CFsSXEVj-B242oUnm.d.mts → app-config-BinBcpPf-1akTl5h4.d.mts}

@@ -5,7 +5,7 @@ import { Input, StackServices } from "alchemy";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { State } from "alchemy/State/State";
-//#region ../../0-framework/1-core/core/dist/app-config-CFsSXEVj.d.mts
+//#region ../../0-framework/1-core/core/dist/app-config-BinBcpPf.d.mts
 //#region src/container-transport.d.ts
 /**
  * Carries resolved containers from the CLI process into the alchemy process
@@ -36,23 +36,42 @@ interface ContainerInstance {
   /** Serialize to a non-empty string for the process transport above. The format is the extension's own; only its `deserialize` reads it. */
   serialize(): string;
 }
+/**
+ * What the caller has already authenticated, handed to one container
+ * lifecycle call. A caller that holds neither omits the argument, and the
+ * extension falls back to whatever credential protocol it defines for
+ * itself (for Prisma Cloud, its env vars — which is how the alchemy child
+ * process still resolves containers).
+ *
+ * `C` is the extension's own platform-client type, left as a type parameter
+ * because this shared-plane module must not import a platform SDK; the
+ * framework only carries the value, never calls it. The framework stores the
+ * erased `C = unknown` form and the extension recovers its concrete client
+ * through the same method bivariance that erases `I` below.
+ */
+interface ContainerCredentials<C = unknown> {
+  /** The workspace the container lives in. `undefined` when the caller has no workspace to name — the extension decides whether it can proceed. */
+  readonly workspaceId: string | undefined;
+  /** An already-authenticated platform API client. Present means the extension must not build its own from the environment. */
+  readonly client?: C | undefined;
+}
 /**
  * The platform containers an app deploys into, as one lifecycle. `I` is
  * the extension's own instance type — the same descriptor produces and
  * consumes it, so the extension gets full typing internally while the
- * framework stores the erased form. METHOD SYNTAX REQUIRED on all four
- * members: the erased assignment into ExtensionDescriptor compiles only
- * through method bivariance; property-arrow members are checked
- * contravariantly and the assignment fails (same rule as
- * ServiceLowering<P, S> — ADR-0033).
+ * framework stores the erased form; `C` erases the same way. METHOD SYNTAX
+ * REQUIRED on all four members: the erased assignment into
+ * ExtensionDescriptor compiles only through method bivariance;
+ * property-arrow members are checked contravariantly and the assignment
+ * fails (same rule as ServiceLowering<P, S> — ADR-0033).
  */
-interface ContainerDescriptor<I extends ContainerInstance = ContainerInstance> {
+interface ContainerDescriptor<I extends ContainerInstance = ContainerInstance, C = unknown> {
   /** Resolve the container for (appName, stage), creating anything absent. Called by `deploy`. */
-  ensure(input: LocateContainerInput): Promise<I>;
+  ensure(input: LocateContainerInput, credentials?: ContainerCredentials<C>): Promise<I>;
   /** Find the container for (appName, stage); `undefined` when nothing exists. Called by `destroy` — never creates. */
-  locate(input: LocateContainerInput): Promise<I | undefined>;
+  locate(input: LocateContainerInput, credentials?: ContainerCredentials<C>): Promise<I | undefined>;
   /** Remove the container after a successful destroy, after every extension's `teardown` has run. Failure policy is the extension's. */
-  remove(instance: I): Promise<void>;
+  remove(instance: I, credentials?: ContainerCredentials<C>): Promise<void>;
   /** Reconstruct an instance from its own `serialize()` output — the far end of the framework's parent→child transport. */
   deserialize(serialized: string): I;
 }
@@ -348,8 +367,13 @@ interface ExtensionDescriptor {
    * runs. A target uses it to verify platform prerequisites (e.g. that every
    * secret env var in the provision manifest exists for the resolved stage) and
    * throws to abort the deploy. Async: it talks to the platform (ADR-0029).
+   *
+   * METHOD SYNTAX REQUIRED, for the same reason ContainerDescriptor's members
+   * need it: the framework hands over the erased `PreflightInput<unknown>`,
+   * and an extension that types the input against its own client type only
+   * assigns here through method bivariance.
    */
-  readonly preflight?: (input: PreflightInput) => Promise<void>;
+  preflight?(input: PreflightInput): Promise<void>;
   /**
    * Destroy-time cleanup — the CLI runs it once, after `alchemy destroy`
    * succeeds and BEFORE the stage's Project/Branch are removed. A target uses
@@ -367,6 +391,12 @@ interface ExtensionDescriptor {
    * in container-transport.ts.
    */
   readonly container?: ContainerDescriptor;
+  /**
+   * Deploy-run reporting. The CLI begins a session after the graph is loaded
+   * and before containers are resolved, and finishes it on every exit path.
+   * An extension without one reports nothing, which is the default.
+   */
+  readonly reporter?: ReporterDescriptor;
   /**
    * The extension's LOCAL TARGET counterpart (ADR-0041; naming, operator
    * 2026-07-23 — "dev" names the user-facing feature only, the seam takes
@@ -391,14 +421,16 @@ interface StateDescriptor {
   /** Build the state layer. `container` is the owning extension's resolved instance; `undefined` when it declared no container descriptor. */
   create(container: ContainerInstance | undefined): AlchemyStateLayer;
 }
-/** The resolved deploy context handed to an extension's `preflight` hook. */
-interface PreflightInput {
+/** The resolved deploy context handed to an extension's `preflight` hook. `C` erases to `unknown` at the framework boundary — see ContainerCredentials. */
+interface PreflightInput<C = unknown> {
   /** The loaded application graph — the manifest of prerequisites is read from it (`provisionManifest`). */
   readonly graph: Graph;
   /** The calling extension's own resolved container; `undefined` when it declares no container descriptor. Narrow with the extension's guard. */
   readonly container: ContainerInstance | undefined;
   /** The stage name (`--stage`), or `undefined` for the default stage — for diagnostics/scope. */
   readonly stage: string | undefined;
+  /** What the caller has already authenticated, for the platform calls preflight makes. Absent means the extension falls back to its own credential protocol. */
+  readonly credentials?: ContainerCredentials<C> | undefined;
 }
 /** The resolved destroy context handed to an extension's `teardown` hook. */
 interface TeardownInput {
@@ -407,6 +439,87 @@ interface TeardownInput {
   /** The stage name (`--stage`), or `undefined` for the default stage — for diagnostics/scope. */
   readonly stage: string | undefined;
 }
+/** The deploy context handed to `ReporterDescriptor.begin`. `C` erases to `unknown` at the framework boundary, exactly as on `PreflightInput`. */
+interface ReportBeginInput<C = unknown> {
+  /** The resolved application name. */
+  readonly appName: string;
+  /** The stage name (`--stage`), or `undefined` for the default stage. */
+  readonly stage: string | undefined;
+  /** The directory the deploy command was run from — where a reporter reads repository metadata. */
+  readonly cwd: string;
+  /**
+   * An existing report record this deploy is one part of, when whatever
+   * invoked Composer created one first — a CI job that opens the record, runs
+   * several steps against it, and closes it afterwards. Opaque to core: only
+   * the reporter knows what record the id names, and a reporter that receives
+   * one joins it instead of creating its own.
+   *
+   * Takes precedence over any equivalent the reporter reads from the
+   * environment, because it was passed deliberately.
+   */
+  readonly reportId: string | undefined;
+  /** What the caller has already authenticated, exactly as `preflight` and the container lifecycle receive it. Present means the reporter must not build a client from the environment. */
+  readonly credentials?: ContainerCredentials<C> | undefined;
+}
+/** The deploy context handed to `RunReporter.attach`, once containers exist. */
+interface ReportAttachInput {
+  /** The calling extension's own resolved container; `undefined` when it declares no container descriptor. Narrow with the extension's guard. */
+  readonly container: ContainerInstance | undefined;
+}
+/** How a run ended, as a reporter sees it. */
+interface RunOutcome {
+  readonly ok: boolean;
+  /** The run was interrupted (the engine settled a Ctrl-C or a termination signal) — a kind of not-ok that is not a failure. Only meaningful when `ok` is false. */
+  readonly cancelled: boolean;
+  /** The failing step's name — the deploy's own error code. `undefined` when the run succeeded. */
+  readonly failingStep: string | undefined;
+  /** Human-readable detail. `undefined` when the run succeeded. */
+  readonly errorMessage: string | undefined;
+  /**
+   * Everything the run's nodes became on the deployment target, flattened.
+   * Core does not interpret a `kind` and neither should the CLI — a reporter
+   * reads the kinds its own extension emits and ignores the rest. Empty when
+   * the run failed before producing a report.
+   */
+  readonly entities: readonly DeployedEntity[];
+}
+/**
+ * One run's reporting session. Every method is best-effort by contract:
+ * reporting is observability, never a step of the deploy, so an
+ * implementation logs its own failures and resolves rather than rejecting.
+ * The CLI does not catch, and will not fail a deploy over a report.
+ */
+interface RunReporter {
+  /**
+   * Extra environment for the alchemy child, so reporting that happens
+   * inside the apply can find the run this session belongs to. Read once,
+   * after `attach`, and merged into the child's environment.
+   */
+  childEnv(): Readonly<Record<string, string>>;
+  /** Called once the extension's own container is resolved, before any stack file is written — the moment the run's project and branch first exist to be referenced. */
+  attach(input: ReportAttachInput): Promise<void>;
+  /** Called exactly once, on every exit path including a thrown error. */
+  finish(outcome: RunOutcome): Promise<void>;
+}
+/**
+ * Deploy-run reporting — how an extension records that a deploy happened,
+ * how far it got, and how it ended. The CLI begins a session after the app's
+ * graph is loaded and before its containers are resolved, so a failure while
+ * creating them is still reported, and finishes it on every exit path.
+ *
+ * Deploy only: `destroy` has no reportable shape on the Prisma Cloud side
+ * (its build phases name a deploy), so the CLI does not run this hook there.
+ */
+interface ReporterDescriptor {
+  /**
+   * Start a session, or return `undefined` when there is nothing to report
+   * against (no credentials, no repository). Never throws. METHOD SYNTAX
+   * REQUIRED, like `preflight`: the framework hands over the erased
+   * `ReportBeginInput<unknown>`, and a reporter that types the input against
+   * its own client type only assigns here through method bivariance.
+   */
+  begin(input: ReportBeginInput): Promise<RunReporter | undefined>;
+}
 /** The extension's LOCAL TARGET counterpart (ADR-0041) — the local-target variant OF ExtensionDescriptor, hence the full qualifier. An extension without one is not local-target-capable (cannot back the "dev" feature). */
 interface LocalTargetDescriptor {
   /** Local providers for the SAME resource types this extension's lowering emits. Receives the app identity — unlike deploy's env-arg-free `providers()`, local providers are emulator clients and must know which app they provision for. */
@@ -493,5 +606,5 @@ interface PrismaAppConfig {
 /** Typed identity — exists so `prisma-composer.config.ts` gets checked against PrismaAppConfig where it is written. */
 declare function defineConfig(config: PrismaAppConfig): PrismaAppConfig;
 //#endregion
-export { ProvisionerDescriptor as A, joinDeployment as B, Lowering as C, PreflightInput as D, PackageInput as E, containerEnv as F, lowering as H, containerEnvVarName as I, defineConfig as L, StateDescriptor as M, TeardownInput as N, PrismaAppConfig as O, buildConfig as P, deserializeContainers as R, LoweredResult as S, Outputs as T, mergedProviders as U, lower as V, resolveStateLayer as W, LocalTargetProvidersInput as _, Bundle as a, LowerError as b, DEV_DIR as c, DeploymentResult as d, ExtensionDescriptor as f, LocalTargetEmulatorsInput as g, LocalTargetDescriptor as h, AssembleInput as i, ServiceLowering as j, ProvisionEdge as k, DeployedEntity as l, LocalTargetAttachment as m, ApplicationDescriptor as n, ContainerDescriptor as o, LocalTargetAttachInput as p, Artifact as r, ContainerInstance as s, AlchemyStateLayer as t, DeployedNode as u, LocateContainerInput as v, NodeDescriptor as w, LowerOptions as x, LowerContext as y, isBuildOnlyExtension as z };
-//# sourceMappingURL=app-config-CFsSXEVj-B242oUnm.d.mts.map
+export { ProvisionEdge as A, buildConfig as B, LoweredResult as C, PackageInput as D, Outputs as E, RunOutcome as F, isBuildOnlyExtension as G, containerEnvVarName as H, RunReporter as I, lowering as J, joinDeployment as K, ServiceLowering as L, ReportAttachInput as M, ReportBeginInput as N, PreflightInput as O, ReporterDescriptor as P, StateDescriptor as R, LowerOptions as S, NodeDescriptor as T, defineConfig as U, containerEnv as V, deserializeContainers as W, resolveStateLayer as X, mergedProviders as Y, LocalTargetEmulatorsInput as _, Bundle as a, LowerContext as b, ContainerInstance as c, DeployedNode as d, DeploymentResult as f, LocalTargetDescriptor as g, LocalTargetAttachment as h, AssembleInput as i, ProvisionerDescriptor as j, PrismaAppConfig as k, DEV_DIR as l, LocalTargetAttachInput as m, ApplicationDescriptor as n, ContainerCredentials as o, ExtensionDescriptor as p, lower as q, Artifact as r, ContainerDescriptor as s, AlchemyStateLayer as t, DeployedEntity as u, LocalTargetProvidersInput as v, Lowering as w, LowerError as x, LocateContainerInput as y, TeardownInput as z };
+//# sourceMappingURL=app-config-BinBcpPf-1akTl5h4.d.mts.map

package/dist/app-config-BinBcpPf-1akTl5h4.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-config-BinBcpPf-1akTl5h4.d.mts","names":[],"sources":["../../../0-framework/1-core/core/dist/app-config-BinBcpPf.d.mts"],"mappings":";;;;;;;;;;;;;;;;;;;;UAmBU;;WAEC;;WAEA;;;;;;;UAOD;WACC,OAAO;;WAEP;;EAET;;;;;;;;;;;;;;;UAeQ,qBAAqB;;WAEpB;;WAEA,SAAS;;;;;;;;;;;;UAYV,oBAAoB,UAAU,oBAAoB,mBAAmB;;EAE7E,OAAO,OAAO,sBAAsB,cAAc,qBAAqB,KAAK,QAAQ;;EAEpF,OAAO,OAAO,sBAAsB,cAAc,qBAAqB,KAAK,QAAQ;;EAEpF,OAAO,UAAU,GAAG,cAAc,qBAAqB,KAAK;;EAE5D,YAAY,qBAAqB;;;iBAGlB,oBAAoB;;iBAEpB,aAAa,WAAW,oBAAoB,qBAAqB;;UAExE;WACC;WACA,YAAY;;;;;;iBAMN,sBAAsB,qBAAqB,+BAA+B,KAAK,SAAS,sCAAsC,oBAAoB;;;;KAI9J,oBAAoB,MAAM,MAAM,cAAc;;;;;;UAMzC;EACR,UAAU,KAAK,eAAe,OAAO;;;;;;;;UAQ7B;WACC;WACA;WACA;WACA;;WAEA,MAAM;;;UAGP;;EAER,UAAU,MAAM,gBAAgB,OAAO;;;;;;;;;;;;;;UAc/B,gBAAgB,aAAa;;EAErC,UAAU,KAAK,eAAe,OAAO,OAAO;;;;;;EAM5C,UAAU,KAAK,cAAc,aAAa,GAAG,QAAQ,SAAS,OAAO,OAAO;;;;;;EAM5E,QAAQ,KAAK,cAAc,OAAO,eAAe,OAAO,OAAO;;EAE/D,OAAO,KAAK,cAAc,aAAa,GAAG,UAAU,UAAU,YAAY,IAAI,OAAO,OAAO;;;UAGpF;;WAEC,WAAW;;WAEX;;;KAGN,YAAY,KAAK,iBAAiB,OAAO,OAAO;UAC3C;WACC,IAAI;;;;;;WAMJ;WACA,MAAM,cAAc;WACpB,OAAO;WACP,MAAM;;;;;;WAMN;;;;;;;WAOA,WAAW;;WAEX,SAAS,YAAY,QAAQ;;WAE7B,aAAa;;;;;;;;;KASnB,UAAU,SAAS;;;;;;;;;;;;;UAad;WACC;WACA;WACA;WACA,UAAU,SAAS;;;;;;;;;;;;;;UAcpB;WACC,SAAS;WACT,mBAAmB,MAAM;;;UAG1B;WACC;WACA,MAAM,cAAc;WACpB,mBAAmB;;;UAGpB;WACC;WACA,gBAAgB;;UAEjB;;WAEC;WACA,SAAS,eAAe;WACxB;;WAEA,QAAQ;;WAER,YAAY,MAAM;;;;;;;;WAQlB,UAAU,QAAQ;;;UAGnB;WACC;WACA;;;;;;;;WAQA;;;UAGD;WACC,OAAO;;WAEP;;WAEA;;;UAGD;WACC;WACA;;cAEG,mBAAmB;EAC/B,YAAY;;;;;;;;;;;;;;iBAcG,YAAY,MAAM,aAAa,IAAI,QAAQ,OAAO,OAAO,SAAS,YAAY,QAAQ,UAAU,aAAa,+BAA+B;;;;;;;;;;;;;;iBAc5I,eAAe,OAAO,OAAO;EAC5C;EACA,mBAAmB;eACN;;;;;;;;iBAQE,kBAAkB,MAAM,cAAc,QAAQ,iBAAiB,YAAY,oBAAoB,qBAAqB;;;;;;iBAMpH,gBAAgB,QAAQ,kBAAkB,MAAM;;;;;iBAKhD,SAAS,MAAM,YAAY,QAAQ,iBAAiB,MAAM,eAAe,OAAO,kBAAkB;;;;;;iBAMlG,MAAM,MAAM,YAAY,QAAQ,iBAAiB,MAAM,eAAe,OAAO,OAAO,QAAQ,uDAAuD;;;;;;;;UAQ1J;;WAEC;;WAEA,OAAO,eAAe;;WAEtB,aAAa,oBAAoB;;WAEjC,cAAc;;WAEd,kBAAkB,MAAM;;;;;;;;;;;;;EAajC,WAAW,OAAO,iBAAiB;;;;;;;;;WAS1B,YAAY,OAAO,kBAAkB;;;;;;;;WAQrC,YAAY;;;;;;WAMZ,WAAW;;;;;;;;;;;;;WAaX,oBAAoB,QAAQ;;;;;;UAM7B;;WAEC;;EAET,OAAO,WAAW,gCAAgC;;;UAG1C,eAAe;;WAEd,OAAO;;WAEP,WAAW;;WAEX;;WAEA,cAAc,qBAAqB;;;UAGpC;;WAEC,WAAW;;WAEX;;;UAGD,iBAAiB;;WAEhB;;WAEA;;WAEA;;;;;;;;;;;WAWA;;WAEA,cAAc,qBAAqB;;;UAGpC;;WAEC,WAAW;;;UAGZ;WACC;;WAEA;;WAEA;;WAEA;;;;;;;WAOA,mBAAmB;;;;;;;;UAQpB;;;;;;EAMR,YAAY,SAAS;;EAErB,OAAO,OAAO,oBAAoB;;EAElC,OAAO,SAAS,aAAa;;;;;;;;;;;UAWrB;;;;;;;;EAQR,MAAM,OAAO,mBAAmB,QAAQ;;;UAGhC;;EAER,UAAU,OAAO,4BAA4B,MAAM;;WAE1C,WAAW;;EAEpB,WAAW,OAAO,iBAAiB;;EAEnC,WAAW,OAAO,4BAA4B;;EAE9C,OAAO,OAAO,yBAAyB,QAAQ;;EAE/C,UAAU,OAAO,gBAAgB;;UAEzB;;WAEC,WAAW;;WAEX;;UAED;;WAEC,OAAO;WACP,WAAW;;WAEX;;UAED;WACC,WAAW;WACX;;UAED;;EAER,iBAAiB;;EAEjB,aAAa;aACF;aACA;;;EAGX,KAAK,QAAQ,aAAa;aACf;MACP;aACO;aACA;;;EAGX,gBAAgB;;;cAGJ;;;;;;;;;iBASG,qBAAqB,WAAW;;;;;;KAM5C;WACM;IACP;WACO;IACP;WACO;EACT,SAAS,OAAO,gBAAgB,QAAQ;;;;;;;UAOhC;WACC,YAAY;WACZ,OAAO;;;iBAGD,aAAa,QAAQ,kBAAkB"}

package/dist/config-647Wkm51.d.mts

@@ -0,0 +1 @@
+import "./app-config-BinBcpPf-1akTl5h4.mjs";

package/dist/config.d.mts

@@ -1,3 +1,3 @@
-import { D as PreflightInput, F as containerEnv, I as containerEnvVarName, L as defineConfig, M as StateDescriptor, N as TeardownInput, O as PrismaAppConfig, R as deserializeContainers, _ as LocalTargetProvidersInput, c as DEV_DIR, f as ExtensionDescriptor, g as LocalTargetEmulatorsInput, h as LocalTargetDescriptor, m as LocalTargetAttachment, o as ContainerDescriptor, p as LocalTargetAttachInput, s as ContainerInstance, v as LocateContainerInput, w as NodeDescriptor, z as isBuildOnlyExtension } from "./app-config-CFsSXEVj-B242oUnm.mjs";
-import "./config-ku5b_2YD.mjs";
-export { type ContainerDescriptor, type ContainerInstance, DEV_DIR, ExtensionDescriptor, LocalTargetAttachInput, LocalTargetAttachment, LocalTargetDescriptor, LocalTargetEmulatorsInput, LocalTargetProvidersInput, type LocateContainerInput, NodeDescriptor, PreflightInput, PrismaAppConfig, StateDescriptor, TeardownInput, containerEnv, containerEnvVarName, defineConfig, deserializeContainers, isBuildOnlyExtension };
+import { F as RunOutcome, G as isBuildOnlyExtension, H as containerEnvVarName, I as RunReporter, M as ReportAttachInput, N as ReportBeginInput, O as PreflightInput, P as ReporterDescriptor, R as StateDescriptor, T as NodeDescriptor, U as defineConfig, V as containerEnv, W as deserializeContainers, _ as LocalTargetEmulatorsInput, c as ContainerInstance, g as LocalTargetDescriptor, h as LocalTargetAttachment, k as PrismaAppConfig, l as DEV_DIR, m as LocalTargetAttachInput, o as ContainerCredentials, p as ExtensionDescriptor, s as ContainerDescriptor, u as DeployedEntity, v as LocalTargetProvidersInput, y as LocateContainerInput, z as TeardownInput } from "./app-config-BinBcpPf-1akTl5h4.mjs";
+import "./config-647Wkm51.mjs";
+export { type ContainerCredentials, type ContainerDescriptor, type ContainerInstance, DEV_DIR, type DeployedEntity, ExtensionDescriptor, LocalTargetAttachInput, LocalTargetAttachment, LocalTargetDescriptor, LocalTargetEmulatorsInput, LocalTargetProvidersInput, type LocateContainerInput, NodeDescriptor, PreflightInput, PrismaAppConfig, ReportAttachInput, ReportBeginInput, ReporterDescriptor, RunOutcome, RunReporter, StateDescriptor, TeardownInput, containerEnv, containerEnvVarName, defineConfig, deserializeContainers, isBuildOnlyExtension };

package/dist/control.d.mts

@@ -1,38 +1,8 @@
 import { dt as CliStructuredError } from "./graph-types-N6brq1zY-1VMNwtkJ.mjs";
-import { l as DeployedEntity } from "./app-config-CFsSXEVj-B242oUnm.mjs";
-import "./config-ku5b_2YD.mjs";
+import { u as DeployedEntity } from "./app-config-BinBcpPf-1akTl5h4.mjs";
+import "./config-647Wkm51.mjs";
 import "./index-DryPyF9U.mjs";
-import "./deploy-ku5b_2YD.mjs";
-//#region ../../0-framework/3-tooling/cli/dist/load-entry-BS8rSRif.d.mts
-//#endregion
-//#region src/operations/shared.d.ts
-/** A running service's dotted address plus its local URL — what `dev` reports
- * as the front door and `log` reports as the tailable services. */
-interface ServiceEndpoint {
-  readonly address: string;
-  readonly url: string;
-}
-/**
- * Where a failed execution left its artifacts — details of the CURRENT
- * execution mechanism (a spawned deploy-engine child driving a generated
- * stack file), for hosts that want to print a reproduce hint. The mechanism
- * is not part of the surface's contract, so these fields may change or
- * disappear if the mechanism does; branch on `code`/`message`/`cause` for
- * anything durable.
- */
-interface ExecutionDiagnostics {
-  /** The child's exit status; undefined means the spawn itself threw. */
-  readonly exitCode: number | undefined;
-  readonly stackFilePath: string;
-  readonly reproduceCommand: string;
-  readonly cwd: string;
-}
-/**
- * Reads the execution diagnostics an engine-failure error carries in
- * `meta.diagnostics`; undefined for every other failure.
- */
-declare function executionDiagnostics(f: CliStructuredError): ExecutionDiagnostics | undefined;
-//#endregion
+import "./deploy-647Wkm51.mjs";
 //#region ../../0-framework/0-foundation/foundation/dist/result.d.mts
 //#region src/result.d.ts
 /**
@@ -61,7 +31,7 @@ interface NotOk<F> {
  */
 type Result<T, F> = Ok<T> | NotOk<F>;
 //#endregion
-//#region ../../0-framework/3-tooling/cli/dist/control.d.mts
+//#region ../../0-framework/3-tooling/cli/dist/log-DDGcAU7S.d.mts
 //#region src/deployment-summary.d.ts
 /** The serializable projection of DeploymentResult — what CAN cross the process
  * boundary. Writer (report hook) and reader (deploy operation) share this shape. */
@@ -74,6 +44,39 @@ interface DeploymentSummary {
   readonly nodes: readonly DeployedNodeSummary[];
 }
 //#endregion
+//#region src/operations/shared.d.ts
+/** A running service's dotted address plus its local URL — what `dev` reports
+ * as the front door and `log` reports as the tailable services. */
+interface ServiceEndpoint {
+  readonly address: string;
+  readonly url: string;
+}
+/**
+ * Where a failed execution left its artifacts — details of the CURRENT
+ * execution mechanism (a spawned deploy-engine child driving a generated
+ * stack file), for hosts that want to print a reproduce hint. The mechanism
+ * is not part of the surface's contract, so these fields may change or
+ * disappear if the mechanism does; branch on `code`/`message`/`cause` for
+ * anything durable.
+ */
+interface ExecutionDiagnostics {
+  /** The child's exit status; undefined means the spawn itself threw, or the
+   *  child was killed by a signal (`signal` then names it). */
+  readonly exitCode: number | undefined;
+  /** The signal that killed the child, when one did. A signal-killed converge
+   *  is an abort the user asked for, not a failure of the deploy — a host
+   *  should report it as an interruption and print no reproduce hint. */
+  readonly signal?: string | undefined;
+  readonly stackFilePath: string;
+  readonly reproduceCommand: string;
+  readonly cwd: string;
+}
+/**
+ * Reads the execution diagnostics an engine-failure error carries in
+ * `meta.diagnostics`; undefined for every other failure.
+ */
+declare function executionDiagnostics(f: CliStructuredError): ExecutionDiagnostics | undefined;
+//#endregion
 //#region src/operations/deploy.d.ts
 interface DeployInput {
   /** Path to the entry module, resolved against `cwd` — same contract as `prisma-composer deploy <entry>`. */
@@ -84,6 +87,20 @@ interface DeployInput {
   readonly stage?: string | undefined;
   /** Defaults to process.cwd(); the directory `.prisma-composer/` and `.alchemy` state live under. */
   readonly cwd?: string | undefined;
+  /**
+   * Where to write the run report — the deploy's outcome as JSON, for a tool
+   * that consumes a deploy rather than watches one. Relative paths resolve
+   * against `cwd`. Absent falls back to `PRISMA_COMPOSER_REPORT_FILE`, and
+   * absent from both writes no report.
+   */
+  readonly reportPath?: string | undefined;
+  /**
+   * An existing report record this deploy belongs to — the `--build-id` flag's
+   * slot. A CI job that opens the record before invoking Composer passes the
+   * id here, and the target's reporter joins that record instead of creating
+   * one. Absent falls back to whatever the target reads from the environment.
+   */
+  readonly reportId?: string | undefined;
 }
 interface DeploySuccess {
   /** Parsed from the alchemy child's result file. Undefined when the child
@@ -212,5 +229,32 @@ interface LogAttached {
 }
 declare function log(input: LogInput): Promise<Result<LogAttached, CliStructuredError>>;
 //#endregion
-export { type CliStructuredError, type DeployInput, type DeploySuccess, type DeployedNodeSummary, type DeploymentSummary, type DestroyEvent, type DestroyInput, type DestroyTarget, type DevEvent, type DevInput, type DevSession, type ExecutionDiagnostics, type LogAttached, type LogEvent, type LogInput, type LogLine, type NotOk, type Ok, type Result, type ServiceEndpoint, deploy, destroy, dev, executionDiagnostics, log };
+//#region ../../0-framework/3-tooling/cli/dist/control.d.mts
+//#region src/run-report.d.ts
+/** Bump when a change would break a consumer that reads the current shape. */
+declare const RUN_REPORT_VERSION = 1;
+/** Names the file to write the run report to, when `--report` is not passed. */
+declare const RUN_REPORT_FILE_ENV = "PRISMA_COMPOSER_REPORT_FILE";
+interface RunReportFailure {
+  /** The deploy's own error code, e.g. `DEPLOY.PREFLIGHT_FAILED`. */
+  readonly code: string;
+  readonly message: string;
+}
+/**
+ * Every field is always present, and absent scalars are `null` rather than
+ * omitted — a consumer can read `report.failure` without first testing
+ * whether the key exists.
+ */
+interface RunReport {
+  readonly version: number;
+  readonly outcome: 'succeeded' | 'failed';
+  /** Null when the run failed before it produced a deployment summary. */
+  readonly app: string | null;
+  /** Null for the default stage. */
+  readonly stage: string | null;
+  readonly nodes: readonly DeployedNodeSummary[];
+  readonly failure: RunReportFailure | null;
+}
+//#endregion
+export { type CliStructuredError, type DeployInput, type DeploySuccess, type DeployedNodeSummary, type DeploymentSummary, type DestroyEvent, type DestroyInput, type DestroyTarget, type DevEvent, type DevInput, type DevSession, type ExecutionDiagnostics, type LogAttached, type LogEvent, type LogInput, type LogLine, type NotOk, type Ok, RUN_REPORT_FILE_ENV, RUN_REPORT_VERSION, type Result, type RunReport, type RunReportFailure, type ServiceEndpoint, deploy, destroy, dev, executionDiagnostics, log };
 //# sourceMappingURL=control.d.mts.map

package/dist/control.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"control.d.mts","names":[],"sources":["../../../0-framework/3-tooling/cli/dist/load-entry-BS8rSRif.d.mts","../../../0-framework/0-foundation/foundation/dist/result.d.mts","../../../0-framework/3-tooling/cli/dist/control.d.mts"],"mappings":";;;;;;;;;;UAyBU;WACC;WACA;;;;;;;;;;UAqBD;;WAEC;WACA;WACA;WACA;;;;;;iBAMM,qBAAqB,GAAG,qBAAqB;;;;;;;UCvDpD,GAAG;WACF;WACA,OAAO;EAChB,YAAY;EACZ;;;;;UAKQ,MAAM;WACL;WACA,SAAS;EAClB;EACA,eAAe;;;;;;;;KAQZ,OAAO,GAAG,KAAK,GAAG,KAAK,MAAM;;;;;;UCfxB;WACC;WACA,mBAAmB;;UAEpB;WACC;WACA,gBAAgB;;;;UAIjB;;WAEC;;WAEA;;WAEA;;WAEA;;UAED;;;WAGC,SAAS;;iBAEH,OAAO,OAAO,cAAc,QAAQ,OAAS,eAAe;;;;KAIxE;WACM;;WAEA;WACA;;KAEN;;;WAGM;WACA;;UAED;WACC;WACA;WACA,QAAQ;WACR;;WAEA,YAAY,OAAO;;iBAEb,QAAQ,OAAO,eAAe,QAAQ,aAAe;;;KAGjE;;;WAGM;WACA,oBAAoB;;WAEpB;WACA;;WAEA;WACA;;;;WAIA;WACA;;;;WAIA;WACA;WACA;WACA;;WAEA;;;;WAIA;WACA;;WAEA;;UAED;WACC;WACA;WACA;WACA;WACA,YAAY,OAAO;;;;;UAKpB;;WAEC,oBAAoB;;;EAG7B,QAAQ;;WAEC,QAAQ;;iBAEF,IAAI,OAAO,WAAW,QAAQ,OAAS,YAAY;;;UAG1D;WACC;WACA;;KAEN;;;WAGM;WACA;;;;;WAKA;WACA;;UAED;WACC;WACA;;WAEA;;;WAGA;WACA;;WAEA,SAAS;WACT,YAAY,OAAO;;UAEpB;;WAEC;;;WAGA,mBAAmB;;WAEnB,OAAO,cAAc;;iBAEf,IAAI,OAAO,WAAW,QAAQ,OAAS,aAAa"}
+{"version":3,"file":"control.d.mts","names":[],"sources":["../../../0-framework/0-foundation/foundation/dist/result.d.mts","../../../0-framework/3-tooling/cli/dist/log-DDGcAU7S.d.mts","../../../0-framework/3-tooling/cli/dist/control.d.mts"],"mappings":";;;;;;;;;;UAIU,GAAG;WACF;WACA,OAAO;EAChB,YAAY;EACZ;;;;;UAKQ,MAAM;WACL;WACA,SAAS;EAClB;EACA,eAAe;;;;;;;;KAQZ,OAAO,GAAG,KAAK,GAAG,KAAK,MAAM;;;;;;UCfxB;WACC;WACA,mBAAmB;;UAEpB;WACC;WACA,gBAAgB;;;;;;UAMjB;WACC;WACA;;;;;;;;;;UA2CD;;;WAGC;;;;WAIA;WACA;WACA;WACA;;;;;;iBAMM,qBAAqB,GAAG,qBAAqB;;;UAGpD;;WAEC;;WAEA;;WAEA;;WAEA;;;;;;;WAOA;;;;;;;WAOA;;UAED;;;WAGC,SAAS;;iBAEH,OAAO,OAAO,cAAc,QAAQ,OAAO,eAAe;;;;KAQtE;WACM;;WAEA;WACA;;KAEN;;;WAGM;WACA;;UAED;WACC;WACA;WACA,QAAQ;WACR;;WAEA,YAAY,OAAO;;iBAEb,QAAQ,OAAO,eAAe,QAAQ,aAAa;;;KAO/D;;;WAGM;WACA,oBAAoB;;WAEpB;WACA;;WAEA;WACA;;;;WAIA;WACA;;;;WAIA;WACA;WACA;WACA;;WAEA;;;;WAIA;WACA;;WAEA;;UAED;WACC;WACA;WACA;WACA;WACA,YAAY,OAAO;;;;;UAKpB;;WAEC,oBAAoB;;;EAG7B,QAAQ;;WAEC,QAAQ;;iBAEF,IAAI,OAAO,WAAW,QAAQ,OAAO,YAAY;;;UAcxD;WACC;WACA;;KAEN;;;WAGM;WACA;;;;;WAKA;WACA;;UAYD;WACC;WACA;;WAEA;;;WAGA;WACA;;WAEA,SAAS;WACT,YAAY,OAAO;;UAEpB;;WAEC;;;WAGA,mBAAmB;;WAEnB,OAAO,cAAc;;iBAEf,IAAI,OAAO,WAAW,QAAQ,OAAO,aAAa;;;;;cCnQrD;;cAEA;UACJ;;WAEC;WACA;;;;;;;UAOD;WACC;WACA;;WAEA;;WAEA;WACA,gBAAgB;WAChB,SAAS"}

package/dist/control.mjs

@@ -1,70 +1,71 @@
-import { a as executorLoadFailure, i as executionDiagnostics, t as notOk } from "./result-CzGChwbZ.mjs";
-//#region ../../0-framework/3-tooling/cli/dist/destroy-DPAo6kVj.mjs
-async function dev(input) {
-	return devWithDeps(input, {});
+import { a as executionDiagnostics, o as executorLoadFailure, t as notOk } from "./result-D95kAAek.mjs";
+import { n as RUN_REPORT_VERSION, t as RUN_REPORT_FILE_ENV } from "./run-report-C2o98uD--AX8kpz4Q.mjs";
+//#region ../../0-framework/3-tooling/cli/dist/log-B1EJJGSl.mjs
+async function deploy(input) {
+	return deployWithDeps(input, {});
 }
 /** In-package variant threading the injection seam (the CLI's RunDeps, unit
 * tests). Deliberately NOT re-exported through `./control` — the seam mirrors
 * internal types and is not part of the published surface. */
-async function devWithDeps(input, deps) {
+async function deployWithDeps(input, deps) {
 	const cwd = input.cwd ?? process.cwd();
 	let executor;
 	try {
-		executor = await import("./execute-dev-DLYyduEM-88uyvrbj.mjs");
+		executor = await import("./execute-deploy-destroy-DRl6Tfg9-B8LE2Lh5.mjs");
 	} catch (error) {
-		return notOk(executorLoadFailure("dev", error, cwd));
+		return notOk(executorLoadFailure("deploy", error, cwd));
 	}
-	return executor.executeDev(input, deps, cwd);
+	return executor.executeDeploy(input, deps, cwd);
 }
-async function log(input) {
-	return logWithDeps(input, {});
+async function destroy(input) {
+	return destroyWithDeps(input, {});
 }
-/** In-package variant threading the injection seam (the CLI's LogRunDeps,
-* unit tests). Deliberately NOT re-exported through `./control` — the seam
-* mirrors internal types and is not part of the published surface. */
-async function logWithDeps(input, deps) {
+/** In-package variant threading the injection seam (the CLI's RunDeps, unit
+* tests). Deliberately NOT re-exported through `./control` — the seam mirrors
+* internal types and is not part of the published surface. */
+async function destroyWithDeps(input, deps) {
 	const cwd = input.cwd ?? process.cwd();
 	let executor;
 	try {
-		executor = await import("./execute-log-VIOL4DBz-DBPH8By4.mjs");
+		executor = await import("./execute-deploy-destroy-DRl6Tfg9-B8LE2Lh5.mjs");
 	} catch (error) {
-		return notOk(executorLoadFailure("log", error, cwd));
+		return notOk(executorLoadFailure("destroy", error, cwd));
 	}
-	return executor.executeLog(input, deps, cwd);
+	return executor.executeDestroy(input, deps, cwd);
 }
-async function deploy(input) {
-	return deployWithDeps(input, {});
+async function dev(input) {
+	return devWithDeps(input, {});
 }
 /** In-package variant threading the injection seam (the CLI's RunDeps, unit
 * tests). Deliberately NOT re-exported through `./control` — the seam mirrors
 * internal types and is not part of the published surface. */
-async function deployWithDeps(input, deps) {
+async function devWithDeps(input, deps) {
 	const cwd = input.cwd ?? process.cwd();
 	let executor;
 	try {
-		executor = await import("./execute-deploy-destroy-IT4vGkMc-oO8yjHPH.mjs");
+		executor = await import("./execute-dev-BMTFWfFc-7MifQgpp.mjs");
 	} catch (error) {
-		return notOk(executorLoadFailure("deploy", error, cwd));
+		return notOk(executorLoadFailure("dev", error, cwd));
 	}
-	return executor.executeDeploy(input, deps, cwd);
+	return executor.executeDev(input, deps, cwd);
 }
-async function destroy(input) {
-	return destroyWithDeps(input, {});
+async function log(input) {
+	return logWithDeps(input, {});
 }
-/** In-package variant threading the injection seam (the CLI's RunDeps, unit
-* tests). Deliberately NOT re-exported through `./control` — the seam mirrors
-* internal types and is not part of the published surface. */
-async function destroyWithDeps(input, deps) {
+/** In-package variant threading the injection seam (the CLI's LogRunDeps,
+* unit tests). Deliberately NOT re-exported through `./control` — the seam
+* mirrors internal types and is not part of the published surface. */
+async function logWithDeps(input, deps) {
 	const cwd = input.cwd ?? process.cwd();
 	let executor;
 	try {
-		executor = await import("./execute-deploy-destroy-IT4vGkMc-oO8yjHPH.mjs");
+		executor = await import("./execute-log-Cay9hlKW-BcvKPOW1.mjs");
 	} catch (error) {
-		return notOk(executorLoadFailure("destroy", error, cwd));
+		return notOk(executorLoadFailure("log", error, cwd));
 	}
-	return executor.executeDestroy(input, deps, cwd);
+	return executor.executeLog(input, deps, cwd);
 }
 //#endregion
-export { deploy, destroy, dev, executionDiagnostics, log };
+export { RUN_REPORT_FILE_ENV, RUN_REPORT_VERSION, deploy, destroy, dev, executionDiagnostics, log };
 
 //# sourceMappingURL=control.mjs.map

package/dist/control.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"control.mjs","names":[],"sources":["../../../0-framework/3-tooling/cli/dist/destroy-DPAo6kVj.mjs"],"sourcesContent":["import { n as executorLoadFailure } from \"./shared-CCaR42wo.mjs\";\nimport { notOk } from \"@internal/foundation/result\";\n//#region src/operations/dev.ts\nasync function dev(input) {\n\treturn devWithDeps(input, {});\n}\n/** In-package variant threading the injection seam (the CLI's RunDeps, unit\n* tests). Deliberately NOT re-exported through `./control` — the seam mirrors\n* internal types and is not part of the published surface. */\nasync function devWithDeps(input, deps) {\n\tconst cwd = input.cwd ?? process.cwd();\n\tlet executor;\n\ttry {\n\t\texecutor = await import(\"./execute-dev-DLYyduEM.mjs\");\n\t} catch (error) {\n\t\treturn notOk(executorLoadFailure(\"dev\", error, cwd));\n\t}\n\treturn executor.executeDev(input, deps, cwd);\n}\n//#endregion\n//#region src/operations/log.ts\nasync function log(input) {\n\treturn logWithDeps(input, {});\n}\n/** In-package variant threading the injection seam (the CLI's LogRunDeps,\n* unit tests). Deliberately NOT re-exported through `./control` — the seam\n* mirrors internal types and is not part of the published surface. */\nasync function logWithDeps(input, deps) {\n\tconst cwd = input.cwd ?? process.cwd();\n\tlet executor;\n\ttry {\n\t\texecutor = await import(\"./execute-log-VIOL4DBz.mjs\");\n\t} catch (error) {\n\t\treturn notOk(executorLoadFailure(\"log\", error, cwd));\n\t}\n\treturn executor.executeLog(input, deps, cwd);\n}\n//#endregion\n//#region src/operations/deploy.ts\nasync function deploy(input) {\n\treturn deployWithDeps(input, {});\n}\n/** In-package variant threading the injection seam (the CLI's RunDeps, unit\n* tests). Deliberately NOT re-exported through `./control` — the seam mirrors\n* internal types and is not part of the published surface. */\nasync function deployWithDeps(input, deps) {\n\tconst cwd = input.cwd ?? process.cwd();\n\tlet executor;\n\ttry {\n\t\texecutor = await import(\"./execute-deploy-destroy-IT4vGkMc.mjs\");\n\t} catch (error) {\n\t\treturn notOk(executorLoadFailure(\"deploy\", error, cwd));\n\t}\n\treturn executor.executeDeploy(input, deps, cwd);\n}\n//#endregion\n//#region src/operations/destroy.ts\nasync function destroy(input) {\n\treturn destroyWithDeps(input, {});\n}\n/** In-package variant threading the injection seam (the CLI's RunDeps, unit\n* tests). Deliberately NOT re-exported through `./control` — the seam mirrors\n* internal types and is not part of the published surface. */\nasync function destroyWithDeps(input, deps) {\n\tconst cwd = input.cwd ?? process.cwd();\n\tlet executor;\n\ttry {\n\t\texecutor = await import(\"./execute-deploy-destroy-IT4vGkMc.mjs\");\n\t} catch (error) {\n\t\treturn notOk(executorLoadFailure(\"destroy\", error, cwd));\n\t}\n\treturn executor.executeDestroy(input, deps, cwd);\n}\n//#endregion\nexport { log as a, devWithDeps as c, deployWithDeps as i, destroyWithDeps as n, logWithDeps as o, deploy as r, dev as s, destroy as t };\n\n//# sourceMappingURL=destroy-DPAo6kVj.mjs.map"],"mappings":";;AAGA,eAAe,IAAI,OAAO;CACzB,OAAO,YAAY,OAAO,CAAC,CAAC;AAC7B;;;;AAIA,eAAe,YAAY,OAAO,MAAM;CACvC,MAAM,MAAM,MAAM,OAAO,QAAQ,IAAI;CACrC,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,OAAO;CACzB,SAAS,OAAO;EACf,OAAO,MAAM,oBAAoB,OAAO,OAAO,GAAG,CAAC;CACpD;CACA,OAAO,SAAS,WAAW,OAAO,MAAM,GAAG;AAC5C;AAGA,eAAe,IAAI,OAAO;CACzB,OAAO,YAAY,OAAO,CAAC,CAAC;AAC7B;;;;AAIA,eAAe,YAAY,OAAO,MAAM;CACvC,MAAM,MAAM,MAAM,OAAO,QAAQ,IAAI;CACrC,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,OAAO;CACzB,SAAS,OAAO;EACf,OAAO,MAAM,oBAAoB,OAAO,OAAO,GAAG,CAAC;CACpD;CACA,OAAO,SAAS,WAAW,OAAO,MAAM,GAAG;AAC5C;AAGA,eAAe,OAAO,OAAO;CAC5B,OAAO,eAAe,OAAO,CAAC,CAAC;AAChC;;;;AAIA,eAAe,eAAe,OAAO,MAAM;CAC1C,MAAM,MAAM,MAAM,OAAO,QAAQ,IAAI;CACrC,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,OAAO;CACzB,SAAS,OAAO;EACf,OAAO,MAAM,oBAAoB,UAAU,OAAO,GAAG,CAAC;CACvD;CACA,OAAO,SAAS,cAAc,OAAO,MAAM,GAAG;AAC/C;AAGA,eAAe,QAAQ,OAAO;CAC7B,OAAO,gBAAgB,OAAO,CAAC,CAAC;AACjC;;;;AAIA,eAAe,gBAAgB,OAAO,MAAM;CAC3C,MAAM,MAAM,MAAM,OAAO,QAAQ,IAAI;CACrC,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,OAAO;CACzB,SAAS,OAAO;EACf,OAAO,MAAM,oBAAoB,WAAW,OAAO,GAAG,CAAC;CACxD;CACA,OAAO,SAAS,eAAe,OAAO,MAAM,GAAG;AAChD"}
+{"version":3,"file":"control.mjs","names":[],"sources":["../../../0-framework/3-tooling/cli/dist/log-B1EJJGSl.mjs"],"sourcesContent":["import { n as executorLoadFailure } from \"./shared-BTnATsqm.mjs\";\nimport { notOk } from \"@internal/foundation/result\";\n//#region src/operations/deploy.ts\nasync function deploy(input) {\n\treturn deployWithDeps(input, {});\n}\n/** In-package variant threading the injection seam (the CLI's RunDeps, unit\n* tests). Deliberately NOT re-exported through `./control` — the seam mirrors\n* internal types and is not part of the published surface. */\nasync function deployWithDeps(input, deps) {\n\tconst cwd = input.cwd ?? process.cwd();\n\tlet executor;\n\ttry {\n\t\texecutor = await import(\"./execute-deploy-destroy-DRl6Tfg9.mjs\");\n\t} catch (error) {\n\t\treturn notOk(executorLoadFailure(\"deploy\", error, cwd));\n\t}\n\treturn executor.executeDeploy(input, deps, cwd);\n}\n//#endregion\n//#region src/operations/destroy.ts\nasync function destroy(input) {\n\treturn destroyWithDeps(input, {});\n}\n/** In-package variant threading the injection seam (the CLI's RunDeps, unit\n* tests). Deliberately NOT re-exported through `./control` — the seam mirrors\n* internal types and is not part of the published surface. */\nasync function destroyWithDeps(input, deps) {\n\tconst cwd = input.cwd ?? process.cwd();\n\tlet executor;\n\ttry {\n\t\texecutor = await import(\"./execute-deploy-destroy-DRl6Tfg9.mjs\");\n\t} catch (error) {\n\t\treturn notOk(executorLoadFailure(\"destroy\", error, cwd));\n\t}\n\treturn executor.executeDestroy(input, deps, cwd);\n}\n//#endregion\n//#region src/operations/dev.ts\nasync function dev(input) {\n\treturn devWithDeps(input, {});\n}\n/** In-package variant threading the injection seam (the CLI's RunDeps, unit\n* tests). Deliberately NOT re-exported through `./control` — the seam mirrors\n* internal types and is not part of the published surface. */\nasync function devWithDeps(input, deps) {\n\tconst cwd = input.cwd ?? process.cwd();\n\tlet executor;\n\ttry {\n\t\texecutor = await import(\"./execute-dev-BMTFWfFc.mjs\");\n\t} catch (error) {\n\t\treturn notOk(executorLoadFailure(\"dev\", error, cwd));\n\t}\n\treturn executor.executeDev(input, deps, cwd);\n}\n//#endregion\n//#region src/operations/log.ts\nasync function log(input) {\n\treturn logWithDeps(input, {});\n}\n/** In-package variant threading the injection seam (the CLI's LogRunDeps,\n* unit tests). Deliberately NOT re-exported through `./control` — the seam\n* mirrors internal types and is not part of the published surface. */\nasync function logWithDeps(input, deps) {\n\tconst cwd = input.cwd ?? process.cwd();\n\tlet executor;\n\ttry {\n\t\texecutor = await import(\"./execute-log-Cay9hlKW.mjs\");\n\t} catch (error) {\n\t\treturn notOk(executorLoadFailure(\"log\", error, cwd));\n\t}\n\treturn executor.executeLog(input, deps, cwd);\n}\n//#endregion\nexport { destroy as a, deployWithDeps as c, devWithDeps as i, logWithDeps as n, destroyWithDeps as o, dev as r, deploy as s, log as t };\n\n//# sourceMappingURL=log-B1EJJGSl.mjs.map"],"mappings":";;;AAGA,eAAe,OAAO,OAAO;CAC5B,OAAO,eAAe,OAAO,CAAC,CAAC;AAChC;;;;AAIA,eAAe,eAAe,OAAO,MAAM;CAC1C,MAAM,MAAM,MAAM,OAAO,QAAQ,IAAI;CACrC,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,OAAO;CACzB,SAAS,OAAO;EACf,OAAO,MAAM,oBAAoB,UAAU,OAAO,GAAG,CAAC;CACvD;CACA,OAAO,SAAS,cAAc,OAAO,MAAM,GAAG;AAC/C;AAGA,eAAe,QAAQ,OAAO;CAC7B,OAAO,gBAAgB,OAAO,CAAC,CAAC;AACjC;;;;AAIA,eAAe,gBAAgB,OAAO,MAAM;CAC3C,MAAM,MAAM,MAAM,OAAO,QAAQ,IAAI;CACrC,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,OAAO;CACzB,SAAS,OAAO;EACf,OAAO,MAAM,oBAAoB,WAAW,OAAO,GAAG,CAAC;CACxD;CACA,OAAO,SAAS,eAAe,OAAO,MAAM,GAAG;AAChD;AAGA,eAAe,IAAI,OAAO;CACzB,OAAO,YAAY,OAAO,CAAC,CAAC;AAC7B;;;;AAIA,eAAe,YAAY,OAAO,MAAM;CACvC,MAAM,MAAM,MAAM,OAAO,QAAQ,IAAI;CACrC,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,OAAO;CACzB,SAAS,OAAO;EACf,OAAO,MAAM,oBAAoB,OAAO,OAAO,GAAG,CAAC;CACpD;CACA,OAAO,SAAS,WAAW,OAAO,MAAM,GAAG;AAC5C;AAGA,eAAe,IAAI,OAAO;CACzB,OAAO,YAAY,OAAO,CAAC,CAAC;AAC7B;;;;AAIA,eAAe,YAAY,OAAO,MAAM;CACvC,MAAM,MAAM,MAAM,OAAO,QAAQ,IAAI;CACrC,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,OAAO;CACzB,SAAS,OAAO;EACf,OAAO,MAAM,oBAAoB,OAAO,OAAO,GAAG,CAAC;CACpD;CACA,OAAO,SAAS,WAAW,OAAO,MAAM,GAAG;AAC5C"}

package/dist/deploy-647Wkm51.d.mts

@@ -0,0 +1 @@
+import "./app-config-BinBcpPf-1akTl5h4.mjs";

package/dist/deploy.d.mts

@@ -1,3 +1,3 @@
-import { A as ProvisionerDescriptor, B as joinDeployment, C as Lowering, E as PackageInput, H as lowering, P as buildConfig, S as LoweredResult, T as Outputs, U as mergedProviders, V as lower, W as resolveStateLayer, a as Bundle, b as LowerError, d as DeploymentResult, i as AssembleInput, j as ServiceLowering, k as ProvisionEdge, l as DeployedEntity, n as ApplicationDescriptor, r as Artifact, t as AlchemyStateLayer, u as DeployedNode, x as LowerOptions, y as LowerContext } from "./app-config-CFsSXEVj-B242oUnm.mjs";
-import "./deploy-ku5b_2YD.mjs";
+import { A as ProvisionEdge, B as buildConfig, C as LoweredResult, D as PackageInput, E as Outputs, J as lowering, K as joinDeployment, L as ServiceLowering, S as LowerOptions, X as resolveStateLayer, Y as mergedProviders, a as Bundle, b as LowerContext, d as DeployedNode, f as DeploymentResult, i as AssembleInput, j as ProvisionerDescriptor, n as ApplicationDescriptor, q as lower, r as Artifact, t as AlchemyStateLayer, u as DeployedEntity, w as Lowering, x as LowerError } from "./app-config-BinBcpPf-1akTl5h4.mjs";
+import "./deploy-647Wkm51.mjs";
 export { AlchemyStateLayer, ApplicationDescriptor, Artifact, AssembleInput, Bundle, DeployedEntity, DeployedNode, DeploymentResult, LowerContext, LowerError, LowerOptions, LoweredResult, Lowering, Outputs, PackageInput, ProvisionEdge, ProvisionerDescriptor, ServiceLowering, buildConfig, joinDeployment, lower, lowering, mergedProviders, resolveStateLayer };

package/dist/{deployment-summary-r47O6kFr-CcMYVOn5.mjs → deployment-summary-DswOl_9E-B9MhYYDt.mjs}

@@ -1,6 +1,6 @@
 import { t as blindCast } from "./casts-DpaahrlC-C5XMnP9S.mjs";
-import * as fs from "node:fs";
-//#region ../../0-framework/3-tooling/cli/dist/deployment-summary-r47O6kFr.mjs
+import * as fs$1 from "node:fs";
+//#region ../../0-framework/3-tooling/cli/dist/deployment-summary-DswOl_9E.mjs
 /**
 * The deploy result's cross-process protocol, whole in one place: the
 * serializable shape, the env var that names the carrier file, the writer the
@@ -34,7 +34,7 @@ function writeDeploymentSummaryFile(result) {
 	const file = process.env[DEPLOYMENT_RESULT_FILE_ENV];
 	if (file === void 0 || file.length === 0) return;
 	try {
-		fs.writeFileSync(file, JSON.stringify(toDeploymentSummary(result)));
+		fs$1.writeFileSync(file, JSON.stringify(toDeploymentSummary(result)));
 	} catch {}
 }
 function isRecord(value) {
@@ -47,7 +47,7 @@ function isRecord(value) {
 function readDeploymentSummary(resultFilePath) {
 	let raw;
 	try {
-		raw = fs.readFileSync(resultFilePath, "utf8");
+		raw = fs$1.readFileSync(resultFilePath, "utf8");
 	} catch {
 		return;
 	}
@@ -67,4 +67,4 @@ function readDeploymentSummary(resultFilePath) {
 //#endregion
 export { readDeploymentSummary as n, writeDeploymentSummaryFile as r, DEPLOYMENT_RESULT_FILE_ENV as t };
 
-//# sourceMappingURL=deployment-summary-r47O6kFr-CcMYVOn5.mjs.map
+//# sourceMappingURL=deployment-summary-DswOl_9E-B9MhYYDt.mjs.map

package/dist/deployment-summary-DswOl_9E-B9MhYYDt.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-summary-DswOl_9E-B9MhYYDt.mjs","names":["fs"],"sources":["../../../0-framework/3-tooling/cli/dist/deployment-summary-DswOl_9E.mjs"],"sourcesContent":["import * as fs from \"node:fs\";\nimport { blindCast } from \"@internal/foundation/casts\";\n//#region src/deployment-summary.ts\n/**\n* The deploy result's cross-process protocol, whole in one place: the\n* serializable shape, the env var that names the carrier file, the writer the\n* report hook calls from inside the alchemy child, and the reader the deploy\n* operation runs after the child exits. `DeploymentResult` itself cannot\n* cross the boundary — its `DeployedNode` entries hold live graph-node\n* references (ADR-0033) — so the writer projects it down to what CAN.\n*\n* The summary is best-effort by contract: the writer never fails the child\n* over it, and the reader maps absent or malformed to `undefined`.\n*/\n/** Env var the deploy operation sets on the alchemy child: when present,\n* the report hook also writes the JSON DeploymentSummary there. */\nconst DEPLOYMENT_RESULT_FILE_ENV = \"PRISMA_COMPOSER_DEPLOYMENT_RESULT_FILE\";\n/** Pure projection: keeps app + each node's address/entities, drops the in-process `node`. */\nfunction toDeploymentSummary(result) {\n\treturn {\n\t\tapp: result.app,\n\t\tnodes: result.nodes.map((node) => ({\n\t\t\taddress: node.address,\n\t\t\tentities: node.entities\n\t\t}))\n\t};\n}\n/**\n* Writer half, called by the report hook inside the alchemy child: when the\n* env var names a file, write the summary there. Best-effort — a write\n* failure must not fail a deploy that already converged, so it is swallowed.\n*/\nfunction writeDeploymentSummaryFile(result) {\n\tconst file = process.env[DEPLOYMENT_RESULT_FILE_ENV];\n\tif (file === void 0 || file.length === 0) return;\n\ttry {\n\t\tfs.writeFileSync(file, JSON.stringify(toDeploymentSummary(result)));\n\t} catch {}\n}\nfunction isRecord(value) {\n\treturn typeof value === \"object\" && value !== null;\n}\n/**\n* Reader half, run by the deploy operation after the child exits. Absent or\n* malformed → undefined — the summary is best-effort, never a deploy failure.\n*/\nfunction readDeploymentSummary(resultFilePath) {\n\tlet raw;\n\ttry {\n\t\traw = fs.readFileSync(resultFilePath, \"utf8\");\n\t} catch {\n\t\treturn;\n\t}\n\tlet parsed;\n\ttry {\n\t\tparsed = JSON.parse(raw);\n\t} catch {\n\t\treturn;\n\t}\n\tif (!isRecord(parsed) || typeof parsed[\"app\"] !== \"string\" || !Array.isArray(parsed[\"nodes\"])) return;\n\tfor (const node of parsed[\"nodes\"]) {\n\t\tif (!isRecord(node) || typeof node[\"address\"] !== \"string\" || !Array.isArray(node[\"entities\"])) return;\n\t\tfor (const entity of node[\"entities\"]) if (!isRecord(entity) || typeof entity[\"kind\"] !== \"string\" || typeof entity[\"id\"] !== \"string\") return;\n\t}\n\treturn blindCast(parsed);\n}\n//#endregion\nexport { readDeploymentSummary as n, writeDeploymentSummaryFile as r, DEPLOYMENT_RESULT_FILE_ENV as t };\n\n//# sourceMappingURL=deployment-summary-DswOl_9E.mjs.map"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAM,6BAA6B;;AAEnC,SAAS,oBAAoB,QAAQ;CACpC,OAAO;EACN,KAAK,OAAO;EACZ,OAAO,OAAO,MAAM,KAAK,UAAU;GAClC,SAAS,KAAK;GACd,UAAU,KAAK;EAChB,EAAE;CACH;AACD;;;;;;AAMA,SAAS,2BAA2B,QAAQ;CAC3C,MAAM,OAAO,QAAQ,IAAI;CACzB,IAAI,SAAS,KAAK,KAAK,KAAK,WAAW,GAAG;CAC1C,IAAI;EACH,KAAG,cAAc,MAAM,KAAK,UAAU,oBAAoB,MAAM,CAAC,CAAC;CACnE,QAAQ,CAAC;AACV;AACA,SAAS,SAAS,OAAO;CACxB,OAAO,OAAO,UAAU,YAAY,UAAU;AAC/C;;;;;AAKA,SAAS,sBAAsB,gBAAgB;CAC9C,IAAI;CACJ,IAAI;EACH,MAAMA,KAAG,aAAa,gBAAgB,MAAM;CAC7C,QAAQ;EACP;CACD;CACA,IAAI;CACJ,IAAI;EACH,SAAS,KAAK,MAAM,GAAG;CACxB,QAAQ;EACP;CACD;CACA,IAAI,CAAC,SAAS,MAAM,KAAK,OAAO,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAC/F,KAAK,MAAM,QAAQ,OAAO,UAAU;EACnC,IAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,eAAe,YAAY,CAAC,MAAM,QAAQ,KAAK,WAAW,GAAG;EAChG,KAAK,MAAM,UAAU,KAAK,aAAa,IAAI,CAAC,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,YAAY,OAAO,OAAO,UAAU,UAAU;CACzI;CACA,OAAO,UAAU,MAAM;AACxB"}

package/dist/dist-CVk7Pk4B.mjs

@@ -0,0 +1,42 @@
+import fs from "node:fs";
+import path from "node:path";
+//#region ../../0-framework/2-authoring/bundle-paths/dist/index.mjs
+/**
+* The path-containment predicate and bundle-link validation shared by every
+* assembly and packaging seam (node/nextjs adapters, the compute artifact
+* writer, the local extractor). This predicate is the enforcement point of
+* ADR-0047's boundary — a symlink may be preserved only while its target
+* stays inside the assembled bundle — so it exists exactly once.
+*/
+/** Lexical containment: `candidate` is `root` itself or below it. Both paths
+* must already be absolute or share a resolution base; no filesystem access. */
+function isWithin(root, candidate) {
+	const relative = path.relative(root, candidate);
+	return relative === "" || !relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative);
+}
+/** Walks the assembled bundle and rejects a dangling symlink or one whose
+* resolved target escapes the bundle root. Symlinked directories are not
+* descended: their targets are validated, and their contents belong to the
+* target's own location. */
+async function assertBundleSymlinksStayInside(bundleDir) {
+	const realRoot = await fs.promises.realpath(bundleDir);
+	const walk = async (directory) => {
+		for (const entry of await fs.promises.readdir(directory, { withFileTypes: true })) {
+			const full = path.join(directory, entry.name);
+			if (entry.isSymbolicLink()) {
+				let realTarget;
+				try {
+					realTarget = await fs.promises.realpath(full);
+				} catch {
+					throw new Error(`the assembled bundle contains a dangling symlink: ${full}`);
+				}
+				if (!isWithin(realRoot, realTarget)) throw new Error(`the assembled bundle contains a symlink whose target escapes the bundle: ${full} -> ${await fs.promises.readlink(full)}`);
+			} else if (entry.isDirectory()) await walk(full);
+		}
+	};
+	await walk(bundleDir);
+}
+//#endregion
+export { isWithin as n, assertBundleSymlinksStayInside as t };
+
+//# sourceMappingURL=dist-CVk7Pk4B.mjs.map

package/dist/dist-CVk7Pk4B.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist-CVk7Pk4B.mjs","names":[],"sources":["../../../0-framework/2-authoring/bundle-paths/dist/index.mjs"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\n//#region src/bundle-paths.ts\n/**\n* The path-containment predicate and bundle-link validation shared by every\n* assembly and packaging seam (node/nextjs adapters, the compute artifact\n* writer, the local extractor). This predicate is the enforcement point of\n* ADR-0047's boundary — a symlink may be preserved only while its target\n* stays inside the assembled bundle — so it exists exactly once.\n*/\n/** Lexical containment: `candidate` is `root` itself or below it. Both paths\n* must already be absolute or share a resolution base; no filesystem access. */\nfunction isWithin(root, candidate) {\n\tconst relative = path.relative(root, candidate);\n\treturn relative === \"\" || !relative.startsWith(`..${path.sep}`) && relative !== \"..\" && !path.isAbsolute(relative);\n}\n/** Walks the assembled bundle and rejects a dangling symlink or one whose\n* resolved target escapes the bundle root. Symlinked directories are not\n* descended: their targets are validated, and their contents belong to the\n* target's own location. */\nasync function assertBundleSymlinksStayInside(bundleDir) {\n\tconst realRoot = await fs.promises.realpath(bundleDir);\n\tconst walk = async (directory) => {\n\t\tfor (const entry of await fs.promises.readdir(directory, { withFileTypes: true })) {\n\t\t\tconst full = path.join(directory, entry.name);\n\t\t\tif (entry.isSymbolicLink()) {\n\t\t\t\tlet realTarget;\n\t\t\t\ttry {\n\t\t\t\t\trealTarget = await fs.promises.realpath(full);\n\t\t\t\t} catch {\n\t\t\t\t\tthrow new Error(`the assembled bundle contains a dangling symlink: ${full}`);\n\t\t\t\t}\n\t\t\t\tif (!isWithin(realRoot, realTarget)) throw new Error(`the assembled bundle contains a symlink whose target escapes the bundle: ${full} -> ${await fs.promises.readlink(full)}`);\n\t\t\t} else if (entry.isDirectory()) await walk(full);\n\t\t}\n\t};\n\tawait walk(bundleDir);\n}\n//#endregion\nexport { assertBundleSymlinksStayInside, isWithin };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;;;;;;;;AAYA,SAAS,SAAS,MAAM,WAAW;CAClC,MAAM,WAAW,KAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,MAAM,CAAC,SAAS,WAAW,KAAK,KAAK,KAAK,KAAK,aAAa,QAAQ,CAAC,KAAK,WAAW,QAAQ;AAClH;;;;;AAKA,eAAe,+BAA+B,WAAW;CACxD,MAAM,WAAW,MAAM,GAAG,SAAS,SAAS,SAAS;CACrD,MAAM,OAAO,OAAO,cAAc;EACjC,KAAK,MAAM,SAAS,MAAM,GAAG,SAAS,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG;GAClF,MAAM,OAAO,KAAK,KAAK,WAAW,MAAM,IAAI;GAC5C,IAAI,MAAM,eAAe,GAAG;IAC3B,IAAI;IACJ,IAAI;KACH,aAAa,MAAM,GAAG,SAAS,SAAS,IAAI;IAC7C,QAAQ;KACP,MAAM,IAAI,MAAM,qDAAqD,MAAM;IAC5E;IACA,IAAI,CAAC,SAAS,UAAU,UAAU,GAAG,MAAM,IAAI,MAAM,4EAA4E,KAAK,MAAM,MAAM,GAAG,SAAS,SAAS,IAAI,GAAG;GAC/K,OAAO,IAAI,MAAM,YAAY,GAAG,MAAM,KAAK,IAAI;EAChD;CACD;CACA,MAAM,KAAK,SAAS;AACrB"}