@prisma/composer-prisma-cloud 0.1.0-dev.1

package/dist/control.mjs

@@ -0,0 +1,2031 @@
+import { a as encodeParamPointer, c as secretName, i as encode, l as secretPointerRows, s as paramEntries, t as configKey } from "./serializer-DAEWRfnm-D3GW9dOZ.mjs";
+import { a as serviceKeyEdges, i as paramName, n as isEnvParamSource, o as serviceKeyEnvName, r as paramBindingFor } from "./param-DB0B8m15-IvzNq9BM.mjs";
+import { a as normalizeSslMode, n as isPnPostgresResourceNode, o as withConnectionRetry } from "./prisma-next-COrwlg3N.mjs";
+import { isParamSource, paramManifest, provisionManifest } from "@prisma/composer";
+import { blindCast } from "@prisma/composer/casts";
+import { RPC_PEER_KEY } from "@prisma/composer/rpc";
+import pg from "pg";
+import * as Layer from "effect/Layer";
+import { createManagementApiClient } from "@prisma/management-api-sdk";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Config$1 from "effect/Config";
+import * as Data from "effect/Data";
+import * as Provider from "alchemy/Provider";
+import { Resource, Stack } from "alchemy";
+import * as Schedule from "effect/Schedule";
+import * as fs from "node:fs";
+import * as crypto$1 from "node:crypto";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as zlib from "node:zlib";
+import postgres from "postgres";
+import { STATE_STORE_VERSION, State, StateStoreError, encodeState, reviveStateRecursive } from "alchemy/State";
+import * as Output from "alchemy/Output";
+import { loadConfig } from "@prisma-next/config-loader";
+import { resolve } from "pathe";
+import { readRef } from "@prisma-next/migration-tools/refs";
+import { APP_SPACE_ID, readContractSpaceHeadRef, spaceMigrationDirectory, spaceRefsDirectory } from "@prisma-next/migration-tools/spaces";
+import { createPostgresControlClient } from "@prisma-next/postgres/control";
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CxGdfSAP.mjs
+/**
+* The Prisma service token used to authenticate Management API calls. Kept
+* as a Redacted value so it never lands in logs or error output.
+*/
+var PrismaCredentials = class extends Context.Service()("PrismaCredentials") {};
+/** Resolve the token from the `PRISMA_SERVICE_TOKEN` environment variable. */
+const fromEnv = () => Layer.effect(PrismaCredentials, Effect.gen(function* () {
+	return { token: yield* Config$1.redacted("PRISMA_SERVICE_TOKEN") };
+}));
+/**
+* The typed Prisma Management API client, built once from the resolved
+* credentials. Providers yield this in their outer Effect and call it inside
+* `reconcile` / `delete`.
+*/
+var ManagementClient = class extends Context.Service()("PrismaManagementClient") {};
+const layer = () => Layer.effect(ManagementClient, Effect.gen(function* () {
+	const { token } = yield* PrismaCredentials;
+	return createManagementApiClient({ token: Redacted.value(token) });
+}));
+/** A non-2xx response from the Management API (or a transport failure). */
+var PrismaApiError = class extends Data.TaggedError("PrismaApiError") {};
+const attempt$1 = (f) => Effect.tryPromise({
+	try: f,
+	catch: (cause) => new PrismaApiError({
+		status: 0,
+		message: String(cause)
+	})
+});
+const fail = (r) => Effect.fail(new PrismaApiError({
+	status: r.response.status,
+	message: JSON.stringify(r.error)
+}));
+/** Unwrap `data`, failing on any API error. Preserves the SDK's response type. */
+const call = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.error !== void 0 || r.data === void 0 ? fail(r) : Effect.succeed(r.data)));
+/** Unwrap `data`, mapping a 404 to `undefined` (resource gone / not found). */
+const callOptional = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.status === 404 ? Effect.succeed(void 0) : r.error !== void 0 ? fail(r) : Effect.succeed(r.data)));
+/** Fire-and-forget a call, tolerating a 404 (already deleted). */
+const callVoid = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute/index.mjs
+/**
+* Stopping a deployment before the app that owns it can be
+* deleted is asynchronous on the platform's side: DELETE can 409 with this
+* message while the deployment is still winding down. Retrying blindly on
+* every API error would mask real failures (bad auth, a genuinely conflicting
+* state, etc.), so this only matches the platform's specific "not delete-safe
+* yet" wording — everything else fails immediately, as before.
+*/
+const isDeleteNotSafeYet = (error) => error.message.includes("did not reach a delete-safe state");
+/**
+* Backs off exponentially from 2s, capped at 5 minutes total — long enough
+* for the platform to finish stopping the deployment, short enough to still
+* fail loudly (rather than hang forever) if it never does.
+*/
+const deleteSafeRetrySchedule = Schedule.both(Schedule.exponential("2 seconds", 2), Schedule.during("5 minutes"));
+/** Every region Prisma Compute serves — the runtime source of truth; `ComputeRegion` is derived from it so the two can never drift. */
+const COMPUTE_REGIONS = [
+	"us-east-1",
+	"us-west-1",
+	"eu-west-3",
+	"eu-central-1",
+	"ap-northeast-1",
+	"ap-southeast-1"
+];
+/** A Prisma **Compute service** — the stable app identity behind a project. */
+const ComputeService = Resource("Prisma.ComputeService");
+const ComputeServiceProvider = () => Provider.effect(ComputeService, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/apps/{appId}", { params: { path: { appId: output.id } } })) : void 0;
+			if (observed) return {
+				id: observed.data.id,
+				name: observed.data.name,
+				endpointDomain: observed.data.appEndpointDomain
+			};
+			const created = yield* call(() => client.POST("/v1/apps", { body: {
+				displayName: news.name,
+				projectId: news.projectId,
+				...news.region && { regionId: news.region },
+				...news.branchId !== void 0 && { branchId: news.branchId }
+			} }));
+			return {
+				id: created.data.id,
+				name: created.data.name,
+				endpointDomain: created.data.appEndpointDomain
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/apps/{appId}", { params: { path: { appId: output.id } } })).pipe(Effect.retry({
+				schedule: deleteSafeRetrySchedule,
+				while: isDeleteNotSafeYet
+			}));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const s = yield* callOptional(() => client.GET("/v1/apps/{appId}", { params: { path: { appId: output.id } } }));
+			return s ? {
+				id: s.data.id,
+				name: s.data.name,
+				endpointDomain: s.data.appEndpointDomain
+			} : void 0;
+		})
+	};
+}));
+/**
+* A **deployment** of a Prisma app — creates a deployment, uploads
+* its artifact, starts the VM, waits for it to run, then promotes it to the
+* app's stable endpoint.
+*/
+const Deployment = Resource("Prisma.Deployment");
+const DeploymentProvider = () => Provider.effect(Deployment, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	const waitForRunning = (deploymentId) => call(() => client.GET("/v1/deployments/{deploymentId}", { params: { path: { deploymentId } } })).pipe(Effect.flatMap((v) => v.data.status === "running" ? Effect.void : Effect.fail(new PrismaApiError({
+		status: 409,
+		message: `deployment ${deploymentId} is ${v.data.status}, not running`
+	}))), Effect.retry(Schedule.both(Schedule.spaced("2 seconds"), Schedule.during("2 minutes"))));
+	return {
+		stables: [],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news }) {
+			const created = yield* call(() => client.POST("/v1/apps/{appId}/deployments", {
+				params: { path: { appId: news.computeServiceId } },
+				body: news.port !== void 0 ? { portMapping: { http: news.port } } : {}
+			}));
+			const deploymentId = created.data.id;
+			if (created.data.uploadUrl) {
+				const uploadUrl = created.data.uploadUrl;
+				const artifact = yield* Effect.try({
+					try: () => fs.readFileSync(news.artifactPath),
+					catch: (cause) => new PrismaApiError({
+						status: 0,
+						message: `failed to read artifact ${news.artifactPath}: ${String(cause)}`
+					})
+				});
+				yield* Effect.tryPromise({
+					try: async () => {
+						const res = await fetch(uploadUrl, {
+							method: "PUT",
+							body: artifact
+						});
+						if (!res.ok) throw new PrismaApiError({
+							status: res.status,
+							message: `artifact upload failed: ${res.status} ${res.statusText}`
+						});
+					},
+					catch: (cause) => cause instanceof PrismaApiError ? cause : new PrismaApiError({
+						status: 0,
+						message: String(cause)
+					})
+				});
+			}
+			yield* call(() => client.POST("/v1/deployments/{deploymentId}/start", { params: { path: { deploymentId } } }));
+			yield* waitForRunning(deploymentId);
+			const deployedUrl = (yield* call(() => client.POST("/v1/apps/{appId}/promote", {
+				params: { path: { appId: news.computeServiceId } },
+				body: { deploymentId }
+			}))).data.appEndpointDomain;
+			return {
+				deploymentId,
+				...deployedUrl !== void 0 && { deployedUrl }
+			};
+		}),
+		delete: Effect.fn(function* () {}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.deploymentId) return void 0;
+			const v = yield* callOptional(() => client.GET("/v1/deployments/{deploymentId}", { params: { path: { deploymentId: output.deploymentId } } }));
+			return v ? {
+				deploymentId: v.data.id,
+				...v.data.previewDomain && { deployedUrl: v.data.previewDomain }
+			} : void 0;
+		})
+	};
+}));
+/**
+* A project-scoped **environment variable** that Compute injects into the
+* project's services from their attached branch (e.g. wiring one module's URL into
+* another).
+*/
+const EnvironmentVariable = Resource("Prisma.EnvironmentVariable");
+const EnvironmentVariableProvider = () => Provider.effect(EnvironmentVariable, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const cls = news.class ?? "production";
+			let id = output?.id;
+			if (id !== void 0) {
+				const priorId = id;
+				if (!(yield* callOptional(() => client.GET("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: priorId } } })))) id = void 0;
+			}
+			if (id === void 0) {
+				const matchId = (yield* call(() => client.GET("/v1/environment-variables", { params: { query: {
+					projectId: news.projectId,
+					class: cls,
+					key: news.key
+				} } }))).data?.[0]?.id;
+				if (matchId !== void 0) {
+					if (!(news.key === "DATABASE_URL" || news.key === "DATABASE_URL_POOLED")) throw new Error(`EnvironmentVariable "${news.key}" (project "${news.projectId}", class "${cls}") exists but is untracked in this deploy state — refusing to overwrite a reserved COMPOSER_ key. Restore this deploy's hosted state, or remove the variable to let this deploy recreate it.`);
+					id = matchId;
+				}
+			}
+			if (id !== void 0) {
+				const targetId = id;
+				yield* call(() => client.PATCH("/v1/environment-variables/{envVarId}", {
+					params: { path: { envVarId: targetId } },
+					body: { value: news.value }
+				}));
+				return {
+					id,
+					key: news.key
+				};
+			}
+			const created = yield* call(() => client.POST("/v1/environment-variables", { body: {
+				projectId: news.projectId,
+				class: cls,
+				key: news.key,
+				value: news.value,
+				...news.branchId ? { branchId: news.branchId } : {}
+			} }));
+			return {
+				id: created.data.id,
+				key: created.data.key
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const v = yield* callOptional(() => client.GET("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: output.id } } }));
+			return v ? {
+				id: v.data.id,
+				key: v.data.key
+			} : void 0;
+		})
+	};
+}));
+/**
+* Assembles a Prisma Compute artifact: the app-built bundle plus the
+* extension-printed bootstrap and manifest, tarred and gzipped deterministically
+* (fixed mtimes, sorted entry order) so an unchanged service noops on
+* redeploy — a rebuild is the only thing that changes the hash. Lives here
+* (not in @prisma/composer-prisma-cloud/control) because it needs node:fs/node:zlib,
+* which the extension's shipped src may never import (invariant 5).
+*/
+const MANIFEST_VERSION = "1";
+/** Finds main.js/main.mjs in a bundle dir when no explicit entry is given. */
+function resolveEntry(bundleDir, entry) {
+	if (entry !== void 0) return entry;
+	const found = fs.readdirSync(bundleDir).find((f) => /^main\.m?js$/.test(f));
+	if (found === void 0) throw new Error(`no main.js/main.mjs found in bundle dir ${bundleDir}`);
+	return found;
+}
+/** All files under `dir`, as dir-relative POSIX paths, in sorted order. A
+* symlink is a hard error: deploy bundles must be flat (ADR-0005), and the
+* user's build owns flattening — dereferencing here would relink the tree and
+* risk packaging files from outside it. */
+function walkFiles(dir) {
+	const out = [];
+	const visit = (sub) => {
+		for (const entry of fs.readdirSync(path.join(dir, sub), { withFileTypes: true })) {
+			const rel = sub.length > 0 ? `${sub}/${entry.name}` : entry.name;
+			if (entry.isSymbolicLink()) throw new Error(`bundle contains a symlink at ${rel} — deploy bundles must be flat; materialize links in your build (e.g. cp -RL) so the tree is self-contained.`);
+			if (entry.isDirectory()) visit(rel);
+			else out.push(rel);
+		}
+	};
+	visit("");
+	return out.sort();
+}
+function octal(value, length) {
+	return `${value.toString(8).padStart(length - 1, "0")}\0`;
+}
+/** Splits a path into ustar's name (<=100 bytes) + prefix (<=155 bytes) fields. */
+function splitUstarPath(relPath) {
+	if (Buffer.byteLength(relPath, "utf8") <= 100) return {
+		name: relPath,
+		prefix: ""
+	};
+	for (let i = relPath.length - 1; i >= 0; i--) {
+		if (relPath[i] !== "/") continue;
+		const prefix = relPath.slice(0, i);
+		const name = relPath.slice(i + 1);
+		if (Buffer.byteLength(prefix, "utf8") <= 155 && Buffer.byteLength(name, "utf8") <= 100) return {
+			name,
+			prefix
+		};
+	}
+	throw new Error(`path too long for a ustar tar entry: ${relPath}`);
+}
+function ustarHeader(relPath, size) {
+	const { name, prefix } = splitUstarPath(relPath);
+	const buf = Buffer.alloc(512);
+	buf.write(name, 0, 100, "utf8");
+	buf.write(octal(420, 8), 100, 8, "utf8");
+	buf.write(octal(0, 8), 108, 8, "utf8");
+	buf.write(octal(0, 8), 116, 8, "utf8");
+	buf.write(octal(size, 12), 124, 12, "utf8");
+	buf.write(octal(0, 12), 136, 12, "utf8");
+	buf.write("        ", 148, 8, "utf8");
+	buf.write("0", 156, 1, "utf8");
+	buf.write("ustar\0", 257, 6, "utf8");
+	buf.write("00", 263, 2, "utf8");
+	buf.write(prefix, 345, 155, "utf8");
+	let sum = 0;
+	for (const b of buf) sum += b;
+	buf.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148, 8, "utf8");
+	return buf;
+}
+function createDeterministicTarGz(entries) {
+	const sorted = [...entries].sort((a, b) => a.relPath.localeCompare(b.relPath));
+	const chunks = [];
+	for (const entry of sorted) {
+		chunks.push(ustarHeader(entry.relPath, entry.content.length));
+		chunks.push(entry.content);
+		const pad = (512 - entry.content.length % 512) % 512;
+		if (pad > 0) chunks.push(Buffer.alloc(pad));
+	}
+	chunks.push(Buffer.alloc(1024));
+	return zlib.gzipSync(Buffer.concat(chunks));
+}
+/**
+* Prints the bootstrap + manifest and tars them with the bundle into a
+* deterministic artifact. If bundleDir doesn't exist (e.g. `alchemy destroy`
+* run before any build), returns a placeholder rather than throwing — the
+* artifact is never read on destroy.
+*/
+function packageComputeArtifact(opts) {
+	if (!fs.existsSync(opts.bundleDir)) return {
+		path: "",
+		sha256: "absent"
+	};
+	const bootstrap = `import main from "./${resolveEntry(opts.bundleDir, opts.bundleEntry)}";\nawait main.run(${JSON.stringify(opts.address)}, () => import(${JSON.stringify(`./${opts.appEntry}`)}));\n`;
+	const manifest = `${JSON.stringify({
+		manifestVersion: MANIFEST_VERSION,
+		entrypoint: "bootstrap.js"
+	}, null, 2)}\n`;
+	const files = walkFiles(opts.bundleDir).map((relPath) => ({
+		relPath,
+		content: fs.readFileSync(path.join(opts.bundleDir, relPath))
+	}));
+	files.push({
+		relPath: "bootstrap.js",
+		content: Buffer.from(bootstrap, "utf8")
+	});
+	files.push({
+		relPath: "compute.manifest.json",
+		content: Buffer.from(manifest, "utf8")
+	});
+	files.push({
+		relPath: "bunfig.toml",
+		content: Buffer.from("[install]\nauto = \"disable\"\n", "utf8")
+	});
+	const gz = createDeterministicTarGz(files);
+	const sha256 = crypto$1.createHash("sha256").update(gz).digest("hex");
+	const outDir = path.join(os.tmpdir(), `prisma-composer-compute-${String(os.userInfo().uid)}`, sha256.slice(0, 16));
+	fs.mkdirSync(outDir, { recursive: true });
+	const outPath = path.join(outDir, `${opts.id}.tar.gz`);
+	const tmpPath = path.join(outDir, `.${opts.id}.${crypto$1.randomUUID()}.tmp`);
+	fs.writeFileSync(tmpPath, gz);
+	fs.renameSync(tmpPath, outPath);
+	return {
+		path: outPath,
+		sha256
+	};
+}
+/**
+* The `ServiceKey` Alchemy resource (ADR-0030) — mints a random 256-bit key
+* ONCE at create and keeps it STABLE across deploys, so an unchanged edge
+* no-ops on redeploy. Same mint-once-stable lifecycle as `S3Credentials`
+* (`packages/1-prisma-cloud/1-extensions/target/src/s3-credentials-resource.ts`):
+* Web Crypto only (`crypto.getRandomValues` — no `node:` import), persisted in
+* Alchemy state; on every later apply the provider returns the persisted
+* attributes (`reconcile`'s `output`) unchanged. One resource per RPC edge;
+* rotation is destroy/recreate.
+*/
+/** The `ServiceKey` resource constructor — `yield* Prisma.ServiceKey(id, {})` in the lowering. */
+const ServiceKey = Resource("PrismaCloud.ServiceKey");
+/** A fresh 256-bit key as 64 lowercase hex chars (Web Crypto — no node import). */
+function mintServiceKey() {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+	return { value: Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("") };
+}
+/**
+* The `ServiceKey` provider service. `reconcile` runs for create and update;
+* it returns the persisted `output` when present (a redeploy reuses the
+* stored key — the no-op property) and mints a fresh key only on first
+* create. Nothing to enumerate (`list` → `[]`) or tear down (`delete` →
+* no-op; the key lives only in state).
+*/
+const serviceKeyProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ output }) => Effect.sync(() => output ?? mintServiceKey()),
+	delete: () => Effect.void
+};
+/** The `ServiceKey` provider layer — merged into the Prisma Cloud extension's `providers()`. */
+const ServiceKeyProvider = () => Provider.effect(ServiceKey, Effect.succeed(serviceKeyProviderService));
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/postgres/index.mjs
+/** A **connection** to a Prisma Postgres database — yields the connection string. */
+const Connection = Resource("Prisma.Connection");
+const ConnectionProvider = () => Provider.effect(Connection, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id", "connectionString"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			if (output?.id) return output;
+			const created = yield* call(() => client.POST("/v1/databases/{databaseId}/connections", {
+				params: { path: { databaseId: news.databaseId } },
+				body: { name: news.name }
+			}));
+			const endpoints = created.data.endpoints;
+			const dsn = endpoints?.direct?.connectionString ?? endpoints?.pooled?.connectionString;
+			if (dsn === void 0) return yield* Effect.fail(new PrismaApiError({
+				status: 0,
+				message: `connection ${created.data.id} returned no direct/pooled connection string`
+			}));
+			return {
+				id: created.data.id,
+				connectionString: Redacted.make(dsn)
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/connections/{id}", { params: { path: { id: output.id } } }));
+		})
+	};
+}));
+/** A Prisma **Postgres database** inside a project. */
+const Database = Resource("Prisma.Database");
+const DatabaseProvider = () => Provider.effect(Database, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } })) : void 0;
+			let result;
+			if (observed) result = {
+				id: observed.data.id,
+				name: observed.data.name
+			};
+			else {
+				const created = yield* call(() => client.POST("/v1/projects/{projectId}/databases", {
+					params: { path: { projectId: news.projectId } },
+					body: {
+						name: news.name,
+						region: news.region,
+						...news.isDefault !== void 0 && { isDefault: news.isDefault }
+					}
+				}));
+				result = {
+					id: created.data.id,
+					name: created.data.name
+				};
+			}
+			if (news.branchId !== void 0) {
+				const branchId = news.branchId;
+				yield* call(() => client.PATCH("/v1/databases/{databaseId}", {
+					params: { path: { databaseId: result.id } },
+					body: { branchId }
+				}));
+			}
+			return result;
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const d = yield* callOptional(() => client.GET("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } }));
+			return d ? {
+				id: d.data.id,
+				name: d.data.name
+			} : void 0;
+		})
+	};
+}));
+/** A Prisma Developer Platform **Project** — the container for databases and compute services. */
+const Project = Resource("Prisma.Project");
+const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/projects/{id}", { params: { path: { id: output.id } } })) : void 0;
+			if (observed) return {
+				id: observed.data.id,
+				name: observed.data.name
+			};
+			const created = yield* call(() => client.POST("/v1/projects", { body: {
+				name: news.name,
+				workspaceId: news.workspaceId
+			} }));
+			return {
+				id: created.data.id,
+				name: created.data.name
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/projects/{id}", { params: { path: { id: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const p = yield* callOptional(() => client.GET("/v1/projects/{id}", { params: { path: { id: output.id } } }));
+			return p ? {
+				id: p.data.id,
+				name: p.data.name
+			} : void 0;
+		})
+	};
+}));
+Data.TaggedError("ContainerNotFoundError");
+/** The collection of Prisma resource providers. */
+var Providers = class extends Provider.ProviderCollection()("Prisma") {};
+/**
+* The Prisma provider bundle: every resource provider, the Management API
+* client, and env-based credentials. Plug into a stack with
+* `{ providers: Prisma.providers() }`.
+*/
+const providers = () => Layer.effect(Providers, Provider.collection([
+	Project,
+	Database,
+	Connection,
+	ComputeService,
+	Deployment,
+	EnvironmentVariable
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/state/index.mjs
+/** The framework-owned database a stage's deploy state lives in — a child of that stage's Branch (ADR-0034). */
+const STATE_DATABASE_NAME = "prisma-composer-state";
+/** Every connection created against a state database carries this prefix — see `cleanupAgedConnections`. */
+const CONNECTION_NAME_PREFIX = "prisma-composer-state-";
+const listAllBranches = (client, projectId) => Effect.gen(function* () {
+	const branches = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {} : { cursor };
+		const page = yield* call(() => client.GET("/v1/projects/{projectId}/branches", { params: {
+			path: { projectId },
+			query
+		} }));
+		branches.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return branches;
+});
+/**
+* The project's implicit default Branch — every live Project owns exactly
+* one (a platform invariant). The list endpoint has no `isDefault` filter, so
+* this pages through every Branch and picks it out client-side. Never creates
+* one: its absence means the platform's invariant is broken, which is not
+* something a deploy can repair.
+*/
+const resolveDefaultBranchId = (client, projectId) => Effect.gen(function* () {
+	const found = (yield* listAllBranches(client, projectId)).find((b) => b.isDefault);
+	if (found !== void 0) return found.id;
+	return yield* Effect.fail(new PrismaApiError({
+		status: 0,
+		message: `project ${projectId} has no default Branch — the platform guarantees every live Project owns one; contact support.`
+	}));
+});
+/** A named stage carries its `branchId`; production omits it, and its state lives on the Project's default Branch. */
+const resolveBranchId = (client, container) => container.branchId !== void 0 ? Effect.succeed(container.branchId) : resolveDefaultBranchId(client, container.projectId);
+/**
+* Every database on this Branch. Uses the flat `GET /v1/databases`, which
+* accepts `projectId` and `branchId` together — the project-scoped listing
+* has no branch filter at all.
+*/
+const listAllDatabasesOnBranch = (client, projectId, branchId) => Effect.gen(function* () {
+	const databases = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {
+			projectId,
+			branchId
+		} : {
+			projectId,
+			branchId,
+			cursor
+		};
+		const page = yield* call(() => client.GET("/v1/databases", { params: { query } }));
+		databases.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return databases;
+});
+/**
+* Databases on this Branch named `prisma-composer-state`, oldest first,
+* excluding the Branch's own default database. The default database is always
+* the user's, never ours to adopt or delete. A name match alone proves
+* nothing — the platform allows duplicate names — so every caller must still
+* verify ownership before acting on a candidate.
+*/
+const listStateDatabaseCandidates = (client, projectId, branchId) => listAllDatabasesOnBranch(client, projectId, branchId).pipe(Effect.map((databases) => databases.filter((d) => d.name === "prisma-composer-state" && !d.isDefault).sort((a, b) => a.createdAt.localeCompare(b.createdAt))));
+/**
+* Creates a fresh Postgres connection and reads its connection string. Reads
+* `endpoints.direct.connectionString` only — never `endpoints.pooled`, and
+* never the deprecated top-level `connectionString`/`url` (PRO-212), neither
+* of which the platform guarantees.
+*
+* The connection string is returned only when the connection is created and
+* cannot be read back afterwards, which is why every run creates a fresh
+* connection instead of reusing one.
+*/
+const createConnection = (client, databaseId) => call(() => client.POST("/v1/databases/{databaseId}/connections", {
+	params: { path: { databaseId } },
+	body: { name: `${CONNECTION_NAME_PREFIX}${Date.now()}` }
+})).pipe(Effect.flatMap((r) => {
+	const created = r.data;
+	const dsn = created.endpoints.direct?.connectionString;
+	return dsn === void 0 ? Effect.fail(new PrismaApiError({
+		status: 0,
+		message: `connection ${created.id} returned no endpoints.direct.connectionString (PRO-212)`
+	})) : Effect.succeed(Redacted.make(dsn));
+}));
+/** Collapses any thrown value (postgres.js failures included) into a {@link StateStoreError}. */
+const toStateStoreError = (cause) => cause instanceof Error ? new StateStoreError({
+	message: cause.message,
+	cause
+}) : new StateStoreError({ message: String(cause) });
+/**
+* An operator-facing failure from the hosted-state bootstrap pipeline
+* (branch/database discovery, connection creation, schema migration, or lock
+* acquisition) — what a deployer actually sees, instead of a raw Effect
+* defect.
+*/
+var HostedStateBootstrapError = class extends Data.TaggedError("HostedStateBootstrapError") {
+	get message() {
+		return `hosted-state bootstrap failed in ${this.container}: ${this.step} — ${this.reason}`;
+	}
+};
+/**
+* Builds a {@link HostedStateBootstrapError} from whatever the failed step
+* threw. Never retains the raw driver/API error object as `cause`: a
+* postgres.js connection failure's `.message`/properties are not verified to
+* omit the DSN or credentials, so only the extracted message text survives
+* into the operator-facing error.
+*/
+const hostedStateBootstrapError = (container, step, cause) => new HostedStateBootstrapError({
+	container,
+	step,
+	reason: cause instanceof Error ? cause.message : String(cause)
+});
+/**
+* The well-known marker row written into every database this store owns.
+* Its presence proves the database is genuinely Prisma App's state store, not
+* a same-named project squatting on the discovery query (see `bootstrap.ts`
+* `verifyOwnership` — PDP allows duplicate project names).
+*/
+const STATE_META_MARKER = "prisma-composer-state-v1";
+/**
+* Idempotent schema migration for the Prisma-hosted state store — safe to run
+* on every deploy, since `create table if not exists` no-ops once the tables
+* exist. Run this against `sql` before serving a {@link StateService} built
+* by `makePrismaStateService` over the same client.
+*/
+const migratePrismaState = (sql) => Effect.tryPromise({
+	try: async () => {
+		await sql`
+        create table if not exists alchemy_resource_state (
+          stack text not null,
+          stage text not null,
+          fqn text not null,
+          value jsonb not null,
+          updated_at timestamptz not null default now(),
+          primary key (stack, stage, fqn)
+        )
+      `;
+		await sql`
+        create table if not exists alchemy_stack_output (
+          stack text not null,
+          stage text not null,
+          value jsonb not null,
+          updated_at timestamptz not null default now(),
+          primary key (stack, stage)
+        )
+      `;
+		await sql`
+        create table if not exists prisma_app_state_meta (
+          marker text primary key,
+          created_at timestamptz not null default now()
+        )
+      `;
+		await sql`
+        insert into prisma_app_state_meta (marker) values (${STATE_META_MARKER})
+        on conflict (marker) do nothing
+      `;
+	},
+	catch: toStateStoreError
+});
+const CONNECTION_MAX_AGE_MS = 1440 * 60 * 1e3;
+/**
+* Creates the state database on the stage's Branch, using the flat endpoint
+* because it is the only one that accepts a `branchId`. The platform still
+* creates the row on the project's default Branch and attaches it afterwards,
+* so a failed attach can leave a database behind on the default Branch. It
+* checks the Branch exists before creating, and this is one request instead of
+* two, so that window is much narrower than attaching from here — but it is
+* narrowed, not closed.
+*
+* `isDefault` is left at the API's `false` default: the state database must
+* never be the stage's default database, which belongs to the user.
+*/
+const createStateDatabase = (client, projectId, branchId) => call(() => client.POST("/v1/databases", { body: {
+	projectId,
+	name: STATE_DATABASE_NAME,
+	region: "inherit",
+	branchId
+} })).pipe(Effect.map((created) => ({
+	id: created.data.id,
+	name: created.data.name,
+	isDefault: created.data.isDefault,
+	createdAt: created.data.createdAt
+})));
+const listAllConnections = (client, databaseId) => Effect.gen(function* () {
+	const connections = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {} : { cursor };
+		const page = yield* call(() => client.GET("/v1/databases/{databaseId}/connections", { params: {
+			path: { databaseId },
+			query
+		} }));
+		connections.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return connections;
+});
+const deleteConnection = (client, connectionId) => callVoid(() => client.DELETE("/v1/connections/{id}", { params: { path: { id: connectionId } } }));
+/**
+* Every deploy creates a fresh connection (`createConnection`) and nothing ever
+* closes it, so the state database otherwise accumulates one connection
+* resource per run without bound. Best-effort, never blocks bootstrap: lists
+* this database's connections, deletes the ones matching our naming pattern
+* older than the age threshold, and swallows any failure (a transient API
+* error here must never fail the deploy it's cleaning up after).
+*/
+const cleanupAgedConnections = (client, databaseId) => Effect.gen(function* () {
+	const connections = yield* listAllConnections(client, databaseId);
+	const cutoff = Date.now() - CONNECTION_MAX_AGE_MS;
+	const aged = connections.filter((c) => c.name.startsWith("prisma-composer-state-") && Date.parse(c.createdAt) < cutoff);
+	yield* Effect.forEach(aged, (c) => deleteConnection(client, c.id), { discard: true });
+}).pipe(Effect.ignore);
+/**
+* PDP allows duplicate database names, so a database named `prisma-composer-state`
+* found by listing is not proof it's ours — it could be an unrelated
+* database that happens to share the name (a squatter, deliberate or not).
+* Connects to the candidate and inspects its tables:
+*
+* - our marker table with our marker row present → `ours`, adopt outright.
+* - our state tables (`alchemy_resource_state`/`alchemy_stack_output`) but no
+*   marker → `legacy`: a database from before this ownership check existed.
+*   The real, currently-in-use workspace state is in this shape today, so it
+*   must keep working — adopt it, and `migratePrismaState` (idempotent)
+*   writes the marker on the way in.
+* - no tables at all → `empty`, a freshly-created database — adopt.
+* - anything else → `squatter`: foreign data occupies the name; refuse it.
+*/
+const verifyOwnership = (connectionString) => Effect.tryPromise({
+	try: async () => {
+		const sql = postgres(Redacted.value(connectionString), {
+			max: 1,
+			onnotice: () => {}
+		});
+		try {
+			const rows = await sql`
+          select tablename from pg_tables where schemaname = 'public'
+        `;
+			const tables = new Set(rows.map((row) => row.tablename));
+			if (tables.has("prisma_app_state_meta")) return (await sql`
+            select marker from prisma_app_state_meta where marker = ${"prisma-composer-state-v1"}
+          `).length > 0 ? { kind: "ours" } : {
+				kind: "squatter",
+				tables: [...tables]
+			};
+			if (tables.has("alchemy_resource_state") || tables.has("alchemy_stack_output")) return { kind: "legacy" };
+			return tables.size === 0 ? { kind: "empty" } : {
+				kind: "squatter",
+				tables: [...tables]
+			};
+		} finally {
+			await sql.end({ timeout: 5 });
+		}
+	},
+	catch: (cause) => new PrismaApiError({
+		status: 0,
+		message: `ownership verification failed: ${cause instanceof Error ? cause.message : String(cause)}`
+	})
+});
+/**
+* Finds the Branch's `prisma-composer-state` database, verifying ownership
+* rather than trusting the name alone (PDP allows duplicate names — see
+* `verifyOwnership`). Finding none creates one, with nothing to verify: only
+* this run can have touched a database it just created.
+*
+* Candidates are tried oldest first, so repeated runs pick the same one. The
+* first that verifies as ours is used. A candidate that fails verification is
+* skipped. If every candidate fails, bootstrap fails and names each rejected
+* database id, so an operator knows which to rename or remove.
+*/
+const resolveStateDatabase = (client, projectId, branchId, verify) => Effect.gen(function* () {
+	const candidates = yield* listStateDatabaseCandidates(client, projectId, branchId);
+	if (candidates.length === 0) {
+		const database = yield* createStateDatabase(client, projectId, branchId);
+		const connectionString = yield* createConnection(client, database.id);
+		console.error(`hosted state: provisioned state database ${database.id} on branch ${branchId} (project ${projectId})`);
+		return {
+			database,
+			connectionString
+		};
+	}
+	const rejected = [];
+	for (const candidate of candidates) {
+		const connectionString = yield* createConnection(client, candidate.id);
+		const verdict = yield* verify(connectionString);
+		if (verdict.kind === "squatter") {
+			rejected.push(`${candidate.id} (foreign tables: ${verdict.tables.join(", ")})`);
+			continue;
+		}
+		console.error(`hosted state: using state database ${candidate.id} on branch ${branchId} (${verdict.kind}) — ${candidates.length} candidate(s) named ${STATE_DATABASE_NAME}`);
+		return {
+			database: candidate,
+			connectionString
+		};
+	}
+	return yield* Effect.fail(new PrismaApiError({
+		status: 0,
+		message: `found ${candidates.length} database(s) named "${STATE_DATABASE_NAME}" on branch ${branchId}, but none verified as Composer's state store: ${rejected.join("; ")}. Rename or remove the offending database(s).`
+	}));
+});
+/**
+* Resolves the stage's Branch, find-or-creates its `prisma-composer-state`
+* database, and creates a fresh connection — the automatic bootstrap every
+* deploy runs once, needing nothing beyond the service token and the
+* Project/Branch ids the CLI already resolved.
+*/
+const bootstrapStateConnection = (container) => bootstrapStateConnectionWith(container, verifyOwnership);
+/**
+* Identical to {@link bootstrapStateConnection}, except the ownership check is
+* a parameter so `bootstrap.test.ts` can supply a fake instead of opening a
+* real Postgres connection.
+*/
+const bootstrapStateConnectionWith = (container, verify) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	const branchId = yield* resolveBranchId(client, container);
+	const { database, connectionString } = yield* resolveStateDatabase(client, container.projectId, branchId, verify);
+	yield* cleanupAgedConnections(client, database.id);
+	return {
+		projectId: container.projectId,
+		databaseId: database.id,
+		connectionString
+	};
+});
+const deleteDatabase = (client, databaseId) => callVoid(() => client.DELETE("/v1/databases/{databaseId}", { params: { path: { databaseId } } }));
+/**
+* Identical to {@link deleteStateDatabase}, except the ownership check is a
+* parameter so tests can supply a fake instead of opening a real Postgres
+* connection.
+*/
+const deleteStateDatabaseWith = (container, verify) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	const branchId = yield* resolveBranchId(client, container);
+	const candidates = yield* listStateDatabaseCandidates(client, container.projectId, branchId);
+	for (const candidate of candidates) {
+		const verdict = yield* verify(yield* createConnection(client, candidate.id));
+		if (verdict.kind === "squatter") {
+			console.warn(`hosted state: left database ${candidate.id} on branch ${branchId} alone — it is named ${STATE_DATABASE_NAME} but holds unrelated data (tables: ${verdict.tables.join(", ")}).`);
+			continue;
+		}
+		yield* deleteDatabase(client, candidate.id);
+		console.error(`hosted state: removed state database ${candidate.id} from branch ${branchId}`);
+	}
+});
+/** Codes for "can't reach the host yet" — DNS/refusal, not a mid-session drop. */
+const ESTABLISHMENT_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ENOTFOUND",
+	"EAI_AGAIN"
+]);
+/** Connection-establishment failure messages (no useful `err.code`). `upstream database` is PPg's edge proxy while a cold/idle upstream warms up. */
+const ESTABLISHMENT_MESSAGE_FRAGMENTS = ["upstream database", "connection refused"];
+/**
+* Whether a failure is a connection-establishment error against a warming
+* upstream (retry), as opposed to a lost lease, a mid-session drop, or a real
+* query error (all of which must surface at once). Unwraps a
+* {@link StateStoreError} to its driver `cause` so a code-only error still
+* classifies.
+*/
+const isColdStartConnectError = (error) => {
+	if (typeof error !== "object" || error === null) return false;
+	const code = "code" in error && typeof error.code === "string" ? error.code : void 0;
+	if (code !== void 0 && ESTABLISHMENT_CODES.has(code)) return true;
+	const message = "message" in error && typeof error.message === "string" ? error.message.toLowerCase() : "";
+	if (ESTABLISHMENT_MESSAGE_FRAGMENTS.some((fragment) => message.includes(fragment))) return true;
+	const cause = "cause" in error ? error.cause : void 0;
+	return cause !== void 0 && cause !== error && isColdStartConnectError(cause);
+};
+/** The same ~2-minute budget the bootstrap migration uses (`layer.ts`): retry every 5s, up to 2 minutes. */
+const COLD_START_SCHEDULE = Schedule.both(Schedule.spaced("5 seconds"), Schedule.during("2 minutes"));
+/**
+* Retries a state operation past a cold-start connection rejection only; every
+* other failure surfaces immediately. `schedule` is injectable so tests drive
+* it without real delay.
+*/
+const retryColdStart = (operation, schedule = COLD_START_SCHEDULE) => Effect.retry(operation, {
+	while: isColdStartConnectError,
+	schedule
+});
+/** Another deploy already holds the lock for this stack/stage. Never queued — fails immediately. */
+var StateLockContentionError = class extends Data.TaggedError("StateLockContentionError") {
+	get message() {
+		return `another deploy holds the state lock for ${this.stack}/${this.stage}`;
+	}
+};
+const lockKey = (stack, stage) => `prisma-composer:${stack}/${stage}`;
+/**
+* Acquires a session-scoped Postgres advisory lock on a reserved
+* connection pulled from `sql`'s pool — session (not transaction) scope,
+* because a transaction-scoped lock releases at the first commit and a
+* deploy spans many. Held for the run's whole lifetime; contention fails
+* immediately rather than queuing. If the process crashes, the reserved
+* connection drops and Postgres auto-releases the session lock — no
+* explicit crash-recovery bookkeeping needed.
+*/
+const acquireStateLock = (sql, stack, stage) => Effect.gen(function* () {
+	const key = lockKey(stack, stage);
+	const reserved = yield* Effect.tryPromise({
+		try: () => sql.reserve(),
+		catch: toStateStoreError
+	});
+	const acquired = yield* Effect.tryPromise({
+		try: async () => {
+			return (await reserved`
+          select
+            pg_try_advisory_lock(hashtextextended(${key}, 0)) as acquired,
+            pg_backend_pid() as pid
+        `)[0];
+		},
+		catch: toStateStoreError
+	});
+	if (acquired?.acquired !== true) {
+		reserved.release();
+		return yield* Effect.fail(new StateLockContentionError({
+			stack,
+			stage
+		}));
+	}
+	const lockPid = acquired.pid;
+	const checkLive = retryColdStart(Effect.tryPromise({
+		try: async () => {
+			return (await sql`
+            select exists (
+              select 1 from pg_locks
+              where locktype = 'advisory'
+                and pid = ${lockPid}
+                and objsubid = 1
+                and granted
+                and ((classid::bigint << 32) | (objid::bigint & 4294967295))
+                  = hashtextextended(${key}, 0)
+            ) as live
+          `)[0]?.live ?? false;
+		},
+		catch: toStateStoreError
+	}).pipe(Effect.flatMap((live) => live ? Effect.void : Effect.fail(new StateStoreError({ message: `the state lock for ${stack}/${stage} was lost mid-run; refusing to continue unlocked` })))));
+	const release = async () => {
+		try {
+			await reserved`select pg_advisory_unlock(hashtextextended(${key}, 0))`;
+		} catch {} finally {
+			reserved.release();
+		}
+	};
+	return {
+		checkLive,
+		release
+	};
+});
+const attempt = (f) => retryColdStart(Effect.tryPromise({
+	try: f,
+	catch: toStateStoreError
+}));
+/**
+* Wraps an already-`encodeState`d value as a jsonb-typed bind parameter.
+* Must go through `sql.json(...)` (not `JSON.stringify(...)::jsonb`) —
+* postgres.js re-serializes the parameter once it learns the server-inferred
+* type is jsonb, so a pre-stringified value passed through a `::jsonb` cast
+* gets JSON-encoded *twice* and lands as a jsonb string instead of an
+* object. `sql.json` gives postgres.js the raw value up front and declares
+* the jsonb oid itself, so it is serialized exactly once.
+*/
+const jsonParam = (sql, value) => sql.json(blindCast(encodeState(value)));
+/**
+* `reviveStateRecursive` is typed to return `unknown` — the caller is
+* expected to know the shape it revived. Here the shape is known by
+* construction: every row was written by `set()`, which persists a value
+* through `encodeState` first, so reviving it recovers a `PersistedState`.
+*/
+const revivePersistedState = (value) => blindCast(reviveStateRecursive(value));
+/** Same reasoning as {@link revivePersistedState}, narrowed by the SQL status filter. */
+const reviveReplacedResourceState = (value) => blindCast(reviveStateRecursive(value));
+/**
+* Builds alchemy's `StateService` over a caller-supplied postgres.js client,
+* against the two-table schema `migratePrismaState` creates. The caller owns
+* the client's lifecycle (connection pooling, reconnects, `.end()`); this
+* factory only issues queries.
+*/
+const makePrismaStateService = (sql) => ({
+	id: "prisma-postgres",
+	getVersion: () => Effect.succeed(STATE_STORE_VERSION),
+	listStacks: () => attempt(() => sql`
+        select stack from alchemy_resource_state
+        union
+        select stack from alchemy_stack_output
+        order by stack
+      `).pipe(Effect.map((rows) => rows.map((row) => row.stack))),
+	listStages: (stack) => attempt(() => sql`
+        select stage from alchemy_resource_state where stack = ${stack}
+        union
+        select stage from alchemy_stack_output where stack = ${stack}
+        order by stage
+      `).pipe(Effect.map((rows) => rows.map((row) => row.stage))),
+	get: (request) => attempt(() => sql`
+        select value from alchemy_resource_state
+        where stack = ${request.stack} and stage = ${request.stage} and fqn = ${request.fqn}
+      `).pipe(Effect.map((rows) => {
+		const row = rows[0];
+		return row === void 0 ? void 0 : revivePersistedState(row.value);
+	})),
+	getReplacedResources: (request) => attempt(() => sql`
+        select value from alchemy_resource_state
+        where stack = ${request.stack} and stage = ${request.stage}
+          and value ->> 'status' = 'replaced'
+      `).pipe(Effect.map((rows) => rows.map((row) => reviveReplacedResourceState(row.value)))),
+	set: (request) => attempt(() => sql`
+        insert into alchemy_resource_state (stack, stage, fqn, value, updated_at)
+        values (
+          ${request.stack}, ${request.stage}, ${request.fqn},
+          ${jsonParam(sql, request.value)}, now()
+        )
+        on conflict (stack, stage, fqn) do update
+          set value = excluded.value, updated_at = excluded.updated_at
+      `).pipe(Effect.map(() => request.value)),
+	delete: (request) => attempt(() => sql`
+        delete from alchemy_resource_state
+        where stack = ${request.stack} and stage = ${request.stage} and fqn = ${request.fqn}
+      `).pipe(Effect.asVoid),
+	deleteStack: (request) => attempt(async () => {
+		if (request.stage === void 0) {
+			await sql`delete from alchemy_resource_state where stack = ${request.stack}`;
+			await sql`delete from alchemy_stack_output where stack = ${request.stack}`;
+		} else {
+			await sql`
+          delete from alchemy_resource_state
+          where stack = ${request.stack} and stage = ${request.stage}
+        `;
+			await sql`
+          delete from alchemy_stack_output
+          where stack = ${request.stack} and stage = ${request.stage}
+        `;
+		}
+	}),
+	list: (request) => attempt(() => sql`
+        select fqn from alchemy_resource_state
+        where stack = ${request.stack} and stage = ${request.stage}
+        order by fqn
+      `).pipe(Effect.map((rows) => rows.map((row) => row.fqn))),
+	getOutput: (request) => attempt(() => sql`
+        select value from alchemy_stack_output
+        where stack = ${request.stack} and stage = ${request.stage}
+      `).pipe(Effect.map((rows) => {
+		const row = rows[0];
+		return row === void 0 ? void 0 : reviveStateRecursive(row.value);
+	})),
+	setOutput: (request) => attempt(() => sql`
+        insert into alchemy_stack_output (stack, stage, value, updated_at)
+        values (${request.stack}, ${request.stage}, ${jsonParam(sql, request.value)}, now())
+        on conflict (stack, stage) do update
+          set value = excluded.value, updated_at = excluded.updated_at
+      `).pipe(Effect.map(() => request.value))
+});
+/**
+* How long a passing lease check is trusted before the next storage
+* operation re-verifies it. A deploy issues many state ops in quick
+* succession, and each raw `checkLive` is a `pg_locks` round-trip; without
+* amortization the guard roughly doubles the store's traffic. The cost of the
+* window is bounded: a lease lost mid-window is detected within this many ms,
+* not instantly — an accepted tradeoff on top of the already-accepted
+* non-atomic (TOCTOU) gap between the check and the operation.
+*/
+const LEASE_CHECK_TTL_MS = 5e3;
+/**
+* Amortizes a lease check over a short TTL: a *passing* check is trusted for
+* `ttlMs`, so a burst of operations inside the window does one round-trip, not
+* one per op. A *failing* check is never cached — it propagates immediately
+* and leaves the last-good timestamp untouched, so the very next op re-checks.
+* The `lastOkAt` state is captured per call, so each store (each layer) gets
+* its own window — two stores in one process never share a cached success.
+*/
+const amortizeCheck = (checkLive, ttlMs, now) => {
+	let lastOkAt;
+	return Effect.suspend(() => {
+		if (lastOkAt !== void 0 && now() - lastOkAt < ttlMs) return Effect.void;
+		return checkLive.pipe(Effect.tap(() => Effect.sync(() => {
+			lastOkAt = now();
+		})));
+	});
+};
+/**
+* Wraps a {@link StateService} so every method that touches storage first
+* re-verifies the state lock's lease via `checkLive`. Used to enforce "a
+* dropped lock connection fails loudly" — see {@link ../lock.ts}. The check is
+* amortized over a short TTL (see {@link amortizeCheck}), so a run of
+* back-to-back operations does not fire one `pg_locks` round-trip per call.
+*
+* Reads are gated too, not just writes: a lost lease means a concurrent
+* deploy may already be mutating this stack's rows, so a read could return
+* stale or conflicting data — untrustworthy either way, not just the writes.
+* The check is best-effort and not atomic with the operation it guards (the
+* lease could be lost in the gap between `checkLive` passing and the wrapped
+* call executing, or within the TTL window); that residual race is accepted.
+*
+* `getVersion` is excluded: it returns a compile-time constant
+* (`STATE_STORE_VERSION`), so guarding it would only add a pointless
+* reserved-connection round-trip.
+*
+* `now` is injectable so tests can advance the clock deterministically; it
+* defaults to `Date.now` (fine in library runtime code — only Workflow
+* scripts forbid it).
+*/
+const guardStateService = (service, checkLive, now = Date.now) => {
+	const guard = amortizeCheck(checkLive, LEASE_CHECK_TTL_MS, now);
+	return {
+		id: service.id,
+		getVersion: () => service.getVersion(),
+		listStacks: () => guard.pipe(Effect.andThen(service.listStacks())),
+		listStages: (stack) => guard.pipe(Effect.andThen(service.listStages(stack))),
+		get: (request) => guard.pipe(Effect.andThen(service.get(request))),
+		getReplacedResources: (request) => guard.pipe(Effect.andThen(service.getReplacedResources(request))),
+		set: (request) => guard.pipe(Effect.andThen(service.set(request))),
+		delete: (request) => guard.pipe(Effect.andThen(service.delete(request))),
+		deleteStack: (request) => guard.pipe(Effect.andThen(service.deleteStack(request))),
+		list: (request) => guard.pipe(Effect.andThen(service.list(request))),
+		getOutput: (request) => guard.pipe(Effect.andThen(service.getOutput(request))),
+		setOutput: (request) => guard.pipe(Effect.andThen(service.setOutput(request)))
+	};
+};
+/**
+* The hosted Alchemy state store. On layer init (scoped, once per stack
+* run): resolve the stage's Branch, find-or-create its `prisma-composer-state`
+* database, create a fresh connection, migrate the schema, and acquire the
+* (stack, stage) advisory lock — see `bootstrap.ts` and `lock.ts`. The
+* Management API plumbing (`ManagementClient`, `PrismaCredentials`) is
+* provided internally, so the returned layer's only requirements are the
+* ones alchemy itself already provides to every state store
+* (`StackServices`).
+*
+* Any bootstrap/lock/migration failure is wrapped into an operator-facing
+* `HostedStateBootstrapError` (naming the Project/Branch and the step that
+* failed, never the raw driver/API error — see `errors.ts`) before dying the
+* layer (loud, immediate, unrecoverable) rather than surfacing as a typed
+* error — matching core's `LowerOptions.state: Layer.Layer<State, never,
+* StackServices>` contract and alchemy's own convention (e.g. a missing
+* state store is `Effect.die` in `Stack.make`).
+*/
+const prismaState = () => {
+	const projectId = process.env["PRISMA_PROJECT_ID"];
+	if (projectId === void 0 || projectId.length === 0) throw new Error("prismaState(): environment variable PRISMA_PROJECT_ID is required (the CLI sets it — deploy via `prisma-composer deploy`).");
+	const branchIdEnv = process.env["PRISMA_BRANCH_ID"];
+	const branchId = branchIdEnv === void 0 || branchIdEnv.length === 0 ? void 0 : branchIdEnv;
+	return Layer.effect(State, Effect.gen(function* () {
+		const stack = yield* Stack;
+		const container = branchId === void 0 ? projectId : `${projectId}/${branchId}`;
+		const bootstrapError = (step) => (cause) => hostedStateBootstrapError(container, step, cause);
+		const { connectionString } = yield* bootstrapStateConnection(branchId === void 0 ? { projectId } : {
+			projectId,
+			branchId
+		}).pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))), Effect.mapError(bootstrapError("resolving the state database on the stage branch")));
+		const sql = postgres(Redacted.value(connectionString), {
+			max: 5,
+			onnotice: () => {}
+		});
+		yield* Effect.addFinalizer(() => Effect.promise(() => sql.end({ timeout: 5 })));
+		yield* migratePrismaState(sql).pipe(Effect.retry(Schedule.both(Schedule.spaced("5 seconds"), Schedule.during("2 minutes"))), Effect.mapError(bootstrapError("schema migration")));
+		const lock = yield* acquireStateLock(sql, stack.name, stack.stage).pipe(Effect.mapError(bootstrapError("lock acquisition")));
+		yield* Effect.addFinalizer(() => Effect.promise(() => lock.release()));
+		const service = guardStateService(makePrismaStateService(sql), lock.checkLive);
+		return Effect.succeed(service);
+	})).pipe(Layer.orDie);
+};
+//#endregion
+//#region ../../1-prisma-cloud/1-extensions/target/dist/control.mjs
+const PRISMA_NAME_MIN = 3;
+const PRISMA_NAME_MAX = 65;
+function validateName(value, source) {
+	if (value.length < PRISMA_NAME_MIN || value.length > PRISMA_NAME_MAX) throw new Error(`prisma-cloud: ${source} "${value}" (${value.length} characters) is not a valid Prisma resource name — Prisma requires ${PRISMA_NAME_MIN}–${PRISMA_NAME_MAX} characters. Rename the provision id (or the deploy --name) to fit.`);
+}
+function isCloudApplication(value) {
+	return typeof value === "object" && value !== null && "projectId" in value && typeof value.projectId === "string";
+}
+/** Narrows `ctx.application`, which core hands over as `unknown`, to this extension's own product; throws naming the hook when it hasn't run. */
+function projectIdOf(application) {
+	if (!isCloudApplication(application)) throw new Error("prisma-cloud: ctx.application is not this extension's application product — the prismaCloud() application hook must run before any node lowers.");
+	return application.projectId;
+}
+/** The `compute` node kind's descriptor: the four service hooks — provision, serialize, package, deploy. */
+/**
+* Returns the PRECISE descriptor type, not the erased `NodeDescriptor`: the
+* registry in control.ts erases it on assignment anyway (method bivariance),
+* but s3-store composes over these hooks and needs their P/S to stay visible.
+* Annotating this `NodeDescriptor` would force s3-store to cast them back.
+*/
+function computeDescriptor(o) {
+	return {
+		kind: "service",
+		provision: ({ id, application }) => Effect.gen(function* () {
+			validateName(id, "service name (from provision id)");
+			const projectId = projectIdOf(application);
+			return {
+				serviceId: (yield* ComputeService(`${id}-svc`, {
+					projectId,
+					name: id,
+					region: o.region ?? "us-east-1",
+					...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+				})).id,
+				projectId
+			};
+		}),
+		serialize: (ctx, provisioned, config) => Effect.gen(function* () {
+			const { address, node, graph } = ctx;
+			const cls = o.branchId ? "preview" : "production";
+			const branch = o.branchId !== void 0 ? { branchId: o.branchId } : {};
+			const projectId = provisioned.projectId;
+			const svc = node;
+			const records = [];
+			for (const d of paramEntries(svc)) {
+				const value = d.owner === "service" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];
+				if (value === void 0) continue;
+				const key = configKey(address, d);
+				const rowValue = d.owner === "service" && isParamSource(value) ? encodeParamPointer(paramName(paramBindingFor(graph.params, address, d.name))) : encode(d.owner, value);
+				records.push(yield* EnvironmentVariable(`${key}-var`, {
+					projectId,
+					key,
+					value: rowValue,
+					class: cls,
+					...branch
+				}));
+			}
+			for (const { key, name } of secretPointerRows(svc, address, graph.secrets)) records.push(yield* EnvironmentVariable(`${key}-var`, {
+				projectId,
+				key,
+				value: name,
+				class: cls,
+				...branch
+			}));
+			if (svc.expose !== void 0 && Object.keys(svc.expose).length > 0) {
+				const keyOuts = serviceKeyEdges(graph).filter((e) => e.providerAddress === address).map((e) => ctx.provisioned.get(e.edgeId)).filter((value) => value !== void 0).map((value) => blindCast(value));
+				const acceptedJson = keyOuts.length > 0 ? Output.map(Output.all(...keyOuts), (vals) => JSON.stringify(vals)) : JSON.stringify([]);
+				const key = serviceKeyEnvName(address);
+				records.push(yield* EnvironmentVariable(`${key}-var`, {
+					projectId,
+					key,
+					value: acceptedJson,
+					class: cls,
+					...branch
+				}));
+			}
+			return {
+				environment: records,
+				port: typeof config.service["port"] === "number" ? config.service["port"] : 3e3
+			};
+		}),
+		package: ({ id }, { assembled, address }) => Effect.try(() => packageComputeArtifact({
+			id,
+			bundleDir: assembled.dir,
+			appEntry: assembled.entry,
+			address
+		})),
+		deploy: ({ id }, provisioned, artifact, serialized) => Effect.gen(function* () {
+			const deployment = yield* Deployment(`${id}-deploy`, {
+				computeServiceId: provisioned.serviceId,
+				artifactPath: artifact.path,
+				artifactHash: artifact.sha256,
+				environment: serialized.environment,
+				port: serialized.port
+			});
+			return {
+				outputs: {
+					url: deployment.deployedUrl,
+					projectId: provisioned.projectId
+				},
+				entities: [{
+					kind: "compute-service",
+					id: provisioned.serviceId,
+					url: deployment.deployedUrl
+				}]
+			};
+		})
+	};
+}
+/**
+* The `PgWarm` Alchemy resource (slice 3, FT-5226) — warm a freshly-provisioned
+* Prisma Postgres database at apply-time so it is ready by deploy-end, and the
+* first real connection (a service's runtime client, or the migration) doesn't
+* eat the cold-start reject.
+*
+* The DB `url` is a lazy `Output` at lowering time, so warming must be an
+* apply-time tracked resource (same pattern as `PnMigration`): its `reconcile`
+* receives the RESOLVED url and connects with `withConnectionRetry` + `select 1`,
+* riding out the cold-start. Shared by BOTH the bare-`postgres` and the
+* `prisma-next` lowerings; keyed on the connection `url`, so an unchanged
+* redeploy is a no-op (warming is idempotent anyway).
+*
+* Deploy-time only: imports `pg` directly + `alchemy`. Imported by `control.ts`
+* and tests, never by `index.ts` / the `./prisma-next` authoring entry — the
+* isolation invariants hold.
+*/
+/** The `PgWarm` resource constructor — `yield* PgWarm(id, { url })` in a lowering. */
+const PgWarm = Resource("PrismaCloud.PgWarm");
+/** Connect (retrying the cold-start) and run `select 1`, then release the connection. */
+async function warmDatabase(url) {
+	await withConnectionRetry(async () => {
+		const client = new pg.Client({ connectionString: normalizeSslMode(url) });
+		await client.connect();
+		try {
+			await client.query("select 1");
+		} finally {
+			await client.end();
+		}
+	});
+}
+/**
+* The `PgWarm` provider service. `reconcile` warms the DB (retrying the
+* cold-start) and echoes the `url` so a downstream resource that reads
+* `warm.url` runs only after the DB is warm. Idempotent — safe on redeploy;
+* nothing to enumerate (`list` → `[]`) or tear down (`delete` → no-op; the DB's
+* own deletion handles teardown). Exported so tests can drive it directly.
+*/
+const pgWarmProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ news }) => Effect.tryPromise({
+		try: () => warmDatabase(news.url),
+		catch: (error) => error
+	}).pipe(Effect.map(() => ({ url: news.url }))),
+	delete: () => Effect.void
+};
+/** The `PgWarm` provider layer — merged into the extension descriptor's `providers()`. */
+const PgWarmProvider = () => Provider.effect(PgWarm, Effect.succeed(pgWarmProviderService));
+/**
+* One Database per module-provisioned postgres resource — `id` is the
+* module provision id, so a resource shared by several consumers is created
+* exactly once.
+*/
+function postgresDescriptor(o) {
+	const lowering = ({ id, application }) => Effect.gen(function* () {
+		validateName(id, "resource name (from provision id)");
+		const db = yield* Database(`${id}-db`, {
+			projectId: projectIdOf(application),
+			name: id,
+			region: o.region ?? "us-east-1",
+			...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+		});
+		const conn = yield* Connection(`${id}-conn`, {
+			databaseId: db.id,
+			name: id
+		});
+		const url = Output.map(conn.connectionString, (value) => Redacted.value(value));
+		return {
+			outputs: { url: (yield* PgWarm(`${id}-warm`, { url })).url },
+			entities: [{
+				kind: "postgres-database",
+				id: db.id
+			}]
+		};
+	});
+	return Object.assign(lowering, { kind: "resource" });
+}
+/**
+* Resolves a `pnPostgres` resource's `prisma-next.config.ts` path to the
+* on-disk migrations directory the control client's `migrate`/`dbInit` needs
+* (ADR-0022, slice 2). Deploy-time only: loads PN's config (via c12) and
+* applies PN's own convention — `migrations.dir`, or the default `migrations/`,
+* relative to the config file's directory (mirrors the CLI's
+* `resolveMigrationPaths`). Imported by `control.ts` + tests, never by
+* `index.ts` / the `./prisma-next` authoring entry.
+*
+* `pathe` (not `node:path`) does the path work so the shipped source carries no
+* `node:` import — the same discipline `control.ts` already follows by
+* delegating fs/tar to `@internal/lowering` (invariant 5).
+*/
+/** The absolute migrations directory PN reads authored migration packages from. */
+async function resolveMigrationsDir(configPath) {
+	return resolve(configPath, "..", (await loadConfig(configPath)).migrations?.dir ?? "migrations");
+}
+/**
+* The Prisma Next migration step of the deploy lowering (ADR-0022, slice 2) —
+* the safety-critical decision that brings a live database to a target REF
+* using ONLY Prisma Next's authored migrations.
+*
+* Deploy-time only: this module imports `@prisma-next/postgres/control` (which
+* transitively pulls PN's control/migration machinery + `pg`). It is imported
+* by the deploy descriptors and this package's tests, NEVER by `index.ts` / the
+* `./prisma-next` authoring entry — so it never lands in an app runtime bundle
+* (the index-isolation invariant holds).
+*
+* The target is a ref `{ hash, invariants }` — not a bare `storageHash`. A
+* ref's `invariants` are named postconditions established by `data`-class
+* migration steps (e.g. a backfill), recorded monotonically on the live
+* marker. Keying on the hash alone would make a pure data-invariant change an
+* A→A self-edge the deploy wrongly skips. The decision, given the live marker
+* and the target ref (see {@link decideMigrationAction}):
+*   - marker at ref.hash AND ref.invariants ⊆ marker.invariants → no-op
+*   - no marker (fresh DB) AND no required invariants           → `dbInit`
+*   - otherwise                                                  → `migrate`
+*
+* `dbInit` is additive-only synthesis — it NEVER runs app-space data steps —
+* so it is only correct when the ref requires no invariants; a fresh DB whose
+* target carries invariants goes through `migrate`, which walks the AUTHORED
+* graph (including the invariant-bearing data migrations) from empty.
+*
+* Never `dbUpdate`: synthesized diff-and-apply plans are never run against a
+* deployed database. A no-authored-path (`MIGRATION_PATH_NOT_FOUND`) or a
+* runner failure fails the deploy as a typed `PnMigrationError` (not swallowed).
+* PN applies each migration in its own transaction, so a failed apply is atomic
+* and resume-safe — the marker and schema are left as the last committed step.
+*/
+/** A deploy-failing migration error — surfaced, never swallowed. */
+var PnMigrationError = class extends Error {
+	code;
+	/** PN's structured explanation, when present. */
+	why;
+	constructor(code, summary, why) {
+		super(`prisma-next migrate (${code}): ${summary}`);
+		this.name = "PnMigrationError";
+		this.code = code;
+		this.why = why;
+	}
+};
+/**
+* The target `storageHash` a contract heads to — `contractJson.storage.storageHash`.
+* Read defensively: `contractJson` crosses the boundary as `unknown`.
+*/
+function targetStorageHash(contractJson) {
+	if (typeof contractJson === "object" && contractJson !== null && "storage" in contractJson) {
+		const storage = contractJson.storage;
+		if (typeof storage === "object" && storage !== null && "storageHash" in storage) {
+			const hash = storage.storageHash;
+			if (typeof hash === "string" && hash.length > 0) return hash;
+		}
+	}
+	throw new PnMigrationError("INIT_FAILED", "the contract has no storage.storageHash — cannot determine the target schema version");
+}
+/**
+* Resolve the deploy's target ref from the migrations dir.
+*
+* - `targetRef` named: read `migrations/app/refs/<name>.json` — fail loudly
+*   (`TARGET_REF_NOT_FOUND`) when the ref doesn't exist or can't be parsed.
+* - Default: the app space's head. PN synthesizes the app head from the
+*   emitted contract — `{ hash: contract.storage.storageHash, invariants: [] }`
+*   (`contract emit` writes no app-space `refs/head.json` today; extension
+*   spaces have one on disk). When a future PN version does emit one, the
+*   on-disk `head.json` wins — read via `readContractSpaceHeadRef`, exactly
+*   the loader PN's own migrate uses.
+*/
+async function resolveTargetRef(migrationsDir, contractJson, targetRef) {
+	if (targetRef !== void 0) {
+		const refsDir = spaceRefsDirectory(spaceMigrationDirectory(migrationsDir, APP_SPACE_ID));
+		try {
+			const ref = await readRef(refsDir, targetRef);
+			return {
+				hash: ref.hash,
+				invariants: ref.invariants
+			};
+		} catch (error) {
+			throw new PnMigrationError("TARGET_REF_NOT_FOUND", `targetRef "${targetRef}" could not be read from ${refsDir}`, error instanceof Error ? error.message : String(error));
+		}
+	}
+	const head = await readContractSpaceHeadRef(migrationsDir, APP_SPACE_ID);
+	if (head !== null) return {
+		hash: head.hash,
+		invariants: head.invariants
+	};
+	return {
+		hash: targetStorageHash(contractJson),
+		invariants: []
+	};
+}
+/**
+* The pure migration decision, mirroring PN's own verifier: the database is
+* AT the target when the marker's hash equals the ref's hash AND every ref
+* invariant is on the marker (marker invariants are monotonic). `dbInit` is
+* additive-only synthesis, so it is chosen only for a fresh DB whose
+* effective required invariants (`ref.invariants − marker.invariants`) are
+* empty; anything else — different hash, missing invariant (the A→A
+* data-only self-edge), or a fresh DB with required invariants — walks the
+* authored graph via `migrate`.
+*/
+function decideMigrationAction(marker, ref) {
+	const markerInvariants = new Set(marker?.invariants ?? []);
+	const missing = ref.invariants.filter((id) => !markerInvariants.has(id));
+	if (marker !== null && marker.storageHash === ref.hash && missing.length === 0) return "noop";
+	if (marker === null && missing.length === 0) return "init";
+	return "migrate";
+}
+/**
+* Bring the database at `url` to the target ref via PN's authored migrations.
+* Reads the live marker, decides no-op / init / migrate
+* ({@link decideMigrationAction}), applies, and throws a typed
+* {@link PnMigrationError} on a no-path or runner failure. `migrationsDir` is
+* the on-disk migrations root and `ref` the resolved target
+* ({@link resolveTargetRef} — both resolved by the lowering, which also keys
+* the PnMigration resource on them). `refName` (the resource's `targetRef`,
+* when set) is threaded into `migrate` so PN targets the named ref's hash and
+* plans an invariant-bearing path.
+*/
+async function applyPnMigration(opts) {
+	const connection = normalizeSslMode(opts.url);
+	return withConnectionRetry(() => runMigration(connection, opts.contractJson, opts.migrationsDir, opts.ref, opts.refName), { shouldRetry: (error) => !(error instanceof PnMigrationError) });
+}
+async function runMigration(connection, contractJson, migrationsDir, ref, refName) {
+	const client = createPostgresControlClient({ connection });
+	await client.connect();
+	try {
+		const marker = await client.readMarker();
+		const markerHashBefore = marker?.storageHash ?? null;
+		const action = decideMigrationAction(marker, ref);
+		if (action === "noop") return {
+			action,
+			targetHash: ref.hash,
+			markerHashBefore
+		};
+		if (action === "init") {
+			const result = await client.dbInit({
+				contract: contractJson,
+				mode: "apply",
+				migrationsDir
+			});
+			if (!result.ok) throw new PnMigrationError("INIT_FAILED", result.failure.summary, result.failure.why);
+			return {
+				action,
+				targetHash: ref.hash,
+				markerHashBefore
+			};
+		}
+		const result = await client.migrate({
+			contract: contractJson,
+			migrationsDir,
+			...refName !== void 0 ? {
+				refHash: ref.hash,
+				refInvariants: ref.invariants,
+				refName
+			} : {}
+		});
+		if (!result.ok) throw new PnMigrationError(result.failure.code === "MIGRATION_PATH_NOT_FOUND" ? "MIGRATION_PATH_NOT_FOUND" : "RUNNER_FAILED", result.failure.summary, result.failure.why);
+		return {
+			action,
+			targetHash: ref.hash,
+			markerHashBefore
+		};
+	} finally {
+		await client.close();
+	}
+}
+/**
+* The `PnMigration` Alchemy resource (ADR-0022, slice 2 D2) — the migration
+* step modeled as a tracked resource so it participates in deploy state: keyed
+* on the target REF identity (`targetHash` + sorted `invariants`), an
+* unchanged redeploy is an Alchemy-level no-op (on top of the marker read),
+* and a contract change — or a DATA-ONLY change that adds a ref invariant at
+* the same hash — re-runs the migration.
+*
+* Its provider's `reconcile` receives the RESOLVED props at apply-time — in
+* particular the concrete DB `url` (a lazy `Output` until the Connection
+* provisions) — and delegates to the proven `applyPnMigration` decision. The
+* provider is a standalone `Provider<PnMigration>` layer; the extension
+* descriptor merges it into its `providers()` (`Layer.merge(Prisma.providers(),
+* PnMigrationProvider())`), and Alchemy resolves it at apply via a direct
+* provider-tag lookup (`tryFindProviderByType`) — no change to `@internal/lowering`.
+*
+* Deploy-time only: imports `@prisma-next/postgres/control` (via the helper) +
+* `alchemy`. Imported by `control.ts` and tests, never by `index.ts` / the
+* `./prisma-next` authoring entry — index isolation holds.
+*/
+/** The `PnMigration` resource constructor — `yield* PnMigration(id, props)` in the lowering. */
+const PnMigration = Resource("PrismaNext.Migration");
+/**
+* The `PnMigration` provider service. `reconcile` runs for both create and
+* update (Alchemy's unified lifecycle); `applyPnMigration` is idempotent via
+* the live marker read, so it is safe to run for either — the marker decides
+* no-op / init / migrate. A migration has nothing to enumerate (`list` → `[]`)
+* and nothing to tear down on its own (`delete` → no-op; the DB's own deletion
+* handles teardown). Exported so tests can drive `reconcile` directly, without
+* building an Effect layer.
+*/
+const pnMigrationProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ news }) => Effect.tryPromise({
+		try: () => applyPnMigration({
+			url: news.url,
+			contractJson: news.contractJson,
+			migrationsDir: news.migrationsDir,
+			ref: {
+				hash: news.targetHash,
+				invariants: news.invariants
+			},
+			...news.refName !== void 0 ? { refName: news.refName } : {}
+		}),
+		catch: (error) => error
+	}).pipe(Effect.map((outcome) => ({
+		storageHash: outcome.targetHash,
+		invariants: news.invariants
+	}))),
+	delete: () => Effect.void
+};
+/** The `PnMigration` provider layer — merged into the extension descriptor's `providers()`. */
+const PnMigrationProvider = () => Provider.effect(PnMigration, Effect.succeed(pnMigrationProviderService));
+/**
+* The migration is a tracked `PnMigration` Alchemy resource keyed on the
+* target REF identity (hash + sorted invariants): unchanged redeploy is a
+* no-op, a contract or ref-invariant change re-migrates.
+*/
+function prismaNextDescriptor(o) {
+	const lowering = ({ id, node, application }) => Effect.gen(function* () {
+		validateName(id, "resource name (from provision id)");
+		const db = yield* Database(`${id}-db`, {
+			projectId: projectIdOf(application),
+			name: id,
+			region: o.region ?? "us-east-1",
+			...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+		});
+		const conn = yield* Connection(`${id}-conn`, {
+			databaseId: db.id,
+			name: id
+		});
+		const url = Output.map(conn.connectionString, (value) => Redacted.value(value));
+		if (!isPnPostgresResourceNode(node)) throw new Error(`prisma-next lowering received a non-prisma-next node (${id}).`);
+		const contractJson = node.provides.__cmp.contractJson;
+		const migrationsDir = yield* Effect.promise(() => resolveMigrationsDir(node.config));
+		const ref = yield* Effect.promise(() => resolveTargetRef(migrationsDir, contractJson, node.targetRef));
+		const warm = yield* PgWarm(`${id}-warm`, { url });
+		yield* PnMigration(`${id}-migrate`, {
+			url: warm.url,
+			contractJson,
+			migrationsDir,
+			targetHash: ref.hash,
+			invariants: [...ref.invariants].sort(),
+			...node.targetRef !== void 0 ? { refName: node.targetRef } : {}
+		});
+		return {
+			outputs: { url: warm.url },
+			entities: [{
+				kind: "postgres-database",
+				id: db.id
+			}]
+		};
+	});
+	return Object.assign(lowering, { kind: "resource" });
+}
+/**
+* The `S3Credentials` Alchemy resource (S5) — mints a random SigV4 key pair
+* ONCE at create and keeps it STABLE across deploys, so an unchanged module
+* no-ops on redeploy. The pair is generated with the Web Crypto global
+* (`crypto.getRandomValues` — no `node:` import, matching this package's
+* runtime-coupling invariant) and persisted in Alchemy state; on every later
+* apply the provider returns the persisted attributes (`reconcile`'s `output`)
+* unchanged — the same way the postgres resource keeps a Connection stable.
+* Rotation is destroy/recreate (a platform ask, not solved here).
+*
+* Deploy-time only: imports `alchemy`. Imported by `control.ts` and tests,
+* never by `index.ts` / the authoring entry.
+*/
+/** The `S3Credentials` resource constructor — `yield* S3Credentials(id, {})` in the lowering. */
+const S3Credentials = Resource("PrismaCloud.S3Credentials");
+function randomBytes(n) {
+	return crypto.getRandomValues(new Uint8Array(n));
+}
+function toHexUpper(bytes) {
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
+}
+/** A fresh SigV4 key pair: an AKIA-prefixed id and a 40-char base64 secret. */
+function mintKeyPair() {
+	return {
+		accessKeyId: `AKIA${toHexUpper(randomBytes(8))}`,
+		secretAccessKey: btoa(String.fromCharCode(...randomBytes(30)))
+	};
+}
+/**
+* The `S3Credentials` provider service. `reconcile` runs for create and update;
+* it returns the persisted `output` when present (a redeploy reuses the stored
+* pair — the no-op property) and mints a fresh pair only on first create.
+* Nothing to enumerate (`list` → `[]`) or tear down (`delete` → no-op; the pair
+* lives only in state). Exported so tests can drive it directly.
+*/
+const s3CredentialsProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ output }) => Effect.sync(() => output ?? mintKeyPair()),
+	delete: () => Effect.void
+};
+/** The `S3Credentials` provider layer — merged into the extension descriptor's `providers()`. */
+const S3CredentialsProvider = () => Provider.effect(S3Credentials, Effect.succeed(s3CredentialsProviderService));
+/**
+* One `S3Credentials` resource per provisioned credentials node — `id` is the
+* module provision id, so a pair shared by the storage service is minted once
+* and kept stable across deploys (the resource's provider preserves it).
+* `_o` is unused today (the mint needs no region/project) but kept for symmetry
+* with the other descriptors' signature.
+*/
+function s3CredentialsDescriptor(_o) {
+	const lowering = ({ id }) => Effect.gen(function* () {
+		const creds = yield* S3Credentials(`${id}-creds`, {});
+		return {
+			outputs: {
+				accessKeyId: creds.accessKeyId,
+				secretAccessKey: creds.secretAccessKey
+			},
+			entities: []
+		};
+	});
+	return Object.assign(lowering, { kind: "resource" });
+}
+function s3StoreDescriptor(o) {
+	const base = computeDescriptor(o);
+	return {
+		kind: "service",
+		provision: base.provision,
+		package: base.package,
+		serialize: (ctx, provisioned, config) => Effect.gen(function* () {
+			const serialized = yield* base.serialize(ctx, provisioned, config);
+			const credentials = config.inputs["credentials"] ?? {};
+			const bucket = config.service["bucket"];
+			if (credentials["accessKeyId"] === void 0 || credentials["secretAccessKey"] === void 0 || bucket === void 0) throw new Error("s3-store service must wire a 'credentials' dependency and a 'bucket' param");
+			return {
+				...serialized,
+				bucket,
+				accessKeyId: credentials["accessKeyId"],
+				secretAccessKey: credentials["secretAccessKey"]
+			};
+		}),
+		deploy: (ctx, provisioned, artifact, serialized) => Effect.gen(function* () {
+			const deployed = yield* base.deploy(ctx, provisioned, artifact, serialized);
+			return {
+				...deployed,
+				outputs: {
+					...deployed.outputs,
+					bucket: serialized.bucket,
+					accessKeyId: serialized.accessKeyId,
+					secretAccessKey: serialized.secretAccessKey
+				}
+			};
+		})
+	};
+}
+/**
+* Deploy preflight (ADR-0029, extended for env-sourced params): before Alchemy
+* runs, verify every secret binding AND every env-sourced param binding in the
+* app's manifests (each a platform env-var NAME) exists on Prisma Cloud for
+* the target stage. A literal-bound param never touches the platform — only
+* `envParam(...)` sources are checked here.
+* A name absent on the platform but present in the deploy shell is provisioned
+* via a direct Management API POST — NEVER an Alchemy resource, so the value
+* never lands in hosted deploy state. A name absent from both fails the deploy,
+* listing exactly what is missing and where to set it.
+*
+* Control-plane only (imported by control.ts → prisma-composer.config.ts); runs
+* in the CLI parent, so it builds its own Management API client from env — the
+* same credential path `ensureContainers` uses.
+*/
+/** production for the default stage; preview for a named stage — matching how the pack writes config rows. */
+const classFor = (branchId) => branchId === void 0 ? "production" : "preview";
+/**
+* One page of the env-var list. The query is `blindCast` to `never` because
+* openapi-fetch types this path's query as `never` (an SDK path/operation
+* mismatch); that same workaround defeats the client's response-type inference,
+* so the result is projected to the small shape we actually read.
+*/
+async function listEnvVars(client, query) {
+	return blindCast(await client.GET("/v1/environment-variables", { params: { query: blindCast(query) } }));
+}
+async function existsOnPlatform(client, projectId, branchId, key) {
+	const cls = classFor(branchId);
+	const visible = (row) => branchId === void 0 || row.branchId === null || row.branchId === branchId;
+	let cursor = null;
+	do {
+		const res = await listEnvVars(client, cursor === null ? {
+			projectId,
+			class: cls,
+			key
+		} : {
+			projectId,
+			class: cls,
+			key,
+			cursor
+		});
+		if (res.error !== void 0) throw listFailedError(key, res.error);
+		const page = res.data;
+		if (page === void 0) return false;
+		if (page.data.some(visible)) return true;
+		cursor = page.pagination.hasMore ? page.pagination.nextCursor : null;
+	} while (cursor !== null);
+	return false;
+}
+/**
+* Provision `key`=`value` directly via the Management API for the target
+* stage's scope (a production template for the default stage; a preview branch
+* override for a named stage — the same scope the pack writes config rows to,
+* EnvironmentVariable.ts). A 409 means a concurrent deploy already provisioned
+* it — tolerated. The value is never logged.
+*/
+async function fillMissing(client, input, key, value) {
+	const res = await client.POST("/v1/environment-variables", { body: {
+		projectId: input.projectId,
+		class: classFor(input.branchId),
+		key,
+		value,
+		...input.branchId !== void 0 ? { branchId: input.branchId } : {}
+	} });
+	if (res.error !== void 0 && res.response.status !== 409) throw fillFailedError(key, res.error);
+}
+const tokenRequiredError$1 = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required for deploy preflight.");
+const listFailedError = (key, error) => /* @__PURE__ */ new Error(`deploy preflight: Prisma Management API error listing "${key}": ${JSON.stringify(error)}.`);
+const fillFailedError = (key, error) => /* @__PURE__ */ new Error(`deploy preflight: failed to provision "${key}" from the deploy shell: ${JSON.stringify(error)}.`);
+function missingError(missing, input) {
+	const scope = input.branchId === void 0 ? "the production class (project-level template)" : `the preview class of stage "${input.stage ?? input.branchId}" (branch override or template)`;
+	const lines = missing.map((m) => `  - ${m.name}  (required by service "${m.serviceAddress}")`);
+	return /* @__PURE__ */ new Error(`Deploy preflight failed — ${missing.length} env var(s) (secret or env-sourced param) are not provisioned on Prisma Cloud for ${scope}, and are absent from the deploy shell:\n${lines.join("\n")}\n\nSet each in the deploy shell environment (the CLI will provision it on deploy), or create it on the platform (Prisma Console or the Management API) in ${scope}.`);
+}
+async function managementClient$1() {
+	if ((process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw tokenRequiredError$1();
+	return Effect.runPromise(Effect.gen(function* () {
+		return yield* ManagementClient;
+	}).pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv())))));
+}
+/**
+* The Prisma Cloud extension's `preflight`. Aggregates the target-agnostic
+* manifests (core's `provisionManifest` for secrets, `paramManifest` filtered
+* to env-sourced bindings for params), checks each pointer name against the
+* platform, fills from the shell where possible, and fails loudly on anything
+* absent from both. Accepts an injected client for tests; otherwise builds one
+* from env.
+*/
+async function runPreflight(input, deps) {
+	const names = /* @__PURE__ */ new Map();
+	for (const binding of provisionManifest(input.graph)) {
+		const name = secretName(binding);
+		if (!names.has(name)) names.set(name, {
+			name,
+			serviceAddress: binding.serviceAddress
+		});
+	}
+	for (const binding of paramManifest(input.graph)) {
+		if (!isEnvParamSource(binding.binding)) continue;
+		const name = paramName(binding);
+		if (!names.has(name)) names.set(name, {
+			name,
+			serviceAddress: binding.serviceAddress
+		});
+	}
+	if (names.size === 0) return;
+	const client = deps?.client ?? await managementClient$1();
+	const missing = [];
+	for (const meta of names.values()) {
+		if (await existsOnPlatform(client, input.projectId, input.branchId, meta.name)) continue;
+		const shellValue = process.env[meta.name];
+		if (shellValue !== void 0 && shellValue.length > 0) {
+			await fillMissing(client, input, meta.name, shellValue);
+			continue;
+		}
+		missing.push(meta);
+	}
+	if (missing.length > 0) throw missingError(missing, input);
+}
+const tokenRequiredError = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required for destroy teardown.");
+async function managementClient() {
+	if ((process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw tokenRequiredError();
+	return Effect.runPromise(Effect.gen(function* () {
+		return yield* ManagementClient;
+	}).pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv())))));
+}
+/**
+* The Prisma Cloud extension's `teardown`. Removes the stage's state database,
+* with failure handling that differs by stage because the consequences do:
+*
+* - **Named stage: throw.** The Branch delete that follows would fail anyway —
+*   the platform refuses a Branch that still has a database attached — so
+*   failing here names the actual cause instead of a confusing symptom.
+* - **Production: warn and continue.** Nothing blocks the Project delete on
+*   this; removing the database only stops production's state outliving
+*   production and holding a quota slot. That is a cleanup step, and a cleanup
+*   step must not fail the command.
+*
+* Accepts an injected client and ownership verifier for tests; otherwise
+* builds a client from env and verifies against the real database.
+*/
+async function runTeardown(input, deps) {
+	const isNamedStage = input.branchId !== void 0;
+	try {
+		const client = deps?.client ?? await managementClient();
+		await Effect.runPromise(deleteStateDatabaseWith({
+			projectId: input.projectId,
+			...input.branchId !== void 0 ? { branchId: input.branchId } : {}
+		}, deps?.verify ?? verifyOwnership).pipe(Effect.provideService(ManagementClient, client)));
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		if (isNamedStage) throw new Error(`Failed to delete the deploy-state database: ${reason}`);
+		console.warn(`Could not remove production's deploy-state database: ${reason}`);
+	}
+}
+/** The Prisma Cloud–hosted deploy state store; its implementation lives in @internal/lowering. */
+/**
+* ADR-0031's registered provisioner for RPC_PEER_KEY: mints one `ServiceKey`
+* resource per edge (ADR-0030) and forwards its value as the opaque ref core
+* writes into the consumer's `serviceKey` param. The resource id keeps the
+* `servicekey-${edgeId}` scheme byte-identical to slice 2's, so an existing
+* deploy's keys are found, not re-minted. Defined here, not in service-keys.ts:
+* that module is also reachable from the runtime/authoring side, which must
+* never import `@internal/lowering` or `effect`.
+*/
+const serviceKeyProvisioner = { provision: (edge) => Effect.gen(function* () {
+	return (yield* ServiceKey(`servicekey-${edge.edgeId}`, {})).value;
+}) };
+const KNOWN_REGION_SET = new Set(COMPUTE_REGIONS);
+function isComputeRegion(value) {
+	return KNOWN_REGION_SET.has(value);
+}
+/** Prisma.providers()'s ProviderCollection doesn't structurally unify with Alchemy's inferred providers Layer (a @internal/lowering typings gap); it satisfies it at runtime. */
+function asProvidersLayer(layer) {
+	return layer;
+}
+/**
+* Resolves the factory's env-or-option inputs, failing fast with the exact
+* variable name. `projectId`/`branchId` aren't required here — `prismaCloud()`
+* also runs in the CLI parent, before they're set; the required check lives in `application.provision`.
+*/
+function resolveOptions(opts) {
+	const workspaceId = opts.workspaceId ?? process.env["PRISMA_WORKSPACE_ID"];
+	if (workspaceId === void 0 || workspaceId.length === 0) throw new Error("prismaCloud(): environment variable PRISMA_WORKSPACE_ID is required.");
+	const projectId = process.env["PRISMA_PROJECT_ID"] || void 0;
+	const branchId = process.env["PRISMA_BRANCH_ID"] || void 0;
+	if (opts.region !== void 0) return {
+		workspaceId,
+		region: opts.region,
+		projectId,
+		branchId
+	};
+	const region = process.env["PRISMA_REGION"];
+	if (region === void 0 || region.length === 0) return {
+		workspaceId,
+		projectId,
+		branchId
+	};
+	if (!isComputeRegion(region)) throw new Error(`prismaCloud(): environment variable PRISMA_REGION="${region}" is not a known region (expected one of: ${COMPUTE_REGIONS.join(", ")}).`);
+	return {
+		workspaceId,
+		region,
+		projectId,
+		branchId
+	};
+}
+/** The Prisma Cloud extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */
+const prismaCloud = (opts = {}) => {
+	const o = resolveOptions(opts);
+	return {
+		id: "@prisma/composer-prisma-cloud",
+		providers: () => asProvidersLayer(Layer.mergeAll(providers(), PgWarmProvider(), PnMigrationProvider(), S3CredentialsProvider(), ServiceKeyProvider())),
+		preflight: (input) => runPreflight(input),
+		teardown: (input) => runTeardown(input),
+		application: { provision: () => Effect.gen(function* () {
+			const projectId = o.projectId;
+			if (projectId === void 0 || projectId.length === 0) throw new Error("prismaCloud(): environment variable PRISMA_PROJECT_ID is required (the CLI sets it — deploy via `prisma-composer deploy`).");
+			for (const key of ["DATABASE_URL", "DATABASE_URL_POOLED"]) yield* EnvironmentVariable(`${key}-poison`, {
+				projectId,
+				key,
+				value: "-",
+				class: o.branchId ? "preview" : "production",
+				...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+			});
+			return { projectId };
+		}) },
+		provisions: /* @__PURE__ */ new Map([[RPC_PEER_KEY, serviceKeyProvisioner]]),
+		nodes: {
+			postgres: postgresDescriptor(o),
+			"prisma-next": prismaNextDescriptor(o),
+			compute: computeDescriptor(o),
+			credentials: s3CredentialsDescriptor(o),
+			"s3-store": s3StoreDescriptor(o)
+		}
+	};
+};
+//#endregion
+export { prismaCloud, prismaState };
+
+//# sourceMappingURL=control.mjs.map