@prisma/composer-prisma-cloud 0.1.0-dev.18 → 0.1.0-dev.3

package/dist/control.mjs

@@ -1,14 +1,14 @@
 import { a as encodeParamPointer, c as secretName, i as encode, l as secretPointerRows, s as paramEntries, t as configKey } from "./serializer-CX4VYdf_-KKGoAxfx.mjs";
-import { a as isEnvParamSource, c as provisionedEdges, n as STREAMS_API_KEY, o as paramBindingFor, s as paramName, t as RESERVED_PROVIDER_PARAMS } from "./provisioned-edges-DIQAR4q4-Bn9op-JG.mjs";
-import { a as normalizeSslMode, n as isPnPostgresResourceNode, o as withConnectionRetry } from "./prisma-next-DlU01kXJ-2sP5mQb6.mjs";
+import { a as isEnvParamSource, c as provisionedEdges, n as STREAMS_API_KEY, o as paramBindingFor, s as paramName, t as RESERVED_PROVIDER_PARAMS } from "./provisioned-edges-Bb7WiV49-DeSPi3Ax.mjs";
+import { a as normalizeSslMode, n as isPnPostgresResourceNode, o as withConnectionRetry } from "./prisma-next-qPB8_Az6.mjs";
 import { isParamSource, paramManifest, provisionManifest } from "@prisma/composer";
 import { blindCast } from "@prisma/composer/casts";
-import { RPC_PEER_KEY } from "@prisma/composer/service-rpc";
+import { RPC_PEER_KEY } from "@prisma/composer/rpc";
 import pg from "pg";
+import * as Layer from "effect/Layer";
 import { createManagementApiClient } from "@prisma/management-api-sdk";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as Config$1 from "effect/Config";
 import * as Data from "effect/Data";
@@ -28,7 +28,7 @@ import { resolve } from "pathe";
 import { readRef } from "@prisma-next/migration-tools/refs";
 import { APP_SPACE_ID, readContractSpaceHeadRef, spaceMigrationDirectory, spaceRefsDirectory } from "@prisma-next/migration-tools/spaces";
 import { createPostgresControlClient } from "@prisma-next/postgres/control";
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CJM0E6rj.mjs
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CxGdfSAP.mjs
 /**
 * The Prisma service token used to authenticate Management API calls. Kept
 * as a Redacted value so it never lands in logs or error output.
@@ -68,84 +68,6 @@ const callOptional = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.s
 /** Fire-and-forget a call, tolerating a 404 (already deleted). */
 const callVoid = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
 //#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/buckets.mjs
-/** A Prisma **Object Store bucket** inside a project. */
-const Bucket = Resource("Prisma.Bucket");
-const BucketProvider = () => Provider.effect(Bucket, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: ["id"],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } })) : void 0;
-			if (observed) return {
-				id: observed.data.id,
-				name: observed.data.name
-			};
-			const created = yield* call(() => client.POST("/v1/buckets", { body: {
-				projectId: news.projectId,
-				name: news.name,
-				...news.branchId !== void 0 ? { branchId: news.branchId } : {}
-			} }));
-			return {
-				id: created.data.id,
-				name: created.data.name
-			};
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
-		}),
-		read: Effect.fn(function* ({ output }) {
-			if (!output?.id) return void 0;
-			const b = yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
-			return b ? {
-				id: b.data.id,
-				name: b.data.name
-			} : void 0;
-		})
-	};
-}));
-/** A **bucket access key** for a Prisma Object Store bucket — yields the S3 credentials. */
-const BucketKey = Resource("Prisma.BucketKey");
-const BucketKeyProvider = () => Provider.effect(BucketKey, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: [
-			"id",
-			"bucketId",
-			"secretAccessKey",
-			"accessKeyId",
-			"endpoint",
-			"bucketName"
-		],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			if (output?.id) return output;
-			const created = yield* call(() => client.POST("/v1/buckets/{bucketId}/keys", {
-				params: { path: { bucketId: news.bucketId } },
-				body: {
-					name: news.name,
-					role: news.role
-				}
-			}));
-			return {
-				id: created.data.id,
-				bucketId: news.bucketId,
-				accessKeyId: created.data.accessKeyId,
-				secretAccessKey: Redacted.make(created.data.secretAccessKey),
-				endpoint: created.data.endpoint,
-				bucketName: created.data.bucketName
-			};
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}/keys/{keyId}", { params: { path: {
-				bucketId: output.bucketId,
-				keyId: output.id
-			} } }));
-		})
-	};
-}));
-//#endregion
 //#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute.mjs
 /**
 * Stopping a deployment before the app that owns it can be
@@ -548,23 +470,25 @@ const DatabaseProvider = () => Provider.effect(Database, Effect.gen(function* ()
 		list: () => Effect.succeed([]),
 		reconcile: Effect.fn(function* ({ news, output }) {
 			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } })) : void 0;
-			if (!observed) {
-				const created = yield* call(() => client.POST("/v1/databases", { body: {
-					projectId: news.projectId,
-					name: news.name,
-					region: news.region,
-					...news.isDefault !== void 0 && { isDefault: news.isDefault },
-					...news.branchId !== void 0 && { branchId: news.branchId }
-				} }));
-				return {
+			let result;
+			if (observed) result = {
+				id: observed.data.id,
+				name: observed.data.name
+			};
+			else {
+				const created = yield* call(() => client.POST("/v1/projects/{projectId}/databases", {
+					params: { path: { projectId: news.projectId } },
+					body: {
+						name: news.name,
+						region: news.region,
+						...news.isDefault !== void 0 && { isDefault: news.isDefault }
+					}
+				}));
+				result = {
 					id: created.data.id,
 					name: created.data.name
 				};
 			}
-			const result = {
-				id: observed.data.id,
-				name: observed.data.name
-			};
 			if (news.branchId !== void 0) {
 				const branchId = news.branchId;
 				yield* call(() => client.PATCH("/v1/databases/{databaseId}", {
@@ -622,107 +546,7 @@ const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
 		})
 	};
 }));
-//#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/index.mjs
-/** Raised with `ensure: false` when the app's Project (or a named stage's Branch) doesn't exist. */
-var ContainerNotFoundError = class extends Data.TaggedError("ContainerNotFoundError") {};
-const listAllProjects = (client) => Effect.gen(function* () {
-	const projects = [];
-	let cursor;
-	for (;;) {
-		const query = cursor === void 0 ? {} : { cursor };
-		const page = yield* call(() => client.GET("/v1/projects", { params: { query } }));
-		projects.push(...page.data);
-		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
-		cursor = page.pagination.nextCursor;
-	}
-	return projects;
-});
-/**
-* Workspace ids circulate in two shapes: `wksp_`-prefixed and bare. Compare
-* bare-to-bare so a `wksp_`-prefixed API id still matches a bare configured
-* one (the same normalization `state/bootstrap.ts` applies to the same
-* `/v1/projects` listing).
-*/
-const bareWorkspaceId = (id) => id.startsWith("wksp_") ? id.slice(5) : id;
-/**
-* Finds the app's Project by name in the workspace — PDP allows duplicate
-* project names, so more than one can match; the oldest wins. Creates one
-* if none match, unless `ensure` is `false` (find-only — `destroy`), in
-* which case an absent Project fails with `ContainerNotFoundError`. No
-* ownership marker and no `--project` override (both deferred — see
-* ADR-0019).
-*/
-const resolveProject = (client, workspaceId, appName, ensure) => Effect.gen(function* () {
-	const oldest = (yield* listAllProjects(client)).filter((p) => bareWorkspaceId(p.workspace.id) === bareWorkspaceId(workspaceId) && p.name === appName).sort((a, b) => a.createdAt.localeCompare(b.createdAt))[0];
-	if (oldest !== void 0) return oldest.id;
-	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({ appName }));
-	return (yield* call(() => client.POST("/v1/projects", { body: {
-		name: appName,
-		workspaceId
-	} }))).data.id;
-});
-const findBranchId = (client, projectId, gitName) => call(() => client.GET("/v1/projects/{projectId}/branches", { params: {
-	path: { projectId },
-	query: { gitName }
-} })).pipe(Effect.map((page) => page.data[0]?.id));
-/**
-* Finds the stage's Branch by its exact `gitName`, creating it if absent
-* unless `ensure` is `false` (find-only — `destroy`), in which case an
-* absent Branch fails with `ContainerNotFoundError`. The Management API has
-* no server-side "create-or-return" idempotency (`POST
-* /v1/projects/:id/branches` 409s on a duplicate `gitName`, with no request
-* field to make that a no-op), so idempotency is client-side: observe
-* first, and on a racing 409 from create, re-observe rather than fail.
-*/
-const resolveBranch = (client, projectId, gitName, appName, ensure) => Effect.gen(function* () {
-	const existing = yield* findBranchId(client, projectId, gitName);
-	if (existing !== void 0) return existing;
-	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({
-		appName,
-		stage: gitName
-	}));
-	return yield* call(() => client.POST("/v1/projects/{projectId}/branches", {
-		params: { path: { projectId } },
-		body: { gitName }
-	})).pipe(Effect.map((r) => r.data.id), Effect.catch((err) => err.status === 409 ? findBranchId(client, projectId, gitName).pipe(Effect.flatMap((id) => id === void 0 ? Effect.fail(err) : Effect.succeed(id))) : Effect.fail(err)));
-});
-/**
-* Resolves the two containers a stage's deploy runs into (ADR-0019): the
-* app's **Project**, found-or-created by name, and — for a named stage
-* only — its **Branch**, found-or-created by `gitName`. The default stage
-* (no `stage`) creates no Branch; `branchId` is omitted. With `ensure:
-* false` (`destroy`), nothing is created — an absent Project or Branch
-* fails with `ContainerNotFoundError` instead.
-*/
-const resolveContainer = (opts) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	const ensure = opts.ensure ?? true;
-	const projectId = yield* resolveProject(client, opts.workspaceId, opts.appName, ensure);
-	if (opts.stage === void 0) return { projectId };
-	return {
-		projectId,
-		branchId: yield* resolveBranch(client, projectId, opts.stage, opts.appName, ensure)
-	};
-});
-/**
-* Soft-deletes a Branch. Tolerates a 404 (already gone). The API refuses if
-* the Branch still has live members or is the production/default Branch —
-* that surfaces as a `PrismaApiError`.
-*/
-const deleteBranch = (branchId) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	yield* callVoid(() => client.DELETE("/v1/branches/{branchId}", { params: { path: { branchId } } }));
-});
-/**
-* Deletes a Project. Tolerates a 404 (already gone). The API refuses with a
-* 400 if the Project still has live dependencies (e.g. another stage's
-* Branch/resources) — that surfaces as a `PrismaApiError`.
-*/
-const deleteProject = (projectId) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	yield* callVoid(() => client.DELETE("/v1/projects/{id}", { params: { path: { id: projectId } } }));
-});
+Data.TaggedError("ContainerNotFoundError");
 /** The collection of Prisma resource providers. */
 var Providers = class extends Provider.ProviderCollection()("Prisma") {};
 /**
@@ -736,10 +560,8 @@ const providers = () => Layer.effect(Providers, Provider.collection([
 	Connection,
 	ComputeService,
 	Deployment,
-	EnvironmentVariable,
-	Bucket,
-	BucketKey
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider(), BucketProvider(), BucketKeyProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
+	EnvironmentVariable
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
 //#endregion
 //#region ../../1-prisma-cloud/0-lowering/lowering/dist/state.mjs
 /** The framework-owned database a stage's deploy state lives in — a child of that stage's Branch (ADR-0034). */
@@ -1380,8 +1202,11 @@ const guardStateService = (service, checkLive, now = Date.now) => {
 * StackServices>` contract and alchemy's own convention (e.g. a missing
 * state store is `Effect.die` in `Stack.make`).
 */
-const prismaStateLayer = (ids) => {
-	const { projectId, branchId } = ids;
+const prismaState = () => {
+	const projectId = process.env["PRISMA_PROJECT_ID"];
+	if (projectId === void 0 || projectId.length === 0) throw new Error("prismaState(): environment variable PRISMA_PROJECT_ID is required (the CLI sets it — deploy via `prisma-composer deploy`).");
+	const branchIdEnv = process.env["PRISMA_BRANCH_ID"];
+	const branchId = branchIdEnv === void 0 || branchIdEnv.length === 0 ? void 0 : branchIdEnv;
 	return Layer.effect(State, Effect.gen(function* () {
 		const stack = yield* Stack;
 		const container = branchId === void 0 ? projectId : `${projectId}/${branchId}`;
@@ -1404,218 +1229,18 @@ const prismaStateLayer = (ids) => {
 };
 //#endregion
 //#region ../../1-prisma-cloud/1-extensions/target/dist/control.mjs
-const PRISMA_CLOUD_EXTENSION_ID = "@prisma/composer-prisma-cloud";
-var PrismaCloudContainer = class {
-	input;
-	projectId;
-	branchId;
-	constructor(input, projectId, branchId) {
-		this.input = input;
-		this.projectId = projectId;
-		this.branchId = branchId;
-	}
-	serialize() {
-		return JSON.stringify({
-			input: this.input,
-			projectId: this.projectId,
-			...this.branchId !== void 0 ? { branchId: this.branchId } : {}
-		});
-	}
-};
-/** `instanceof` — parent-side instances and child-side deserialized instances are both constructed by this module. */
-function isPrismaCloudContainer(value) {
-	return value instanceof PrismaCloudContainer;
-}
-/** Narrow-or-throw for hook inputs. */
-function prismaCloudContainerOf(value) {
-	if (!isPrismaCloudContainer(value)) throw new Error("the Prisma Cloud container was not resolved — the extension's container descriptor did not run.");
-	return value;
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-function invalidPayloadError(reason) {
-	return /* @__PURE__ */ new Error(`${PRISMA_CLOUD_EXTENSION_ID}: invalid container transport payload — ${reason}.`);
-}
-/** Reconstructs a `PrismaCloudContainer` from `serialize()`'s JSON output — real narrowing, no casts. */
-function deserialize(serialized) {
-	let parsed;
-	try {
-		parsed = JSON.parse(serialized);
-	} catch (error) {
-		throw invalidPayloadError(`not valid JSON (${error instanceof Error ? error.message : String(error)})`);
-	}
-	if (!isRecord(parsed)) throw invalidPayloadError("not an object");
-	const input = parsed["input"];
-	if (!isRecord(input)) throw invalidPayloadError("\"input\" is not an object");
-	const appName = input["appName"];
-	if (typeof appName !== "string") throw invalidPayloadError("\"input.appName\" is not a string");
-	const stage = input["stage"];
-	if (stage !== void 0 && typeof stage !== "string") throw invalidPayloadError("\"input.stage\" is not a string or absent");
-	const projectId = parsed["projectId"];
-	if (typeof projectId !== "string") throw invalidPayloadError("\"projectId\" is not a string");
-	const branchId = parsed["branchId"];
-	if (branchId !== void 0 && typeof branchId !== "string") throw invalidPayloadError("\"branchId\" is not a string or absent");
-	return new PrismaCloudContainer({
-		appName,
-		stage
-	}, projectId, branchId);
-}
-const workspaceRequiredError = () => /* @__PURE__ */ new Error("environment variable PRISMA_WORKSPACE_ID is required.");
-const tokenRequiredError$2 = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required.");
-function requireWorkspaceId() {
-	const workspaceId = process.env["PRISMA_WORKSPACE_ID"];
-	if (workspaceId === void 0 || workspaceId.length === 0) throw workspaceRequiredError();
-	return workspaceId;
-}
-function requireTokenUnlessInjected(deps) {
-	if (deps?.client === void 0 && (process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw tokenRequiredError$2();
-}
-async function ensureContainer(input, deps) {
-	const workspaceId = requireWorkspaceId();
-	requireTokenUnlessInjected(deps);
-	const program = resolveContainer({
-		workspaceId,
-		appName: input.appName,
-		...input.stage !== void 0 ? { stage: input.stage } : {},
-		ensure: true
-	}).pipe(Effect.map((c) => ({
-		ok: true,
-		container: c
-	})), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		message: `Prisma Management API error resolving containers: ${e.message}.`
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (!outcome.ok) throw new Error(outcome.message);
-	return new PrismaCloudContainer(input, outcome.container.projectId, outcome.container.branchId);
-}
-async function locateContainer(input, deps) {
-	const workspaceId = requireWorkspaceId();
-	requireTokenUnlessInjected(deps);
-	const program = resolveContainer({
-		workspaceId,
-		appName: input.appName,
-		...input.stage !== void 0 ? { stage: input.stage } : {},
-		ensure: false
-	}).pipe(Effect.map((c) => ({
-		ok: true,
-		container: c
-	})), Effect.catchTag("ContainerNotFoundError", () => Effect.succeed({ ok: false })), Effect.catchTag("PrismaApiError", (e) => Effect.fail(/* @__PURE__ */ new Error(`Prisma Management API error resolving containers: ${e.message}.`))));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (!outcome.ok) return void 0;
-	return new PrismaCloudContainer(input, outcome.container.projectId, outcome.container.branchId);
-}
-/**
-* Soft-deletes a named stage's Branch after a successful `alchemy destroy`
-* has removed its members — the Management API refuses to delete a Branch
-* that still has live members.
-*/
-async function removeStageBranch(branchId, deps) {
-	requireTokenUnlessInjected(deps);
-	const program = deleteBranch(branchId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		message: `Failed to delete the stage Branch: ${e.message}.`
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (!outcome.ok) throw new Error(outcome.message);
-}
-/**
-* Best-effort cleanup after a successful `--production` destroy: removes
-* the app's Project so hand-run stacks don't accumulate as empty Projects
-* (they eventually hit the workspace's plan limit). Unlike `removeStageBranch`,
-* this never throws: the destroy itself already succeeded, and the API's own
-* 400 ("still has dependencies") is the only check that matters — failing
-* the command over a cleanup step would be worse than leaving a Project shell.
-*/
-async function removeAppProject(projectId, deps) {
-	if (deps?.client === void 0 && (process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) {
-		console.warn(`Skipped removing the Project (${projectId}): PRISMA_SERVICE_TOKEN is not set.`);
-		return;
-	}
-	const program = deleteProject(projectId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		error: e
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (outcome.ok) {
-		console.log(`Removed the Project (${projectId}) — nothing was left in it.`);
-		return;
-	}
-	if (outcome.error.status === 400) {
-		console.log(`Kept the Project (${projectId}) — it still has another stage's resources.`);
-		return;
-	}
-	console.warn(`Could not remove the Project (${projectId}) after destroy: ${outcome.error.message}.`);
-}
-function containerDescriptor(deps) {
-	return {
-		ensure: (input) => ensureContainer(input, deps),
-		locate: (input) => locateContainer(input, deps),
-		remove: (instance) => instance.input.stage !== void 0 ? removeStageBranch(instance.branchId ?? missingBranchId(instance), deps) : removeAppProject(instance.projectId, deps),
-		deserialize
-	};
-}
-/** Defensive: a named-stage container always resolves a Branch together with its stage — `ensure`/`locate`/`deserialize` never produce one without the other. */
-function missingBranchId(instance) {
-	throw new Error(`${PRISMA_CLOUD_EXTENSION_ID}: a named-stage ("${instance.input.stage}") container instance is missing its branchId — this is a bug in ensure/locate/deserialize.`);
-}
 const PRISMA_NAME_MIN = 3;
 const PRISMA_NAME_MAX = 65;
 function validateName(value, source) {
 	if (value.length < PRISMA_NAME_MIN || value.length > PRISMA_NAME_MAX) throw new Error(`prisma-cloud: ${source} "${value}" (${value.length} characters) is not a valid Prisma resource name — Prisma requires ${PRISMA_NAME_MIN}–${PRISMA_NAME_MAX} characters. Rename the provision id (or the deploy --name) to fit.`);
 }
 function isCloudApplication(value) {
-	return typeof value === "object" && value !== null && "projectId" in value && typeof value.projectId === "string" && "branchId" in value && (value.branchId === void 0 || typeof value.branchId === "string");
+	return typeof value === "object" && value !== null && "projectId" in value && typeof value.projectId === "string";
 }
 /** Narrows `ctx.application`, which core hands over as `unknown`, to this extension's own product; throws naming the hook when it hasn't run. */
-function cloudApplicationOf(application) {
-	if (!isCloudApplication(application)) throw new Error("prisma-cloud: ctx.application is not this extension's application product — the prismaCloud() application hook must run before any node lowers.");
-	return application;
-}
 function projectIdOf(application) {
-	return cloudApplicationOf(application).projectId;
-}
-/**
-* One Bucket per module-provisioned bucket resource — `id` is the module
-* provision id, so a resource shared by several consumers is created exactly
-* once. A BucketKey is minted for the bucket: it is the reveal-once credential
-* carrier, and its attributes (endpoint, bucketName, accessKeyId,
-* secretAccessKey) become the four S3Config outputs consumers resolve by name.
-*/
-function bucketDescriptor(_o) {
-	const lowering = ({ id, application }) => Effect.gen(function* () {
-		validateName(id, "resource name (from provision id)");
-		const branchId = cloudApplicationOf(application).branchId;
-		const bkt = yield* Bucket(`${id}-bucket`, {
-			projectId: projectIdOf(application),
-			name: id,
-			...branchId !== void 0 ? { branchId } : {}
-		});
-		const key = yield* BucketKey(`${id}-key`, {
-			bucketId: bkt.id,
-			name: id,
-			role: "read_write"
-		});
-		const secretAccessKey = Output.map(key.secretAccessKey, (v) => Redacted.value(v));
-		return {
-			outputs: {
-				url: key.endpoint,
-				bucket: key.bucketName,
-				accessKeyId: key.accessKeyId,
-				secretAccessKey
-			},
-			entities: [{
-				kind: "bucket",
-				id: bkt.id
-			}]
-		};
-	});
-	return Object.assign(lowering, { kind: "resource" });
+	if (!isCloudApplication(application)) throw new Error("prisma-cloud: ctx.application is not this extension's application product — the prismaCloud() application hook must run before any node lowers.");
+	return application.projectId;
 }
 /** The `compute` node kind's descriptor: the four service hooks — provision, serialize, package, deploy. */
 /**
@@ -1630,22 +1255,20 @@ function computeDescriptor(o) {
 		provision: ({ id, application }) => Effect.gen(function* () {
 			validateName(id, "service name (from provision id)");
 			const projectId = projectIdOf(application);
-			const branchId = cloudApplicationOf(application).branchId;
 			return {
 				serviceId: (yield* ComputeService(`${id}-svc`, {
 					projectId,
 					name: id,
 					region: o.region ?? "us-east-1",
-					...branchId !== void 0 ? { branchId } : {}
+					...o.branchId !== void 0 ? { branchId: o.branchId } : {}
 				})).id,
 				projectId
 			};
 		}),
 		serialize: (ctx, provisioned, config) => Effect.gen(function* () {
 			const { address, node, graph } = ctx;
-			const branchId = cloudApplicationOf(ctx.application).branchId;
-			const cls = branchId ? "preview" : "production";
-			const branch = branchId !== void 0 ? { branchId } : {};
+			const cls = o.branchId ? "preview" : "production";
+			const branch = o.branchId !== void 0 ? { branchId: o.branchId } : {};
 			const projectId = provisioned.projectId;
 			const svc = node;
 			const records = [];
@@ -1785,12 +1408,11 @@ const PgWarmProvider = () => Provider.effect(PgWarm, Effect.succeed(pgWarmProvid
 function postgresDescriptor(o) {
 	const lowering = ({ id, application }) => Effect.gen(function* () {
 		validateName(id, "resource name (from provision id)");
-		const branchId = cloudApplicationOf(application).branchId;
 		const db = yield* Database(`${id}-db`, {
 			projectId: projectIdOf(application),
 			name: id,
 			region: o.region ?? "us-east-1",
-			...branchId !== void 0 ? { branchId } : {}
+			...o.branchId !== void 0 ? { branchId: o.branchId } : {}
 		});
 		const conn = yield* Connection(`${id}-conn`, {
 			databaseId: db.id,
@@ -2054,12 +1676,11 @@ const PnMigrationProvider = () => Provider.effect(PnMigration, Effect.succeed(pn
 function prismaNextDescriptor(o) {
 	const lowering = ({ id, node, application }) => Effect.gen(function* () {
 		validateName(id, "resource name (from provision id)");
-		const branchId = cloudApplicationOf(application).branchId;
 		const db = yield* Database(`${id}-db`, {
 			projectId: projectIdOf(application),
 			name: id,
 			region: o.region ?? "us-east-1",
-			...branchId !== void 0 ? { branchId } : {}
+			...o.branchId !== void 0 ? { branchId: o.branchId } : {}
 		});
 		const conn = yield* Connection(`${id}-conn`, {
 			databaseId: db.id,
@@ -2196,7 +1817,7 @@ function s3StoreDescriptor(o) {
 *
 * Control-plane only (imported by control.ts → prisma-composer.config.ts); runs
 * in the CLI parent, so it builds its own Management API client from env — the
-* same credential path `container.ts`'s `ensure`/`locate` use.
+* same credential path `ensureContainers` uses.
 */
 /** production for the default stage; preview for a named stage — matching how the pack writes config rows. */
 const classFor = (branchId) => branchId === void 0 ? "production" : "preview";
@@ -2239,21 +1860,21 @@ async function existsOnPlatform(client, projectId, branchId, key) {
 * EnvironmentVariable.ts). A 409 means a concurrent deploy already provisioned
 * it — tolerated. The value is never logged.
 */
-async function fillMissing(client, projectId, branchId, key, value) {
+async function fillMissing(client, input, key, value) {
 	const res = await client.POST("/v1/environment-variables", { body: {
-		projectId,
-		class: classFor(branchId),
+		projectId: input.projectId,
+		class: classFor(input.branchId),
 		key,
 		value,
-		...branchId !== void 0 ? { branchId } : {}
+		...input.branchId !== void 0 ? { branchId: input.branchId } : {}
 	} });
 	if (res.error !== void 0 && res.response.status !== 409) throw fillFailedError(key, res.error);
 }
 const tokenRequiredError$1 = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required for deploy preflight.");
 const listFailedError = (key, error) => /* @__PURE__ */ new Error(`deploy preflight: Prisma Management API error listing "${key}": ${JSON.stringify(error)}.`);
 const fillFailedError = (key, error) => /* @__PURE__ */ new Error(`deploy preflight: failed to provision "${key}" from the deploy shell: ${JSON.stringify(error)}.`);
-function missingError(missing, branchId, stage) {
-	const scope = branchId === void 0 ? "the production class (project-level template)" : `the preview class of stage "${stage ?? branchId}" (branch override or template)`;
+function missingError(missing, input) {
+	const scope = input.branchId === void 0 ? "the production class (project-level template)" : `the preview class of stage "${input.stage ?? input.branchId}" (branch override or template)`;
 	const lines = missing.map((m) => `  - ${m.name}  (required by service "${m.serviceAddress}")`);
 	return /* @__PURE__ */ new Error(`Deploy preflight failed — ${missing.length} env var(s) (secret or env-sourced param) are not provisioned on Prisma Cloud for ${scope}, and are absent from the deploy shell:\n${lines.join("\n")}\n\nSet each in the deploy shell environment (the CLI will provision it on deploy), or create it on the platform (Prisma Console or the Management API) in ${scope}.`);
 }
@@ -2272,7 +1893,6 @@ async function managementClient$1() {
 * from env.
 */
 async function runPreflight(input, deps) {
-	const { projectId, branchId } = prismaCloudContainerOf(input.container);
 	const names = /* @__PURE__ */ new Map();
 	for (const binding of provisionManifest(input.graph)) {
 		const name = secretName(binding);
@@ -2293,15 +1913,15 @@ async function runPreflight(input, deps) {
 	const client = deps?.client ?? await managementClient$1();
 	const missing = [];
 	for (const meta of names.values()) {
-		if (await existsOnPlatform(client, projectId, branchId, meta.name)) continue;
+		if (await existsOnPlatform(client, input.projectId, input.branchId, meta.name)) continue;
 		const shellValue = process.env[meta.name];
 		if (shellValue !== void 0 && shellValue.length > 0) {
-			await fillMissing(client, projectId, branchId, meta.name, shellValue);
+			await fillMissing(client, input, meta.name, shellValue);
 			continue;
 		}
 		missing.push(meta);
 	}
-	if (missing.length > 0) throw missingError(missing, branchId, input.stage);
+	if (missing.length > 0) throw missingError(missing, input);
 }
 const tokenRequiredError = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required for destroy teardown.");
 async function managementClient() {
@@ -2326,13 +1946,12 @@ async function managementClient() {
 * builds a client from env and verifies against the real database.
 */
 async function runTeardown(input, deps) {
-	const { projectId, branchId } = prismaCloudContainerOf(input.container);
-	const isNamedStage = branchId !== void 0;
+	const isNamedStage = input.branchId !== void 0;
 	try {
 		const client = deps?.client ?? await managementClient();
 		await Effect.runPromise(deleteStateDatabaseWith({
-			projectId,
-			...branchId !== void 0 ? { branchId } : {}
+			projectId: input.projectId,
+			...input.branchId !== void 0 ? { branchId: input.branchId } : {}
 		}, deps?.verify ?? verifyOwnership).pipe(Effect.provideService(ManagementClient, client)));
 	} catch (error) {
 		const reason = error instanceof Error ? error.message : String(error);
@@ -2410,17 +2029,6 @@ const streamsApiKeyValue = (refs) => {
 		return distinct[0] ?? "";
 	});
 };
-/** The user-facing state descriptor: `state: prismaState()` in `prisma-composer.config.ts` (ADR-0017). */
-const prismaState = () => ({
-	extension: PRISMA_CLOUD_EXTENSION_ID,
-	create: (container) => {
-		const { projectId, branchId } = prismaCloudContainerOf(container);
-		return prismaStateLayer(branchId !== void 0 ? {
-			projectId,
-			branchId
-		} : { projectId });
-	}
-});
 const KNOWN_REGION_SET = new Set(COMPUTE_REGIONS);
 function isComputeRegion(value) {
 	return KNOWN_REGION_SET.has(value);
@@ -2476,25 +2084,34 @@ function buildProviderParams(entries, values) {
 const PROVIDER_PARAMS = buildProviderParams(RESERVED_PROVIDER_PARAMS, PROVIDER_PARAM_VALUES);
 /**
 * Resolves the factory's env-or-option inputs, failing fast with the exact
-* variable name.
+* variable name. `projectId`/`branchId` aren't required here — `prismaCloud()`
+* also runs in the CLI parent, before they're set; the required check lives in `application.provision`.
 */
 function resolveOptions(opts) {
 	const workspaceId = opts.workspaceId ?? process.env["PRISMA_WORKSPACE_ID"];
 	if (workspaceId === void 0 || workspaceId.length === 0) throw new Error("prismaCloud(): environment variable PRISMA_WORKSPACE_ID is required.");
+	const projectId = process.env["PRISMA_PROJECT_ID"] || void 0;
+	const branchId = process.env["PRISMA_BRANCH_ID"] || void 0;
 	if (opts.region !== void 0) return {
 		workspaceId,
 		region: opts.region,
+		projectId,
+		branchId,
 		providerParams: PROVIDER_PARAMS
 	};
 	const region = process.env["PRISMA_REGION"];
 	if (region === void 0 || region.length === 0) return {
 		workspaceId,
+		projectId,
+		branchId,
 		providerParams: PROVIDER_PARAMS
 	};
 	if (!isComputeRegion(region)) throw new Error(`prismaCloud(): environment variable PRISMA_REGION="${region}" is not a known region (expected one of: ${COMPUTE_REGIONS.join(", ")}).`);
 	return {
 		workspaceId,
 		region,
+		projectId,
+		branchId,
 		providerParams: PROVIDER_PARAMS
 	};
 }
@@ -2502,24 +2119,21 @@ function resolveOptions(opts) {
 const prismaCloud = (opts = {}) => {
 	const o = resolveOptions(opts);
 	return {
-		id: PRISMA_CLOUD_EXTENSION_ID,
-		container: containerDescriptor(),
+		id: "@prisma/composer-prisma-cloud",
 		providers: () => asProvidersLayer(Layer.mergeAll(providers(), PgWarmProvider(), PnMigrationProvider(), S3CredentialsProvider(), ServiceKeyProvider())),
 		preflight: (input) => runPreflight(input),
 		teardown: (input) => runTeardown(input),
-		application: { provision: (ctx) => Effect.gen(function* () {
-			const { projectId, branchId } = prismaCloudContainerOf(ctx.container);
+		application: { provision: () => Effect.gen(function* () {
+			const projectId = o.projectId;
+			if (projectId === void 0 || projectId.length === 0) throw new Error("prismaCloud(): environment variable PRISMA_PROJECT_ID is required (the CLI sets it — deploy via `prisma-composer deploy`).");
 			for (const key of ["DATABASE_URL", "DATABASE_URL_POOLED"]) yield* EnvironmentVariable(`${key}-poison`, {
 				projectId,
 				key,
 				value: "-",
-				class: branchId ? "preview" : "production",
-				...branchId !== void 0 ? { branchId } : {}
+				class: o.branchId ? "preview" : "production",
+				...o.branchId !== void 0 ? { branchId: o.branchId } : {}
 			});
-			return {
-				projectId,
-				branchId
-			};
+			return { projectId };
 		}) },
 		provisions: PROVISIONERS,
 		nodes: {
@@ -2527,8 +2141,7 @@ const prismaCloud = (opts = {}) => {
 			"prisma-next": prismaNextDescriptor(o),
 			compute: computeDescriptor(o),
 			credentials: s3CredentialsDescriptor(o),
-			"s3-store": s3StoreDescriptor(o),
-			s3: bucketDescriptor(o)
+			"s3-store": s3StoreDescriptor(o)
 		}
 	};
 };