@prisma/composer-prisma-cloud 0.1.0 → 0.2.0-dev.10

package/dist/control.mjs

@@ -1,12 +1,14 @@
-import { c as secretPointerRows, i as encode, o as paramEntries, s as secretName, t as configKey } from "./serializer-C2CsA7xm-29Eg2Tjl.mjs";
-import { a as normalizeSslMode, n as isPnPostgresResourceNode, o as withConnectionRetry } from "./prisma-next-COrwlg3N.mjs";
-import { provisionManifest } from "@prisma/composer";
+import { a as encode, c as paramEntries, d as secretPointerRows, n as configKey, o as encodeParamPointer, u as secretName } from "./serializer-D8_84XWO-DA2B6YbX.mjs";
+import { c as paramName, l as provisionedEdges, n as SELF_ORIGIN, o as isEnvParamSource, r as STREAMS_API_KEY, s as paramBindingFor, t as RESERVED_PROVIDER_PARAMS } from "./provisioned-edges-B_XS1Mz--NFJgcXK7.mjs";
+import { a as normalizeSslMode, n as isPnPostgresResourceNode, o as withConnectionRetry } from "./prisma-next-BvBwGCIt-CSauMX4l.mjs";
+import { isParamSource, paramManifest, provisionManifest } from "@prisma/composer";
 import { blindCast } from "@prisma/composer/casts";
+import { RPC_PEER_KEY } from "@prisma/composer/service-rpc";
 import pg from "pg";
-import * as Layer from "effect/Layer";
 import { createManagementApiClient } from "@prisma/management-api-sdk";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as Config$1 from "effect/Config";
 import * as Data from "effect/Data";
@@ -18,15 +20,15 @@ import * as crypto$1 from "node:crypto";
 import * as os from "node:os";
 import * as path from "node:path";
 import * as zlib from "node:zlib";
-import { STATE_STORE_VERSION, State, StateStoreError, encodeState, reviveStateRecursive } from "alchemy/State";
 import postgres from "postgres";
+import { STATE_STORE_VERSION, State, StateStoreError, encodeState, reviveStateRecursive } from "alchemy/State";
 import * as Output from "alchemy/Output";
-import { loadConfig } from "@prisma-next/cli/config-loader";
+import { loadConfig } from "@prisma-next/config-loader";
 import { resolve } from "pathe";
 import { readRef } from "@prisma-next/migration-tools/refs";
 import { APP_SPACE_ID, readContractSpaceHeadRef, spaceMigrationDirectory, spaceRefsDirectory } from "@prisma-next/migration-tools/spaces";
 import { createPostgresControlClient } from "@prisma-next/postgres/control";
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CxGdfSAP.mjs
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CJM0E6rj.mjs
 /**
 * The Prisma service token used to authenticate Management API calls. Kept
 * as a Redacted value so it never lands in logs or error output.
@@ -66,9 +68,87 @@ const callOptional = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.s
 /** Fire-and-forget a call, tolerating a 404 (already deleted). */
 const callVoid = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
 //#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute/index.mjs
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/buckets.mjs
+/** A Prisma **Object Store bucket** inside a project. */
+const Bucket = Resource("Prisma.Bucket");
+const BucketProvider = () => Provider.effect(Bucket, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } })) : void 0;
+			if (observed) return {
+				id: observed.data.id,
+				name: observed.data.name
+			};
+			const created = yield* call(() => client.POST("/v1/buckets", { body: {
+				projectId: news.projectId,
+				name: news.name,
+				...news.branchId !== void 0 ? { branchId: news.branchId } : {}
+			} }));
+			return {
+				id: created.data.id,
+				name: created.data.name
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const b = yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
+			return b ? {
+				id: b.data.id,
+				name: b.data.name
+			} : void 0;
+		})
+	};
+}));
+/** A **bucket access key** for a Prisma Object Store bucket — yields the S3 credentials. */
+const BucketKey = Resource("Prisma.BucketKey");
+const BucketKeyProvider = () => Provider.effect(BucketKey, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: [
+			"id",
+			"bucketId",
+			"secretAccessKey",
+			"accessKeyId",
+			"endpoint",
+			"bucketName"
+		],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			if (output?.id) return output;
+			const created = yield* call(() => client.POST("/v1/buckets/{bucketId}/keys", {
+				params: { path: { bucketId: news.bucketId } },
+				body: {
+					name: news.name,
+					role: news.role
+				}
+			}));
+			return {
+				id: created.data.id,
+				bucketId: news.bucketId,
+				accessKeyId: created.data.accessKeyId,
+				secretAccessKey: Redacted.make(created.data.secretAccessKey),
+				endpoint: created.data.endpoint,
+				bucketName: created.data.bucketName
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}/keys/{keyId}", { params: { path: {
+				bucketId: output.bucketId,
+				keyId: output.id
+			} } }));
+		})
+	};
+}));
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute.mjs
 /**
-* Stopping a deployment before the compute service that owns it can be
+* Stopping a deployment before the app that owns it can be
 * deleted is asynchronous on the platform's side: DELETE can 409 with this
 * message while the deployment is still winding down. Retrying blindly on
 * every API error would mask real failures (bad auth, a genuinely conflicting
@@ -99,64 +179,62 @@ const ComputeServiceProvider = () => Provider.effect(ComputeService, Effect.gen(
 		stables: ["id"],
 		list: () => Effect.succeed([]),
 		reconcile: Effect.fn(function* ({ news, output }) {
-			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/compute-services/{computeServiceId}", { params: { path: { computeServiceId: output.id } } })) : void 0;
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/apps/{appId}", { params: { path: { appId: output.id } } })) : void 0;
 			if (observed) return {
 				id: observed.data.id,
 				name: observed.data.name,
-				endpointDomain: observed.data.serviceEndpointDomain
+				endpointDomain: observed.data.appEndpointDomain
 			};
-			const created = yield* call(() => client.POST("/v1/projects/{projectId}/compute-services", {
-				params: { path: { projectId: news.projectId } },
-				body: {
-					displayName: news.name,
-					...news.region && { regionId: news.region },
-					...news.branchId !== void 0 && { branchId: news.branchId }
-				}
-			}));
+			const created = yield* call(() => client.POST("/v1/apps", { body: {
+				displayName: news.name,
+				projectId: news.projectId,
+				...news.region && { regionId: news.region },
+				...news.branchId !== void 0 && { branchId: news.branchId }
+			} }));
 			return {
 				id: created.data.id,
 				name: created.data.name,
-				endpointDomain: created.data.serviceEndpointDomain
+				endpointDomain: created.data.appEndpointDomain
 			};
 		}),
 		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/compute-services/{computeServiceId}", { params: { path: { computeServiceId: output.id } } })).pipe(Effect.retry({
+			yield* callVoid(() => client.DELETE("/v1/apps/{appId}", { params: { path: { appId: output.id } } })).pipe(Effect.retry({
 				schedule: deleteSafeRetrySchedule,
 				while: isDeleteNotSafeYet
 			}));
 		}),
 		read: Effect.fn(function* ({ output }) {
 			if (!output?.id) return void 0;
-			const s = yield* callOptional(() => client.GET("/v1/compute-services/{computeServiceId}", { params: { path: { computeServiceId: output.id } } }));
+			const s = yield* callOptional(() => client.GET("/v1/apps/{appId}", { params: { path: { appId: output.id } } }));
 			return s ? {
 				id: s.data.id,
 				name: s.data.name,
-				endpointDomain: s.data.serviceEndpointDomain
+				endpointDomain: s.data.appEndpointDomain
 			} : void 0;
 		})
 	};
 }));
 /**
-* A **deployment** of a Prisma Compute service — creates a version, uploads
+* A **deployment** of a Prisma app — creates a deployment, uploads
 * its artifact, starts the VM, waits for it to run, then promotes it to the
-* service's stable endpoint.
+* app's stable endpoint.
 */
 const Deployment = Resource("Prisma.Deployment");
 const DeploymentProvider = () => Provider.effect(Deployment, Effect.gen(function* () {
 	const client = yield* ManagementClient;
-	const waitForRunning = (versionId) => call(() => client.GET("/v1/compute-services/versions/{versionId}", { params: { path: { versionId } } })).pipe(Effect.flatMap((v) => v.data.status === "running" ? Effect.void : Effect.fail(new PrismaApiError({
+	const waitForRunning = (deploymentId) => call(() => client.GET("/v1/deployments/{deploymentId}", { params: { path: { deploymentId } } })).pipe(Effect.flatMap((v) => v.data.status === "running" ? Effect.void : Effect.fail(new PrismaApiError({
 		status: 409,
-		message: `compute version ${versionId} is ${v.data.status}, not running`
+		message: `deployment ${deploymentId} is ${v.data.status}, not running`
 	}))), Effect.retry(Schedule.both(Schedule.spaced("2 seconds"), Schedule.during("2 minutes"))));
 	return {
 		stables: [],
 		list: () => Effect.succeed([]),
 		reconcile: Effect.fn(function* ({ news }) {
-			const created = yield* call(() => client.POST("/v1/compute-services/{computeServiceId}/versions", {
-				params: { path: { computeServiceId: news.computeServiceId } },
+			const created = yield* call(() => client.POST("/v1/apps/{appId}/deployments", {
+				params: { path: { appId: news.computeServiceId } },
 				body: news.port !== void 0 ? { portMapping: { http: news.port } } : {}
 			}));
-			const versionId = created.data.id;
+			const deploymentId = created.data.id;
 			if (created.data.uploadUrl) {
 				const uploadUrl = created.data.uploadUrl;
 				const artifact = yield* Effect.try({
@@ -183,24 +261,23 @@ const DeploymentProvider = () => Provider.effect(Deployment, Effect.gen(function
 					})
 				});
 			}
-			yield* call(() => client.POST("/v1/compute-services/versions/{versionId}/start", { params: { path: { versionId } } }));
-			yield* waitForRunning(versionId);
-			yield* call(() => client.POST("/v1/compute-services/{computeServiceId}/promote", {
-				params: { path: { computeServiceId: news.computeServiceId } },
-				body: { versionId }
-			}));
-			const deployedUrl = (yield* call(() => client.GET("/v1/compute-services/{computeServiceId}", { params: { path: { computeServiceId: news.computeServiceId } } }))).data.serviceEndpointDomain;
+			yield* call(() => client.POST("/v1/deployments/{deploymentId}/start", { params: { path: { deploymentId } } }));
+			yield* waitForRunning(deploymentId);
+			const deployedUrl = (yield* call(() => client.POST("/v1/apps/{appId}/promote", {
+				params: { path: { appId: news.computeServiceId } },
+				body: { deploymentId }
+			}))).data.appEndpointDomain;
 			return {
-				versionId,
+				deploymentId,
 				...deployedUrl !== void 0 && { deployedUrl }
 			};
 		}),
 		delete: Effect.fn(function* () {}),
 		read: Effect.fn(function* ({ output }) {
-			if (!output?.versionId) return void 0;
-			const v = yield* callOptional(() => client.GET("/v1/compute-services/versions/{versionId}", { params: { path: { versionId: output.versionId } } }));
+			if (!output?.deploymentId) return void 0;
+			const v = yield* callOptional(() => client.GET("/v1/deployments/{deploymentId}", { params: { path: { deploymentId: output.deploymentId } } }));
 			return v ? {
-				versionId: v.data.id,
+				deploymentId: v.data.id,
 				...v.data.previewDomain && { deployedUrl: v.data.previewDomain }
 			} : void 0;
 		})
@@ -231,7 +308,7 @@ const EnvironmentVariableProvider = () => Provider.effect(EnvironmentVariable, E
 					key: news.key
 				} } }))).data?.[0]?.id;
 				if (matchId !== void 0) {
-					if (!(news.key === "DATABASE_URL" || news.key === "DATABASE_URL_POOLED")) throw new Error(`EnvironmentVariable "${news.key}" (project "${news.projectId}", class "${cls}") exists but is untracked in this deploy state — refusing to overwrite a reserved COMPOSE_ key. Restore this deploy's hosted state, or remove the variable to let this deploy recreate it.`);
+					if (!(news.key === "DATABASE_URL" || news.key === "DATABASE_URL_POOLED")) throw new Error(`EnvironmentVariable "${news.key}" (project "${news.projectId}", class "${cls}") exists but is untracked in this deploy state — refusing to overwrite a reserved COMPOSER_ key. Restore this deploy's hosted state, or remove the variable to let this deploy recreate it.`);
 					id = matchId;
 				}
 			}
@@ -400,8 +477,39 @@ function packageComputeArtifact(opts) {
 		sha256
 	};
 }
+/**
+* The `ServiceKey` Alchemy resource (ADR-0030) — mints a random 256-bit key
+* ONCE at create and keeps it STABLE across deploys, so an unchanged edge
+* no-ops on redeploy. Same mint-once-stable lifecycle as `S3Credentials`
+* (`packages/1-prisma-cloud/1-extensions/target/src/s3-credentials-resource.ts`):
+* Web Crypto only (`crypto.getRandomValues` — no `node:` import), persisted in
+* Alchemy state; on every later apply the provider returns the persisted
+* attributes (`reconcile`'s `output`) unchanged. One resource per RPC edge;
+* rotation is destroy/recreate.
+*/
+/** The `ServiceKey` resource constructor — `yield* Prisma.ServiceKey(id, {})` in the lowering. */
+const ServiceKey = Resource("PrismaCloud.ServiceKey");
+/** A fresh 256-bit key as 64 lowercase hex chars (Web Crypto — no node import). */
+function mintServiceKey() {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+	return { value: Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("") };
+}
+/**
+* The `ServiceKey` provider service. `reconcile` runs for create and update;
+* it returns the persisted `output` when present (a redeploy reuses the
+* stored key — the no-op property) and mints a fresh key only on first
+* create. Nothing to enumerate (`list` → `[]`) or tear down (`delete` →
+* no-op; the key lives only in state).
+*/
+const serviceKeyProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ output }) => Effect.sync(() => output ?? mintServiceKey()),
+	delete: () => Effect.void
+};
+/** The `ServiceKey` provider layer — merged into the Prisma Cloud extension's `providers()`. */
+const ServiceKeyProvider = () => Provider.effect(ServiceKey, Effect.succeed(serviceKeyProviderService));
 //#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/postgres/index.mjs
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/postgres.mjs
 /** A **connection** to a Prisma Postgres database — yields the connection string. */
 const Connection = Resource("Prisma.Connection");
 const ConnectionProvider = () => Provider.effect(Connection, Effect.gen(function* () {
@@ -440,25 +548,23 @@ const DatabaseProvider = () => Provider.effect(Database, Effect.gen(function* ()
 		list: () => Effect.succeed([]),
 		reconcile: Effect.fn(function* ({ news, output }) {
 			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } })) : void 0;
-			let result;
-			if (observed) result = {
-				id: observed.data.id,
-				name: observed.data.name
-			};
-			else {
-				const created = yield* call(() => client.POST("/v1/projects/{projectId}/databases", {
-					params: { path: { projectId: news.projectId } },
-					body: {
-						name: news.name,
-						region: news.region,
-						...news.isDefault !== void 0 && { isDefault: news.isDefault }
-					}
-				}));
-				result = {
+			if (!observed) {
+				const created = yield* call(() => client.POST("/v1/databases", { body: {
+					projectId: news.projectId,
+					name: news.name,
+					region: news.region,
+					...news.isDefault !== void 0 && { isDefault: news.isDefault },
+					...news.branchId !== void 0 && { branchId: news.branchId }
+				} }));
+				return {
 					id: created.data.id,
 					name: created.data.name
 				};
 			}
+			const result = {
+				id: observed.data.id,
+				name: observed.data.name
+			};
 			if (news.branchId !== void 0) {
 				const branchId = news.branchId;
 				yield* call(() => client.PATCH("/v1/databases/{databaseId}", {
@@ -516,7 +622,107 @@ const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
 		})
 	};
 }));
-Data.TaggedError("ContainerNotFoundError");
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/index.mjs
+/** Raised with `ensure: false` when the app's Project (or a named stage's Branch) doesn't exist. */
+var ContainerNotFoundError = class extends Data.TaggedError("ContainerNotFoundError") {};
+const listAllProjects = (client) => Effect.gen(function* () {
+	const projects = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {} : { cursor };
+		const page = yield* call(() => client.GET("/v1/projects", { params: { query } }));
+		projects.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return projects;
+});
+/**
+* Workspace ids circulate in two shapes: `wksp_`-prefixed and bare. Compare
+* bare-to-bare so a `wksp_`-prefixed API id still matches a bare configured
+* one (the same normalization `state/bootstrap.ts` applies to the same
+* `/v1/projects` listing).
+*/
+const bareWorkspaceId = (id) => id.startsWith("wksp_") ? id.slice(5) : id;
+/**
+* Finds the app's Project by name in the workspace — PDP allows duplicate
+* project names, so more than one can match; the oldest wins. Creates one
+* if none match, unless `ensure` is `false` (find-only — `destroy`), in
+* which case an absent Project fails with `ContainerNotFoundError`. No
+* ownership marker and no `--project` override (both deferred — see
+* ADR-0019).
+*/
+const resolveProject = (client, workspaceId, appName, ensure) => Effect.gen(function* () {
+	const oldest = (yield* listAllProjects(client)).filter((p) => bareWorkspaceId(p.workspace.id) === bareWorkspaceId(workspaceId) && p.name === appName).sort((a, b) => a.createdAt.localeCompare(b.createdAt))[0];
+	if (oldest !== void 0) return oldest.id;
+	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({ appName }));
+	return (yield* call(() => client.POST("/v1/projects", { body: {
+		name: appName,
+		workspaceId
+	} }))).data.id;
+});
+const findBranchId = (client, projectId, gitName) => call(() => client.GET("/v1/projects/{projectId}/branches", { params: {
+	path: { projectId },
+	query: { gitName }
+} })).pipe(Effect.map((page) => page.data[0]?.id));
+/**
+* Finds the stage's Branch by its exact `gitName`, creating it if absent
+* unless `ensure` is `false` (find-only — `destroy`), in which case an
+* absent Branch fails with `ContainerNotFoundError`. The Management API has
+* no server-side "create-or-return" idempotency (`POST
+* /v1/projects/:id/branches` 409s on a duplicate `gitName`, with no request
+* field to make that a no-op), so idempotency is client-side: observe
+* first, and on a racing 409 from create, re-observe rather than fail.
+*/
+const resolveBranch = (client, projectId, gitName, appName, ensure) => Effect.gen(function* () {
+	const existing = yield* findBranchId(client, projectId, gitName);
+	if (existing !== void 0) return existing;
+	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({
+		appName,
+		stage: gitName
+	}));
+	return yield* call(() => client.POST("/v1/projects/{projectId}/branches", {
+		params: { path: { projectId } },
+		body: { gitName }
+	})).pipe(Effect.map((r) => r.data.id), Effect.catch((err) => err.status === 409 ? findBranchId(client, projectId, gitName).pipe(Effect.flatMap((id) => id === void 0 ? Effect.fail(err) : Effect.succeed(id))) : Effect.fail(err)));
+});
+/**
+* Resolves the two containers a stage's deploy runs into (ADR-0019): the
+* app's **Project**, found-or-created by name, and — for a named stage
+* only — its **Branch**, found-or-created by `gitName`. The default stage
+* (no `stage`) creates no Branch; `branchId` is omitted. With `ensure:
+* false` (`destroy`), nothing is created — an absent Project or Branch
+* fails with `ContainerNotFoundError` instead.
+*/
+const resolveContainer = (opts) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	const ensure = opts.ensure ?? true;
+	const projectId = yield* resolveProject(client, opts.workspaceId, opts.appName, ensure);
+	if (opts.stage === void 0) return { projectId };
+	return {
+		projectId,
+		branchId: yield* resolveBranch(client, projectId, opts.stage, opts.appName, ensure)
+	};
+});
+/**
+* Soft-deletes a Branch. Tolerates a 404 (already gone). The API refuses if
+* the Branch still has live members or is the production/default Branch —
+* that surfaces as a `PrismaApiError`.
+*/
+const deleteBranch = (branchId) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	yield* callVoid(() => client.DELETE("/v1/branches/{branchId}", { params: { path: { branchId } } }));
+});
+/**
+* Deletes a Project. Tolerates a 404 (already gone). The API refuses with a
+* 400 if the Project still has live dependencies (e.g. another stage's
+* Branch/resources) — that surfaces as a `PrismaApiError`.
+*/
+const deleteProject = (projectId) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	yield* callVoid(() => client.DELETE("/v1/projects/{id}", { params: { path: { id: projectId } } }));
+});
 /** The collection of Prisma resource providers. */
 var Providers = class extends Provider.ProviderCollection()("Prisma") {};
 /**
@@ -530,10 +736,101 @@ const providers = () => Layer.effect(Providers, Provider.collection([
 	Connection,
 	ComputeService,
 	Deployment,
-	EnvironmentVariable
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
+	EnvironmentVariable,
+	Bucket,
+	BucketKey
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider(), BucketProvider(), BucketKeyProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
 //#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/state/index.mjs
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/state.mjs
+/** The framework-owned database a stage's deploy state lives in — a child of that stage's Branch (ADR-0034). */
+const STATE_DATABASE_NAME = "prisma-composer-state";
+/** Every connection created against a state database carries this prefix — see `cleanupAgedConnections`. */
+const CONNECTION_NAME_PREFIX = "prisma-composer-state-";
+const listAllBranches = (client, projectId) => Effect.gen(function* () {
+	const branches = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {} : { cursor };
+		const page = yield* call(() => client.GET("/v1/projects/{projectId}/branches", { params: {
+			path: { projectId },
+			query
+		} }));
+		branches.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return branches;
+});
+/**
+* The project's implicit default Branch — every live Project owns exactly
+* one (a platform invariant). The list endpoint has no `isDefault` filter, so
+* this pages through every Branch and picks it out client-side. Never creates
+* one: its absence means the platform's invariant is broken, which is not
+* something a deploy can repair.
+*/
+const resolveDefaultBranchId = (client, projectId) => Effect.gen(function* () {
+	const found = (yield* listAllBranches(client, projectId)).find((b) => b.isDefault);
+	if (found !== void 0) return found.id;
+	return yield* Effect.fail(new PrismaApiError({
+		status: 0,
+		message: `project ${projectId} has no default Branch — the platform guarantees every live Project owns one; contact support.`
+	}));
+});
+/** A named stage carries its `branchId`; production omits it, and its state lives on the Project's default Branch. */
+const resolveBranchId = (client, container) => container.branchId !== void 0 ? Effect.succeed(container.branchId) : resolveDefaultBranchId(client, container.projectId);
+/**
+* Every database on this Branch. Uses the flat `GET /v1/databases`, which
+* accepts `projectId` and `branchId` together — the project-scoped listing
+* has no branch filter at all.
+*/
+const listAllDatabasesOnBranch = (client, projectId, branchId) => Effect.gen(function* () {
+	const databases = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {
+			projectId,
+			branchId
+		} : {
+			projectId,
+			branchId,
+			cursor
+		};
+		const page = yield* call(() => client.GET("/v1/databases", { params: { query } }));
+		databases.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return databases;
+});
+/**
+* Databases on this Branch named `prisma-composer-state`, oldest first,
+* excluding the Branch's own default database. The default database is always
+* the user's, never ours to adopt or delete. A name match alone proves
+* nothing — the platform allows duplicate names — so every caller must still
+* verify ownership before acting on a candidate.
+*/
+const listStateDatabaseCandidates = (client, projectId, branchId) => listAllDatabasesOnBranch(client, projectId, branchId).pipe(Effect.map((databases) => databases.filter((d) => d.name === "prisma-composer-state" && !d.isDefault).sort((a, b) => a.createdAt.localeCompare(b.createdAt))));
+/**
+* Creates a fresh Postgres connection and reads its connection string. Reads
+* `endpoints.direct.connectionString` only — never `endpoints.pooled`, and
+* never the deprecated top-level `connectionString`/`url` (PRO-212), neither
+* of which the platform guarantees.
+*
+* The connection string is returned only when the connection is created and
+* cannot be read back afterwards, which is why every run creates a fresh
+* connection instead of reusing one.
+*/
+const createConnection = (client, databaseId) => call(() => client.POST("/v1/databases/{databaseId}/connections", {
+	params: { path: { databaseId } },
+	body: { name: `${CONNECTION_NAME_PREFIX}${Date.now()}` }
+})).pipe(Effect.flatMap((r) => {
+	const created = r.data;
+	const dsn = created.endpoints.direct?.connectionString;
+	return dsn === void 0 ? Effect.fail(new PrismaApiError({
+		status: 0,
+		message: `connection ${created.id} returned no endpoints.direct.connectionString (PRO-212)`
+	})) : Effect.succeed(Redacted.make(dsn));
+}));
 /** Collapses any thrown value (postgres.js failures included) into a {@link StateStoreError}. */
 const toStateStoreError = (cause) => cause instanceof Error ? new StateStoreError({
 	message: cause.message,
@@ -541,13 +838,13 @@ const toStateStoreError = (cause) => cause instanceof Error ? new StateStoreErro
 }) : new StateStoreError({ message: String(cause) });
 /**
 * An operator-facing failure from the hosted-state bootstrap pipeline
-* (project/database discovery, connection mint, schema migration, or lock
+* (branch/database discovery, connection creation, schema migration, or lock
 * acquisition) — what a deployer actually sees, instead of a raw Effect
 * defect.
 */
 var HostedStateBootstrapError = class extends Data.TaggedError("HostedStateBootstrapError") {
 	get message() {
-		return `hosted-state bootstrap failed for workspace ${this.workspaceId}: ${this.step} — ${this.reason}`;
+		return `hosted-state bootstrap failed in ${this.container}: ${this.step} — ${this.reason}`;
 	}
 };
 /**
@@ -557,8 +854,8 @@ var HostedStateBootstrapError = class extends Data.TaggedError("HostedStateBoots
 * omit the DSN or credentials, so only the extracted message text survives
 * into the operator-facing error.
 */
-const hostedStateBootstrapError = (workspaceId, step, cause) => new HostedStateBootstrapError({
-	workspaceId,
+const hostedStateBootstrapError = (container, step, cause) => new HostedStateBootstrapError({
+	container,
 	step,
 	reason: cause instanceof Error ? cause.message : String(cause)
 });
@@ -609,85 +906,30 @@ const migratePrismaState = (sql) => Effect.tryPromise({
 	},
 	catch: toStateStoreError
 });
-/**
-* The workspace's dedicated project for hosted deploy state. A project is
-* the closest expressible stand-in for "ambient platform infrastructure" —
-* PDP has no workspace-level database, and the app's own project is
-* circular (it doesn't exist before the first apply, and is itself tracked
-* in the state it would have to host).
-*/
-const STATE_PROJECT_NAME = "prisma-composer-state";
-/** Every connection this bootstrap mints carries this prefix — see `cleanupAgedConnections`. */
-const CONNECTION_NAME_PREFIX = "prisma-composer-state-";
 const CONNECTION_MAX_AGE_MS = 1440 * 60 * 1e3;
-const DEFAULT_DATABASE_POLL_ATTEMPTS = 5;
-const DEFAULT_DATABASE_POLL_DELAY = "500 millis";
-const listAllProjects = (client) => Effect.gen(function* () {
-	const projects = [];
-	let cursor;
-	for (;;) {
-		const query = cursor === void 0 ? {} : { cursor };
-		const page = yield* call(() => client.GET("/v1/projects", { params: { query } }));
-		projects.push(...page.data);
-		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
-		cursor = page.pagination.nextCursor;
-	}
-	return projects;
-});
 /**
-* Workspace ids circulate in two shapes: the API returns them `wksp_`-prefixed
-* (`wksp_abc…`), while tokens/config often carry the bare id (`abc…`) — the
-* API accepts both on writes. Comparing them raw silently never matches when
-* the shapes differ, which made bootstrap re-provision a fresh state project
-* on every run in CI. Compare bare-to-bare.
+* Creates the state database on the stage's Branch, using the flat endpoint
+* because it is the only one that accepts a `branchId`. The platform still
+* creates the row on the project's default Branch and attaches it afterwards,
+* so a failed attach can leave a database behind on the default Branch. It
+* checks the Branch exists before creating, and this is one request instead of
+* two, so that window is much narrower than attaching from here — but it is
+* narrowed, not closed.
+*
+* `isDefault` is left at the API's `false` default: the state database must
+* never be the stage's default database, which belongs to the user.
 */
-const bareWorkspaceId = (id) => id.startsWith("wksp_") ? id.slice(5) : id;
-/**
-* All projects named `prisma-composer-state` in the workspace — plural, because PDP
-* allows duplicate project names (verified 2026-07-09), so name-based
-* discovery can never assume there is at most one. See `resolveStateProject`
-* for how candidates get disambiguated.
-*/
-const listStateProjects = (client, workspaceId) => listAllProjects(client).pipe(Effect.map((projects) => projects.filter((p) => bareWorkspaceId(p.workspace.id) === bareWorkspaceId(workspaceId) && p.name === STATE_PROJECT_NAME)));
-const createStateProject = (client, workspaceId) => call(() => client.POST("/v1/projects", { body: {
-	name: STATE_PROJECT_NAME,
-	workspaceId
-} })).pipe(Effect.map((r) => r.data));
-const listAllDatabases = (client, projectId) => Effect.gen(function* () {
-	const databases = [];
-	let cursor;
-	for (;;) {
-		const query = cursor === void 0 ? {} : { cursor };
-		const page = yield* call(() => client.GET("/v1/projects/{projectId}/databases", { params: {
-			path: { projectId },
-			query
-		} }));
-		databases.push(...page.data);
-		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
-		cursor = page.pagination.nextCursor;
-	}
-	return databases;
-});
-/**
-* The project's default database — auto-provisioned at project creation.
-* Never create a database here: a project already has exactly one default,
-* and creating another 409s (FT-5220). Whether the default is listable in
-* the same tick as the project-create response is not a documented
-* contract, so a fresh project polls a few times with a short backoff
-* before giving up — the observed live behaviour is synchronous, but this
-* does not assume that holds on every run.
-*/
-const findDefaultDatabase = (client, projectId) => Effect.gen(function* () {
-	for (let attempt = 1; attempt <= DEFAULT_DATABASE_POLL_ATTEMPTS; attempt++) {
-		const found = (yield* listAllDatabases(client, projectId)).find((d) => d.isDefault);
-		if (found !== void 0) return found;
-		if (attempt < DEFAULT_DATABASE_POLL_ATTEMPTS) yield* Effect.sleep(DEFAULT_DATABASE_POLL_DELAY);
-	}
-	return yield* Effect.fail(new PrismaApiError({
-		status: 0,
-		message: `project ${projectId} (${STATE_PROJECT_NAME}) has no default database after ${DEFAULT_DATABASE_POLL_ATTEMPTS} attempts — it may still be provisioning; re-run the deploy.`
-	}));
-});
+const createStateDatabase = (client, projectId, branchId) => call(() => client.POST("/v1/databases", { body: {
+	projectId,
+	name: STATE_DATABASE_NAME,
+	region: "inherit",
+	branchId
+} })).pipe(Effect.map((created) => ({
+	id: created.data.id,
+	name: created.data.name,
+	isDefault: created.data.isDefault,
+	createdAt: created.data.createdAt
+})));
 const listAllConnections = (client, databaseId) => Effect.gen(function* () {
 	const connections = [];
 	let cursor;
@@ -705,43 +947,24 @@ const listAllConnections = (client, databaseId) => Effect.gen(function* () {
 });
 const deleteConnection = (client, connectionId) => callVoid(() => client.DELETE("/v1/connections/{id}", { params: { path: { id: connectionId } } }));
 /**
-* Every deploy mints a fresh connection (`mintConnection`) and nothing ever
-* closes it, so the store's default database otherwise accumulates one
-* connection resource per run without bound. Best-effort, never blocks
-* bootstrap: lists this database's connections, deletes the ones matching
-* our naming pattern older than the age threshold, and swallows any failure
-* (a transient API error here must never fail the deploy it's cleaning up
-* after).
+* Every deploy creates a fresh connection (`createConnection`) and nothing ever
+* closes it, so the state database otherwise accumulates one connection
+* resource per run without bound. Best-effort, never blocks bootstrap: lists
+* this database's connections, deletes the ones matching our naming pattern
+* older than the age threshold, and swallows any failure (a transient API
+* error here must never fail the deploy it's cleaning up after).
 */
 const cleanupAgedConnections = (client, databaseId) => Effect.gen(function* () {
 	const connections = yield* listAllConnections(client, databaseId);
 	const cutoff = Date.now() - CONNECTION_MAX_AGE_MS;
-	const aged = connections.filter((c) => c.name.startsWith(CONNECTION_NAME_PREFIX) && Date.parse(c.createdAt) < cutoff);
+	const aged = connections.filter((c) => c.name.startsWith("prisma-composer-state-") && Date.parse(c.createdAt) < cutoff);
 	yield* Effect.forEach(aged, (c) => deleteConnection(client, c.id), { discard: true });
 }).pipe(Effect.ignore);
 /**
-* Mints a fresh Postgres connection and reads the direct endpoint's DSN.
-* Never `endpoints.pooled`, the deprecated top-level `connectionString`/`url`
-* (PRO-212) — those are not guaranteed by the platform. The DSN is
-* write-only on read (a stored connection can't be re-read later), which is
-* exactly why a fresh connection is minted every run instead of reusing one.
-*/
-const mintConnection = (client, databaseId) => call(() => client.POST("/v1/databases/{databaseId}/connections", {
-	params: { path: { databaseId } },
-	body: { name: `${CONNECTION_NAME_PREFIX}${Date.now()}` }
-})).pipe(Effect.flatMap((r) => {
-	const created = r.data;
-	const dsn = created.endpoints.direct?.connectionString;
-	return dsn === void 0 ? Effect.fail(new PrismaApiError({
-		status: 0,
-		message: `connection ${created.id} returned no endpoints.direct.connectionString (PRO-212)`
-	})) : Effect.succeed(Redacted.make(dsn));
-}));
-/**
-* PDP allows duplicate project names, so a project named `prisma-composer-state`
+* PDP allows duplicate database names, so a database named `prisma-composer-state`
 * found by listing is not proof it's ours — it could be an unrelated
-* project that happens to share the name (a squatter, deliberate or not).
-* Connects to the candidate's default database and inspects its tables:
+* database that happens to share the name (a squatter, deliberate or not).
+* Connects to the candidate and inspects its tables:
 *
 * - our marker table with our marker row present → `ours`, adopt outright.
 * - our state tables (`alchemy_resource_state`/`alchemy_stack_output`) but no
@@ -749,7 +972,7 @@ const mintConnection = (client, databaseId) => call(() => client.POST("/v1/datab
 *   The real, currently-in-use workspace state is in this shape today, so it
 *   must keep working — adopt it, and `migratePrismaState` (idempotent)
 *   writes the marker on the way in.
-* - no tables at all → `empty`, a freshly-created default database — adopt.
+* - no tables at all → `empty`, a freshly-created database — adopt.
 * - anything else → `squatter`: foreign data occupies the name; refuse it.
 */
 const verifyOwnership = (connectionString) => Effect.tryPromise({
@@ -784,76 +1007,124 @@ const verifyOwnership = (connectionString) => Effect.tryPromise({
 	})
 });
 /**
-* Finds the workspace's `prisma-composer-state` project, verifying ownership rather
-* than trusting the name alone (PDP allows duplicate names — see
-* `verifyOwnership`). Zero candidates creates one: nothing to verify, since
-* only this run could possibly have touched the brand-new database between
-* create and here (`migratePrismaState` writes the marker once bootstrap
-* hands the connection off). One or more candidates are tried
-* oldest-`createdAt` first, deterministically, and the first that verifies
-* as ours (or adoptable legacy/empty) wins; a candidate that fails
-* verification is skipped, not fatal, unless every candidate fails, in
-* which case the failure names every rejected project id so an operator can
-* act on it.
-*/
-const resolveStateProject = (client, workspaceId, verify) => Effect.gen(function* () {
-	const candidates = yield* listStateProjects(client, workspaceId);
+* Finds the Branch's `prisma-composer-state` database, verifying ownership
+* rather than trusting the name alone (PDP allows duplicate names — see
+* `verifyOwnership`). Finding none creates one, with nothing to verify: only
+* this run can have touched a database it just created.
+*
+* Candidates are tried oldest first, so repeated runs pick the same one. The
+* first that verifies as ours is used. A candidate that fails verification is
+* skipped. If every candidate fails, bootstrap fails and names each rejected
+* database id, so an operator knows which to rename or remove.
+*/
+const resolveStateDatabase = (client, projectId, branchId, verify) => Effect.gen(function* () {
+	const candidates = yield* listStateDatabaseCandidates(client, projectId, branchId);
 	if (candidates.length === 0) {
-		const project = yield* createStateProject(client, workspaceId);
-		const database = yield* findDefaultDatabase(client, project.id);
-		const connectionString = yield* mintConnection(client, database.id);
-		console.error(`hosted state: provisioned new state project ${project.id} (db ${database.id}) in workspace ${workspaceId}`);
+		const database = yield* createStateDatabase(client, projectId, branchId);
+		const connectionString = yield* createConnection(client, database.id);
+		console.error(`hosted state: provisioned state database ${database.id} on branch ${branchId} (project ${projectId})`);
 		return {
-			project,
 			database,
 			connectionString
 		};
 	}
-	const sorted = [...candidates].sort((a, b) => a.createdAt.localeCompare(b.createdAt));
 	const rejected = [];
-	for (const candidate of sorted) {
-		const database = yield* findDefaultDatabase(client, candidate.id);
-		const connectionString = yield* mintConnection(client, database.id);
+	for (const candidate of candidates) {
+		const connectionString = yield* createConnection(client, candidate.id);
 		const verdict = yield* verify(connectionString);
 		if (verdict.kind === "squatter") {
-			rejected.push(`${candidate.id} (foreign tables: ${verdict.tables.join(", ") || "none named"})`);
+			rejected.push(`${candidate.id} (foreign tables: ${verdict.tables.join(", ")})`);
 			continue;
 		}
-		console.error(`hosted state: using state project ${candidate.id} (db ${database.id}, ${verdict.kind}) — ${sorted.length} candidate(s) named ${STATE_PROJECT_NAME} in workspace ${workspaceId}`);
+		console.error(`hosted state: using state database ${candidate.id} on branch ${branchId} (${verdict.kind}) — ${candidates.length} candidate(s) named ${STATE_DATABASE_NAME}`);
 		return {
-			project: candidate,
-			database,
+			database: candidate,
 			connectionString
 		};
 	}
 	return yield* Effect.fail(new PrismaApiError({
 		status: 0,
-		message: `found ${sorted.length} project(s) named "${STATE_PROJECT_NAME}" in workspace ${workspaceId}, but none verified as Prisma App's state store: ${rejected.join("; ")}. The name is squatted by unrelated data — rename or remove the offending project(s), or see platform-ask.md (reserved/unique state project names).`
+		message: `found ${candidates.length} database(s) named "${STATE_DATABASE_NAME}" on branch ${branchId}, but none verified as Composer's state store: ${rejected.join("; ")}. Rename or remove the offending database(s).`
 	}));
 });
 /**
-* Find-or-create the workspace's `prisma-composer-state` project, resolve its
-* default database, and mint a fresh connection — the automatic bootstrap
-* every deploy runs once, needing nothing beyond the service token and
-* workspace id a deployer already has.
+* Resolves the stage's Branch, find-or-creates its `prisma-composer-state`
+* database, and creates a fresh connection — the automatic bootstrap every
+* deploy runs once, needing nothing beyond the service token and the
+* Project/Branch ids the CLI already resolved.
 */
-const bootstrapStateConnection = (workspaceId) => bootstrapStateConnectionWith(workspaceId, verifyOwnership);
+const bootstrapStateConnection = (container) => bootstrapStateConnectionWith(container, verifyOwnership);
 /**
-* Test seam: identical to {@link bootstrapStateConnection} but with the
-* ownership verifier injectable, so `bootstrap.test.ts` can stub ownership
-* decisions against its fake DSNs without opening a real Postgres
-* connection to them.
+* Identical to {@link bootstrapStateConnection}, except the ownership check is
+* a parameter so `bootstrap.test.ts` can supply a fake instead of opening a
+* real Postgres connection.
 */
-const bootstrapStateConnectionWith = (workspaceId, verify) => Effect.gen(function* () {
+const bootstrapStateConnectionWith = (container, verify) => Effect.gen(function* () {
 	const client = yield* ManagementClient;
-	const { project, database, connectionString } = yield* resolveStateProject(client, workspaceId, verify);
+	const branchId = yield* resolveBranchId(client, container);
+	const { database, connectionString } = yield* resolveStateDatabase(client, container.projectId, branchId, verify);
 	yield* cleanupAgedConnections(client, database.id);
 	return {
-		projectId: project.id,
+		projectId: container.projectId,
 		databaseId: database.id,
 		connectionString
 	};
 });
+const deleteDatabase = (client, databaseId) => callVoid(() => client.DELETE("/v1/databases/{databaseId}", { params: { path: { databaseId } } }));
+/**
+* Identical to {@link deleteStateDatabase}, except the ownership check is a
+* parameter so tests can supply a fake instead of opening a real Postgres
+* connection.
+*/
+const deleteStateDatabaseWith = (container, verify) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	const branchId = yield* resolveBranchId(client, container);
+	const candidates = yield* listStateDatabaseCandidates(client, container.projectId, branchId);
+	for (const candidate of candidates) {
+		const verdict = yield* verify(yield* createConnection(client, candidate.id));
+		if (verdict.kind === "squatter") {
+			console.warn(`hosted state: left database ${candidate.id} on branch ${branchId} alone — it is named ${STATE_DATABASE_NAME} but holds unrelated data (tables: ${verdict.tables.join(", ")}).`);
+			continue;
+		}
+		yield* deleteDatabase(client, candidate.id);
+		console.error(`hosted state: removed state database ${candidate.id} from branch ${branchId}`);
+	}
+});
+/** Codes for "can't reach the host yet" — DNS/refusal, not a mid-session drop. */
+const ESTABLISHMENT_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ENOTFOUND",
+	"EAI_AGAIN"
+]);
+/** Connection-establishment failure messages (no useful `err.code`). `upstream database` is PPg's edge proxy while a cold/idle upstream warms up. */
+const ESTABLISHMENT_MESSAGE_FRAGMENTS = ["upstream database", "connection refused"];
+/**
+* Whether a failure is a connection-establishment error against a warming
+* upstream (retry), as opposed to a lost lease, a mid-session drop, or a real
+* query error (all of which must surface at once). Unwraps a
+* {@link StateStoreError} to its driver `cause` so a code-only error still
+* classifies.
+*/
+const isColdStartConnectError = (error) => {
+	if (typeof error !== "object" || error === null) return false;
+	const code = "code" in error && typeof error.code === "string" ? error.code : void 0;
+	if (code !== void 0 && ESTABLISHMENT_CODES.has(code)) return true;
+	const message = "message" in error && typeof error.message === "string" ? error.message.toLowerCase() : "";
+	if (ESTABLISHMENT_MESSAGE_FRAGMENTS.some((fragment) => message.includes(fragment))) return true;
+	const cause = "cause" in error ? error.cause : void 0;
+	return cause !== void 0 && cause !== error && isColdStartConnectError(cause);
+};
+/** The same ~2-minute budget the bootstrap migration uses (`layer.ts`): retry every 5s, up to 2 minutes. */
+const COLD_START_SCHEDULE = Schedule.both(Schedule.spaced("5 seconds"), Schedule.during("2 minutes"));
+/**
+* Retries a state operation past a cold-start connection rejection only; every
+* other failure surfaces immediately. `schedule` is injectable so tests drive
+* it without real delay.
+*/
+const retryColdStart = (operation, schedule = COLD_START_SCHEDULE) => Effect.retry(operation, {
+	while: isColdStartConnectError,
+	schedule
+});
 /** Another deploy already holds the lock for this stack/stage. Never queued — fails immediately. */
 var StateLockContentionError = class extends Data.TaggedError("StateLockContentionError") {
 	get message() {
@@ -894,22 +1165,22 @@ const acquireStateLock = (sql, stack, stage) => Effect.gen(function* () {
 		}));
 	}
 	const lockPid = acquired.pid;
-	const checkLive = Effect.tryPromise({
+	const checkLive = retryColdStart(Effect.tryPromise({
 		try: async () => {
 			return (await sql`
-          select exists (
-            select 1 from pg_locks
-            where locktype = 'advisory'
-              and pid = ${lockPid}
-              and objsubid = 1
-              and granted
-              and ((classid::bigint << 32) | (objid::bigint & 4294967295))
-                = hashtextextended(${key}, 0)
-          ) as live
-        `)[0]?.live ?? false;
+            select exists (
+              select 1 from pg_locks
+              where locktype = 'advisory'
+                and pid = ${lockPid}
+                and objsubid = 1
+                and granted
+                and ((classid::bigint << 32) | (objid::bigint & 4294967295))
+                  = hashtextextended(${key}, 0)
+            ) as live
+          `)[0]?.live ?? false;
 		},
 		catch: toStateStoreError
-	}).pipe(Effect.flatMap((live) => live ? Effect.void : Effect.fail(new StateStoreError({ message: `the state lock for ${stack}/${stage} was lost mid-run; refusing to continue unlocked` }))));
+	}).pipe(Effect.flatMap((live) => live ? Effect.void : Effect.fail(new StateStoreError({ message: `the state lock for ${stack}/${stage} was lost mid-run; refusing to continue unlocked` })))));
 	const release = async () => {
 		try {
 			await reserved`select pg_advisory_unlock(hashtextextended(${key}, 0))`;
@@ -922,10 +1193,10 @@ const acquireStateLock = (sql, stack, stage) => Effect.gen(function* () {
 		release
 	};
 });
-const attempt = (f) => Effect.tryPromise({
+const attempt = (f) => retryColdStart(Effect.tryPromise({
 	try: f,
 	catch: toStateStoreError
-});
+}));
 /**
 * Wraps an already-`encodeState`d value as a jsonb-typed bind parameter.
 * Must go through `sql.json(...)` (not `JSON.stringify(...)::jsonb`) —
@@ -1093,29 +1364,32 @@ const guardStateService = (service, checkLive, now = Date.now) => {
 };
 /**
 * The hosted Alchemy state store. On layer init (scoped, once per stack
-* run): find-or-create the workspace's `prisma-composer-state` project, mint a
-* fresh connection to its default database, migrate the schema, and
-* acquire the (stack, stage) advisory lock — see `bootstrap.ts` and
-* `lock.ts`. The Management API plumbing (`ManagementClient`,
-* `PrismaCredentials`) is provided internally, so the returned layer's
-* only requirements are the ones alchemy itself already provides to every
-* state store (`StackServices`).
+* run): resolve the stage's Branch, find-or-create its `prisma-composer-state`
+* database, create a fresh connection, migrate the schema, and acquire the
+* (stack, stage) advisory lock — see `bootstrap.ts` and `lock.ts`. The
+* Management API plumbing (`ManagementClient`, `PrismaCredentials`) is
+* provided internally, so the returned layer's only requirements are the
+* ones alchemy itself already provides to every state store
+* (`StackServices`).
 *
 * Any bootstrap/lock/migration failure is wrapped into an operator-facing
-* `HostedStateBootstrapError` (naming the workspace and the step that
+* `HostedStateBootstrapError` (naming the Project/Branch and the step that
 * failed, never the raw driver/API error — see `errors.ts`) before dying the
 * layer (loud, immediate, unrecoverable) rather than surfacing as a typed
 * error — matching core's `LowerOptions.state: Layer.Layer<State, never,
 * StackServices>` contract and alchemy's own convention (e.g. a missing
 * state store is `Effect.die` in `Stack.make`).
 */
-const prismaState = (opts = {}) => {
-	const workspaceId = opts.workspaceId ?? process.env["PRISMA_WORKSPACE_ID"];
-	if (workspaceId === void 0 || workspaceId.length === 0) throw new Error("prismaState(): environment variable PRISMA_WORKSPACE_ID is required.");
+const prismaStateLayer = (ids) => {
+	const { projectId, branchId } = ids;
 	return Layer.effect(State, Effect.gen(function* () {
 		const stack = yield* Stack;
-		const bootstrapError = (step) => (cause) => hostedStateBootstrapError(workspaceId, step, cause);
-		const { connectionString } = yield* bootstrapStateConnection(workspaceId).pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))), Effect.mapError(bootstrapError("finding/creating the prisma-composer-state project")));
+		const container = branchId === void 0 ? projectId : `${projectId}/${branchId}`;
+		const bootstrapError = (step) => (cause) => hostedStateBootstrapError(container, step, cause);
+		const { connectionString } = yield* bootstrapStateConnection(branchId === void 0 ? { projectId } : {
+			projectId,
+			branchId
+		}).pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))), Effect.mapError(bootstrapError("resolving the state database on the stage branch")));
 		const sql = postgres(Redacted.value(connectionString), {
 			max: 5,
 			onnotice: () => {}
@@ -1130,41 +1404,262 @@ const prismaState = (opts = {}) => {
 };
 //#endregion
 //#region ../../1-prisma-cloud/1-extensions/target/dist/control.mjs
+const PRISMA_CLOUD_EXTENSION_ID = "@prisma/composer-prisma-cloud";
+var PrismaCloudContainer = class {
+	input;
+	projectId;
+	branchId;
+	constructor(input, projectId, branchId) {
+		this.input = input;
+		this.projectId = projectId;
+		this.branchId = branchId;
+	}
+	serialize() {
+		return JSON.stringify({
+			input: this.input,
+			projectId: this.projectId,
+			...this.branchId !== void 0 ? { branchId: this.branchId } : {}
+		});
+	}
+};
+/** `instanceof` — parent-side instances and child-side deserialized instances are both constructed by this module. */
+function isPrismaCloudContainer(value) {
+	return value instanceof PrismaCloudContainer;
+}
+/** Narrow-or-throw for hook inputs. */
+function prismaCloudContainerOf(value) {
+	if (!isPrismaCloudContainer(value)) throw new Error("the Prisma Cloud container was not resolved — the extension's container descriptor did not run.");
+	return value;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function invalidPayloadError(reason) {
+	return /* @__PURE__ */ new Error(`${PRISMA_CLOUD_EXTENSION_ID}: invalid container transport payload — ${reason}.`);
+}
+/** Reconstructs a `PrismaCloudContainer` from `serialize()`'s JSON output — real narrowing, no casts. */
+function deserialize(serialized) {
+	let parsed;
+	try {
+		parsed = JSON.parse(serialized);
+	} catch (error) {
+		throw invalidPayloadError(`not valid JSON (${error instanceof Error ? error.message : String(error)})`);
+	}
+	if (!isRecord(parsed)) throw invalidPayloadError("not an object");
+	const input = parsed["input"];
+	if (!isRecord(input)) throw invalidPayloadError("\"input\" is not an object");
+	const appName = input["appName"];
+	if (typeof appName !== "string") throw invalidPayloadError("\"input.appName\" is not a string");
+	const stage = input["stage"];
+	if (stage !== void 0 && typeof stage !== "string") throw invalidPayloadError("\"input.stage\" is not a string or absent");
+	const projectId = parsed["projectId"];
+	if (typeof projectId !== "string") throw invalidPayloadError("\"projectId\" is not a string");
+	const branchId = parsed["branchId"];
+	if (branchId !== void 0 && typeof branchId !== "string") throw invalidPayloadError("\"branchId\" is not a string or absent");
+	return new PrismaCloudContainer({
+		appName,
+		stage
+	}, projectId, branchId);
+}
+const workspaceRequiredError = () => /* @__PURE__ */ new Error("environment variable PRISMA_WORKSPACE_ID is required.");
+const tokenRequiredError$2 = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required.");
+function requireWorkspaceId() {
+	const workspaceId = process.env["PRISMA_WORKSPACE_ID"];
+	if (workspaceId === void 0 || workspaceId.length === 0) throw workspaceRequiredError();
+	return workspaceId;
+}
+function requireTokenUnlessInjected(deps) {
+	if (deps?.client === void 0 && (process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw tokenRequiredError$2();
+}
+async function ensureContainer(input, deps) {
+	const workspaceId = requireWorkspaceId();
+	requireTokenUnlessInjected(deps);
+	const program = resolveContainer({
+		workspaceId,
+		appName: input.appName,
+		...input.stage !== void 0 ? { stage: input.stage } : {},
+		ensure: true
+	}).pipe(Effect.map((c) => ({
+		ok: true,
+		container: c
+	})), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
+		ok: false,
+		message: `Prisma Management API error resolving containers: ${e.message}.`
+	})));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (!outcome.ok) throw new Error(outcome.message);
+	return new PrismaCloudContainer(input, outcome.container.projectId, outcome.container.branchId);
+}
+async function locateContainer(input, deps) {
+	const workspaceId = requireWorkspaceId();
+	requireTokenUnlessInjected(deps);
+	const program = resolveContainer({
+		workspaceId,
+		appName: input.appName,
+		...input.stage !== void 0 ? { stage: input.stage } : {},
+		ensure: false
+	}).pipe(Effect.map((c) => ({
+		ok: true,
+		container: c
+	})), Effect.catchTag("ContainerNotFoundError", () => Effect.succeed({ ok: false })), Effect.catchTag("PrismaApiError", (e) => Effect.fail(/* @__PURE__ */ new Error(`Prisma Management API error resolving containers: ${e.message}.`))));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (!outcome.ok) return void 0;
+	return new PrismaCloudContainer(input, outcome.container.projectId, outcome.container.branchId);
+}
+/**
+* Soft-deletes a named stage's Branch after a successful `alchemy destroy`
+* has removed its members — the Management API refuses to delete a Branch
+* that still has live members.
+*/
+async function removeStageBranch(branchId, deps) {
+	requireTokenUnlessInjected(deps);
+	const program = deleteBranch(branchId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
+		ok: false,
+		message: `Failed to delete the stage Branch: ${e.message}.`
+	})));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (!outcome.ok) throw new Error(outcome.message);
+}
+/**
+* Best-effort cleanup after a successful `--production` destroy: removes
+* the app's Project so hand-run stacks don't accumulate as empty Projects
+* (they eventually hit the workspace's plan limit). Unlike `removeStageBranch`,
+* this never throws: the destroy itself already succeeded, and the API's own
+* 400 ("still has dependencies") is the only check that matters — failing
+* the command over a cleanup step would be worse than leaving a Project shell.
+*/
+async function removeAppProject(projectId, deps) {
+	if (deps?.client === void 0 && (process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) {
+		console.warn(`Skipped removing the Project (${projectId}): PRISMA_SERVICE_TOKEN is not set.`);
+		return;
+	}
+	const program = deleteProject(projectId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
+		ok: false,
+		error: e
+	})));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (outcome.ok) {
+		console.log(`Removed the Project (${projectId}) — nothing was left in it.`);
+		return;
+	}
+	if (outcome.error.status === 400) {
+		console.log(`Kept the Project (${projectId}) — it still has another stage's resources.`);
+		return;
+	}
+	console.warn(`Could not remove the Project (${projectId}) after destroy: ${outcome.error.message}.`);
+}
+function containerDescriptor(deps) {
+	return {
+		ensure: (input) => ensureContainer(input, deps),
+		locate: (input) => locateContainer(input, deps),
+		remove: (instance) => instance.input.stage !== void 0 ? removeStageBranch(instance.branchId ?? missingBranchId(instance), deps) : removeAppProject(instance.projectId, deps),
+		deserialize
+	};
+}
+/** Defensive: a named-stage container always resolves a Branch together with its stage — `ensure`/`locate`/`deserialize` never produce one without the other. */
+function missingBranchId(instance) {
+	throw new Error(`${PRISMA_CLOUD_EXTENSION_ID}: a named-stage ("${instance.input.stage}") container instance is missing its branchId — this is a bug in ensure/locate/deserialize.`);
+}
 const PRISMA_NAME_MIN = 3;
 const PRISMA_NAME_MAX = 65;
 function validateName(value, source) {
 	if (value.length < PRISMA_NAME_MIN || value.length > PRISMA_NAME_MAX) throw new Error(`prisma-cloud: ${source} "${value}" (${value.length} characters) is not a valid Prisma resource name — Prisma requires ${PRISMA_NAME_MIN}–${PRISMA_NAME_MAX} characters. Rename the provision id (or the deploy --name) to fit.`);
 }
-/** The application/provisioned hook's `projectId` output — `LoweredNode.outputs` is typed `unknown`, so this is the one asserted read. */
-const projectIdOf = (hook) => blindCast(hook.outputs["projectId"]);
+function isCloudApplication(value) {
+	return typeof value === "object" && value !== null && "projectId" in value && typeof value.projectId === "string" && "branchId" in value && (value.branchId === void 0 || typeof value.branchId === "string");
+}
+/** Narrows `ctx.application`, which core hands over as `unknown`, to this extension's own product; throws naming the hook when it hasn't run. */
+function cloudApplicationOf(application) {
+	if (!isCloudApplication(application)) throw new Error("prisma-cloud: ctx.application is not this extension's application product — the prismaCloud() application hook must run before any node lowers.");
+	return application;
+}
+function projectIdOf(application) {
+	return cloudApplicationOf(application).projectId;
+}
+/**
+* One Bucket per module-provisioned bucket resource — `id` is the module
+* provision id, so a resource shared by several consumers is created exactly
+* once. A BucketKey is minted for the bucket: it is the reveal-once credential
+* carrier, and its attributes (endpoint, bucketName, accessKeyId,
+* secretAccessKey) become the four S3Config outputs consumers resolve by name.
+*/
+function bucketDescriptor(_o) {
+	const lowering = ({ id, application }) => Effect.gen(function* () {
+		validateName(id, "resource name (from provision id)");
+		const branchId = cloudApplicationOf(application).branchId;
+		const bkt = yield* Bucket(`${id}-bucket`, {
+			projectId: projectIdOf(application),
+			name: id,
+			...branchId !== void 0 ? { branchId } : {}
+		});
+		const key = yield* BucketKey(`${id}-key`, {
+			bucketId: bkt.id,
+			name: id,
+			role: "read_write"
+		});
+		const secretAccessKey = Output.map(key.secretAccessKey, (v) => Redacted.value(v));
+		return {
+			outputs: {
+				url: key.endpoint,
+				bucket: key.bucketName,
+				accessKeyId: key.accessKeyId,
+				secretAccessKey
+			},
+			entities: [{
+				kind: "bucket",
+				id: bkt.id
+			}]
+		};
+	});
+	return Object.assign(lowering, { kind: "resource" });
+}
+/** The `compute` node kind's descriptor: the four service hooks — provision, serialize, package, deploy. */
+/**
+* Returns the PRECISE descriptor type, not the erased `NodeDescriptor`: the
+* registry in control.ts erases it on assignment anyway (method bivariance),
+* but s3-store composes over these hooks and needs their P/S to stay visible.
+* Annotating this `NodeDescriptor` would force s3-store to cast them back.
+*/
 function computeDescriptor(o) {
 	return {
 		kind: "service",
 		provision: ({ id, application }) => Effect.gen(function* () {
 			validateName(id, "service name (from provision id)");
-			return { outputs: {
-				serviceId: (yield* ComputeService(`${id}-svc`, {
-					projectId: projectIdOf(application),
-					name: id,
-					region: o.region ?? "us-east-1",
-					...o.branchId !== void 0 ? { branchId: o.branchId } : {}
-				})).id,
-				projectId: application.outputs["projectId"]
-			} };
+			const projectId = projectIdOf(application);
+			const branchId = cloudApplicationOf(application).branchId;
+			const svc = yield* ComputeService(`${id}-svc`, {
+				projectId,
+				name: id,
+				region: o.region ?? "us-east-1",
+				...branchId !== void 0 ? { branchId } : {}
+			});
+			return {
+				serviceId: svc.id,
+				projectId,
+				endpointDomain: svc.endpointDomain
+			};
 		}),
-		serialize: ({ address, node, graph }, provisioned, config) => Effect.gen(function* () {
-			const cls = o.branchId ? "preview" : "production";
-			const branch = o.branchId !== void 0 ? { branchId: o.branchId } : {};
-			const projectId = projectIdOf(provisioned);
+		serialize: (ctx, provisioned, config) => Effect.gen(function* () {
+			const { address, node, graph } = ctx;
+			const branchId = cloudApplicationOf(ctx.application).branchId;
+			const cls = branchId ? "preview" : "production";
+			const branch = branchId !== void 0 ? { branchId } : {};
+			const projectId = provisioned.projectId;
 			const svc = node;
 			const records = [];
 			for (const d of paramEntries(svc)) {
 				const value = d.owner === "service" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];
+				if (value === void 0) continue;
 				const key = configKey(address, d);
+				const rowValue = d.owner === "service" && isParamSource(value) ? encodeParamPointer(paramName(paramBindingFor(graph.params, address, d.name))) : encode(d.owner, value);
 				records.push(yield* EnvironmentVariable(`${key}-var`, {
 					projectId,
 					key,
-					value: encode(d.owner, value),
+					value: rowValue,
 					class: cls,
 					...branch
 				}));
@@ -1176,10 +1671,36 @@ function computeDescriptor(o) {
 				class: cls,
 				...branch
 			}));
-			return { outputs: {
+			const exposes = svc.expose !== void 0 && Object.keys(svc.expose).length > 0;
+			const refsByBrand = /* @__PURE__ */ new Map();
+			if (exposes) for (const edge of provisionedEdges(graph)) {
+				if (edge.providerAddress !== address) continue;
+				const ref = ctx.provisioned.get(edge.edgeId);
+				if (ref === void 0) continue;
+				const refs = refsByBrand.get(edge.brand) ?? [];
+				refs.push(ref);
+				refsByBrand.set(edge.brand, refs);
+			}
+			for (const [brand, entry] of o.providerParams) {
+				const raw = "valueForService" in entry ? entry.valueForService(provisioned, address) : exposes ? entry.value(refsByBrand.get(brand) ?? []) : void 0;
+				if (raw === void 0) continue;
+				const key = configKey(address, {
+					owner: "service",
+					name: entry.name
+				});
+				const value = Output.isOutput(raw) ? Output.map(raw, (v) => encode("service", v)) : encode("service", raw);
+				records.push(yield* EnvironmentVariable(`${key}-var`, {
+					projectId,
+					key,
+					value,
+					class: cls,
+					...branch
+				}));
+			}
+			return {
 				environment: records,
 				port: typeof config.service["port"] === "number" ? config.service["port"] : 3e3
-			} };
+			};
 		}),
 		package: ({ id }, { assembled, address }) => Effect.try(() => packageComputeArtifact({
 			id,
@@ -1188,16 +1709,24 @@ function computeDescriptor(o) {
 			address
 		})),
 		deploy: ({ id }, provisioned, artifact, serialized) => Effect.gen(function* () {
-			return { outputs: {
-				url: (yield* Deployment(`${id}-deploy`, {
-					computeServiceId: provisioned.outputs["serviceId"],
-					artifactPath: artifact.path,
-					artifactHash: artifact.sha256,
-					environment: serialized.outputs["environment"],
-					port: typeof serialized.outputs["port"] === "number" ? serialized.outputs["port"] : 3e3
-				})).deployedUrl,
-				projectId: provisioned.outputs["projectId"]
-			} };
+			const deployment = yield* Deployment(`${id}-deploy`, {
+				computeServiceId: provisioned.serviceId,
+				artifactPath: artifact.path,
+				artifactHash: artifact.sha256,
+				environment: serialized.environment,
+				port: serialized.port
+			});
+			return {
+				outputs: {
+					url: deployment.deployedUrl,
+					projectId: provisioned.projectId
+				},
+				entities: [{
+					kind: "compute-service",
+					id: provisioned.serviceId,
+					url: deployment.deployedUrl
+				}]
+			};
 		})
 	};
 }
@@ -1257,18 +1786,25 @@ const PgWarmProvider = () => Provider.effect(PgWarm, Effect.succeed(pgWarmProvid
 function postgresDescriptor(o) {
 	const lowering = ({ id, application }) => Effect.gen(function* () {
 		validateName(id, "resource name (from provision id)");
+		const branchId = cloudApplicationOf(application).branchId;
 		const db = yield* Database(`${id}-db`, {
 			projectId: projectIdOf(application),
 			name: id,
 			region: o.region ?? "us-east-1",
-			...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+			...branchId !== void 0 ? { branchId } : {}
 		});
 		const conn = yield* Connection(`${id}-conn`, {
 			databaseId: db.id,
 			name: id
 		});
 		const url = Output.map(conn.connectionString, (value) => Redacted.value(value));
-		return { outputs: { url: (yield* PgWarm(`${id}-warm`, { url })).url } };
+		return {
+			outputs: { url: (yield* PgWarm(`${id}-warm`, { url })).url },
+			entities: [{
+				kind: "postgres-database",
+				id: db.id
+			}]
+		};
 	});
 	return Object.assign(lowering, { kind: "resource" });
 }
@@ -1519,11 +2055,12 @@ const PnMigrationProvider = () => Provider.effect(PnMigration, Effect.succeed(pn
 function prismaNextDescriptor(o) {
 	const lowering = ({ id, node, application }) => Effect.gen(function* () {
 		validateName(id, "resource name (from provision id)");
+		const branchId = cloudApplicationOf(application).branchId;
 		const db = yield* Database(`${id}-db`, {
 			projectId: projectIdOf(application),
 			name: id,
 			region: o.region ?? "us-east-1",
-			...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+			...branchId !== void 0 ? { branchId } : {}
 		});
 		const conn = yield* Connection(`${id}-conn`, {
 			databaseId: db.id,
@@ -1543,7 +2080,13 @@ function prismaNextDescriptor(o) {
 			invariants: [...ref.invariants].sort(),
 			...node.targetRef !== void 0 ? { refName: node.targetRef } : {}
 		});
-		return { outputs: { url: warm.url } };
+		return {
+			outputs: { url: warm.url },
+			entities: [{
+				kind: "postgres-database",
+				id: db.id
+			}]
+		};
 	});
 	return Object.assign(lowering, { kind: "resource" });
 }
@@ -1599,16 +2142,18 @@ const S3CredentialsProvider = () => Provider.effect(S3Credentials, Effect.succee
 function s3CredentialsDescriptor(_o) {
 	const lowering = ({ id }) => Effect.gen(function* () {
 		const creds = yield* S3Credentials(`${id}-creds`, {});
-		return { outputs: {
-			accessKeyId: creds.accessKeyId,
-			secretAccessKey: creds.secretAccessKey
-		} };
+		return {
+			outputs: {
+				accessKeyId: creds.accessKeyId,
+				secretAccessKey: creds.secretAccessKey
+			},
+			entities: []
+		};
 	});
 	return Object.assign(lowering, { kind: "resource" });
 }
 function s3StoreDescriptor(o) {
 	const base = computeDescriptor(o);
-	if (base.kind !== "service") throw new Error("computeDescriptor must be a service descriptor");
 	return {
 		kind: "service",
 		provision: base.provision,
@@ -1618,27 +2163,33 @@ function s3StoreDescriptor(o) {
 			const credentials = config.inputs["credentials"] ?? {};
 			const bucket = config.service["bucket"];
 			if (credentials["accessKeyId"] === void 0 || credentials["secretAccessKey"] === void 0 || bucket === void 0) throw new Error("s3-store service must wire a 'credentials' dependency and a 'bucket' param");
-			return { outputs: {
-				...serialized.outputs,
+			return {
+				...serialized,
 				bucket,
 				accessKeyId: credentials["accessKeyId"],
 				secretAccessKey: credentials["secretAccessKey"]
-			} };
+			};
 		}),
 		deploy: (ctx, provisioned, artifact, serialized) => Effect.gen(function* () {
-			return { outputs: {
-				...(yield* base.deploy(ctx, provisioned, artifact, serialized)).outputs,
-				bucket: serialized.outputs["bucket"],
-				accessKeyId: serialized.outputs["accessKeyId"],
-				secretAccessKey: serialized.outputs["secretAccessKey"]
-			} };
+			const deployed = yield* base.deploy(ctx, provisioned, artifact, serialized);
+			return {
+				...deployed,
+				outputs: {
+					...deployed.outputs,
+					bucket: serialized.bucket,
+					accessKeyId: serialized.accessKeyId,
+					secretAccessKey: serialized.secretAccessKey
+				}
+			};
 		})
 	};
 }
 /**
-* Deploy preflight (ADR-0029): before Alchemy runs, verify every secret binding
-* in the app's provision manifest (each a platform env-var NAME) exists on Prisma
-* Cloud for the target stage.
+* Deploy preflight (ADR-0029, extended for env-sourced params): before Alchemy
+* runs, verify every secret binding AND every env-sourced param binding in the
+* app's manifests (each a platform env-var NAME) exists on Prisma Cloud for
+* the target stage. A literal-bound param never touches the platform — only
+* `envParam(...)` sources are checked here.
 * A name absent on the platform but present in the deploy shell is provisioned
 * via a direct Management API POST — NEVER an Alchemy resource, so the value
 * never lands in hosted deploy state. A name absent from both fails the deploy,
@@ -1646,7 +2197,7 @@ function s3StoreDescriptor(o) {
 *
 * Control-plane only (imported by control.ts → prisma-composer.config.ts); runs
 * in the CLI parent, so it builds its own Management API client from env — the
-* same credential path `ensureContainers` uses.
+* same credential path `container.ts`'s `ensure`/`locate` use.
 */
 /** production for the default stage; preview for a named stage — matching how the pack writes config rows. */
 const classFor = (branchId) => branchId === void 0 ? "production" : "preview";
@@ -1689,59 +2240,202 @@ async function existsOnPlatform(client, projectId, branchId, key) {
 * EnvironmentVariable.ts). A 409 means a concurrent deploy already provisioned
 * it — tolerated. The value is never logged.
 */
-async function fillMissing(client, input, key, value) {
+async function fillMissing(client, projectId, branchId, key, value) {
 	const res = await client.POST("/v1/environment-variables", { body: {
-		projectId: input.projectId,
-		class: classFor(input.branchId),
+		projectId,
+		class: classFor(branchId),
 		key,
 		value,
-		...input.branchId !== void 0 ? { branchId: input.branchId } : {}
+		...branchId !== void 0 ? { branchId } : {}
 	} });
 	if (res.error !== void 0 && res.response.status !== 409) throw fillFailedError(key, res.error);
 }
-const tokenRequiredError = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required for deploy preflight.");
+const tokenRequiredError$1 = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required for deploy preflight.");
 const listFailedError = (key, error) => /* @__PURE__ */ new Error(`deploy preflight: Prisma Management API error listing "${key}": ${JSON.stringify(error)}.`);
 const fillFailedError = (key, error) => /* @__PURE__ */ new Error(`deploy preflight: failed to provision "${key}" from the deploy shell: ${JSON.stringify(error)}.`);
-function missingError(missing, input) {
-	const scope = input.branchId === void 0 ? "the production class (project-level template)" : `the preview class of stage "${input.stage ?? input.branchId}" (branch override or template)`;
+function missingError(missing, branchId, stage) {
+	const scope = branchId === void 0 ? "the production class (project-level template)" : `the preview class of stage "${stage ?? branchId}" (branch override or template)`;
 	const lines = missing.map((m) => `  - ${m.name}  (required by service "${m.serviceAddress}")`);
-	return /* @__PURE__ */ new Error(`Deploy preflight failed — ${missing.length} secret env var(s) are not provisioned on Prisma Cloud for ${scope}, and are absent from the deploy shell:\n${lines.join("\n")}\n\nSet each in the deploy shell environment (the CLI will provision it on deploy), or create it on the platform (Prisma Console or the Management API) in ${scope}.`);
+	return /* @__PURE__ */ new Error(`Deploy preflight failed — ${missing.length} env var(s) (secret or env-sourced param) are not provisioned on Prisma Cloud for ${scope}, and are absent from the deploy shell:\n${lines.join("\n")}\n\nSet each in the deploy shell environment (the CLI will provision it on deploy), or create it on the platform (Prisma Console or the Management API) in ${scope}.`);
 }
-async function managementClient() {
-	if ((process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw tokenRequiredError();
+async function managementClient$1() {
+	if ((process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw tokenRequiredError$1();
 	return Effect.runPromise(Effect.gen(function* () {
 		return yield* ManagementClient;
 	}).pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv())))));
 }
 /**
 * The Prisma Cloud extension's `preflight`. Aggregates the target-agnostic
-* manifest (core's `provisionManifest`), checks each pointer secret against the
+* manifests (core's `provisionManifest` for secrets, `paramManifest` filtered
+* to env-sourced bindings for params), checks each pointer name against the
 * platform, fills from the shell where possible, and fails loudly on anything
 * absent from both. Accepts an injected client for tests; otherwise builds one
 * from env.
 */
 async function runPreflight(input, deps) {
-	const manifest = provisionManifest(input.graph);
-	if (manifest.length === 0) return;
+	const { projectId, branchId } = prismaCloudContainerOf(input.container);
 	const names = /* @__PURE__ */ new Map();
-	for (const binding of manifest) if (!names.has(secretName(binding))) names.set(secretName(binding), {
-		name: secretName(binding),
-		serviceAddress: binding.serviceAddress
-	});
-	const client = deps?.client ?? await managementClient();
+	for (const binding of provisionManifest(input.graph)) {
+		const name = secretName(binding);
+		if (!names.has(name)) names.set(name, {
+			name,
+			serviceAddress: binding.serviceAddress
+		});
+	}
+	for (const binding of paramManifest(input.graph)) {
+		if (!isEnvParamSource(binding.binding)) continue;
+		const name = paramName(binding);
+		if (!names.has(name)) names.set(name, {
+			name,
+			serviceAddress: binding.serviceAddress
+		});
+	}
+	if (names.size === 0) return;
+	const client = deps?.client ?? await managementClient$1();
 	const missing = [];
 	for (const meta of names.values()) {
-		if (await existsOnPlatform(client, input.projectId, input.branchId, meta.name)) continue;
+		if (await existsOnPlatform(client, projectId, branchId, meta.name)) continue;
 		const shellValue = process.env[meta.name];
 		if (shellValue !== void 0 && shellValue.length > 0) {
-			await fillMissing(client, input, meta.name, shellValue);
+			await fillMissing(client, projectId, branchId, meta.name, shellValue);
 			continue;
 		}
 		missing.push(meta);
 	}
-	if (missing.length > 0) throw missingError(missing, input);
+	if (missing.length > 0) throw missingError(missing, branchId, input.stage);
+}
+const tokenRequiredError = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required for destroy teardown.");
+async function managementClient() {
+	if ((process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw tokenRequiredError();
+	return Effect.runPromise(Effect.gen(function* () {
+		return yield* ManagementClient;
+	}).pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv())))));
+}
+/**
+* The Prisma Cloud extension's `teardown`. Removes the stage's state database,
+* with failure handling that differs by stage because the consequences do:
+*
+* - **Named stage: throw.** The Branch delete that follows would fail anyway —
+*   the platform refuses a Branch that still has a database attached — so
+*   failing here names the actual cause instead of a confusing symptom.
+* - **Production: warn and continue.** Nothing blocks the Project delete on
+*   this; removing the database only stops production's state outliving
+*   production and holding a quota slot. That is a cleanup step, and a cleanup
+*   step must not fail the command.
+*
+* Accepts an injected client and ownership verifier for tests; otherwise
+* builds a client from env and verifies against the real database.
+*/
+async function runTeardown(input, deps) {
+	const { projectId, branchId } = prismaCloudContainerOf(input.container);
+	const isNamedStage = branchId !== void 0;
+	try {
+		const client = deps?.client ?? await managementClient();
+		await Effect.runPromise(deleteStateDatabaseWith({
+			projectId,
+			...branchId !== void 0 ? { branchId } : {}
+		}, deps?.verify ?? verifyOwnership).pipe(Effect.provideService(ManagementClient, client)));
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		if (isNamedStage) throw new Error(`Failed to delete the deploy-state database: ${reason}`);
+		console.warn(`Could not remove production's deploy-state database: ${reason}`);
+	}
 }
 /** The Prisma Cloud–hosted deploy state store; its implementation lives in @internal/lowering. */
+/**
+* ADR-0031's registered provisioner for RPC_PEER_KEY: mints one `ServiceKey`
+* resource per edge (ADR-0030) and forwards its value as the opaque ref core
+* writes into the consumer's `serviceKey` param. The resource id keeps the
+* `servicekey-${edgeId}` scheme byte-identical to slice 2's, so an existing
+* deploy's keys are found, not re-minted. Defined here, not in service-keys.ts:
+* that module is also reachable from the runtime/authoring side, which must
+* never import `@internal/lowering` or `effect`.
+*/
+const serviceKeyProvisioner = { provision: (edge) => Effect.gen(function* () {
+	return (yield* ServiceKey(`servicekey-${edge.edgeId}`, {})).value;
+}) };
+/**
+* `ctx.provisioned`'s refs are typed `unknown` — core forwards a provisioner's
+* ref without inspecting it. Each provider param below is the sole reader of
+* its own provisioner's output, so the shape is asserted here, once, rather
+* than checked.
+*/
+const asKeyOutputs = (refs) => refs.map((ref) => blindCast(ref));
+/**
+* RPC's deploy-side `value(refs)` (ADR-0030): the provider stores a SET — one
+* key per inbound edge — into the accepted-keys var `serve()` reads. Paired
+* with the provisioner above: mint per edge, aggregate every edge.
+*
+* Zero consumers still emits, and that is the whole point of #100: an ABSENT
+* var means "never provisioned" and passes every caller through, so a deployed
+* provider nobody wired must say "[]" — deny everything — rather than say
+* nothing. Written as a literal because `Output.all()` with no arguments has
+* nothing to resolve.
+*/
+const rpcAcceptedKeysValue = (refs) => refs.length > 0 ? Output.all(...asKeyOutputs(refs)) : [];
+/**
+* ADR-0031's registered provisioner for STREAMS_API_KEY — the same `ServiceKey`
+* mint, keyed PER PROVIDER instead of per edge: the resource id is the
+* provider's address, so every consumer edge of one streams module resolves to
+* the same resource and therefore the same stable value. That is what
+* `@prisma/streams-server` requires (it authenticates a single `API_KEY`), and
+* cardinality is exactly what ADR-0031 leaves to the provisioner. Making it
+* per-edge later is this id's shape plus an accepted-set provider param — no
+* new resource, no core change.
+*/
+const streamsApiKeyProvisioner = { provision: (edge) => Effect.gen(function* () {
+	return (yield* ServiceKey(`streamskey-${edge.providerAddress}`, {})).value;
+}) };
+/**
+* Streams' deploy-side `value(refs)`: ONE value, not a set —
+* `@prisma/streams-server` authenticates a single `API_KEY`, which is why the
+* provisioner above mints per provider. That pairing is the invariant this
+* param depends on, so it asserts rather than trusts it: a future per-edge
+* flip without a paired accepted-set param here would otherwise ship
+* whichever key came first and leave every other consumer 401ing, silently.
+* The refs are lazy Outputs (not comparable at serialize time); inside
+* `Output.map` they are resolved strings, the same seam RPC's set aggregates
+* on.
+*
+* Zero consumers emits NOTHING — the streams counterpart to RPC's "[]".
+* `@prisma/streams-server` has no deny-all mode: it either authenticates a key
+* or runs --no-auth, so there is no value here that means "refuse everyone".
+* Writing no key is what fails closed — the entrypoint refuses to boot with
+* a named error rather than serve unauthenticated.
+*/
+const streamsApiKeyValue = (refs) => {
+	if (refs.length === 0) return void 0;
+	return Output.map(Output.all(...asKeyOutputs(refs)), (vals) => {
+		const distinct = [...new Set(vals)];
+		if (distinct.length > 1) throw new Error(`a streams provider was provisioned ${distinct.length} distinct keys across its ${refs.length} inbound bindings, but it can only be given one (@prisma/streams-server authenticates a single API_KEY). Its provisioner must mint per provider, not per edge — or this param must store an accepted-key set, once the server accepts one.`);
+		return distinct[0] ?? "";
+	});
+};
+/**
+* Origin's deploy-side value function (service-derived): the provisioned
+* service's own `endpointDomain`, verbatim — `https://…`, no trailing slash,
+* no normalization. Every compute service gets this row, exposing or not.
+* The undefined guard is a deploy-time invariant check, not a policy: the
+* Management API always reports an endpoint domain post-PRO-200, so a missing
+* one means the platform predates the fix — fail the deploy loudly rather
+* than write a row origin() would trust. The raw string is JSON-encoded by
+* the descriptor's generic loop, like every other reserved provider param.
+*/
+const selfOriginValue = (provisioned, address) => Output.map(provisioned.endpointDomain, (v) => {
+	if (v === void 0) throw new Error(`ComputeService for "${address}" reported no endpointDomain at provision — cannot resolve the service's own origin (Management API predates the PRO-200 fix?)`);
+	return v;
+});
+/** The user-facing state descriptor: `state: prismaState()` in `prisma-composer.config.ts` (ADR-0017). */
+const prismaState = () => ({
+	extension: PRISMA_CLOUD_EXTENSION_ID,
+	create: (container) => {
+		const { projectId, branchId } = prismaCloudContainerOf(container);
+		return prismaStateLayer(branchId !== void 0 ? {
+			projectId,
+			branchId
+		} : { projectId });
+	}
+});
 const KNOWN_REGION_SET = new Set(COMPUTE_REGIONS);
 function isComputeRegion(value) {
 	return KNOWN_REGION_SET.has(value);
@@ -1751,64 +2445,114 @@ function asProvidersLayer(layer) {
 	return layer;
 }
 /**
+* This extension's brands, each with the two halves ADR-0031 splits: the
+* PROVISIONER core resolves a mint through, and the reserved PROVIDER PARAM
+* that stores the minted values on the provider. So this file stays the only
+* place a brand is named — `descriptors/compute.ts` just looks a provider
+* param up by brand.
+*
+* `__tests__/provider-params.test.ts` asserts this map's brands are exactly
+* `PROVIDER_PARAMS`'s edge-derived brands (a service-derived param like the
+* origin mints nothing, so it has no provisioner): a brand minted here with no provider param
+* below would leave the value it mints written to consumers while no
+* provider ever stores an accepted-keys row for it — `serve()` (or the
+* equivalent runtime reader) then sees an absent var and passes every caller
+* through.
+*/
+const PROVISIONERS = /* @__PURE__ */ new Map([[RPC_PEER_KEY, serviceKeyProvisioner], [STREAMS_API_KEY, streamsApiKeyProvisioner]]);
+/**
+* Every brand's deploy-side value function — the only per-brand thing this
+* file still holds directly. `PROVIDER_PARAMS` below is built by mapping
+* `RESERVED_PROVIDER_PARAMS` (`provider-params.ts`, the boot-side list) onto
+* this map, so a param can exist on the deploy side only if it already
+* exists on the boot side: `RESERVED_PROVIDER_PARAMS` is the single source of
+* which reserved provider params exist at all, closing the drift the old
+* name-comparison test only detected after the fact.
+*/
+const PROVIDER_PARAM_VALUES = /* @__PURE__ */ new Map([
+	[RPC_PEER_KEY, { value: rpcAcceptedKeysValue }],
+	[STREAMS_API_KEY, { value: streamsApiKeyValue }],
+	[SELF_ORIGIN, { valueForService: selfOriginValue }]
+]);
+/**
+* Builds the deploy-side registry from the boot-side list, keyed by brand —
+* throws if a boot-side entry has no registered deploy-side value function,
+* so `RESERVED_PROVIDER_PARAMS` stays the single source of which reserved
+* provider params exist: deploy can no longer write a row boot never
+* stashes. Exported (rather than inlined into `PROVIDER_PARAMS` below) so
+* `__tests__/provider-params.test.ts` can drive it directly with a
+* deliberately incomplete value map and watch it throw.
+*/
+function buildProviderParams(entries, values) {
+	return new Map(entries.map((entry) => {
+		const value = values.get(entry.brand);
+		if (value === void 0) throw new Error(`prisma-cloud: reserved provider param "${entry.name}" (provider-params.ts) has no registered deploy-side value() in control.ts's PROVIDER_PARAM_VALUES — every param in RESERVED_PROVIDER_PARAMS must have one.`);
+		return [entry.brand, {
+			...entry,
+			...value
+		}];
+	}));
+}
+const PROVIDER_PARAMS = buildProviderParams(RESERVED_PROVIDER_PARAMS, PROVIDER_PARAM_VALUES);
+/**
 * Resolves the factory's env-or-option inputs, failing fast with the exact
-* variable name. `projectId`/`branchId` aren't required here — `prismaCloud()`
-* also runs in the CLI parent, before they're set; the required check lives in `application.provision`.
+* variable name.
 */
 function resolveOptions(opts) {
 	const workspaceId = opts.workspaceId ?? process.env["PRISMA_WORKSPACE_ID"];
 	if (workspaceId === void 0 || workspaceId.length === 0) throw new Error("prismaCloud(): environment variable PRISMA_WORKSPACE_ID is required.");
-	const projectId = process.env["PRISMA_PROJECT_ID"] || void 0;
-	const branchId = process.env["PRISMA_BRANCH_ID"] || void 0;
 	if (opts.region !== void 0) return {
 		workspaceId,
 		region: opts.region,
-		projectId,
-		branchId
+		providerParams: PROVIDER_PARAMS
 	};
 	const region = process.env["PRISMA_REGION"];
 	if (region === void 0 || region.length === 0) return {
 		workspaceId,
-		projectId,
-		branchId
+		providerParams: PROVIDER_PARAMS
 	};
 	if (!isComputeRegion(region)) throw new Error(`prismaCloud(): environment variable PRISMA_REGION="${region}" is not a known region (expected one of: ${COMPUTE_REGIONS.join(", ")}).`);
 	return {
 		workspaceId,
 		region,
-		projectId,
-		branchId
+		providerParams: PROVIDER_PARAMS
 	};
 }
 /** The Prisma Cloud extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */
 const prismaCloud = (opts = {}) => {
 	const o = resolveOptions(opts);
 	return {
-		id: "@prisma/composer-prisma-cloud",
-		providers: () => asProvidersLayer(Layer.mergeAll(providers(), PgWarmProvider(), PnMigrationProvider(), S3CredentialsProvider())),
+		id: PRISMA_CLOUD_EXTENSION_ID,
+		container: containerDescriptor(),
+		providers: () => asProvidersLayer(Layer.mergeAll(providers(), PgWarmProvider(), PnMigrationProvider(), S3CredentialsProvider(), ServiceKeyProvider())),
 		preflight: (input) => runPreflight(input),
-		application: { provision: () => Effect.gen(function* () {
-			const projectId = o.projectId;
-			if (projectId === void 0 || projectId.length === 0) throw new Error("prismaCloud(): environment variable PRISMA_PROJECT_ID is required (the CLI sets it — deploy via `prisma-composer deploy`).");
+		teardown: (input) => runTeardown(input),
+		application: { provision: (ctx) => Effect.gen(function* () {
+			const { projectId, branchId } = prismaCloudContainerOf(ctx.container);
 			for (const key of ["DATABASE_URL", "DATABASE_URL_POOLED"]) yield* EnvironmentVariable(`${key}-poison`, {
 				projectId,
 				key,
 				value: "-",
-				class: o.branchId ? "preview" : "production",
-				...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+				class: branchId ? "preview" : "production",
+				...branchId !== void 0 ? { branchId } : {}
 			});
-			return { outputs: { projectId } };
+			return {
+				projectId,
+				branchId
+			};
 		}) },
+		provisions: PROVISIONERS,
 		nodes: {
 			postgres: postgresDescriptor(o),
 			"prisma-next": prismaNextDescriptor(o),
 			compute: computeDescriptor(o),
 			credentials: s3CredentialsDescriptor(o),
-			"s3-store": s3StoreDescriptor(o)
+			"s3-store": s3StoreDescriptor(o),
+			s3: bucketDescriptor(o)
 		}
 	};
 };
 //#endregion
-export { prismaCloud, prismaState };
+export { PROVIDER_PARAMS, buildProviderParams, prismaCloud, prismaState };
 
 //# sourceMappingURL=control.mjs.map