@prisma/composer-prisma-cloud 0.1.0

package/dist/control.mjs

@@ -0,0 +1,1814 @@
+import { c as secretPointerRows, i as encode, o as paramEntries, s as secretName, t as configKey } from "./serializer-C2CsA7xm-29Eg2Tjl.mjs";
+import { a as normalizeSslMode, n as isPnPostgresResourceNode, o as withConnectionRetry } from "./prisma-next-COrwlg3N.mjs";
+import { provisionManifest } from "@prisma/composer";
+import { blindCast } from "@prisma/composer/casts";
+import pg from "pg";
+import * as Layer from "effect/Layer";
+import { createManagementApiClient } from "@prisma/management-api-sdk";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Config$1 from "effect/Config";
+import * as Data from "effect/Data";
+import * as Provider from "alchemy/Provider";
+import { Resource, Stack } from "alchemy";
+import * as Schedule from "effect/Schedule";
+import * as fs from "node:fs";
+import * as crypto$1 from "node:crypto";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as zlib from "node:zlib";
+import { STATE_STORE_VERSION, State, StateStoreError, encodeState, reviveStateRecursive } from "alchemy/State";
+import postgres from "postgres";
+import * as Output from "alchemy/Output";
+import { loadConfig } from "@prisma-next/cli/config-loader";
+import { resolve } from "pathe";
+import { readRef } from "@prisma-next/migration-tools/refs";
+import { APP_SPACE_ID, readContractSpaceHeadRef, spaceMigrationDirectory, spaceRefsDirectory } from "@prisma-next/migration-tools/spaces";
+import { createPostgresControlClient } from "@prisma-next/postgres/control";
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CxGdfSAP.mjs
+/**
+* The Prisma service token used to authenticate Management API calls. Kept
+* as a Redacted value so it never lands in logs or error output.
+*/
+var PrismaCredentials = class extends Context.Service()("PrismaCredentials") {};
+/** Resolve the token from the `PRISMA_SERVICE_TOKEN` environment variable. */
+const fromEnv = () => Layer.effect(PrismaCredentials, Effect.gen(function* () {
+	return { token: yield* Config$1.redacted("PRISMA_SERVICE_TOKEN") };
+}));
+/**
+* The typed Prisma Management API client, built once from the resolved
+* credentials. Providers yield this in their outer Effect and call it inside
+* `reconcile` / `delete`.
+*/
+var ManagementClient = class extends Context.Service()("PrismaManagementClient") {};
+const layer = () => Layer.effect(ManagementClient, Effect.gen(function* () {
+	const { token } = yield* PrismaCredentials;
+	return createManagementApiClient({ token: Redacted.value(token) });
+}));
+/** A non-2xx response from the Management API (or a transport failure). */
+var PrismaApiError = class extends Data.TaggedError("PrismaApiError") {};
+const attempt$1 = (f) => Effect.tryPromise({
+	try: f,
+	catch: (cause) => new PrismaApiError({
+		status: 0,
+		message: String(cause)
+	})
+});
+const fail = (r) => Effect.fail(new PrismaApiError({
+	status: r.response.status,
+	message: JSON.stringify(r.error)
+}));
+/** Unwrap `data`, failing on any API error. Preserves the SDK's response type. */
+const call = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.error !== void 0 || r.data === void 0 ? fail(r) : Effect.succeed(r.data)));
+/** Unwrap `data`, mapping a 404 to `undefined` (resource gone / not found). */
+const callOptional = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.status === 404 ? Effect.succeed(void 0) : r.error !== void 0 ? fail(r) : Effect.succeed(r.data)));
+/** Fire-and-forget a call, tolerating a 404 (already deleted). */
+const callVoid = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute/index.mjs
+/**
+* Stopping a deployment before the compute service that owns it can be
+* deleted is asynchronous on the platform's side: DELETE can 409 with this
+* message while the deployment is still winding down. Retrying blindly on
+* every API error would mask real failures (bad auth, a genuinely conflicting
+* state, etc.), so this only matches the platform's specific "not delete-safe
+* yet" wording — everything else fails immediately, as before.
+*/
+const isDeleteNotSafeYet = (error) => error.message.includes("did not reach a delete-safe state");
+/**
+* Backs off exponentially from 2s, capped at 5 minutes total — long enough
+* for the platform to finish stopping the deployment, short enough to still
+* fail loudly (rather than hang forever) if it never does.
+*/
+const deleteSafeRetrySchedule = Schedule.both(Schedule.exponential("2 seconds", 2), Schedule.during("5 minutes"));
+/** Every region Prisma Compute serves — the runtime source of truth; `ComputeRegion` is derived from it so the two can never drift. */
+const COMPUTE_REGIONS = [
+	"us-east-1",
+	"us-west-1",
+	"eu-west-3",
+	"eu-central-1",
+	"ap-northeast-1",
+	"ap-southeast-1"
+];
+/** A Prisma **Compute service** — the stable app identity behind a project. */
+const ComputeService = Resource("Prisma.ComputeService");
+const ComputeServiceProvider = () => Provider.effect(ComputeService, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/compute-services/{computeServiceId}", { params: { path: { computeServiceId: output.id } } })) : void 0;
+			if (observed) return {
+				id: observed.data.id,
+				name: observed.data.name,
+				endpointDomain: observed.data.serviceEndpointDomain
+			};
+			const created = yield* call(() => client.POST("/v1/projects/{projectId}/compute-services", {
+				params: { path: { projectId: news.projectId } },
+				body: {
+					displayName: news.name,
+					...news.region && { regionId: news.region },
+					...news.branchId !== void 0 && { branchId: news.branchId }
+				}
+			}));
+			return {
+				id: created.data.id,
+				name: created.data.name,
+				endpointDomain: created.data.serviceEndpointDomain
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/compute-services/{computeServiceId}", { params: { path: { computeServiceId: output.id } } })).pipe(Effect.retry({
+				schedule: deleteSafeRetrySchedule,
+				while: isDeleteNotSafeYet
+			}));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const s = yield* callOptional(() => client.GET("/v1/compute-services/{computeServiceId}", { params: { path: { computeServiceId: output.id } } }));
+			return s ? {
+				id: s.data.id,
+				name: s.data.name,
+				endpointDomain: s.data.serviceEndpointDomain
+			} : void 0;
+		})
+	};
+}));
+/**
+* A **deployment** of a Prisma Compute service — creates a version, uploads
+* its artifact, starts the VM, waits for it to run, then promotes it to the
+* service's stable endpoint.
+*/
+const Deployment = Resource("Prisma.Deployment");
+const DeploymentProvider = () => Provider.effect(Deployment, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	const waitForRunning = (versionId) => call(() => client.GET("/v1/compute-services/versions/{versionId}", { params: { path: { versionId } } })).pipe(Effect.flatMap((v) => v.data.status === "running" ? Effect.void : Effect.fail(new PrismaApiError({
+		status: 409,
+		message: `compute version ${versionId} is ${v.data.status}, not running`
+	}))), Effect.retry(Schedule.both(Schedule.spaced("2 seconds"), Schedule.during("2 minutes"))));
+	return {
+		stables: [],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news }) {
+			const created = yield* call(() => client.POST("/v1/compute-services/{computeServiceId}/versions", {
+				params: { path: { computeServiceId: news.computeServiceId } },
+				body: news.port !== void 0 ? { portMapping: { http: news.port } } : {}
+			}));
+			const versionId = created.data.id;
+			if (created.data.uploadUrl) {
+				const uploadUrl = created.data.uploadUrl;
+				const artifact = yield* Effect.try({
+					try: () => fs.readFileSync(news.artifactPath),
+					catch: (cause) => new PrismaApiError({
+						status: 0,
+						message: `failed to read artifact ${news.artifactPath}: ${String(cause)}`
+					})
+				});
+				yield* Effect.tryPromise({
+					try: async () => {
+						const res = await fetch(uploadUrl, {
+							method: "PUT",
+							body: artifact
+						});
+						if (!res.ok) throw new PrismaApiError({
+							status: res.status,
+							message: `artifact upload failed: ${res.status} ${res.statusText}`
+						});
+					},
+					catch: (cause) => cause instanceof PrismaApiError ? cause : new PrismaApiError({
+						status: 0,
+						message: String(cause)
+					})
+				});
+			}
+			yield* call(() => client.POST("/v1/compute-services/versions/{versionId}/start", { params: { path: { versionId } } }));
+			yield* waitForRunning(versionId);
+			yield* call(() => client.POST("/v1/compute-services/{computeServiceId}/promote", {
+				params: { path: { computeServiceId: news.computeServiceId } },
+				body: { versionId }
+			}));
+			const deployedUrl = (yield* call(() => client.GET("/v1/compute-services/{computeServiceId}", { params: { path: { computeServiceId: news.computeServiceId } } }))).data.serviceEndpointDomain;
+			return {
+				versionId,
+				...deployedUrl !== void 0 && { deployedUrl }
+			};
+		}),
+		delete: Effect.fn(function* () {}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.versionId) return void 0;
+			const v = yield* callOptional(() => client.GET("/v1/compute-services/versions/{versionId}", { params: { path: { versionId: output.versionId } } }));
+			return v ? {
+				versionId: v.data.id,
+				...v.data.previewDomain && { deployedUrl: v.data.previewDomain }
+			} : void 0;
+		})
+	};
+}));
+/**
+* A project-scoped **environment variable** that Compute injects into the
+* project's services from their attached branch (e.g. wiring one module's URL into
+* another).
+*/
+const EnvironmentVariable = Resource("Prisma.EnvironmentVariable");
+const EnvironmentVariableProvider = () => Provider.effect(EnvironmentVariable, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const cls = news.class ?? "production";
+			let id = output?.id;
+			if (id !== void 0) {
+				const priorId = id;
+				if (!(yield* callOptional(() => client.GET("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: priorId } } })))) id = void 0;
+			}
+			if (id === void 0) {
+				const matchId = (yield* call(() => client.GET("/v1/environment-variables", { params: { query: {
+					projectId: news.projectId,
+					class: cls,
+					key: news.key
+				} } }))).data?.[0]?.id;
+				if (matchId !== void 0) {
+					if (!(news.key === "DATABASE_URL" || news.key === "DATABASE_URL_POOLED")) throw new Error(`EnvironmentVariable "${news.key}" (project "${news.projectId}", class "${cls}") exists but is untracked in this deploy state — refusing to overwrite a reserved COMPOSE_ key. Restore this deploy's hosted state, or remove the variable to let this deploy recreate it.`);
+					id = matchId;
+				}
+			}
+			if (id !== void 0) {
+				const targetId = id;
+				yield* call(() => client.PATCH("/v1/environment-variables/{envVarId}", {
+					params: { path: { envVarId: targetId } },
+					body: { value: news.value }
+				}));
+				return {
+					id,
+					key: news.key
+				};
+			}
+			const created = yield* call(() => client.POST("/v1/environment-variables", { body: {
+				projectId: news.projectId,
+				class: cls,
+				key: news.key,
+				value: news.value,
+				...news.branchId ? { branchId: news.branchId } : {}
+			} }));
+			return {
+				id: created.data.id,
+				key: created.data.key
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const v = yield* callOptional(() => client.GET("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: output.id } } }));
+			return v ? {
+				id: v.data.id,
+				key: v.data.key
+			} : void 0;
+		})
+	};
+}));
+/**
+* Assembles a Prisma Compute artifact: the app-built bundle plus the
+* extension-printed bootstrap and manifest, tarred and gzipped deterministically
+* (fixed mtimes, sorted entry order) so an unchanged service noops on
+* redeploy — a rebuild is the only thing that changes the hash. Lives here
+* (not in @prisma/composer-prisma-cloud/control) because it needs node:fs/node:zlib,
+* which the extension's shipped src may never import (invariant 5).
+*/
+const MANIFEST_VERSION = "1";
+/** Finds main.js/main.mjs in a bundle dir when no explicit entry is given. */
+function resolveEntry(bundleDir, entry) {
+	if (entry !== void 0) return entry;
+	const found = fs.readdirSync(bundleDir).find((f) => /^main\.m?js$/.test(f));
+	if (found === void 0) throw new Error(`no main.js/main.mjs found in bundle dir ${bundleDir}`);
+	return found;
+}
+/** All files under `dir`, as dir-relative POSIX paths, in sorted order. A
+* symlink is a hard error: deploy bundles must be flat (ADR-0005), and the
+* user's build owns flattening — dereferencing here would relink the tree and
+* risk packaging files from outside it. */
+function walkFiles(dir) {
+	const out = [];
+	const visit = (sub) => {
+		for (const entry of fs.readdirSync(path.join(dir, sub), { withFileTypes: true })) {
+			const rel = sub.length > 0 ? `${sub}/${entry.name}` : entry.name;
+			if (entry.isSymbolicLink()) throw new Error(`bundle contains a symlink at ${rel} — deploy bundles must be flat; materialize links in your build (e.g. cp -RL) so the tree is self-contained.`);
+			if (entry.isDirectory()) visit(rel);
+			else out.push(rel);
+		}
+	};
+	visit("");
+	return out.sort();
+}
+function octal(value, length) {
+	return `${value.toString(8).padStart(length - 1, "0")}\0`;
+}
+/** Splits a path into ustar's name (<=100 bytes) + prefix (<=155 bytes) fields. */
+function splitUstarPath(relPath) {
+	if (Buffer.byteLength(relPath, "utf8") <= 100) return {
+		name: relPath,
+		prefix: ""
+	};
+	for (let i = relPath.length - 1; i >= 0; i--) {
+		if (relPath[i] !== "/") continue;
+		const prefix = relPath.slice(0, i);
+		const name = relPath.slice(i + 1);
+		if (Buffer.byteLength(prefix, "utf8") <= 155 && Buffer.byteLength(name, "utf8") <= 100) return {
+			name,
+			prefix
+		};
+	}
+	throw new Error(`path too long for a ustar tar entry: ${relPath}`);
+}
+function ustarHeader(relPath, size) {
+	const { name, prefix } = splitUstarPath(relPath);
+	const buf = Buffer.alloc(512);
+	buf.write(name, 0, 100, "utf8");
+	buf.write(octal(420, 8), 100, 8, "utf8");
+	buf.write(octal(0, 8), 108, 8, "utf8");
+	buf.write(octal(0, 8), 116, 8, "utf8");
+	buf.write(octal(size, 12), 124, 12, "utf8");
+	buf.write(octal(0, 12), 136, 12, "utf8");
+	buf.write("        ", 148, 8, "utf8");
+	buf.write("0", 156, 1, "utf8");
+	buf.write("ustar\0", 257, 6, "utf8");
+	buf.write("00", 263, 2, "utf8");
+	buf.write(prefix, 345, 155, "utf8");
+	let sum = 0;
+	for (const b of buf) sum += b;
+	buf.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148, 8, "utf8");
+	return buf;
+}
+function createDeterministicTarGz(entries) {
+	const sorted = [...entries].sort((a, b) => a.relPath.localeCompare(b.relPath));
+	const chunks = [];
+	for (const entry of sorted) {
+		chunks.push(ustarHeader(entry.relPath, entry.content.length));
+		chunks.push(entry.content);
+		const pad = (512 - entry.content.length % 512) % 512;
+		if (pad > 0) chunks.push(Buffer.alloc(pad));
+	}
+	chunks.push(Buffer.alloc(1024));
+	return zlib.gzipSync(Buffer.concat(chunks));
+}
+/**
+* Prints the bootstrap + manifest and tars them with the bundle into a
+* deterministic artifact. If bundleDir doesn't exist (e.g. `alchemy destroy`
+* run before any build), returns a placeholder rather than throwing — the
+* artifact is never read on destroy.
+*/
+function packageComputeArtifact(opts) {
+	if (!fs.existsSync(opts.bundleDir)) return {
+		path: "",
+		sha256: "absent"
+	};
+	const bootstrap = `import main from "./${resolveEntry(opts.bundleDir, opts.bundleEntry)}";\nawait main.run(${JSON.stringify(opts.address)}, () => import(${JSON.stringify(`./${opts.appEntry}`)}));\n`;
+	const manifest = `${JSON.stringify({
+		manifestVersion: MANIFEST_VERSION,
+		entrypoint: "bootstrap.js"
+	}, null, 2)}\n`;
+	const files = walkFiles(opts.bundleDir).map((relPath) => ({
+		relPath,
+		content: fs.readFileSync(path.join(opts.bundleDir, relPath))
+	}));
+	files.push({
+		relPath: "bootstrap.js",
+		content: Buffer.from(bootstrap, "utf8")
+	});
+	files.push({
+		relPath: "compute.manifest.json",
+		content: Buffer.from(manifest, "utf8")
+	});
+	files.push({
+		relPath: "bunfig.toml",
+		content: Buffer.from("[install]\nauto = \"disable\"\n", "utf8")
+	});
+	const gz = createDeterministicTarGz(files);
+	const sha256 = crypto$1.createHash("sha256").update(gz).digest("hex");
+	const outDir = path.join(os.tmpdir(), `prisma-composer-compute-${String(os.userInfo().uid)}`, sha256.slice(0, 16));
+	fs.mkdirSync(outDir, { recursive: true });
+	const outPath = path.join(outDir, `${opts.id}.tar.gz`);
+	const tmpPath = path.join(outDir, `.${opts.id}.${crypto$1.randomUUID()}.tmp`);
+	fs.writeFileSync(tmpPath, gz);
+	fs.renameSync(tmpPath, outPath);
+	return {
+		path: outPath,
+		sha256
+	};
+}
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/postgres/index.mjs
+/** A **connection** to a Prisma Postgres database — yields the connection string. */
+const Connection = Resource("Prisma.Connection");
+const ConnectionProvider = () => Provider.effect(Connection, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id", "connectionString"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			if (output?.id) return output;
+			const created = yield* call(() => client.POST("/v1/databases/{databaseId}/connections", {
+				params: { path: { databaseId: news.databaseId } },
+				body: { name: news.name }
+			}));
+			const endpoints = created.data.endpoints;
+			const dsn = endpoints?.direct?.connectionString ?? endpoints?.pooled?.connectionString;
+			if (dsn === void 0) return yield* Effect.fail(new PrismaApiError({
+				status: 0,
+				message: `connection ${created.data.id} returned no direct/pooled connection string`
+			}));
+			return {
+				id: created.data.id,
+				connectionString: Redacted.make(dsn)
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/connections/{id}", { params: { path: { id: output.id } } }));
+		})
+	};
+}));
+/** A Prisma **Postgres database** inside a project. */
+const Database = Resource("Prisma.Database");
+const DatabaseProvider = () => Provider.effect(Database, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } })) : void 0;
+			let result;
+			if (observed) result = {
+				id: observed.data.id,
+				name: observed.data.name
+			};
+			else {
+				const created = yield* call(() => client.POST("/v1/projects/{projectId}/databases", {
+					params: { path: { projectId: news.projectId } },
+					body: {
+						name: news.name,
+						region: news.region,
+						...news.isDefault !== void 0 && { isDefault: news.isDefault }
+					}
+				}));
+				result = {
+					id: created.data.id,
+					name: created.data.name
+				};
+			}
+			if (news.branchId !== void 0) {
+				const branchId = news.branchId;
+				yield* call(() => client.PATCH("/v1/databases/{databaseId}", {
+					params: { path: { databaseId: result.id } },
+					body: { branchId }
+				}));
+			}
+			return result;
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const d = yield* callOptional(() => client.GET("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } }));
+			return d ? {
+				id: d.data.id,
+				name: d.data.name
+			} : void 0;
+		})
+	};
+}));
+/** A Prisma Developer Platform **Project** — the container for databases and compute services. */
+const Project = Resource("Prisma.Project");
+const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/projects/{id}", { params: { path: { id: output.id } } })) : void 0;
+			if (observed) return {
+				id: observed.data.id,
+				name: observed.data.name
+			};
+			const created = yield* call(() => client.POST("/v1/projects", { body: {
+				name: news.name,
+				workspaceId: news.workspaceId
+			} }));
+			return {
+				id: created.data.id,
+				name: created.data.name
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/projects/{id}", { params: { path: { id: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const p = yield* callOptional(() => client.GET("/v1/projects/{id}", { params: { path: { id: output.id } } }));
+			return p ? {
+				id: p.data.id,
+				name: p.data.name
+			} : void 0;
+		})
+	};
+}));
+Data.TaggedError("ContainerNotFoundError");
+/** The collection of Prisma resource providers. */
+var Providers = class extends Provider.ProviderCollection()("Prisma") {};
+/**
+* The Prisma provider bundle: every resource provider, the Management API
+* client, and env-based credentials. Plug into a stack with
+* `{ providers: Prisma.providers() }`.
+*/
+const providers = () => Layer.effect(Providers, Provider.collection([
+	Project,
+	Database,
+	Connection,
+	ComputeService,
+	Deployment,
+	EnvironmentVariable
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/state/index.mjs
+/** Collapses any thrown value (postgres.js failures included) into a {@link StateStoreError}. */
+const toStateStoreError = (cause) => cause instanceof Error ? new StateStoreError({
+	message: cause.message,
+	cause
+}) : new StateStoreError({ message: String(cause) });
+/**
+* An operator-facing failure from the hosted-state bootstrap pipeline
+* (project/database discovery, connection mint, schema migration, or lock
+* acquisition) — what a deployer actually sees, instead of a raw Effect
+* defect.
+*/
+var HostedStateBootstrapError = class extends Data.TaggedError("HostedStateBootstrapError") {
+	get message() {
+		return `hosted-state bootstrap failed for workspace ${this.workspaceId}: ${this.step} — ${this.reason}`;
+	}
+};
+/**
+* Builds a {@link HostedStateBootstrapError} from whatever the failed step
+* threw. Never retains the raw driver/API error object as `cause`: a
+* postgres.js connection failure's `.message`/properties are not verified to
+* omit the DSN or credentials, so only the extracted message text survives
+* into the operator-facing error.
+*/
+const hostedStateBootstrapError = (workspaceId, step, cause) => new HostedStateBootstrapError({
+	workspaceId,
+	step,
+	reason: cause instanceof Error ? cause.message : String(cause)
+});
+/**
+* The well-known marker row written into every database this store owns.
+* Its presence proves the database is genuinely Prisma App's state store, not
+* a same-named project squatting on the discovery query (see `bootstrap.ts`
+* `verifyOwnership` — PDP allows duplicate project names).
+*/
+const STATE_META_MARKER = "prisma-composer-state-v1";
+/**
+* Idempotent schema migration for the Prisma-hosted state store — safe to run
+* on every deploy, since `create table if not exists` no-ops once the tables
+* exist. Run this against `sql` before serving a {@link StateService} built
+* by `makePrismaStateService` over the same client.
+*/
+const migratePrismaState = (sql) => Effect.tryPromise({
+	try: async () => {
+		await sql`
+        create table if not exists alchemy_resource_state (
+          stack text not null,
+          stage text not null,
+          fqn text not null,
+          value jsonb not null,
+          updated_at timestamptz not null default now(),
+          primary key (stack, stage, fqn)
+        )
+      `;
+		await sql`
+        create table if not exists alchemy_stack_output (
+          stack text not null,
+          stage text not null,
+          value jsonb not null,
+          updated_at timestamptz not null default now(),
+          primary key (stack, stage)
+        )
+      `;
+		await sql`
+        create table if not exists prisma_app_state_meta (
+          marker text primary key,
+          created_at timestamptz not null default now()
+        )
+      `;
+		await sql`
+        insert into prisma_app_state_meta (marker) values (${STATE_META_MARKER})
+        on conflict (marker) do nothing
+      `;
+	},
+	catch: toStateStoreError
+});
+/**
+* The workspace's dedicated project for hosted deploy state. A project is
+* the closest expressible stand-in for "ambient platform infrastructure" —
+* PDP has no workspace-level database, and the app's own project is
+* circular (it doesn't exist before the first apply, and is itself tracked
+* in the state it would have to host).
+*/
+const STATE_PROJECT_NAME = "prisma-composer-state";
+/** Every connection this bootstrap mints carries this prefix — see `cleanupAgedConnections`. */
+const CONNECTION_NAME_PREFIX = "prisma-composer-state-";
+const CONNECTION_MAX_AGE_MS = 1440 * 60 * 1e3;
+const DEFAULT_DATABASE_POLL_ATTEMPTS = 5;
+const DEFAULT_DATABASE_POLL_DELAY = "500 millis";
+const listAllProjects = (client) => Effect.gen(function* () {
+	const projects = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {} : { cursor };
+		const page = yield* call(() => client.GET("/v1/projects", { params: { query } }));
+		projects.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return projects;
+});
+/**
+* Workspace ids circulate in two shapes: the API returns them `wksp_`-prefixed
+* (`wksp_abc…`), while tokens/config often carry the bare id (`abc…`) — the
+* API accepts both on writes. Comparing them raw silently never matches when
+* the shapes differ, which made bootstrap re-provision a fresh state project
+* on every run in CI. Compare bare-to-bare.
+*/
+const bareWorkspaceId = (id) => id.startsWith("wksp_") ? id.slice(5) : id;
+/**
+* All projects named `prisma-composer-state` in the workspace — plural, because PDP
+* allows duplicate project names (verified 2026-07-09), so name-based
+* discovery can never assume there is at most one. See `resolveStateProject`
+* for how candidates get disambiguated.
+*/
+const listStateProjects = (client, workspaceId) => listAllProjects(client).pipe(Effect.map((projects) => projects.filter((p) => bareWorkspaceId(p.workspace.id) === bareWorkspaceId(workspaceId) && p.name === STATE_PROJECT_NAME)));
+const createStateProject = (client, workspaceId) => call(() => client.POST("/v1/projects", { body: {
+	name: STATE_PROJECT_NAME,
+	workspaceId
+} })).pipe(Effect.map((r) => r.data));
+const listAllDatabases = (client, projectId) => Effect.gen(function* () {
+	const databases = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {} : { cursor };
+		const page = yield* call(() => client.GET("/v1/projects/{projectId}/databases", { params: {
+			path: { projectId },
+			query
+		} }));
+		databases.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return databases;
+});
+/**
+* The project's default database — auto-provisioned at project creation.
+* Never create a database here: a project already has exactly one default,
+* and creating another 409s (FT-5220). Whether the default is listable in
+* the same tick as the project-create response is not a documented
+* contract, so a fresh project polls a few times with a short backoff
+* before giving up — the observed live behaviour is synchronous, but this
+* does not assume that holds on every run.
+*/
+const findDefaultDatabase = (client, projectId) => Effect.gen(function* () {
+	for (let attempt = 1; attempt <= DEFAULT_DATABASE_POLL_ATTEMPTS; attempt++) {
+		const found = (yield* listAllDatabases(client, projectId)).find((d) => d.isDefault);
+		if (found !== void 0) return found;
+		if (attempt < DEFAULT_DATABASE_POLL_ATTEMPTS) yield* Effect.sleep(DEFAULT_DATABASE_POLL_DELAY);
+	}
+	return yield* Effect.fail(new PrismaApiError({
+		status: 0,
+		message: `project ${projectId} (${STATE_PROJECT_NAME}) has no default database after ${DEFAULT_DATABASE_POLL_ATTEMPTS} attempts — it may still be provisioning; re-run the deploy.`
+	}));
+});
+const listAllConnections = (client, databaseId) => Effect.gen(function* () {
+	const connections = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {} : { cursor };
+		const page = yield* call(() => client.GET("/v1/databases/{databaseId}/connections", { params: {
+			path: { databaseId },
+			query
+		} }));
+		connections.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return connections;
+});
+const deleteConnection = (client, connectionId) => callVoid(() => client.DELETE("/v1/connections/{id}", { params: { path: { id: connectionId } } }));
+/**
+* Every deploy mints a fresh connection (`mintConnection`) and nothing ever
+* closes it, so the store's default database otherwise accumulates one
+* connection resource per run without bound. Best-effort, never blocks
+* bootstrap: lists this database's connections, deletes the ones matching
+* our naming pattern older than the age threshold, and swallows any failure
+* (a transient API error here must never fail the deploy it's cleaning up
+* after).
+*/
+const cleanupAgedConnections = (client, databaseId) => Effect.gen(function* () {
+	const connections = yield* listAllConnections(client, databaseId);
+	const cutoff = Date.now() - CONNECTION_MAX_AGE_MS;
+	const aged = connections.filter((c) => c.name.startsWith(CONNECTION_NAME_PREFIX) && Date.parse(c.createdAt) < cutoff);
+	yield* Effect.forEach(aged, (c) => deleteConnection(client, c.id), { discard: true });
+}).pipe(Effect.ignore);
+/**
+* Mints a fresh Postgres connection and reads the direct endpoint's DSN.
+* Never `endpoints.pooled`, the deprecated top-level `connectionString`/`url`
+* (PRO-212) — those are not guaranteed by the platform. The DSN is
+* write-only on read (a stored connection can't be re-read later), which is
+* exactly why a fresh connection is minted every run instead of reusing one.
+*/
+const mintConnection = (client, databaseId) => call(() => client.POST("/v1/databases/{databaseId}/connections", {
+	params: { path: { databaseId } },
+	body: { name: `${CONNECTION_NAME_PREFIX}${Date.now()}` }
+})).pipe(Effect.flatMap((r) => {
+	const created = r.data;
+	const dsn = created.endpoints.direct?.connectionString;
+	return dsn === void 0 ? Effect.fail(new PrismaApiError({
+		status: 0,
+		message: `connection ${created.id} returned no endpoints.direct.connectionString (PRO-212)`
+	})) : Effect.succeed(Redacted.make(dsn));
+}));
+/**
+* PDP allows duplicate project names, so a project named `prisma-composer-state`
+* found by listing is not proof it's ours — it could be an unrelated
+* project that happens to share the name (a squatter, deliberate or not).
+* Connects to the candidate's default database and inspects its tables:
+*
+* - our marker table with our marker row present → `ours`, adopt outright.
+* - our state tables (`alchemy_resource_state`/`alchemy_stack_output`) but no
+*   marker → `legacy`: a database from before this ownership check existed.
+*   The real, currently-in-use workspace state is in this shape today, so it
+*   must keep working — adopt it, and `migratePrismaState` (idempotent)
+*   writes the marker on the way in.
+* - no tables at all → `empty`, a freshly-created default database — adopt.
+* - anything else → `squatter`: foreign data occupies the name; refuse it.
+*/
+const verifyOwnership = (connectionString) => Effect.tryPromise({
+	try: async () => {
+		const sql = postgres(Redacted.value(connectionString), {
+			max: 1,
+			onnotice: () => {}
+		});
+		try {
+			const rows = await sql`
+          select tablename from pg_tables where schemaname = 'public'
+        `;
+			const tables = new Set(rows.map((row) => row.tablename));
+			if (tables.has("prisma_app_state_meta")) return (await sql`
+            select marker from prisma_app_state_meta where marker = ${"prisma-composer-state-v1"}
+          `).length > 0 ? { kind: "ours" } : {
+				kind: "squatter",
+				tables: [...tables]
+			};
+			if (tables.has("alchemy_resource_state") || tables.has("alchemy_stack_output")) return { kind: "legacy" };
+			return tables.size === 0 ? { kind: "empty" } : {
+				kind: "squatter",
+				tables: [...tables]
+			};
+		} finally {
+			await sql.end({ timeout: 5 });
+		}
+	},
+	catch: (cause) => new PrismaApiError({
+		status: 0,
+		message: `ownership verification failed: ${cause instanceof Error ? cause.message : String(cause)}`
+	})
+});
+/**
+* Finds the workspace's `prisma-composer-state` project, verifying ownership rather
+* than trusting the name alone (PDP allows duplicate names — see
+* `verifyOwnership`). Zero candidates creates one: nothing to verify, since
+* only this run could possibly have touched the brand-new database between
+* create and here (`migratePrismaState` writes the marker once bootstrap
+* hands the connection off). One or more candidates are tried
+* oldest-`createdAt` first, deterministically, and the first that verifies
+* as ours (or adoptable legacy/empty) wins; a candidate that fails
+* verification is skipped, not fatal, unless every candidate fails, in
+* which case the failure names every rejected project id so an operator can
+* act on it.
+*/
+const resolveStateProject = (client, workspaceId, verify) => Effect.gen(function* () {
+	const candidates = yield* listStateProjects(client, workspaceId);
+	if (candidates.length === 0) {
+		const project = yield* createStateProject(client, workspaceId);
+		const database = yield* findDefaultDatabase(client, project.id);
+		const connectionString = yield* mintConnection(client, database.id);
+		console.error(`hosted state: provisioned new state project ${project.id} (db ${database.id}) in workspace ${workspaceId}`);
+		return {
+			project,
+			database,
+			connectionString
+		};
+	}
+	const sorted = [...candidates].sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+	const rejected = [];
+	for (const candidate of sorted) {
+		const database = yield* findDefaultDatabase(client, candidate.id);
+		const connectionString = yield* mintConnection(client, database.id);
+		const verdict = yield* verify(connectionString);
+		if (verdict.kind === "squatter") {
+			rejected.push(`${candidate.id} (foreign tables: ${verdict.tables.join(", ") || "none named"})`);
+			continue;
+		}
+		console.error(`hosted state: using state project ${candidate.id} (db ${database.id}, ${verdict.kind}) — ${sorted.length} candidate(s) named ${STATE_PROJECT_NAME} in workspace ${workspaceId}`);
+		return {
+			project: candidate,
+			database,
+			connectionString
+		};
+	}
+	return yield* Effect.fail(new PrismaApiError({
+		status: 0,
+		message: `found ${sorted.length} project(s) named "${STATE_PROJECT_NAME}" in workspace ${workspaceId}, but none verified as Prisma App's state store: ${rejected.join("; ")}. The name is squatted by unrelated data — rename or remove the offending project(s), or see platform-ask.md (reserved/unique state project names).`
+	}));
+});
+/**
+* Find-or-create the workspace's `prisma-composer-state` project, resolve its
+* default database, and mint a fresh connection — the automatic bootstrap
+* every deploy runs once, needing nothing beyond the service token and
+* workspace id a deployer already has.
+*/
+const bootstrapStateConnection = (workspaceId) => bootstrapStateConnectionWith(workspaceId, verifyOwnership);
+/**
+* Test seam: identical to {@link bootstrapStateConnection} but with the
+* ownership verifier injectable, so `bootstrap.test.ts` can stub ownership
+* decisions against its fake DSNs without opening a real Postgres
+* connection to them.
+*/
+const bootstrapStateConnectionWith = (workspaceId, verify) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	const { project, database, connectionString } = yield* resolveStateProject(client, workspaceId, verify);
+	yield* cleanupAgedConnections(client, database.id);
+	return {
+		projectId: project.id,
+		databaseId: database.id,
+		connectionString
+	};
+});
+/** Another deploy already holds the lock for this stack/stage. Never queued — fails immediately. */
+var StateLockContentionError = class extends Data.TaggedError("StateLockContentionError") {
+	get message() {
+		return `another deploy holds the state lock for ${this.stack}/${this.stage}`;
+	}
+};
+const lockKey = (stack, stage) => `prisma-composer:${stack}/${stage}`;
+/**
+* Acquires a session-scoped Postgres advisory lock on a reserved
+* connection pulled from `sql`'s pool — session (not transaction) scope,
+* because a transaction-scoped lock releases at the first commit and a
+* deploy spans many. Held for the run's whole lifetime; contention fails
+* immediately rather than queuing. If the process crashes, the reserved
+* connection drops and Postgres auto-releases the session lock — no
+* explicit crash-recovery bookkeeping needed.
+*/
+const acquireStateLock = (sql, stack, stage) => Effect.gen(function* () {
+	const key = lockKey(stack, stage);
+	const reserved = yield* Effect.tryPromise({
+		try: () => sql.reserve(),
+		catch: toStateStoreError
+	});
+	const acquired = yield* Effect.tryPromise({
+		try: async () => {
+			return (await reserved`
+          select
+            pg_try_advisory_lock(hashtextextended(${key}, 0)) as acquired,
+            pg_backend_pid() as pid
+        `)[0];
+		},
+		catch: toStateStoreError
+	});
+	if (acquired?.acquired !== true) {
+		reserved.release();
+		return yield* Effect.fail(new StateLockContentionError({
+			stack,
+			stage
+		}));
+	}
+	const lockPid = acquired.pid;
+	const checkLive = Effect.tryPromise({
+		try: async () => {
+			return (await sql`
+          select exists (
+            select 1 from pg_locks
+            where locktype = 'advisory'
+              and pid = ${lockPid}
+              and objsubid = 1
+              and granted
+              and ((classid::bigint << 32) | (objid::bigint & 4294967295))
+                = hashtextextended(${key}, 0)
+          ) as live
+        `)[0]?.live ?? false;
+		},
+		catch: toStateStoreError
+	}).pipe(Effect.flatMap((live) => live ? Effect.void : Effect.fail(new StateStoreError({ message: `the state lock for ${stack}/${stage} was lost mid-run; refusing to continue unlocked` }))));
+	const release = async () => {
+		try {
+			await reserved`select pg_advisory_unlock(hashtextextended(${key}, 0))`;
+		} catch {} finally {
+			reserved.release();
+		}
+	};
+	return {
+		checkLive,
+		release
+	};
+});
+const attempt = (f) => Effect.tryPromise({
+	try: f,
+	catch: toStateStoreError
+});
+/**
+* Wraps an already-`encodeState`d value as a jsonb-typed bind parameter.
+* Must go through `sql.json(...)` (not `JSON.stringify(...)::jsonb`) —
+* postgres.js re-serializes the parameter once it learns the server-inferred
+* type is jsonb, so a pre-stringified value passed through a `::jsonb` cast
+* gets JSON-encoded *twice* and lands as a jsonb string instead of an
+* object. `sql.json` gives postgres.js the raw value up front and declares
+* the jsonb oid itself, so it is serialized exactly once.
+*/
+const jsonParam = (sql, value) => sql.json(blindCast(encodeState(value)));
+/**
+* `reviveStateRecursive` is typed to return `unknown` — the caller is
+* expected to know the shape it revived. Here the shape is known by
+* construction: every row was written by `set()`, which persists a value
+* through `encodeState` first, so reviving it recovers a `PersistedState`.
+*/
+const revivePersistedState = (value) => blindCast(reviveStateRecursive(value));
+/** Same reasoning as {@link revivePersistedState}, narrowed by the SQL status filter. */
+const reviveReplacedResourceState = (value) => blindCast(reviveStateRecursive(value));
+/**
+* Builds alchemy's `StateService` over a caller-supplied postgres.js client,
+* against the two-table schema `migratePrismaState` creates. The caller owns
+* the client's lifecycle (connection pooling, reconnects, `.end()`); this
+* factory only issues queries.
+*/
+const makePrismaStateService = (sql) => ({
+	id: "prisma-postgres",
+	getVersion: () => Effect.succeed(STATE_STORE_VERSION),
+	listStacks: () => attempt(() => sql`
+        select stack from alchemy_resource_state
+        union
+        select stack from alchemy_stack_output
+        order by stack
+      `).pipe(Effect.map((rows) => rows.map((row) => row.stack))),
+	listStages: (stack) => attempt(() => sql`
+        select stage from alchemy_resource_state where stack = ${stack}
+        union
+        select stage from alchemy_stack_output where stack = ${stack}
+        order by stage
+      `).pipe(Effect.map((rows) => rows.map((row) => row.stage))),
+	get: (request) => attempt(() => sql`
+        select value from alchemy_resource_state
+        where stack = ${request.stack} and stage = ${request.stage} and fqn = ${request.fqn}
+      `).pipe(Effect.map((rows) => {
+		const row = rows[0];
+		return row === void 0 ? void 0 : revivePersistedState(row.value);
+	})),
+	getReplacedResources: (request) => attempt(() => sql`
+        select value from alchemy_resource_state
+        where stack = ${request.stack} and stage = ${request.stage}
+          and value ->> 'status' = 'replaced'
+      `).pipe(Effect.map((rows) => rows.map((row) => reviveReplacedResourceState(row.value)))),
+	set: (request) => attempt(() => sql`
+        insert into alchemy_resource_state (stack, stage, fqn, value, updated_at)
+        values (
+          ${request.stack}, ${request.stage}, ${request.fqn},
+          ${jsonParam(sql, request.value)}, now()
+        )
+        on conflict (stack, stage, fqn) do update
+          set value = excluded.value, updated_at = excluded.updated_at
+      `).pipe(Effect.map(() => request.value)),
+	delete: (request) => attempt(() => sql`
+        delete from alchemy_resource_state
+        where stack = ${request.stack} and stage = ${request.stage} and fqn = ${request.fqn}
+      `).pipe(Effect.asVoid),
+	deleteStack: (request) => attempt(async () => {
+		if (request.stage === void 0) {
+			await sql`delete from alchemy_resource_state where stack = ${request.stack}`;
+			await sql`delete from alchemy_stack_output where stack = ${request.stack}`;
+		} else {
+			await sql`
+          delete from alchemy_resource_state
+          where stack = ${request.stack} and stage = ${request.stage}
+        `;
+			await sql`
+          delete from alchemy_stack_output
+          where stack = ${request.stack} and stage = ${request.stage}
+        `;
+		}
+	}),
+	list: (request) => attempt(() => sql`
+        select fqn from alchemy_resource_state
+        where stack = ${request.stack} and stage = ${request.stage}
+        order by fqn
+      `).pipe(Effect.map((rows) => rows.map((row) => row.fqn))),
+	getOutput: (request) => attempt(() => sql`
+        select value from alchemy_stack_output
+        where stack = ${request.stack} and stage = ${request.stage}
+      `).pipe(Effect.map((rows) => {
+		const row = rows[0];
+		return row === void 0 ? void 0 : reviveStateRecursive(row.value);
+	})),
+	setOutput: (request) => attempt(() => sql`
+        insert into alchemy_stack_output (stack, stage, value, updated_at)
+        values (${request.stack}, ${request.stage}, ${jsonParam(sql, request.value)}, now())
+        on conflict (stack, stage) do update
+          set value = excluded.value, updated_at = excluded.updated_at
+      `).pipe(Effect.map(() => request.value))
+});
+/**
+* How long a passing lease check is trusted before the next storage
+* operation re-verifies it. A deploy issues many state ops in quick
+* succession, and each raw `checkLive` is a `pg_locks` round-trip; without
+* amortization the guard roughly doubles the store's traffic. The cost of the
+* window is bounded: a lease lost mid-window is detected within this many ms,
+* not instantly — an accepted tradeoff on top of the already-accepted
+* non-atomic (TOCTOU) gap between the check and the operation.
+*/
+const LEASE_CHECK_TTL_MS = 5e3;
+/**
+* Amortizes a lease check over a short TTL: a *passing* check is trusted for
+* `ttlMs`, so a burst of operations inside the window does one round-trip, not
+* one per op. A *failing* check is never cached — it propagates immediately
+* and leaves the last-good timestamp untouched, so the very next op re-checks.
+* The `lastOkAt` state is captured per call, so each store (each layer) gets
+* its own window — two stores in one process never share a cached success.
+*/
+const amortizeCheck = (checkLive, ttlMs, now) => {
+	let lastOkAt;
+	return Effect.suspend(() => {
+		if (lastOkAt !== void 0 && now() - lastOkAt < ttlMs) return Effect.void;
+		return checkLive.pipe(Effect.tap(() => Effect.sync(() => {
+			lastOkAt = now();
+		})));
+	});
+};
+/**
+* Wraps a {@link StateService} so every method that touches storage first
+* re-verifies the state lock's lease via `checkLive`. Used to enforce "a
+* dropped lock connection fails loudly" — see {@link ../lock.ts}. The check is
+* amortized over a short TTL (see {@link amortizeCheck}), so a run of
+* back-to-back operations does not fire one `pg_locks` round-trip per call.
+*
+* Reads are gated too, not just writes: a lost lease means a concurrent
+* deploy may already be mutating this stack's rows, so a read could return
+* stale or conflicting data — untrustworthy either way, not just the writes.
+* The check is best-effort and not atomic with the operation it guards (the
+* lease could be lost in the gap between `checkLive` passing and the wrapped
+* call executing, or within the TTL window); that residual race is accepted.
+*
+* `getVersion` is excluded: it returns a compile-time constant
+* (`STATE_STORE_VERSION`), so guarding it would only add a pointless
+* reserved-connection round-trip.
+*
+* `now` is injectable so tests can advance the clock deterministically; it
+* defaults to `Date.now` (fine in library runtime code — only Workflow
+* scripts forbid it).
+*/
+const guardStateService = (service, checkLive, now = Date.now) => {
+	const guard = amortizeCheck(checkLive, LEASE_CHECK_TTL_MS, now);
+	return {
+		id: service.id,
+		getVersion: () => service.getVersion(),
+		listStacks: () => guard.pipe(Effect.andThen(service.listStacks())),
+		listStages: (stack) => guard.pipe(Effect.andThen(service.listStages(stack))),
+		get: (request) => guard.pipe(Effect.andThen(service.get(request))),
+		getReplacedResources: (request) => guard.pipe(Effect.andThen(service.getReplacedResources(request))),
+		set: (request) => guard.pipe(Effect.andThen(service.set(request))),
+		delete: (request) => guard.pipe(Effect.andThen(service.delete(request))),
+		deleteStack: (request) => guard.pipe(Effect.andThen(service.deleteStack(request))),
+		list: (request) => guard.pipe(Effect.andThen(service.list(request))),
+		getOutput: (request) => guard.pipe(Effect.andThen(service.getOutput(request))),
+		setOutput: (request) => guard.pipe(Effect.andThen(service.setOutput(request)))
+	};
+};
+/**
+* The hosted Alchemy state store. On layer init (scoped, once per stack
+* run): find-or-create the workspace's `prisma-composer-state` project, mint a
+* fresh connection to its default database, migrate the schema, and
+* acquire the (stack, stage) advisory lock — see `bootstrap.ts` and
+* `lock.ts`. The Management API plumbing (`ManagementClient`,
+* `PrismaCredentials`) is provided internally, so the returned layer's
+* only requirements are the ones alchemy itself already provides to every
+* state store (`StackServices`).
+*
+* Any bootstrap/lock/migration failure is wrapped into an operator-facing
+* `HostedStateBootstrapError` (naming the workspace and the step that
+* failed, never the raw driver/API error — see `errors.ts`) before dying the
+* layer (loud, immediate, unrecoverable) rather than surfacing as a typed
+* error — matching core's `LowerOptions.state: Layer.Layer<State, never,
+* StackServices>` contract and alchemy's own convention (e.g. a missing
+* state store is `Effect.die` in `Stack.make`).
+*/
+const prismaState = (opts = {}) => {
+	const workspaceId = opts.workspaceId ?? process.env["PRISMA_WORKSPACE_ID"];
+	if (workspaceId === void 0 || workspaceId.length === 0) throw new Error("prismaState(): environment variable PRISMA_WORKSPACE_ID is required.");
+	return Layer.effect(State, Effect.gen(function* () {
+		const stack = yield* Stack;
+		const bootstrapError = (step) => (cause) => hostedStateBootstrapError(workspaceId, step, cause);
+		const { connectionString } = yield* bootstrapStateConnection(workspaceId).pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))), Effect.mapError(bootstrapError("finding/creating the prisma-composer-state project")));
+		const sql = postgres(Redacted.value(connectionString), {
+			max: 5,
+			onnotice: () => {}
+		});
+		yield* Effect.addFinalizer(() => Effect.promise(() => sql.end({ timeout: 5 })));
+		yield* migratePrismaState(sql).pipe(Effect.retry(Schedule.both(Schedule.spaced("5 seconds"), Schedule.during("2 minutes"))), Effect.mapError(bootstrapError("schema migration")));
+		const lock = yield* acquireStateLock(sql, stack.name, stack.stage).pipe(Effect.mapError(bootstrapError("lock acquisition")));
+		yield* Effect.addFinalizer(() => Effect.promise(() => lock.release()));
+		const service = guardStateService(makePrismaStateService(sql), lock.checkLive);
+		return Effect.succeed(service);
+	})).pipe(Layer.orDie);
+};
+//#endregion
+//#region ../../1-prisma-cloud/1-extensions/target/dist/control.mjs
+const PRISMA_NAME_MIN = 3;
+const PRISMA_NAME_MAX = 65;
+function validateName(value, source) {
+	if (value.length < PRISMA_NAME_MIN || value.length > PRISMA_NAME_MAX) throw new Error(`prisma-cloud: ${source} "${value}" (${value.length} characters) is not a valid Prisma resource name — Prisma requires ${PRISMA_NAME_MIN}–${PRISMA_NAME_MAX} characters. Rename the provision id (or the deploy --name) to fit.`);
+}
+/** The application/provisioned hook's `projectId` output — `LoweredNode.outputs` is typed `unknown`, so this is the one asserted read. */
+const projectIdOf = (hook) => blindCast(hook.outputs["projectId"]);
+function computeDescriptor(o) {
+	return {
+		kind: "service",
+		provision: ({ id, application }) => Effect.gen(function* () {
+			validateName(id, "service name (from provision id)");
+			return { outputs: {
+				serviceId: (yield* ComputeService(`${id}-svc`, {
+					projectId: projectIdOf(application),
+					name: id,
+					region: o.region ?? "us-east-1",
+					...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+				})).id,
+				projectId: application.outputs["projectId"]
+			} };
+		}),
+		serialize: ({ address, node, graph }, provisioned, config) => Effect.gen(function* () {
+			const cls = o.branchId ? "preview" : "production";
+			const branch = o.branchId !== void 0 ? { branchId: o.branchId } : {};
+			const projectId = projectIdOf(provisioned);
+			const svc = node;
+			const records = [];
+			for (const d of paramEntries(svc)) {
+				const value = d.owner === "service" ? config.service[d.name] : config.inputs[d.owner.input]?.[d.name];
+				const key = configKey(address, d);
+				records.push(yield* EnvironmentVariable(`${key}-var`, {
+					projectId,
+					key,
+					value: encode(d.owner, value),
+					class: cls,
+					...branch
+				}));
+			}
+			for (const { key, name } of secretPointerRows(svc, address, graph.secrets)) records.push(yield* EnvironmentVariable(`${key}-var`, {
+				projectId,
+				key,
+				value: name,
+				class: cls,
+				...branch
+			}));
+			return { outputs: {
+				environment: records,
+				port: typeof config.service["port"] === "number" ? config.service["port"] : 3e3
+			} };
+		}),
+		package: ({ id }, { assembled, address }) => Effect.try(() => packageComputeArtifact({
+			id,
+			bundleDir: assembled.dir,
+			appEntry: assembled.entry,
+			address
+		})),
+		deploy: ({ id }, provisioned, artifact, serialized) => Effect.gen(function* () {
+			return { outputs: {
+				url: (yield* Deployment(`${id}-deploy`, {
+					computeServiceId: provisioned.outputs["serviceId"],
+					artifactPath: artifact.path,
+					artifactHash: artifact.sha256,
+					environment: serialized.outputs["environment"],
+					port: typeof serialized.outputs["port"] === "number" ? serialized.outputs["port"] : 3e3
+				})).deployedUrl,
+				projectId: provisioned.outputs["projectId"]
+			} };
+		})
+	};
+}
+/**
+* The `PgWarm` Alchemy resource (slice 3, FT-5226) — warm a freshly-provisioned
+* Prisma Postgres database at apply-time so it is ready by deploy-end, and the
+* first real connection (a service's runtime client, or the migration) doesn't
+* eat the cold-start reject.
+*
+* The DB `url` is a lazy `Output` at lowering time, so warming must be an
+* apply-time tracked resource (same pattern as `PnMigration`): its `reconcile`
+* receives the RESOLVED url and connects with `withConnectionRetry` + `select 1`,
+* riding out the cold-start. Shared by BOTH the bare-`postgres` and the
+* `prisma-next` lowerings; keyed on the connection `url`, so an unchanged
+* redeploy is a no-op (warming is idempotent anyway).
+*
+* Deploy-time only: imports `pg` directly + `alchemy`. Imported by `control.ts`
+* and tests, never by `index.ts` / the `./prisma-next` authoring entry — the
+* isolation invariants hold.
+*/
+/** The `PgWarm` resource constructor — `yield* PgWarm(id, { url })` in a lowering. */
+const PgWarm = Resource("PrismaCloud.PgWarm");
+/** Connect (retrying the cold-start) and run `select 1`, then release the connection. */
+async function warmDatabase(url) {
+	await withConnectionRetry(async () => {
+		const client = new pg.Client({ connectionString: normalizeSslMode(url) });
+		await client.connect();
+		try {
+			await client.query("select 1");
+		} finally {
+			await client.end();
+		}
+	});
+}
+/**
+* The `PgWarm` provider service. `reconcile` warms the DB (retrying the
+* cold-start) and echoes the `url` so a downstream resource that reads
+* `warm.url` runs only after the DB is warm. Idempotent — safe on redeploy;
+* nothing to enumerate (`list` → `[]`) or tear down (`delete` → no-op; the DB's
+* own deletion handles teardown). Exported so tests can drive it directly.
+*/
+const pgWarmProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ news }) => Effect.tryPromise({
+		try: () => warmDatabase(news.url),
+		catch: (error) => error
+	}).pipe(Effect.map(() => ({ url: news.url }))),
+	delete: () => Effect.void
+};
+/** The `PgWarm` provider layer — merged into the extension descriptor's `providers()`. */
+const PgWarmProvider = () => Provider.effect(PgWarm, Effect.succeed(pgWarmProviderService));
+/**
+* One Database per module-provisioned postgres resource — `id` is the
+* module provision id, so a resource shared by several consumers is created
+* exactly once.
+*/
+function postgresDescriptor(o) {
+	const lowering = ({ id, application }) => Effect.gen(function* () {
+		validateName(id, "resource name (from provision id)");
+		const db = yield* Database(`${id}-db`, {
+			projectId: projectIdOf(application),
+			name: id,
+			region: o.region ?? "us-east-1",
+			...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+		});
+		const conn = yield* Connection(`${id}-conn`, {
+			databaseId: db.id,
+			name: id
+		});
+		const url = Output.map(conn.connectionString, (value) => Redacted.value(value));
+		return { outputs: { url: (yield* PgWarm(`${id}-warm`, { url })).url } };
+	});
+	return Object.assign(lowering, { kind: "resource" });
+}
+/**
+* Resolves a `pnPostgres` resource's `prisma-next.config.ts` path to the
+* on-disk migrations directory the control client's `migrate`/`dbInit` needs
+* (ADR-0022, slice 2). Deploy-time only: loads PN's config (via c12) and
+* applies PN's own convention — `migrations.dir`, or the default `migrations/`,
+* relative to the config file's directory (mirrors the CLI's
+* `resolveMigrationPaths`). Imported by `control.ts` + tests, never by
+* `index.ts` / the `./prisma-next` authoring entry.
+*
+* `pathe` (not `node:path`) does the path work so the shipped source carries no
+* `node:` import — the same discipline `control.ts` already follows by
+* delegating fs/tar to `@internal/lowering` (invariant 5).
+*/
+/** The absolute migrations directory PN reads authored migration packages from. */
+async function resolveMigrationsDir(configPath) {
+	return resolve(configPath, "..", (await loadConfig(configPath)).migrations?.dir ?? "migrations");
+}
+/**
+* The Prisma Next migration step of the deploy lowering (ADR-0022, slice 2) —
+* the safety-critical decision that brings a live database to a target REF
+* using ONLY Prisma Next's authored migrations.
+*
+* Deploy-time only: this module imports `@prisma-next/postgres/control` (which
+* transitively pulls PN's control/migration machinery + `pg`). It is imported
+* by the deploy descriptors and this package's tests, NEVER by `index.ts` / the
+* `./prisma-next` authoring entry — so it never lands in an app runtime bundle
+* (the index-isolation invariant holds).
+*
+* The target is a ref `{ hash, invariants }` — not a bare `storageHash`. A
+* ref's `invariants` are named postconditions established by `data`-class
+* migration steps (e.g. a backfill), recorded monotonically on the live
+* marker. Keying on the hash alone would make a pure data-invariant change an
+* A→A self-edge the deploy wrongly skips. The decision, given the live marker
+* and the target ref (see {@link decideMigrationAction}):
+*   - marker at ref.hash AND ref.invariants ⊆ marker.invariants → no-op
+*   - no marker (fresh DB) AND no required invariants           → `dbInit`
+*   - otherwise                                                  → `migrate`
+*
+* `dbInit` is additive-only synthesis — it NEVER runs app-space data steps —
+* so it is only correct when the ref requires no invariants; a fresh DB whose
+* target carries invariants goes through `migrate`, which walks the AUTHORED
+* graph (including the invariant-bearing data migrations) from empty.
+*
+* Never `dbUpdate`: synthesized diff-and-apply plans are never run against a
+* deployed database. A no-authored-path (`MIGRATION_PATH_NOT_FOUND`) or a
+* runner failure fails the deploy as a typed `PnMigrationError` (not swallowed).
+* PN applies each migration in its own transaction, so a failed apply is atomic
+* and resume-safe — the marker and schema are left as the last committed step.
+*/
+/** A deploy-failing migration error — surfaced, never swallowed. */
+var PnMigrationError = class extends Error {
+	code;
+	/** PN's structured explanation, when present. */
+	why;
+	constructor(code, summary, why) {
+		super(`prisma-next migrate (${code}): ${summary}`);
+		this.name = "PnMigrationError";
+		this.code = code;
+		this.why = why;
+	}
+};
+/**
+* The target `storageHash` a contract heads to — `contractJson.storage.storageHash`.
+* Read defensively: `contractJson` crosses the boundary as `unknown`.
+*/
+function targetStorageHash(contractJson) {
+	if (typeof contractJson === "object" && contractJson !== null && "storage" in contractJson) {
+		const storage = contractJson.storage;
+		if (typeof storage === "object" && storage !== null && "storageHash" in storage) {
+			const hash = storage.storageHash;
+			if (typeof hash === "string" && hash.length > 0) return hash;
+		}
+	}
+	throw new PnMigrationError("INIT_FAILED", "the contract has no storage.storageHash — cannot determine the target schema version");
+}
+/**
+* Resolve the deploy's target ref from the migrations dir.
+*
+* - `targetRef` named: read `migrations/app/refs/<name>.json` — fail loudly
+*   (`TARGET_REF_NOT_FOUND`) when the ref doesn't exist or can't be parsed.
+* - Default: the app space's head. PN synthesizes the app head from the
+*   emitted contract — `{ hash: contract.storage.storageHash, invariants: [] }`
+*   (`contract emit` writes no app-space `refs/head.json` today; extension
+*   spaces have one on disk). When a future PN version does emit one, the
+*   on-disk `head.json` wins — read via `readContractSpaceHeadRef`, exactly
+*   the loader PN's own migrate uses.
+*/
+async function resolveTargetRef(migrationsDir, contractJson, targetRef) {
+	if (targetRef !== void 0) {
+		const refsDir = spaceRefsDirectory(spaceMigrationDirectory(migrationsDir, APP_SPACE_ID));
+		try {
+			const ref = await readRef(refsDir, targetRef);
+			return {
+				hash: ref.hash,
+				invariants: ref.invariants
+			};
+		} catch (error) {
+			throw new PnMigrationError("TARGET_REF_NOT_FOUND", `targetRef "${targetRef}" could not be read from ${refsDir}`, error instanceof Error ? error.message : String(error));
+		}
+	}
+	const head = await readContractSpaceHeadRef(migrationsDir, APP_SPACE_ID);
+	if (head !== null) return {
+		hash: head.hash,
+		invariants: head.invariants
+	};
+	return {
+		hash: targetStorageHash(contractJson),
+		invariants: []
+	};
+}
+/**
+* The pure migration decision, mirroring PN's own verifier: the database is
+* AT the target when the marker's hash equals the ref's hash AND every ref
+* invariant is on the marker (marker invariants are monotonic). `dbInit` is
+* additive-only synthesis, so it is chosen only for a fresh DB whose
+* effective required invariants (`ref.invariants − marker.invariants`) are
+* empty; anything else — different hash, missing invariant (the A→A
+* data-only self-edge), or a fresh DB with required invariants — walks the
+* authored graph via `migrate`.
+*/
+function decideMigrationAction(marker, ref) {
+	const markerInvariants = new Set(marker?.invariants ?? []);
+	const missing = ref.invariants.filter((id) => !markerInvariants.has(id));
+	if (marker !== null && marker.storageHash === ref.hash && missing.length === 0) return "noop";
+	if (marker === null && missing.length === 0) return "init";
+	return "migrate";
+}
+/**
+* Bring the database at `url` to the target ref via PN's authored migrations.
+* Reads the live marker, decides no-op / init / migrate
+* ({@link decideMigrationAction}), applies, and throws a typed
+* {@link PnMigrationError} on a no-path or runner failure. `migrationsDir` is
+* the on-disk migrations root and `ref` the resolved target
+* ({@link resolveTargetRef} — both resolved by the lowering, which also keys
+* the PnMigration resource on them). `refName` (the resource's `targetRef`,
+* when set) is threaded into `migrate` so PN targets the named ref's hash and
+* plans an invariant-bearing path.
+*/
+async function applyPnMigration(opts) {
+	const connection = normalizeSslMode(opts.url);
+	return withConnectionRetry(() => runMigration(connection, opts.contractJson, opts.migrationsDir, opts.ref, opts.refName), { shouldRetry: (error) => !(error instanceof PnMigrationError) });
+}
+async function runMigration(connection, contractJson, migrationsDir, ref, refName) {
+	const client = createPostgresControlClient({ connection });
+	await client.connect();
+	try {
+		const marker = await client.readMarker();
+		const markerHashBefore = marker?.storageHash ?? null;
+		const action = decideMigrationAction(marker, ref);
+		if (action === "noop") return {
+			action,
+			targetHash: ref.hash,
+			markerHashBefore
+		};
+		if (action === "init") {
+			const result = await client.dbInit({
+				contract: contractJson,
+				mode: "apply",
+				migrationsDir
+			});
+			if (!result.ok) throw new PnMigrationError("INIT_FAILED", result.failure.summary, result.failure.why);
+			return {
+				action,
+				targetHash: ref.hash,
+				markerHashBefore
+			};
+		}
+		const result = await client.migrate({
+			contract: contractJson,
+			migrationsDir,
+			...refName !== void 0 ? {
+				refHash: ref.hash,
+				refInvariants: ref.invariants,
+				refName
+			} : {}
+		});
+		if (!result.ok) throw new PnMigrationError(result.failure.code === "MIGRATION_PATH_NOT_FOUND" ? "MIGRATION_PATH_NOT_FOUND" : "RUNNER_FAILED", result.failure.summary, result.failure.why);
+		return {
+			action,
+			targetHash: ref.hash,
+			markerHashBefore
+		};
+	} finally {
+		await client.close();
+	}
+}
+/**
+* The `PnMigration` Alchemy resource (ADR-0022, slice 2 D2) — the migration
+* step modeled as a tracked resource so it participates in deploy state: keyed
+* on the target REF identity (`targetHash` + sorted `invariants`), an
+* unchanged redeploy is an Alchemy-level no-op (on top of the marker read),
+* and a contract change — or a DATA-ONLY change that adds a ref invariant at
+* the same hash — re-runs the migration.
+*
+* Its provider's `reconcile` receives the RESOLVED props at apply-time — in
+* particular the concrete DB `url` (a lazy `Output` until the Connection
+* provisions) — and delegates to the proven `applyPnMigration` decision. The
+* provider is a standalone `Provider<PnMigration>` layer; the extension
+* descriptor merges it into its `providers()` (`Layer.merge(Prisma.providers(),
+* PnMigrationProvider())`), and Alchemy resolves it at apply via a direct
+* provider-tag lookup (`tryFindProviderByType`) — no change to `@internal/lowering`.
+*
+* Deploy-time only: imports `@prisma-next/postgres/control` (via the helper) +
+* `alchemy`. Imported by `control.ts` and tests, never by `index.ts` / the
+* `./prisma-next` authoring entry — index isolation holds.
+*/
+/** The `PnMigration` resource constructor — `yield* PnMigration(id, props)` in the lowering. */
+const PnMigration = Resource("PrismaNext.Migration");
+/**
+* The `PnMigration` provider service. `reconcile` runs for both create and
+* update (Alchemy's unified lifecycle); `applyPnMigration` is idempotent via
+* the live marker read, so it is safe to run for either — the marker decides
+* no-op / init / migrate. A migration has nothing to enumerate (`list` → `[]`)
+* and nothing to tear down on its own (`delete` → no-op; the DB's own deletion
+* handles teardown). Exported so tests can drive `reconcile` directly, without
+* building an Effect layer.
+*/
+const pnMigrationProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ news }) => Effect.tryPromise({
+		try: () => applyPnMigration({
+			url: news.url,
+			contractJson: news.contractJson,
+			migrationsDir: news.migrationsDir,
+			ref: {
+				hash: news.targetHash,
+				invariants: news.invariants
+			},
+			...news.refName !== void 0 ? { refName: news.refName } : {}
+		}),
+		catch: (error) => error
+	}).pipe(Effect.map((outcome) => ({
+		storageHash: outcome.targetHash,
+		invariants: news.invariants
+	}))),
+	delete: () => Effect.void
+};
+/** The `PnMigration` provider layer — merged into the extension descriptor's `providers()`. */
+const PnMigrationProvider = () => Provider.effect(PnMigration, Effect.succeed(pnMigrationProviderService));
+/**
+* The migration is a tracked `PnMigration` Alchemy resource keyed on the
+* target REF identity (hash + sorted invariants): unchanged redeploy is a
+* no-op, a contract or ref-invariant change re-migrates.
+*/
+function prismaNextDescriptor(o) {
+	const lowering = ({ id, node, application }) => Effect.gen(function* () {
+		validateName(id, "resource name (from provision id)");
+		const db = yield* Database(`${id}-db`, {
+			projectId: projectIdOf(application),
+			name: id,
+			region: o.region ?? "us-east-1",
+			...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+		});
+		const conn = yield* Connection(`${id}-conn`, {
+			databaseId: db.id,
+			name: id
+		});
+		const url = Output.map(conn.connectionString, (value) => Redacted.value(value));
+		if (!isPnPostgresResourceNode(node)) throw new Error(`prisma-next lowering received a non-prisma-next node (${id}).`);
+		const contractJson = node.provides.__cmp.contractJson;
+		const migrationsDir = yield* Effect.promise(() => resolveMigrationsDir(node.config));
+		const ref = yield* Effect.promise(() => resolveTargetRef(migrationsDir, contractJson, node.targetRef));
+		const warm = yield* PgWarm(`${id}-warm`, { url });
+		yield* PnMigration(`${id}-migrate`, {
+			url: warm.url,
+			contractJson,
+			migrationsDir,
+			targetHash: ref.hash,
+			invariants: [...ref.invariants].sort(),
+			...node.targetRef !== void 0 ? { refName: node.targetRef } : {}
+		});
+		return { outputs: { url: warm.url } };
+	});
+	return Object.assign(lowering, { kind: "resource" });
+}
+/**
+* The `S3Credentials` Alchemy resource (S5) — mints a random SigV4 key pair
+* ONCE at create and keeps it STABLE across deploys, so an unchanged module
+* no-ops on redeploy. The pair is generated with the Web Crypto global
+* (`crypto.getRandomValues` — no `node:` import, matching this package's
+* runtime-coupling invariant) and persisted in Alchemy state; on every later
+* apply the provider returns the persisted attributes (`reconcile`'s `output`)
+* unchanged — the same way the postgres resource keeps a Connection stable.
+* Rotation is destroy/recreate (a platform ask, not solved here).
+*
+* Deploy-time only: imports `alchemy`. Imported by `control.ts` and tests,
+* never by `index.ts` / the authoring entry.
+*/
+/** The `S3Credentials` resource constructor — `yield* S3Credentials(id, {})` in the lowering. */
+const S3Credentials = Resource("PrismaCloud.S3Credentials");
+function randomBytes(n) {
+	return crypto.getRandomValues(new Uint8Array(n));
+}
+function toHexUpper(bytes) {
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
+}
+/** A fresh SigV4 key pair: an AKIA-prefixed id and a 40-char base64 secret. */
+function mintKeyPair() {
+	return {
+		accessKeyId: `AKIA${toHexUpper(randomBytes(8))}`,
+		secretAccessKey: btoa(String.fromCharCode(...randomBytes(30)))
+	};
+}
+/**
+* The `S3Credentials` provider service. `reconcile` runs for create and update;
+* it returns the persisted `output` when present (a redeploy reuses the stored
+* pair — the no-op property) and mints a fresh pair only on first create.
+* Nothing to enumerate (`list` → `[]`) or tear down (`delete` → no-op; the pair
+* lives only in state). Exported so tests can drive it directly.
+*/
+const s3CredentialsProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ output }) => Effect.sync(() => output ?? mintKeyPair()),
+	delete: () => Effect.void
+};
+/** The `S3Credentials` provider layer — merged into the extension descriptor's `providers()`. */
+const S3CredentialsProvider = () => Provider.effect(S3Credentials, Effect.succeed(s3CredentialsProviderService));
+/**
+* One `S3Credentials` resource per provisioned credentials node — `id` is the
+* module provision id, so a pair shared by the storage service is minted once
+* and kept stable across deploys (the resource's provider preserves it).
+* `_o` is unused today (the mint needs no region/project) but kept for symmetry
+* with the other descriptors' signature.
+*/
+function s3CredentialsDescriptor(_o) {
+	const lowering = ({ id }) => Effect.gen(function* () {
+		const creds = yield* S3Credentials(`${id}-creds`, {});
+		return { outputs: {
+			accessKeyId: creds.accessKeyId,
+			secretAccessKey: creds.secretAccessKey
+		} };
+	});
+	return Object.assign(lowering, { kind: "resource" });
+}
+function s3StoreDescriptor(o) {
+	const base = computeDescriptor(o);
+	if (base.kind !== "service") throw new Error("computeDescriptor must be a service descriptor");
+	return {
+		kind: "service",
+		provision: base.provision,
+		package: base.package,
+		serialize: (ctx, provisioned, config) => Effect.gen(function* () {
+			const serialized = yield* base.serialize(ctx, provisioned, config);
+			const credentials = config.inputs["credentials"] ?? {};
+			const bucket = config.service["bucket"];
+			if (credentials["accessKeyId"] === void 0 || credentials["secretAccessKey"] === void 0 || bucket === void 0) throw new Error("s3-store service must wire a 'credentials' dependency and a 'bucket' param");
+			return { outputs: {
+				...serialized.outputs,
+				bucket,
+				accessKeyId: credentials["accessKeyId"],
+				secretAccessKey: credentials["secretAccessKey"]
+			} };
+		}),
+		deploy: (ctx, provisioned, artifact, serialized) => Effect.gen(function* () {
+			return { outputs: {
+				...(yield* base.deploy(ctx, provisioned, artifact, serialized)).outputs,
+				bucket: serialized.outputs["bucket"],
+				accessKeyId: serialized.outputs["accessKeyId"],
+				secretAccessKey: serialized.outputs["secretAccessKey"]
+			} };
+		})
+	};
+}
+/**
+* Deploy preflight (ADR-0029): before Alchemy runs, verify every secret binding
+* in the app's provision manifest (each a platform env-var NAME) exists on Prisma
+* Cloud for the target stage.
+* A name absent on the platform but present in the deploy shell is provisioned
+* via a direct Management API POST — NEVER an Alchemy resource, so the value
+* never lands in hosted deploy state. A name absent from both fails the deploy,
+* listing exactly what is missing and where to set it.
+*
+* Control-plane only (imported by control.ts → prisma-composer.config.ts); runs
+* in the CLI parent, so it builds its own Management API client from env — the
+* same credential path `ensureContainers` uses.
+*/
+/** production for the default stage; preview for a named stage — matching how the pack writes config rows. */
+const classFor = (branchId) => branchId === void 0 ? "production" : "preview";
+/**
+* One page of the env-var list. The query is `blindCast` to `never` because
+* openapi-fetch types this path's query as `never` (an SDK path/operation
+* mismatch); that same workaround defeats the client's response-type inference,
+* so the result is projected to the small shape we actually read.
+*/
+async function listEnvVars(client, query) {
+	return blindCast(await client.GET("/v1/environment-variables", { params: { query: blindCast(query) } }));
+}
+async function existsOnPlatform(client, projectId, branchId, key) {
+	const cls = classFor(branchId);
+	const visible = (row) => branchId === void 0 || row.branchId === null || row.branchId === branchId;
+	let cursor = null;
+	do {
+		const res = await listEnvVars(client, cursor === null ? {
+			projectId,
+			class: cls,
+			key
+		} : {
+			projectId,
+			class: cls,
+			key,
+			cursor
+		});
+		if (res.error !== void 0) throw listFailedError(key, res.error);
+		const page = res.data;
+		if (page === void 0) return false;
+		if (page.data.some(visible)) return true;
+		cursor = page.pagination.hasMore ? page.pagination.nextCursor : null;
+	} while (cursor !== null);
+	return false;
+}
+/**
+* Provision `key`=`value` directly via the Management API for the target
+* stage's scope (a production template for the default stage; a preview branch
+* override for a named stage — the same scope the pack writes config rows to,
+* EnvironmentVariable.ts). A 409 means a concurrent deploy already provisioned
+* it — tolerated. The value is never logged.
+*/
+async function fillMissing(client, input, key, value) {
+	const res = await client.POST("/v1/environment-variables", { body: {
+		projectId: input.projectId,
+		class: classFor(input.branchId),
+		key,
+		value,
+		...input.branchId !== void 0 ? { branchId: input.branchId } : {}
+	} });
+	if (res.error !== void 0 && res.response.status !== 409) throw fillFailedError(key, res.error);
+}
+const tokenRequiredError = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required for deploy preflight.");
+const listFailedError = (key, error) => /* @__PURE__ */ new Error(`deploy preflight: Prisma Management API error listing "${key}": ${JSON.stringify(error)}.`);
+const fillFailedError = (key, error) => /* @__PURE__ */ new Error(`deploy preflight: failed to provision "${key}" from the deploy shell: ${JSON.stringify(error)}.`);
+function missingError(missing, input) {
+	const scope = input.branchId === void 0 ? "the production class (project-level template)" : `the preview class of stage "${input.stage ?? input.branchId}" (branch override or template)`;
+	const lines = missing.map((m) => `  - ${m.name}  (required by service "${m.serviceAddress}")`);
+	return /* @__PURE__ */ new Error(`Deploy preflight failed — ${missing.length} secret env var(s) are not provisioned on Prisma Cloud for ${scope}, and are absent from the deploy shell:\n${lines.join("\n")}\n\nSet each in the deploy shell environment (the CLI will provision it on deploy), or create it on the platform (Prisma Console or the Management API) in ${scope}.`);
+}
+async function managementClient() {
+	if ((process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw tokenRequiredError();
+	return Effect.runPromise(Effect.gen(function* () {
+		return yield* ManagementClient;
+	}).pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv())))));
+}
+/**
+* The Prisma Cloud extension's `preflight`. Aggregates the target-agnostic
+* manifest (core's `provisionManifest`), checks each pointer secret against the
+* platform, fills from the shell where possible, and fails loudly on anything
+* absent from both. Accepts an injected client for tests; otherwise builds one
+* from env.
+*/
+async function runPreflight(input, deps) {
+	const manifest = provisionManifest(input.graph);
+	if (manifest.length === 0) return;
+	const names = /* @__PURE__ */ new Map();
+	for (const binding of manifest) if (!names.has(secretName(binding))) names.set(secretName(binding), {
+		name: secretName(binding),
+		serviceAddress: binding.serviceAddress
+	});
+	const client = deps?.client ?? await managementClient();
+	const missing = [];
+	for (const meta of names.values()) {
+		if (await existsOnPlatform(client, input.projectId, input.branchId, meta.name)) continue;
+		const shellValue = process.env[meta.name];
+		if (shellValue !== void 0 && shellValue.length > 0) {
+			await fillMissing(client, input, meta.name, shellValue);
+			continue;
+		}
+		missing.push(meta);
+	}
+	if (missing.length > 0) throw missingError(missing, input);
+}
+/** The Prisma Cloud–hosted deploy state store; its implementation lives in @internal/lowering. */
+const KNOWN_REGION_SET = new Set(COMPUTE_REGIONS);
+function isComputeRegion(value) {
+	return KNOWN_REGION_SET.has(value);
+}
+/** Prisma.providers()'s ProviderCollection doesn't structurally unify with Alchemy's inferred providers Layer (a @internal/lowering typings gap); it satisfies it at runtime. */
+function asProvidersLayer(layer) {
+	return layer;
+}
+/**
+* Resolves the factory's env-or-option inputs, failing fast with the exact
+* variable name. `projectId`/`branchId` aren't required here — `prismaCloud()`
+* also runs in the CLI parent, before they're set; the required check lives in `application.provision`.
+*/
+function resolveOptions(opts) {
+	const workspaceId = opts.workspaceId ?? process.env["PRISMA_WORKSPACE_ID"];
+	if (workspaceId === void 0 || workspaceId.length === 0) throw new Error("prismaCloud(): environment variable PRISMA_WORKSPACE_ID is required.");
+	const projectId = process.env["PRISMA_PROJECT_ID"] || void 0;
+	const branchId = process.env["PRISMA_BRANCH_ID"] || void 0;
+	if (opts.region !== void 0) return {
+		workspaceId,
+		region: opts.region,
+		projectId,
+		branchId
+	};
+	const region = process.env["PRISMA_REGION"];
+	if (region === void 0 || region.length === 0) return {
+		workspaceId,
+		projectId,
+		branchId
+	};
+	if (!isComputeRegion(region)) throw new Error(`prismaCloud(): environment variable PRISMA_REGION="${region}" is not a known region (expected one of: ${COMPUTE_REGIONS.join(", ")}).`);
+	return {
+		workspaceId,
+		region,
+		projectId,
+		branchId
+	};
+}
+/** The Prisma Cloud extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */
+const prismaCloud = (opts = {}) => {
+	const o = resolveOptions(opts);
+	return {
+		id: "@prisma/composer-prisma-cloud",
+		providers: () => asProvidersLayer(Layer.mergeAll(providers(), PgWarmProvider(), PnMigrationProvider(), S3CredentialsProvider())),
+		preflight: (input) => runPreflight(input),
+		application: { provision: () => Effect.gen(function* () {
+			const projectId = o.projectId;
+			if (projectId === void 0 || projectId.length === 0) throw new Error("prismaCloud(): environment variable PRISMA_PROJECT_ID is required (the CLI sets it — deploy via `prisma-composer deploy`).");
+			for (const key of ["DATABASE_URL", "DATABASE_URL_POOLED"]) yield* EnvironmentVariable(`${key}-poison`, {
+				projectId,
+				key,
+				value: "-",
+				class: o.branchId ? "preview" : "production",
+				...o.branchId !== void 0 ? { branchId: o.branchId } : {}
+			});
+			return { outputs: { projectId } };
+		}) },
+		nodes: {
+			postgres: postgresDescriptor(o),
+			"prisma-next": prismaNextDescriptor(o),
+			compute: computeDescriptor(o),
+			credentials: s3CredentialsDescriptor(o),
+			"s3-store": s3StoreDescriptor(o)
+		}
+	};
+};
+//#endregion
+export { prismaCloud, prismaState };
+
+//# sourceMappingURL=control.mjs.map