@prisma/composer-prisma-cloud 0.2.0-dev.12 → 0.2.0-dev.14

package/dist/preflight-names-BPL-qsZF-BfoRgbgb.mjs

@@ -0,0 +1,1252 @@
+import { n as secretName } from "./secret-rz_ZqNeq-_xd97Jd9.mjs";
+import { i as paramName, n as isEnvParamSource } from "./param-BTzY0ne5-CW6ojZ3E.mjs";
+import { r as withConnectionRetry, t as normalizeSslMode } from "./pg-connection-CadPZuEK-CF3FsSQu.mjs";
+import { paramManifest, provisionManifest } from "@prisma/composer";
+import { createManagementApiClient } from "@prisma/management-api-sdk";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Config$1 from "effect/Config";
+import * as Data from "effect/Data";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy";
+import * as Schedule from "effect/Schedule";
+import * as fs from "node:fs";
+import * as crypto$1 from "node:crypto";
+import "node:crypto";
+import * as os$1 from "node:os";
+import * as path from "node:path";
+import * as zlib from "node:zlib";
+import pg from "pg";
+import { readRef } from "@prisma-next/migration-tools/refs";
+import { APP_SPACE_ID, readContractSpaceHeadRef, spaceMigrationDirectory, spaceRefsDirectory } from "@prisma-next/migration-tools/spaces";
+import { createPostgresControlClient } from "@prisma-next/postgres/control";
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CJM0E6rj.mjs
+/**
+* The Prisma service token used to authenticate Management API calls. Kept
+* as a Redacted value so it never lands in logs or error output.
+*/
+var PrismaCredentials = class extends Context.Service()("PrismaCredentials") {};
+/** Resolve the token from the `PRISMA_SERVICE_TOKEN` environment variable. */
+const fromEnv = () => Layer.effect(PrismaCredentials, Effect.gen(function* () {
+	return { token: yield* Config$1.redacted("PRISMA_SERVICE_TOKEN") };
+}));
+/**
+* The typed Prisma Management API client, built once from the resolved
+* credentials. Providers yield this in their outer Effect and call it inside
+* `reconcile` / `delete`.
+*/
+var ManagementClient = class extends Context.Service()("PrismaManagementClient") {};
+const layer = () => Layer.effect(ManagementClient, Effect.gen(function* () {
+	const { token } = yield* PrismaCredentials;
+	return createManagementApiClient({ token: Redacted.value(token) });
+}));
+/** A non-2xx response from the Management API (or a transport failure). */
+var PrismaApiError = class extends Data.TaggedError("PrismaApiError") {};
+const attempt = (f) => Effect.tryPromise({
+	try: f,
+	catch: (cause) => new PrismaApiError({
+		status: 0,
+		message: String(cause)
+	})
+});
+const fail = (r) => Effect.fail(new PrismaApiError({
+	status: r.response.status,
+	message: JSON.stringify(r.error)
+}));
+/** Unwrap `data`, failing on any API error. Preserves the SDK's response type. */
+const call = (f) => attempt(f).pipe(Effect.flatMap((r) => r.error !== void 0 || r.data === void 0 ? fail(r) : Effect.succeed(r.data)));
+/** Unwrap `data`, mapping a 404 to `undefined` (resource gone / not found). */
+const callOptional = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status === 404 ? Effect.succeed(void 0) : r.error !== void 0 ? fail(r) : Effect.succeed(r.data)));
+/** Fire-and-forget a call, tolerating a 404 (already deleted). */
+const callVoid = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/buckets.mjs
+/** A Prisma **Object Store bucket** inside a project. */
+const Bucket = Resource("Prisma.Bucket");
+const BucketProvider = () => Provider.effect(Bucket, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } })) : void 0;
+			if (observed) return {
+				id: observed.data.id,
+				name: observed.data.name
+			};
+			const created = yield* call(() => client.POST("/v1/buckets", { body: {
+				projectId: news.projectId,
+				name: news.name,
+				...news.branchId !== void 0 ? { branchId: news.branchId } : {}
+			} }));
+			return {
+				id: created.data.id,
+				name: created.data.name
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const b = yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
+			return b ? {
+				id: b.data.id,
+				name: b.data.name
+			} : void 0;
+		})
+	};
+}));
+/** A **bucket access key** for a Prisma Object Store bucket — yields the S3 credentials. */
+const BucketKey = Resource("Prisma.BucketKey");
+const BucketKeyProvider = () => Provider.effect(BucketKey, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: [
+			"id",
+			"bucketId",
+			"secretAccessKey",
+			"accessKeyId",
+			"endpoint",
+			"bucketName"
+		],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			if (output?.id) return output;
+			const created = yield* call(() => client.POST("/v1/buckets/{bucketId}/keys", {
+				params: { path: { bucketId: news.bucketId } },
+				body: {
+					name: news.name,
+					role: news.role
+				}
+			}));
+			return {
+				id: created.data.id,
+				bucketId: news.bucketId,
+				accessKeyId: created.data.accessKeyId,
+				secretAccessKey: Redacted.make(created.data.secretAccessKey),
+				endpoint: created.data.endpoint,
+				bucketName: created.data.bucketName
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}/keys/{keyId}", { params: { path: {
+				bucketId: output.bucketId,
+				keyId: output.id
+			} } }));
+		})
+	};
+}));
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute.mjs
+/**
+* Stopping a deployment before the app that owns it can be
+* deleted is asynchronous on the platform's side: DELETE can 409 with this
+* message while the deployment is still winding down. Retrying blindly on
+* every API error would mask real failures (bad auth, a genuinely conflicting
+* state, etc.), so this only matches the platform's specific "not delete-safe
+* yet" wording — everything else fails immediately, as before.
+*/
+const isDeleteNotSafeYet = (error) => error.message.includes("did not reach a delete-safe state");
+/**
+* Backs off exponentially from 2s, capped at 5 minutes total — long enough
+* for the platform to finish stopping the deployment, short enough to still
+* fail loudly (rather than hang forever) if it never does.
+*/
+const deleteSafeRetrySchedule = Schedule.both(Schedule.exponential("2 seconds", 2), Schedule.during("5 minutes"));
+/** Every region Prisma Compute serves — the runtime source of truth; `ComputeRegion` is derived from it so the two can never drift. */
+const COMPUTE_REGIONS = [
+	"us-east-1",
+	"us-west-1",
+	"eu-west-3",
+	"eu-central-1",
+	"ap-northeast-1",
+	"ap-southeast-1"
+];
+/** A Prisma **Compute service** — the stable app identity behind a project. */
+const ComputeService = Resource("Prisma.ComputeService");
+const ComputeServiceProvider = () => Provider.effect(ComputeService, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/apps/{appId}", { params: { path: { appId: output.id } } })) : void 0;
+			if (observed) return {
+				id: observed.data.id,
+				name: observed.data.name,
+				endpointDomain: observed.data.appEndpointDomain
+			};
+			const created = yield* call(() => client.POST("/v1/apps", { body: {
+				displayName: news.name,
+				projectId: news.projectId,
+				...news.region && { regionId: news.region },
+				...news.branchId !== void 0 && { branchId: news.branchId }
+			} }));
+			return {
+				id: created.data.id,
+				name: created.data.name,
+				endpointDomain: created.data.appEndpointDomain
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/apps/{appId}", { params: { path: { appId: output.id } } })).pipe(Effect.retry({
+				schedule: deleteSafeRetrySchedule,
+				while: isDeleteNotSafeYet
+			}));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const s = yield* callOptional(() => client.GET("/v1/apps/{appId}", { params: { path: { appId: output.id } } }));
+			return s ? {
+				id: s.data.id,
+				name: s.data.name,
+				endpointDomain: s.data.appEndpointDomain
+			} : void 0;
+		})
+	};
+}));
+/**
+* A **deployment** of a Prisma app — creates a deployment, uploads
+* its artifact, starts the VM, waits for it to run, then promotes it to the
+* app's stable endpoint.
+*/
+const Deployment = Resource("Prisma.Deployment");
+const DeploymentProvider = () => Provider.effect(Deployment, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	const waitForRunning = (deploymentId) => call(() => client.GET("/v1/deployments/{deploymentId}", { params: { path: { deploymentId } } })).pipe(Effect.flatMap((v) => v.data.status === "running" ? Effect.void : Effect.fail(new PrismaApiError({
+		status: 409,
+		message: `deployment ${deploymentId} is ${v.data.status}, not running`
+	}))), Effect.retry(Schedule.both(Schedule.spaced("2 seconds"), Schedule.during("2 minutes"))));
+	return {
+		stables: [],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news }) {
+			const created = yield* call(() => client.POST("/v1/apps/{appId}/deployments", {
+				params: { path: { appId: news.computeServiceId } },
+				body: news.port !== void 0 ? { portMapping: { http: news.port } } : {}
+			}));
+			const deploymentId = created.data.id;
+			if (created.data.uploadUrl) {
+				const uploadUrl = created.data.uploadUrl;
+				const artifact = yield* Effect.try({
+					try: () => fs.readFileSync(news.artifactPath),
+					catch: (cause) => new PrismaApiError({
+						status: 0,
+						message: `failed to read artifact ${news.artifactPath}: ${String(cause)}`
+					})
+				});
+				yield* Effect.tryPromise({
+					try: async () => {
+						const res = await fetch(uploadUrl, {
+							method: "PUT",
+							body: artifact
+						});
+						if (!res.ok) throw new PrismaApiError({
+							status: res.status,
+							message: `artifact upload failed: ${res.status} ${res.statusText}`
+						});
+					},
+					catch: (cause) => cause instanceof PrismaApiError ? cause : new PrismaApiError({
+						status: 0,
+						message: String(cause)
+					})
+				});
+			}
+			yield* call(() => client.POST("/v1/deployments/{deploymentId}/start", { params: { path: { deploymentId } } }));
+			yield* waitForRunning(deploymentId);
+			const deployedUrl = (yield* call(() => client.POST("/v1/apps/{appId}/promote", {
+				params: { path: { appId: news.computeServiceId } },
+				body: { deploymentId }
+			}))).data.appEndpointDomain;
+			return {
+				deploymentId,
+				...deployedUrl !== void 0 && { deployedUrl }
+			};
+		}),
+		delete: Effect.fn(function* () {}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.deploymentId) return void 0;
+			const v = yield* callOptional(() => client.GET("/v1/deployments/{deploymentId}", { params: { path: { deploymentId: output.deploymentId } } }));
+			return v ? {
+				deploymentId: v.data.id,
+				...v.data.previewDomain && { deployedUrl: v.data.previewDomain }
+			} : void 0;
+		})
+	};
+}));
+/**
+* A project-scoped **environment variable** that Compute injects into the
+* project's services from their attached branch (e.g. wiring one module's URL into
+* another).
+*/
+const EnvironmentVariable = Resource("Prisma.EnvironmentVariable");
+const EnvironmentVariableProvider = () => Provider.effect(EnvironmentVariable, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const cls = news.class ?? "production";
+			let id = output?.id;
+			if (id !== void 0) {
+				const priorId = id;
+				if (!(yield* callOptional(() => client.GET("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: priorId } } })))) id = void 0;
+			}
+			if (id === void 0) {
+				const matchId = (yield* call(() => client.GET("/v1/environment-variables", { params: { query: {
+					projectId: news.projectId,
+					class: cls,
+					key: news.key
+				} } }))).data?.[0]?.id;
+				if (matchId !== void 0) {
+					if (!(news.key === "DATABASE_URL" || news.key === "DATABASE_URL_POOLED")) throw new Error(`EnvironmentVariable "${news.key}" (project "${news.projectId}", class "${cls}") exists but is untracked in this deploy state — refusing to overwrite a reserved COMPOSER_ key. Restore this deploy's hosted state, or remove the variable to let this deploy recreate it.`);
+					id = matchId;
+				}
+			}
+			if (id !== void 0) {
+				const targetId = id;
+				yield* call(() => client.PATCH("/v1/environment-variables/{envVarId}", {
+					params: { path: { envVarId: targetId } },
+					body: { value: news.value }
+				}));
+				return {
+					id,
+					key: news.key
+				};
+			}
+			const created = yield* call(() => client.POST("/v1/environment-variables", { body: {
+				projectId: news.projectId,
+				class: cls,
+				key: news.key,
+				value: news.value,
+				...news.branchId ? { branchId: news.branchId } : {}
+			} }));
+			return {
+				id: created.data.id,
+				key: created.data.key
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const v = yield* callOptional(() => client.GET("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: output.id } } }));
+			return v ? {
+				id: v.data.id,
+				key: v.data.key
+			} : void 0;
+		})
+	};
+}));
+/**
+* Assembles a Prisma Compute artifact: the app-built bundle plus the
+* extension-printed bootstrap and manifest, tarred and gzipped deterministically
+* (fixed mtimes, sorted entry order) so an unchanged service noops on
+* redeploy — a rebuild is the only thing that changes the hash. Lives here
+* (not in @prisma/composer-prisma-cloud/control) because it needs node:fs/node:zlib,
+* which the extension's shipped src may never import (invariant 5).
+*/
+const MANIFEST_VERSION = "1";
+/** Finds main.js/main.mjs in a bundle dir when no explicit entry is given. */
+function resolveEntry(bundleDir, entry) {
+	if (entry !== void 0) return entry;
+	const found = fs.readdirSync(bundleDir).find((f) => /^main\.m?js$/.test(f));
+	if (found === void 0) throw new Error(`no main.js/main.mjs found in bundle dir ${bundleDir}`);
+	return found;
+}
+/** All files under `dir`, as dir-relative POSIX paths, in sorted order. A
+* symlink is a hard error: deploy bundles must be flat (ADR-0005), and the
+* user's build owns flattening — dereferencing here would relink the tree and
+* risk packaging files from outside it. */
+function walkFiles(dir) {
+	const out = [];
+	const visit = (sub) => {
+		for (const entry of fs.readdirSync(path.join(dir, sub), { withFileTypes: true })) {
+			const rel = sub.length > 0 ? `${sub}/${entry.name}` : entry.name;
+			if (entry.isSymbolicLink()) throw new Error(`bundle contains a symlink at ${rel} — deploy bundles must be flat; materialize links in your build (e.g. cp -RL) so the tree is self-contained.`);
+			if (entry.isDirectory()) visit(rel);
+			else out.push(rel);
+		}
+	};
+	visit("");
+	return out.sort();
+}
+function octal(value, length) {
+	return `${value.toString(8).padStart(length - 1, "0")}\0`;
+}
+/** Splits a path into ustar's name (<=100 bytes) + prefix (<=155 bytes) fields. */
+function splitUstarPath(relPath) {
+	if (Buffer.byteLength(relPath, "utf8") <= 100) return {
+		name: relPath,
+		prefix: ""
+	};
+	for (let i = relPath.length - 1; i >= 0; i--) {
+		if (relPath[i] !== "/") continue;
+		const prefix = relPath.slice(0, i);
+		const name = relPath.slice(i + 1);
+		if (Buffer.byteLength(prefix, "utf8") <= 155 && Buffer.byteLength(name, "utf8") <= 100) return {
+			name,
+			prefix
+		};
+	}
+	throw new Error(`path too long for a ustar tar entry: ${relPath}`);
+}
+function ustarHeader(relPath, size) {
+	const { name, prefix } = splitUstarPath(relPath);
+	const buf = Buffer.alloc(512);
+	buf.write(name, 0, 100, "utf8");
+	buf.write(octal(420, 8), 100, 8, "utf8");
+	buf.write(octal(0, 8), 108, 8, "utf8");
+	buf.write(octal(0, 8), 116, 8, "utf8");
+	buf.write(octal(size, 12), 124, 12, "utf8");
+	buf.write(octal(0, 12), 136, 12, "utf8");
+	buf.write("        ", 148, 8, "utf8");
+	buf.write("0", 156, 1, "utf8");
+	buf.write("ustar\0", 257, 6, "utf8");
+	buf.write("00", 263, 2, "utf8");
+	buf.write(prefix, 345, 155, "utf8");
+	let sum = 0;
+	for (const b of buf) sum += b;
+	buf.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148, 8, "utf8");
+	return buf;
+}
+function createDeterministicTarGz(entries) {
+	const sorted = [...entries].sort((a, b) => a.relPath.localeCompare(b.relPath));
+	const chunks = [];
+	for (const entry of sorted) {
+		chunks.push(ustarHeader(entry.relPath, entry.content.length));
+		chunks.push(entry.content);
+		const pad = (512 - entry.content.length % 512) % 512;
+		if (pad > 0) chunks.push(Buffer.alloc(pad));
+	}
+	chunks.push(Buffer.alloc(1024));
+	return zlib.gzipSync(Buffer.concat(chunks));
+}
+/**
+* Prints the bootstrap + manifest and tars them with the bundle into a
+* deterministic artifact. If bundleDir doesn't exist (e.g. `alchemy destroy`
+* run before any build), returns a placeholder rather than throwing — the
+* artifact is never read on destroy.
+*/
+function packageComputeArtifact(opts) {
+	if (!fs.existsSync(opts.bundleDir)) return {
+		path: "",
+		sha256: "absent"
+	};
+	const bootstrap = `import main from "./${resolveEntry(opts.bundleDir, opts.bundleEntry)}";\nawait main.run(${JSON.stringify(opts.address)}, () => import(${JSON.stringify(`./${opts.appEntry}`)}));\n`;
+	const manifest = `${JSON.stringify({
+		manifestVersion: MANIFEST_VERSION,
+		entrypoint: "bootstrap.js",
+		address: opts.address
+	}, null, 2)}\n`;
+	const files = walkFiles(opts.bundleDir).map((relPath) => ({
+		relPath,
+		content: fs.readFileSync(path.join(opts.bundleDir, relPath))
+	}));
+	files.push({
+		relPath: "bootstrap.js",
+		content: Buffer.from(bootstrap, "utf8")
+	});
+	files.push({
+		relPath: "compute.manifest.json",
+		content: Buffer.from(manifest, "utf8")
+	});
+	files.push({
+		relPath: "bunfig.toml",
+		content: Buffer.from("[install]\nauto = \"disable\"\n", "utf8")
+	});
+	const gz = createDeterministicTarGz(files);
+	const sha256 = crypto$1.createHash("sha256").update(gz).digest("hex");
+	const outDir = path.join(os$1.tmpdir(), `prisma-composer-compute-${String(os$1.userInfo().uid)}`, sha256.slice(0, 16));
+	fs.mkdirSync(outDir, { recursive: true });
+	const outPath = path.join(outDir, `${opts.id}.tar.gz`);
+	const tmpPath = path.join(outDir, `.${opts.id}.${crypto$1.randomUUID()}.tmp`);
+	fs.writeFileSync(tmpPath, gz);
+	fs.renameSync(tmpPath, outPath);
+	return {
+		path: outPath,
+		sha256
+	};
+}
+/**
+* The `ServiceKey` Alchemy resource (ADR-0030) — mints a random 256-bit key
+* ONCE at create and keeps it STABLE across deploys, so an unchanged edge
+* no-ops on redeploy. Same mint-once-stable lifecycle as `S3Credentials`
+* (`packages/1-prisma-cloud/1-extensions/target/src/s3-credentials-resource.ts`):
+* Web Crypto only (`crypto.getRandomValues` — no `node:` import), persisted in
+* Alchemy state; on every later apply the provider returns the persisted
+* attributes (`reconcile`'s `output`) unchanged. One resource per RPC edge;
+* rotation is destroy/recreate.
+*/
+/** The `ServiceKey` resource constructor — `yield* Prisma.ServiceKey(id, {})` in the lowering. */
+const ServiceKey = Resource("PrismaCloud.ServiceKey");
+/** A fresh 256-bit key as 64 lowercase hex chars (Web Crypto — no node import). */
+function mintServiceKey() {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+	return { value: Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("") };
+}
+/**
+* The `ServiceKey` provider service. `reconcile` runs for create and update;
+* it returns the persisted `output` when present (a redeploy reuses the
+* stored key — the no-op property) and mints a fresh key only on first
+* create. Nothing to enumerate (`list` → `[]`) or tear down (`delete` →
+* no-op; the key lives only in state).
+*/
+const serviceKeyProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ output }) => Effect.sync(() => output ?? mintServiceKey()),
+	delete: () => Effect.void
+};
+/** The `ServiceKey` provider layer — merged into the Prisma Cloud extension's `providers()`. */
+const ServiceKeyProvider = () => Provider.effect(ServiceKey, Effect.succeed(serviceKeyProviderService));
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/postgres.mjs
+/** A **connection** to a Prisma Postgres database — yields the connection string. */
+const Connection = Resource("Prisma.Connection");
+const ConnectionProvider = () => Provider.effect(Connection, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id", "connectionString"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			if (output?.id) return output;
+			const created = yield* call(() => client.POST("/v1/databases/{databaseId}/connections", {
+				params: { path: { databaseId: news.databaseId } },
+				body: { name: news.name }
+			}));
+			const endpoints = created.data.endpoints;
+			const dsn = endpoints?.direct?.connectionString ?? endpoints?.pooled?.connectionString;
+			if (dsn === void 0) return yield* Effect.fail(new PrismaApiError({
+				status: 0,
+				message: `connection ${created.data.id} returned no direct/pooled connection string`
+			}));
+			return {
+				id: created.data.id,
+				connectionString: Redacted.make(dsn)
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/connections/{id}", { params: { path: { id: output.id } } }));
+		})
+	};
+}));
+/** A Prisma **Postgres database** inside a project. */
+const Database = Resource("Prisma.Database");
+const DatabaseProvider = () => Provider.effect(Database, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } })) : void 0;
+			if (!observed) {
+				const created = yield* call(() => client.POST("/v1/databases", { body: {
+					projectId: news.projectId,
+					name: news.name,
+					region: news.region,
+					...news.isDefault !== void 0 && { isDefault: news.isDefault },
+					...news.branchId !== void 0 && { branchId: news.branchId }
+				} }));
+				return {
+					id: created.data.id,
+					name: created.data.name
+				};
+			}
+			const result = {
+				id: observed.data.id,
+				name: observed.data.name
+			};
+			if (news.branchId !== void 0) {
+				const branchId = news.branchId;
+				yield* call(() => client.PATCH("/v1/databases/{databaseId}", {
+					params: { path: { databaseId: result.id } },
+					body: { branchId }
+				}));
+			}
+			return result;
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const d = yield* callOptional(() => client.GET("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } }));
+			return d ? {
+				id: d.data.id,
+				name: d.data.name
+			} : void 0;
+		})
+	};
+}));
+/** A Prisma Developer Platform **Project** — the container for databases and compute services. */
+const Project = Resource("Prisma.Project");
+const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	return {
+		stables: ["id"],
+		list: () => Effect.succeed([]),
+		reconcile: Effect.fn(function* ({ news, output }) {
+			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/projects/{id}", { params: { path: { id: output.id } } })) : void 0;
+			if (observed) return {
+				id: observed.data.id,
+				name: observed.data.name
+			};
+			const created = yield* call(() => client.POST("/v1/projects", { body: {
+				name: news.name,
+				workspaceId: news.workspaceId
+			} }));
+			return {
+				id: created.data.id,
+				name: created.data.name
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* callVoid(() => client.DELETE("/v1/projects/{id}", { params: { path: { id: output.id } } }));
+		}),
+		read: Effect.fn(function* ({ output }) {
+			if (!output?.id) return void 0;
+			const p = yield* callOptional(() => client.GET("/v1/projects/{id}", { params: { path: { id: output.id } } }));
+			return p ? {
+				id: p.data.id,
+				name: p.data.name
+			} : void 0;
+		})
+	};
+}));
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/index.mjs
+/** Raised with `ensure: false` when the app's Project (or a named stage's Branch) doesn't exist. */
+var ContainerNotFoundError = class extends Data.TaggedError("ContainerNotFoundError") {};
+const listAllProjects = (client) => Effect.gen(function* () {
+	const projects = [];
+	let cursor;
+	for (;;) {
+		const query = cursor === void 0 ? {} : { cursor };
+		const page = yield* call(() => client.GET("/v1/projects", { params: { query } }));
+		projects.push(...page.data);
+		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
+		cursor = page.pagination.nextCursor;
+	}
+	return projects;
+});
+/**
+* Workspace ids circulate in two shapes: `wksp_`-prefixed and bare. Compare
+* bare-to-bare so a `wksp_`-prefixed API id still matches a bare configured
+* one (the same normalization `state/bootstrap.ts` applies to the same
+* `/v1/projects` listing).
+*/
+const bareWorkspaceId = (id) => id.startsWith("wksp_") ? id.slice(5) : id;
+/**
+* Finds the app's Project by name in the workspace — PDP allows duplicate
+* project names, so more than one can match; the oldest wins. Creates one
+* if none match, unless `ensure` is `false` (find-only — `destroy`), in
+* which case an absent Project fails with `ContainerNotFoundError`. No
+* ownership marker and no `--project` override (both deferred — see
+* ADR-0019).
+*/
+const resolveProject = (client, workspaceId, appName, ensure) => Effect.gen(function* () {
+	const oldest = (yield* listAllProjects(client)).filter((p) => bareWorkspaceId(p.workspace.id) === bareWorkspaceId(workspaceId) && p.name === appName).sort((a, b) => a.createdAt.localeCompare(b.createdAt))[0];
+	if (oldest !== void 0) return oldest.id;
+	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({ appName }));
+	return (yield* call(() => client.POST("/v1/projects", { body: {
+		name: appName,
+		workspaceId
+	} }))).data.id;
+});
+const findBranchId = (client, projectId, gitName) => call(() => client.GET("/v1/projects/{projectId}/branches", { params: {
+	path: { projectId },
+	query: { gitName }
+} })).pipe(Effect.map((page) => page.data[0]?.id));
+/**
+* Finds the stage's Branch by its exact `gitName`, creating it if absent
+* unless `ensure` is `false` (find-only — `destroy`), in which case an
+* absent Branch fails with `ContainerNotFoundError`. The Management API has
+* no server-side "create-or-return" idempotency (`POST
+* /v1/projects/:id/branches` 409s on a duplicate `gitName`, with no request
+* field to make that a no-op), so idempotency is client-side: observe
+* first, and on a racing 409 from create, re-observe rather than fail.
+*/
+const resolveBranch = (client, projectId, gitName, appName, ensure) => Effect.gen(function* () {
+	const existing = yield* findBranchId(client, projectId, gitName);
+	if (existing !== void 0) return existing;
+	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({
+		appName,
+		stage: gitName
+	}));
+	return yield* call(() => client.POST("/v1/projects/{projectId}/branches", {
+		params: { path: { projectId } },
+		body: { gitName }
+	})).pipe(Effect.map((r) => r.data.id), Effect.catch((err) => err.status === 409 ? findBranchId(client, projectId, gitName).pipe(Effect.flatMap((id) => id === void 0 ? Effect.fail(err) : Effect.succeed(id))) : Effect.fail(err)));
+});
+/**
+* Resolves the two containers a stage's deploy runs into (ADR-0019): the
+* app's **Project**, found-or-created by name, and — for a named stage
+* only — its **Branch**, found-or-created by `gitName`. The default stage
+* (no `stage`) creates no Branch; `branchId` is omitted. With `ensure:
+* false` (`destroy`), nothing is created — an absent Project or Branch
+* fails with `ContainerNotFoundError` instead.
+*/
+const resolveContainer = (opts) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	const ensure = opts.ensure ?? true;
+	const projectId = yield* resolveProject(client, opts.workspaceId, opts.appName, ensure);
+	if (opts.stage === void 0) return { projectId };
+	return {
+		projectId,
+		branchId: yield* resolveBranch(client, projectId, opts.stage, opts.appName, ensure)
+	};
+});
+/**
+* Soft-deletes a Branch. Tolerates a 404 (already gone). The API refuses if
+* the Branch still has live members or is the production/default Branch —
+* that surfaces as a `PrismaApiError`.
+*/
+const deleteBranch = (branchId) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	yield* callVoid(() => client.DELETE("/v1/branches/{branchId}", { params: { path: { branchId } } }));
+});
+/**
+* Deletes a Project. Tolerates a 404 (already gone). The API refuses with a
+* 400 if the Project still has live dependencies (e.g. another stage's
+* Branch/resources) — that surfaces as a `PrismaApiError`.
+*/
+const deleteProject = (projectId) => Effect.gen(function* () {
+	const client = yield* ManagementClient;
+	yield* callVoid(() => client.DELETE("/v1/projects/{id}", { params: { path: { id: projectId } } }));
+});
+/** The collection of Prisma resource providers. */
+var Providers = class extends Provider.ProviderCollection()("Prisma") {};
+/**
+* The Prisma provider bundle: every resource provider, the Management API
+* client, and env-based credentials. Plug into a stack with
+* `{ providers: Prisma.providers() }`.
+*/
+const providers = () => Layer.effect(Providers, Provider.collection([
+	Project,
+	Database,
+	Connection,
+	ComputeService,
+	Deployment,
+	EnvironmentVariable,
+	Bucket,
+	BucketKey
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider(), BucketProvider(), BucketKeyProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/s3-protocol/dist/index.mjs
+/**
+* AWS SigV4 verification for the S3 wire protocol (spec § 2 auth). The payload
+* hash comes from the client — `x-amz-content-sha256` (a real hash or
+* `UNSIGNED-PAYLOAD`) for header auth, `UNSIGNED-PAYLOAD` for presign — and is
+* never re-hashed; the verifier trusts what was signed, like a real S3 endpoint.
+* Runtime engine code (`node:crypto`); not re-exported from the authoring barrel.
+*
+* Also owns `mintKeyPair` (local-dev spec § 1) — the one key-pair generator
+* both the deploy-time `S3Credentials` resource and the local dev bucket
+* emulator's credential provisioning use.
+*/
+function randomBytes$1(n) {
+	return crypto.getRandomValues(new Uint8Array(n));
+}
+function toHexUpper(bytes) {
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
+}
+/** A fresh SigV4 key pair: an AKIA-prefixed id and a 40-char base64 secret. */
+function mintKeyPair() {
+	return {
+		accessKeyId: `AKIA${toHexUpper(randomBytes$1(8))}`,
+		secretAccessKey: btoa(String.fromCharCode(...randomBytes$1(30)))
+	};
+}
+//#endregion
+//#region ../../1-prisma-cloud/1-extensions/target/dist/preflight-names-BPL-qsZF.mjs
+const PRISMA_CLOUD_EXTENSION_ID = "@prisma/composer-prisma-cloud";
+var PrismaCloudContainer = class {
+	input;
+	projectId;
+	branchId;
+	constructor(input, projectId, branchId) {
+		this.input = input;
+		this.projectId = projectId;
+		this.branchId = branchId;
+	}
+	serialize() {
+		return JSON.stringify({
+			input: this.input,
+			projectId: this.projectId,
+			...this.branchId !== void 0 ? { branchId: this.branchId } : {}
+		});
+	}
+};
+/** `instanceof` — parent-side instances and child-side deserialized instances are both constructed by this module. */
+function isPrismaCloudContainer(value) {
+	return value instanceof PrismaCloudContainer;
+}
+/** Narrow-or-throw for hook inputs. */
+function prismaCloudContainerOf(value) {
+	if (!isPrismaCloudContainer(value)) throw new Error("the Prisma Cloud container was not resolved — the extension's container descriptor did not run.");
+	return value;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function invalidPayloadError(reason) {
+	return /* @__PURE__ */ new Error(`${PRISMA_CLOUD_EXTENSION_ID}: invalid container transport payload — ${reason}.`);
+}
+/**
+* Reconstructs a `PrismaCloudContainer` from `serialize()`'s JSON output —
+* real narrowing, no casts. Exported so `dev/container.ts`'s
+* `devContainerDescriptor` can reuse it verbatim (local-dev spec § 5) — the
+* dev and deploy container descriptors deserialize the identical wire shape.
+*/
+function deserialize(serialized) {
+	let parsed;
+	try {
+		parsed = JSON.parse(serialized);
+	} catch (error) {
+		throw invalidPayloadError(`not valid JSON (${error instanceof Error ? error.message : String(error)})`);
+	}
+	if (!isRecord(parsed)) throw invalidPayloadError("not an object");
+	const input = parsed["input"];
+	if (!isRecord(input)) throw invalidPayloadError("\"input\" is not an object");
+	const appName = input["appName"];
+	if (typeof appName !== "string") throw invalidPayloadError("\"input.appName\" is not a string");
+	const stage = input["stage"];
+	if (stage !== void 0 && typeof stage !== "string") throw invalidPayloadError("\"input.stage\" is not a string or absent");
+	const projectId = parsed["projectId"];
+	if (typeof projectId !== "string") throw invalidPayloadError("\"projectId\" is not a string");
+	const branchId = parsed["branchId"];
+	if (branchId !== void 0 && typeof branchId !== "string") throw invalidPayloadError("\"branchId\" is not a string or absent");
+	return new PrismaCloudContainer({
+		appName,
+		stage
+	}, projectId, branchId);
+}
+const workspaceRequiredError = () => /* @__PURE__ */ new Error("environment variable PRISMA_WORKSPACE_ID is required.");
+const tokenRequiredError = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required.");
+function requireWorkspaceId() {
+	const workspaceId = process.env["PRISMA_WORKSPACE_ID"];
+	if (workspaceId === void 0 || workspaceId.length === 0) throw workspaceRequiredError();
+	return workspaceId;
+}
+function requireTokenUnlessInjected(deps) {
+	if (deps?.client === void 0 && (process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw tokenRequiredError();
+}
+async function ensureContainer(input, deps) {
+	const workspaceId = requireWorkspaceId();
+	requireTokenUnlessInjected(deps);
+	const program = resolveContainer({
+		workspaceId,
+		appName: input.appName,
+		...input.stage !== void 0 ? { stage: input.stage } : {},
+		ensure: true
+	}).pipe(Effect.map((c) => ({
+		ok: true,
+		container: c
+	})), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
+		ok: false,
+		message: `Prisma Management API error resolving containers: ${e.message}.`
+	})));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (!outcome.ok) throw new Error(outcome.message);
+	return new PrismaCloudContainer(input, outcome.container.projectId, outcome.container.branchId);
+}
+async function locateContainer(input, deps) {
+	const workspaceId = requireWorkspaceId();
+	requireTokenUnlessInjected(deps);
+	const program = resolveContainer({
+		workspaceId,
+		appName: input.appName,
+		...input.stage !== void 0 ? { stage: input.stage } : {},
+		ensure: false
+	}).pipe(Effect.map((c) => ({
+		ok: true,
+		container: c
+	})), Effect.catchTag("ContainerNotFoundError", () => Effect.succeed({ ok: false })), Effect.catchTag("PrismaApiError", (e) => Effect.fail(/* @__PURE__ */ new Error(`Prisma Management API error resolving containers: ${e.message}.`))));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (!outcome.ok) return void 0;
+	return new PrismaCloudContainer(input, outcome.container.projectId, outcome.container.branchId);
+}
+/**
+* Soft-deletes a named stage's Branch after a successful `alchemy destroy`
+* has removed its members — the Management API refuses to delete a Branch
+* that still has live members.
+*/
+async function removeStageBranch(branchId, deps) {
+	requireTokenUnlessInjected(deps);
+	const program = deleteBranch(branchId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
+		ok: false,
+		message: `Failed to delete the stage Branch: ${e.message}.`
+	})));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (!outcome.ok) throw new Error(outcome.message);
+}
+/**
+* Best-effort cleanup after a successful `--production` destroy: removes
+* the app's Project so hand-run stacks don't accumulate as empty Projects
+* (they eventually hit the workspace's plan limit). Unlike `removeStageBranch`,
+* this never throws: the destroy itself already succeeded, and the API's own
+* 400 ("still has dependencies") is the only check that matters — failing
+* the command over a cleanup step would be worse than leaving a Project shell.
+*/
+async function removeAppProject(projectId, deps) {
+	if (deps?.client === void 0 && (process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) {
+		console.warn(`Skipped removing the Project (${projectId}): PRISMA_SERVICE_TOKEN is not set.`);
+		return;
+	}
+	const program = deleteProject(projectId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
+		ok: false,
+		error: e
+	})));
+	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
+	const outcome = await Effect.runPromise(provided);
+	if (outcome.ok) {
+		console.log(`Removed the Project (${projectId}) — nothing was left in it.`);
+		return;
+	}
+	if (outcome.error.status === 400) {
+		console.log(`Kept the Project (${projectId}) — it still has another stage's resources.`);
+		return;
+	}
+	console.warn(`Could not remove the Project (${projectId}) after destroy: ${outcome.error.message}.`);
+}
+function containerDescriptor(deps) {
+	return {
+		ensure: (input) => ensureContainer(input, deps),
+		locate: (input) => locateContainer(input, deps),
+		remove: (instance) => instance.input.stage !== void 0 ? removeStageBranch(instance.branchId ?? missingBranchId(instance), deps) : removeAppProject(instance.projectId, deps),
+		deserialize
+	};
+}
+/** Defensive: a named-stage container always resolves a Branch together with its stage — `ensure`/`locate`/`deserialize` never produce one without the other. */
+function missingBranchId(instance) {
+	throw new Error(`${PRISMA_CLOUD_EXTENSION_ID}: a named-stage ("${instance.input.stage}") container instance is missing its branchId — this is a bug in ensure/locate/deserialize.`);
+}
+/**
+* The `PgWarm` Alchemy resource (slice 3, FT-5226) — warm a freshly-provisioned
+* Prisma Postgres database at apply-time so it is ready by deploy-end, and the
+* first real connection (a service's runtime client, or the migration) doesn't
+* eat the cold-start reject.
+*
+* The DB `url` is a lazy `Output` at lowering time, so warming must be an
+* apply-time tracked resource (same pattern as `PnMigration`): its `reconcile`
+* receives the RESOLVED url and connects with `withConnectionRetry` + `select 1`,
+* riding out the cold-start. Shared by BOTH the bare-`postgres` and the
+* `prisma-next` lowerings; keyed on the connection `url`, so an unchanged
+* redeploy is a no-op (warming is idempotent anyway).
+*
+* Deploy-time only: imports `pg` directly + `alchemy`. Imported by `control.ts`
+* and tests, never by `index.ts` / the `./prisma-next` authoring entry — the
+* isolation invariants hold.
+*/
+/** The `PgWarm` resource constructor — `yield* PgWarm(id, { url })` in a lowering. */
+const PgWarm = Resource("PrismaCloud.PgWarm");
+/** Connect (retrying the cold-start) and run `select 1`, then release the connection. */
+async function warmDatabase(url) {
+	await withConnectionRetry(async () => {
+		const client = new pg.Client({ connectionString: normalizeSslMode(url) });
+		await client.connect();
+		try {
+			await client.query("select 1");
+		} finally {
+			await client.end();
+		}
+	});
+}
+/**
+* The `PgWarm` provider service. `reconcile` warms the DB (retrying the
+* cold-start) and echoes the `url` so a downstream resource that reads
+* `warm.url` runs only after the DB is warm. Idempotent — safe on redeploy;
+* nothing to enumerate (`list` → `[]`) or tear down (`delete` → no-op; the DB's
+* own deletion handles teardown). Exported so tests can drive it directly.
+*/
+const pgWarmProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ news }) => Effect.tryPromise({
+		try: () => warmDatabase(news.url),
+		catch: (error) => error
+	}).pipe(Effect.map(() => ({ url: news.url }))),
+	delete: () => Effect.void
+};
+/** The `PgWarm` provider layer — merged into the extension descriptor's `providers()`. */
+const PgWarmProvider = () => Provider.effect(PgWarm, Effect.succeed(pgWarmProviderService));
+/**
+* The Prisma Next migration step of the deploy lowering (ADR-0022, slice 2) —
+* the safety-critical decision that brings a live database to a target REF
+* using ONLY Prisma Next's authored migrations.
+*
+* Deploy-time only: this module imports `@prisma-next/postgres/control` (which
+* transitively pulls PN's control/migration machinery + `pg`). It is imported
+* by the deploy descriptors and this package's tests, NEVER by `index.ts` / the
+* `./prisma-next` authoring entry — so it never lands in an app runtime bundle
+* (the index-isolation invariant holds).
+*
+* The target is a ref `{ hash, invariants }` — not a bare `storageHash`. A
+* ref's `invariants` are named postconditions established by `data`-class
+* migration steps (e.g. a backfill), recorded monotonically on the live
+* marker. Keying on the hash alone would make a pure data-invariant change an
+* A→A self-edge the deploy wrongly skips. The decision, given the live marker
+* and the target ref (see {@link decideMigrationAction}):
+*   - marker at ref.hash AND ref.invariants ⊆ marker.invariants → no-op
+*   - no marker (fresh DB) AND no required invariants           → `dbInit`
+*   - otherwise                                                  → `migrate`
+*
+* `dbInit` is additive-only synthesis — it NEVER runs app-space data steps —
+* so it is only correct when the ref requires no invariants; a fresh DB whose
+* target carries invariants goes through `migrate`, which walks the AUTHORED
+* graph (including the invariant-bearing data migrations) from empty.
+*
+* Never `dbUpdate`: synthesized diff-and-apply plans are never run against a
+* deployed database. A no-authored-path (`MIGRATION_PATH_NOT_FOUND`) or a
+* runner failure fails the deploy as a typed `PnMigrationError` (not swallowed).
+* PN applies each migration in its own transaction, so a failed apply is atomic
+* and resume-safe — the marker and schema are left as the last committed step.
+*/
+/** A deploy-failing migration error — surfaced, never swallowed. */
+var PnMigrationError = class extends Error {
+	code;
+	/** PN's structured explanation, when present. */
+	why;
+	constructor(code, summary, why) {
+		super(`prisma-next migrate (${code}): ${summary}`);
+		this.name = "PnMigrationError";
+		this.code = code;
+		this.why = why;
+	}
+};
+/**
+* The target `storageHash` a contract heads to — `contractJson.storage.storageHash`.
+* Read defensively: `contractJson` crosses the boundary as `unknown`.
+*/
+function targetStorageHash(contractJson) {
+	if (typeof contractJson === "object" && contractJson !== null && "storage" in contractJson) {
+		const storage = contractJson.storage;
+		if (typeof storage === "object" && storage !== null && "storageHash" in storage) {
+			const hash = storage.storageHash;
+			if (typeof hash === "string" && hash.length > 0) return hash;
+		}
+	}
+	throw new PnMigrationError("INIT_FAILED", "the contract has no storage.storageHash — cannot determine the target schema version");
+}
+/**
+* Resolve the deploy's target ref from the migrations dir.
+*
+* - `targetRef` named: read `migrations/app/refs/<name>.json` — fail loudly
+*   (`TARGET_REF_NOT_FOUND`) when the ref doesn't exist or can't be parsed.
+* - Default: the app space's head. PN synthesizes the app head from the
+*   emitted contract — `{ hash: contract.storage.storageHash, invariants: [] }`
+*   (`contract emit` writes no app-space `refs/head.json` today; extension
+*   spaces have one on disk). When a future PN version does emit one, the
+*   on-disk `head.json` wins — read via `readContractSpaceHeadRef`, exactly
+*   the loader PN's own migrate uses.
+*/
+async function resolveTargetRef(migrationsDir, contractJson, targetRef) {
+	if (targetRef !== void 0) {
+		const refsDir = spaceRefsDirectory(spaceMigrationDirectory(migrationsDir, APP_SPACE_ID));
+		try {
+			const ref = await readRef(refsDir, targetRef);
+			return {
+				hash: ref.hash,
+				invariants: ref.invariants
+			};
+		} catch (error) {
+			throw new PnMigrationError("TARGET_REF_NOT_FOUND", `targetRef "${targetRef}" could not be read from ${refsDir}`, error instanceof Error ? error.message : String(error));
+		}
+	}
+	const head = await readContractSpaceHeadRef(migrationsDir, APP_SPACE_ID);
+	if (head !== null) return {
+		hash: head.hash,
+		invariants: head.invariants
+	};
+	return {
+		hash: targetStorageHash(contractJson),
+		invariants: []
+	};
+}
+/**
+* The pure migration decision, mirroring PN's own verifier: the database is
+* AT the target when the marker's hash equals the ref's hash AND every ref
+* invariant is on the marker (marker invariants are monotonic). `dbInit` is
+* additive-only synthesis, so it is chosen only for a fresh DB whose
+* effective required invariants (`ref.invariants − marker.invariants`) are
+* empty; anything else — different hash, missing invariant (the A→A
+* data-only self-edge), or a fresh DB with required invariants — walks the
+* authored graph via `migrate`.
+*/
+function decideMigrationAction(marker, ref) {
+	const markerInvariants = new Set(marker?.invariants ?? []);
+	const missing = ref.invariants.filter((id) => !markerInvariants.has(id));
+	if (marker !== null && marker.storageHash === ref.hash && missing.length === 0) return "noop";
+	if (marker === null && missing.length === 0) return "init";
+	return "migrate";
+}
+/**
+* Bring the database at `url` to the target ref via PN's authored migrations.
+* Reads the live marker, decides no-op / init / migrate
+* ({@link decideMigrationAction}), applies, and throws a typed
+* {@link PnMigrationError} on a no-path or runner failure. `migrationsDir` is
+* the on-disk migrations root and `ref` the resolved target
+* ({@link resolveTargetRef} — both resolved by the lowering, which also keys
+* the PnMigration resource on them). `refName` (the resource's `targetRef`,
+* when set) is threaded into `migrate` so PN targets the named ref's hash and
+* plans an invariant-bearing path.
+*/
+async function applyPnMigration(opts) {
+	const connection = normalizeSslMode(opts.url);
+	return withConnectionRetry(() => runMigration(connection, opts.contractJson, opts.migrationsDir, opts.ref, opts.refName), { shouldRetry: (error) => !(error instanceof PnMigrationError) });
+}
+async function runMigration(connection, contractJson, migrationsDir, ref, refName) {
+	const client = createPostgresControlClient({ connection });
+	await client.connect();
+	try {
+		const marker = await client.readMarker();
+		const markerHashBefore = marker?.storageHash ?? null;
+		const action = decideMigrationAction(marker, ref);
+		if (action === "noop") return {
+			action,
+			targetHash: ref.hash,
+			markerHashBefore
+		};
+		if (action === "init") {
+			const result = await client.dbInit({
+				contract: contractJson,
+				mode: "apply",
+				migrationsDir
+			});
+			if (!result.ok) throw new PnMigrationError("INIT_FAILED", result.failure.summary, result.failure.why);
+			return {
+				action,
+				targetHash: ref.hash,
+				markerHashBefore
+			};
+		}
+		const result = await client.migrate({
+			contract: contractJson,
+			migrationsDir,
+			...refName !== void 0 ? {
+				refHash: ref.hash,
+				refInvariants: ref.invariants,
+				refName
+			} : {}
+		});
+		if (!result.ok) throw new PnMigrationError(result.failure.code === "MIGRATION_PATH_NOT_FOUND" ? "MIGRATION_PATH_NOT_FOUND" : "RUNNER_FAILED", result.failure.summary, result.failure.why);
+		return {
+			action,
+			targetHash: ref.hash,
+			markerHashBefore
+		};
+	} finally {
+		await client.close();
+	}
+}
+/**
+* The `PnMigration` Alchemy resource (ADR-0022, slice 2 D2) — the migration
+* step modeled as a tracked resource so it participates in deploy state: keyed
+* on the target REF identity (`targetHash` + sorted `invariants`), an
+* unchanged redeploy is an Alchemy-level no-op (on top of the marker read),
+* and a contract change — or a DATA-ONLY change that adds a ref invariant at
+* the same hash — re-runs the migration.
+*
+* Its provider's `reconcile` receives the RESOLVED props at apply-time — in
+* particular the concrete DB `url` (a lazy `Output` until the Connection
+* provisions) — and delegates to the proven `applyPnMigration` decision. The
+* provider is a standalone `Provider<PnMigration>` layer; the extension
+* descriptor merges it into its `providers()` (`Layer.merge(Prisma.providers(),
+* PnMigrationProvider())`), and Alchemy resolves it at apply via a direct
+* provider-tag lookup (`tryFindProviderByType`) — no change to `@internal/lowering`.
+*
+* Deploy-time only: imports `@prisma-next/postgres/control` (via the helper) +
+* `alchemy`. Imported by `control.ts` and tests, never by `index.ts` / the
+* `./prisma-next` authoring entry — index isolation holds.
+*/
+/** The `PnMigration` resource constructor — `yield* PnMigration(id, props)` in the lowering. */
+const PnMigration = Resource("PrismaNext.Migration");
+/**
+* The `PnMigration` provider service. `reconcile` runs for both create and
+* update (Alchemy's unified lifecycle); `applyPnMigration` is idempotent via
+* the live marker read, so it is safe to run for either — the marker decides
+* no-op / init / migrate. A migration has nothing to enumerate (`list` → `[]`)
+* and nothing to tear down on its own (`delete` → no-op; the DB's own deletion
+* handles teardown). Exported so tests can drive `reconcile` directly, without
+* building an Effect layer.
+*/
+const pnMigrationProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ news }) => Effect.tryPromise({
+		try: () => applyPnMigration({
+			url: news.url,
+			contractJson: news.contractJson,
+			migrationsDir: news.migrationsDir,
+			ref: {
+				hash: news.targetHash,
+				invariants: news.invariants
+			},
+			...news.refName !== void 0 ? { refName: news.refName } : {}
+		}),
+		catch: (error) => error
+	}).pipe(Effect.map((outcome) => ({
+		storageHash: outcome.targetHash,
+		invariants: news.invariants
+	}))),
+	delete: () => Effect.void
+};
+/** The `PnMigration` provider layer — merged into the extension descriptor's `providers()`. */
+const PnMigrationProvider = () => Provider.effect(PnMigration, Effect.succeed(pnMigrationProviderService));
+/**
+* The `S3Credentials` Alchemy resource (S5) — mints a random SigV4 key pair
+* ONCE at create and keeps it STABLE across deploys, so an unchanged module
+* no-ops on redeploy. The pair is generated by `@internal/s3-protocol`'s
+* `mintKeyPair` (moved there per the local-dev spec § 1, so deploy and local
+* dev credential minting share one implementation) and persisted in Alchemy
+* state; on every later apply the provider returns the persisted attributes
+* (`reconcile`'s `output`) unchanged — the same way the postgres resource
+* keeps a Connection stable. Rotation is destroy/recreate (a platform ask,
+* not solved here).
+*
+* Deploy-time only: imports `alchemy`. Imported by `control.ts` and tests,
+* never by `index.ts` / the authoring entry.
+*/
+/** The `S3Credentials` resource constructor — `yield* S3Credentials(id, {})` in the lowering. */
+const S3Credentials = Resource("PrismaCloud.S3Credentials");
+/**
+* The `S3Credentials` provider service. `reconcile` runs for create and update;
+* it returns the persisted `output` when present (a redeploy reuses the stored
+* pair — the no-op property) and mints a fresh pair only on first create.
+* Nothing to enumerate (`list` → `[]`) or tear down (`delete` → no-op; the pair
+* lives only in state). Exported so tests can drive it directly.
+*/
+const s3CredentialsProviderService = {
+	list: () => Effect.succeed([]),
+	reconcile: ({ output }) => Effect.sync(() => output ?? mintKeyPair()),
+	delete: () => Effect.void
+};
+/** The `S3Credentials` provider layer — merged into the extension descriptor's `providers()`. */
+const S3CredentialsProvider = () => Provider.effect(S3Credentials, Effect.succeed(s3CredentialsProviderService));
+function dedupedNames(entries) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const entry of entries) if (!byName.has(entry.name)) byName.set(entry.name, entry);
+	return [...byName.values()];
+}
+/** Walks `graph.secrets`/`graph.params` exactly as `runPreflight` did before this extraction. */
+function collectPreflightNames(graph) {
+	return {
+		secrets: dedupedNames(provisionManifest(graph).map((binding) => ({
+			name: secretName(binding),
+			serviceAddress: binding.serviceAddress
+		}))),
+		envParams: dedupedNames(paramManifest(graph).filter((binding) => isEnvParamSource(binding.binding)).map((binding) => ({
+			name: paramName(binding),
+			serviceAddress: binding.serviceAddress
+		})))
+	};
+}
+//#endregion
+export { PrismaApiError as A, EnvironmentVariable as C, Bucket as D, packageComputeArtifact as E, callVoid as M, fromEnv as N, BucketKey as O, layer as P, Deployment as S, ServiceKeyProvider as T, Connection as _, PnMigrationProvider as a, COMPUTE_REGIONS as b, S3CredentialsProvider as c, deserialize as d, prismaCloudContainerOf as f, providers as g, Providers as h, PnMigration as i, call as j, ManagementClient as k, collectPreflightNames as l, mintKeyPair as m, PgWarm as n, PrismaCloudContainer as o, resolveTargetRef as p, PgWarmProvider as r, S3Credentials as s, PRISMA_CLOUD_EXTENSION_ID as t, containerDescriptor as u, Database as v, ServiceKey as w, ComputeService as x, Project as y };
+
+//# sourceMappingURL=preflight-names-BPL-qsZF-BfoRgbgb.mjs.map