@prisma/composer-prisma-cloud 0.2.0-dev.9 → 0.3.0-dev.1

package/dist/control.mjs

@@ -1,746 +1,22 @@
-import { a as encode, c as paramEntries, d as secretPointerRows, n as configKey, o as encodeParamPointer, u as secretName } from "./serializer-D8_84XWO-DA2B6YbX.mjs";
-import { c as paramName, l as provisionedEdges, n as SELF_ORIGIN, o as isEnvParamSource, r as STREAMS_API_KEY, s as paramBindingFor, t as RESERVED_PROVIDER_PARAMS } from "./provisioned-edges-B_XS1Mz--NFJgcXK7.mjs";
-import { a as normalizeSslMode, n as isPnPostgresResourceNode, o as withConnectionRetry } from "./prisma-next-BvBwGCIt-CSauMX4l.mjs";
-import { isParamSource, paramManifest, provisionManifest } from "@prisma/composer";
+import { a as encode, l as secretPointerRows, n as configKey, o as encodeParamPointer, s as paramEntries } from "./serializer-CJiOhF2d-DJUjQj1i.mjs";
+import { a as provisionedEdges, n as SELF_ORIGIN, r as STREAMS_API_KEY, t as RESERVED_PROVIDER_PARAMS } from "./provisioned-edges-C1wSO3cx-YC5C19f9.mjs";
+import { i as paramName, r as paramBindingFor } from "./param-BTzY0ne5-CW6ojZ3E.mjs";
+import { A as PrismaApiError, C as EnvironmentVariable, D as Bucket, E as packageComputeArtifact, M as callVoid, N as fromEnv, O as BucketKey, P as layer, S as Deployment, T as ServiceKeyProvider, _ as Connection, a as PnMigrationProvider, b as COMPUTE_REGIONS, c as S3CredentialsProvider, f as prismaCloudContainerOf, g as providers, i as PnMigration, j as call, k as ManagementClient, l as collectPreflightNames, n as PgWarm, p as resolveTargetRef, r as PgWarmProvider, s as S3Credentials, t as PRISMA_CLOUD_EXTENSION_ID, u as containerDescriptor, v as Database, w as ServiceKey, x as ComputeService } from "./preflight-names-BPL-qsZF-BfoRgbgb.mjs";
+import { n as isPnPostgresResourceNode } from "./prisma-next-BvBwGCIt-DssgnctU.mjs";
+import { isParamSource } from "@prisma/composer";
 import { blindCast } from "@prisma/composer/casts";
 import { RPC_PEER_KEY } from "@prisma/composer/service-rpc";
-import pg from "pg";
-import { createManagementApiClient } from "@prisma/management-api-sdk";
-import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
-import * as Config$1 from "effect/Config";
 import * as Data from "effect/Data";
-import * as Provider from "alchemy/Provider";
-import { Resource, Stack } from "alchemy";
+import { Stack } from "alchemy";
 import * as Schedule from "effect/Schedule";
-import * as fs from "node:fs";
-import * as crypto$1 from "node:crypto";
-import * as os from "node:os";
-import * as path from "node:path";
-import * as zlib from "node:zlib";
 import postgres from "postgres";
 import { STATE_STORE_VERSION, State, StateStoreError, encodeState, reviveStateRecursive } from "alchemy/State";
 import * as Output from "alchemy/Output";
 import { loadConfig } from "@prisma-next/config-loader";
 import { resolve } from "pathe";
-import { readRef } from "@prisma-next/migration-tools/refs";
-import { APP_SPACE_ID, readContractSpaceHeadRef, spaceMigrationDirectory, spaceRefsDirectory } from "@prisma-next/migration-tools/spaces";
-import { createPostgresControlClient } from "@prisma-next/postgres/control";
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CJM0E6rj.mjs
-/**
-* The Prisma service token used to authenticate Management API calls. Kept
-* as a Redacted value so it never lands in logs or error output.
-*/
-var PrismaCredentials = class extends Context.Service()("PrismaCredentials") {};
-/** Resolve the token from the `PRISMA_SERVICE_TOKEN` environment variable. */
-const fromEnv = () => Layer.effect(PrismaCredentials, Effect.gen(function* () {
-	return { token: yield* Config$1.redacted("PRISMA_SERVICE_TOKEN") };
-}));
-/**
-* The typed Prisma Management API client, built once from the resolved
-* credentials. Providers yield this in their outer Effect and call it inside
-* `reconcile` / `delete`.
-*/
-var ManagementClient = class extends Context.Service()("PrismaManagementClient") {};
-const layer = () => Layer.effect(ManagementClient, Effect.gen(function* () {
-	const { token } = yield* PrismaCredentials;
-	return createManagementApiClient({ token: Redacted.value(token) });
-}));
-/** A non-2xx response from the Management API (or a transport failure). */
-var PrismaApiError = class extends Data.TaggedError("PrismaApiError") {};
-const attempt$1 = (f) => Effect.tryPromise({
-	try: f,
-	catch: (cause) => new PrismaApiError({
-		status: 0,
-		message: String(cause)
-	})
-});
-const fail = (r) => Effect.fail(new PrismaApiError({
-	status: r.response.status,
-	message: JSON.stringify(r.error)
-}));
-/** Unwrap `data`, failing on any API error. Preserves the SDK's response type. */
-const call = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.error !== void 0 || r.data === void 0 ? fail(r) : Effect.succeed(r.data)));
-/** Unwrap `data`, mapping a 404 to `undefined` (resource gone / not found). */
-const callOptional = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.status === 404 ? Effect.succeed(void 0) : r.error !== void 0 ? fail(r) : Effect.succeed(r.data)));
-/** Fire-and-forget a call, tolerating a 404 (already deleted). */
-const callVoid = (f) => attempt$1(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
-//#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/buckets.mjs
-/** A Prisma **Object Store bucket** inside a project. */
-const Bucket = Resource("Prisma.Bucket");
-const BucketProvider = () => Provider.effect(Bucket, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: ["id"],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } })) : void 0;
-			if (observed) return {
-				id: observed.data.id,
-				name: observed.data.name
-			};
-			const created = yield* call(() => client.POST("/v1/buckets", { body: {
-				projectId: news.projectId,
-				name: news.name,
-				...news.branchId !== void 0 ? { branchId: news.branchId } : {}
-			} }));
-			return {
-				id: created.data.id,
-				name: created.data.name
-			};
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
-		}),
-		read: Effect.fn(function* ({ output }) {
-			if (!output?.id) return void 0;
-			const b = yield* callOptional(() => client.GET("/v1/buckets/{bucketId}", { params: { path: { bucketId: output.id } } }));
-			return b ? {
-				id: b.data.id,
-				name: b.data.name
-			} : void 0;
-		})
-	};
-}));
-/** A **bucket access key** for a Prisma Object Store bucket — yields the S3 credentials. */
-const BucketKey = Resource("Prisma.BucketKey");
-const BucketKeyProvider = () => Provider.effect(BucketKey, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: [
-			"id",
-			"bucketId",
-			"secretAccessKey",
-			"accessKeyId",
-			"endpoint",
-			"bucketName"
-		],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			if (output?.id) return output;
-			const created = yield* call(() => client.POST("/v1/buckets/{bucketId}/keys", {
-				params: { path: { bucketId: news.bucketId } },
-				body: {
-					name: news.name,
-					role: news.role
-				}
-			}));
-			return {
-				id: created.data.id,
-				bucketId: news.bucketId,
-				accessKeyId: created.data.accessKeyId,
-				secretAccessKey: Redacted.make(created.data.secretAccessKey),
-				endpoint: created.data.endpoint,
-				bucketName: created.data.bucketName
-			};
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/buckets/{bucketId}/keys/{keyId}", { params: { path: {
-				bucketId: output.bucketId,
-				keyId: output.id
-			} } }));
-		})
-	};
-}));
-//#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute.mjs
-/**
-* Stopping a deployment before the app that owns it can be
-* deleted is asynchronous on the platform's side: DELETE can 409 with this
-* message while the deployment is still winding down. Retrying blindly on
-* every API error would mask real failures (bad auth, a genuinely conflicting
-* state, etc.), so this only matches the platform's specific "not delete-safe
-* yet" wording — everything else fails immediately, as before.
-*/
-const isDeleteNotSafeYet = (error) => error.message.includes("did not reach a delete-safe state");
-/**
-* Backs off exponentially from 2s, capped at 5 minutes total — long enough
-* for the platform to finish stopping the deployment, short enough to still
-* fail loudly (rather than hang forever) if it never does.
-*/
-const deleteSafeRetrySchedule = Schedule.both(Schedule.exponential("2 seconds", 2), Schedule.during("5 minutes"));
-/** Every region Prisma Compute serves — the runtime source of truth; `ComputeRegion` is derived from it so the two can never drift. */
-const COMPUTE_REGIONS = [
-	"us-east-1",
-	"us-west-1",
-	"eu-west-3",
-	"eu-central-1",
-	"ap-northeast-1",
-	"ap-southeast-1"
-];
-/** A Prisma **Compute service** — the stable app identity behind a project. */
-const ComputeService = Resource("Prisma.ComputeService");
-const ComputeServiceProvider = () => Provider.effect(ComputeService, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: ["id"],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/apps/{appId}", { params: { path: { appId: output.id } } })) : void 0;
-			if (observed) return {
-				id: observed.data.id,
-				name: observed.data.name,
-				endpointDomain: observed.data.appEndpointDomain
-			};
-			const created = yield* call(() => client.POST("/v1/apps", { body: {
-				displayName: news.name,
-				projectId: news.projectId,
-				...news.region && { regionId: news.region },
-				...news.branchId !== void 0 && { branchId: news.branchId }
-			} }));
-			return {
-				id: created.data.id,
-				name: created.data.name,
-				endpointDomain: created.data.appEndpointDomain
-			};
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/apps/{appId}", { params: { path: { appId: output.id } } })).pipe(Effect.retry({
-				schedule: deleteSafeRetrySchedule,
-				while: isDeleteNotSafeYet
-			}));
-		}),
-		read: Effect.fn(function* ({ output }) {
-			if (!output?.id) return void 0;
-			const s = yield* callOptional(() => client.GET("/v1/apps/{appId}", { params: { path: { appId: output.id } } }));
-			return s ? {
-				id: s.data.id,
-				name: s.data.name,
-				endpointDomain: s.data.appEndpointDomain
-			} : void 0;
-		})
-	};
-}));
-/**
-* A **deployment** of a Prisma app — creates a deployment, uploads
-* its artifact, starts the VM, waits for it to run, then promotes it to the
-* app's stable endpoint.
-*/
-const Deployment = Resource("Prisma.Deployment");
-const DeploymentProvider = () => Provider.effect(Deployment, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	const waitForRunning = (deploymentId) => call(() => client.GET("/v1/deployments/{deploymentId}", { params: { path: { deploymentId } } })).pipe(Effect.flatMap((v) => v.data.status === "running" ? Effect.void : Effect.fail(new PrismaApiError({
-		status: 409,
-		message: `deployment ${deploymentId} is ${v.data.status}, not running`
-	}))), Effect.retry(Schedule.both(Schedule.spaced("2 seconds"), Schedule.during("2 minutes"))));
-	return {
-		stables: [],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news }) {
-			const created = yield* call(() => client.POST("/v1/apps/{appId}/deployments", {
-				params: { path: { appId: news.computeServiceId } },
-				body: news.port !== void 0 ? { portMapping: { http: news.port } } : {}
-			}));
-			const deploymentId = created.data.id;
-			if (created.data.uploadUrl) {
-				const uploadUrl = created.data.uploadUrl;
-				const artifact = yield* Effect.try({
-					try: () => fs.readFileSync(news.artifactPath),
-					catch: (cause) => new PrismaApiError({
-						status: 0,
-						message: `failed to read artifact ${news.artifactPath}: ${String(cause)}`
-					})
-				});
-				yield* Effect.tryPromise({
-					try: async () => {
-						const res = await fetch(uploadUrl, {
-							method: "PUT",
-							body: artifact
-						});
-						if (!res.ok) throw new PrismaApiError({
-							status: res.status,
-							message: `artifact upload failed: ${res.status} ${res.statusText}`
-						});
-					},
-					catch: (cause) => cause instanceof PrismaApiError ? cause : new PrismaApiError({
-						status: 0,
-						message: String(cause)
-					})
-				});
-			}
-			yield* call(() => client.POST("/v1/deployments/{deploymentId}/start", { params: { path: { deploymentId } } }));
-			yield* waitForRunning(deploymentId);
-			const deployedUrl = (yield* call(() => client.POST("/v1/apps/{appId}/promote", {
-				params: { path: { appId: news.computeServiceId } },
-				body: { deploymentId }
-			}))).data.appEndpointDomain;
-			return {
-				deploymentId,
-				...deployedUrl !== void 0 && { deployedUrl }
-			};
-		}),
-		delete: Effect.fn(function* () {}),
-		read: Effect.fn(function* ({ output }) {
-			if (!output?.deploymentId) return void 0;
-			const v = yield* callOptional(() => client.GET("/v1/deployments/{deploymentId}", { params: { path: { deploymentId: output.deploymentId } } }));
-			return v ? {
-				deploymentId: v.data.id,
-				...v.data.previewDomain && { deployedUrl: v.data.previewDomain }
-			} : void 0;
-		})
-	};
-}));
-/**
-* A project-scoped **environment variable** that Compute injects into the
-* project's services from their attached branch (e.g. wiring one module's URL into
-* another).
-*/
-const EnvironmentVariable = Resource("Prisma.EnvironmentVariable");
-const EnvironmentVariableProvider = () => Provider.effect(EnvironmentVariable, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: ["id"],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			const cls = news.class ?? "production";
-			let id = output?.id;
-			if (id !== void 0) {
-				const priorId = id;
-				if (!(yield* callOptional(() => client.GET("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: priorId } } })))) id = void 0;
-			}
-			if (id === void 0) {
-				const matchId = (yield* call(() => client.GET("/v1/environment-variables", { params: { query: {
-					projectId: news.projectId,
-					class: cls,
-					key: news.key
-				} } }))).data?.[0]?.id;
-				if (matchId !== void 0) {
-					if (!(news.key === "DATABASE_URL" || news.key === "DATABASE_URL_POOLED")) throw new Error(`EnvironmentVariable "${news.key}" (project "${news.projectId}", class "${cls}") exists but is untracked in this deploy state — refusing to overwrite a reserved COMPOSER_ key. Restore this deploy's hosted state, or remove the variable to let this deploy recreate it.`);
-					id = matchId;
-				}
-			}
-			if (id !== void 0) {
-				const targetId = id;
-				yield* call(() => client.PATCH("/v1/environment-variables/{envVarId}", {
-					params: { path: { envVarId: targetId } },
-					body: { value: news.value }
-				}));
-				return {
-					id,
-					key: news.key
-				};
-			}
-			const created = yield* call(() => client.POST("/v1/environment-variables", { body: {
-				projectId: news.projectId,
-				class: cls,
-				key: news.key,
-				value: news.value,
-				...news.branchId ? { branchId: news.branchId } : {}
-			} }));
-			return {
-				id: created.data.id,
-				key: created.data.key
-			};
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: output.id } } }));
-		}),
-		read: Effect.fn(function* ({ output }) {
-			if (!output?.id) return void 0;
-			const v = yield* callOptional(() => client.GET("/v1/environment-variables/{envVarId}", { params: { path: { envVarId: output.id } } }));
-			return v ? {
-				id: v.data.id,
-				key: v.data.key
-			} : void 0;
-		})
-	};
-}));
-/**
-* Assembles a Prisma Compute artifact: the app-built bundle plus the
-* extension-printed bootstrap and manifest, tarred and gzipped deterministically
-* (fixed mtimes, sorted entry order) so an unchanged service noops on
-* redeploy — a rebuild is the only thing that changes the hash. Lives here
-* (not in @prisma/composer-prisma-cloud/control) because it needs node:fs/node:zlib,
-* which the extension's shipped src may never import (invariant 5).
-*/
-const MANIFEST_VERSION = "1";
-/** Finds main.js/main.mjs in a bundle dir when no explicit entry is given. */
-function resolveEntry(bundleDir, entry) {
-	if (entry !== void 0) return entry;
-	const found = fs.readdirSync(bundleDir).find((f) => /^main\.m?js$/.test(f));
-	if (found === void 0) throw new Error(`no main.js/main.mjs found in bundle dir ${bundleDir}`);
-	return found;
-}
-/** All files under `dir`, as dir-relative POSIX paths, in sorted order. A
-* symlink is a hard error: deploy bundles must be flat (ADR-0005), and the
-* user's build owns flattening — dereferencing here would relink the tree and
-* risk packaging files from outside it. */
-function walkFiles(dir) {
-	const out = [];
-	const visit = (sub) => {
-		for (const entry of fs.readdirSync(path.join(dir, sub), { withFileTypes: true })) {
-			const rel = sub.length > 0 ? `${sub}/${entry.name}` : entry.name;
-			if (entry.isSymbolicLink()) throw new Error(`bundle contains a symlink at ${rel} — deploy bundles must be flat; materialize links in your build (e.g. cp -RL) so the tree is self-contained.`);
-			if (entry.isDirectory()) visit(rel);
-			else out.push(rel);
-		}
-	};
-	visit("");
-	return out.sort();
-}
-function octal(value, length) {
-	return `${value.toString(8).padStart(length - 1, "0")}\0`;
-}
-/** Splits a path into ustar's name (<=100 bytes) + prefix (<=155 bytes) fields. */
-function splitUstarPath(relPath) {
-	if (Buffer.byteLength(relPath, "utf8") <= 100) return {
-		name: relPath,
-		prefix: ""
-	};
-	for (let i = relPath.length - 1; i >= 0; i--) {
-		if (relPath[i] !== "/") continue;
-		const prefix = relPath.slice(0, i);
-		const name = relPath.slice(i + 1);
-		if (Buffer.byteLength(prefix, "utf8") <= 155 && Buffer.byteLength(name, "utf8") <= 100) return {
-			name,
-			prefix
-		};
-	}
-	throw new Error(`path too long for a ustar tar entry: ${relPath}`);
-}
-function ustarHeader(relPath, size) {
-	const { name, prefix } = splitUstarPath(relPath);
-	const buf = Buffer.alloc(512);
-	buf.write(name, 0, 100, "utf8");
-	buf.write(octal(420, 8), 100, 8, "utf8");
-	buf.write(octal(0, 8), 108, 8, "utf8");
-	buf.write(octal(0, 8), 116, 8, "utf8");
-	buf.write(octal(size, 12), 124, 12, "utf8");
-	buf.write(octal(0, 12), 136, 12, "utf8");
-	buf.write("        ", 148, 8, "utf8");
-	buf.write("0", 156, 1, "utf8");
-	buf.write("ustar\0", 257, 6, "utf8");
-	buf.write("00", 263, 2, "utf8");
-	buf.write(prefix, 345, 155, "utf8");
-	let sum = 0;
-	for (const b of buf) sum += b;
-	buf.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148, 8, "utf8");
-	return buf;
-}
-function createDeterministicTarGz(entries) {
-	const sorted = [...entries].sort((a, b) => a.relPath.localeCompare(b.relPath));
-	const chunks = [];
-	for (const entry of sorted) {
-		chunks.push(ustarHeader(entry.relPath, entry.content.length));
-		chunks.push(entry.content);
-		const pad = (512 - entry.content.length % 512) % 512;
-		if (pad > 0) chunks.push(Buffer.alloc(pad));
-	}
-	chunks.push(Buffer.alloc(1024));
-	return zlib.gzipSync(Buffer.concat(chunks));
-}
-/**
-* Prints the bootstrap + manifest and tars them with the bundle into a
-* deterministic artifact. If bundleDir doesn't exist (e.g. `alchemy destroy`
-* run before any build), returns a placeholder rather than throwing — the
-* artifact is never read on destroy.
-*/
-function packageComputeArtifact(opts) {
-	if (!fs.existsSync(opts.bundleDir)) return {
-		path: "",
-		sha256: "absent"
-	};
-	const bootstrap = `import main from "./${resolveEntry(opts.bundleDir, opts.bundleEntry)}";\nawait main.run(${JSON.stringify(opts.address)}, () => import(${JSON.stringify(`./${opts.appEntry}`)}));\n`;
-	const manifest = `${JSON.stringify({
-		manifestVersion: MANIFEST_VERSION,
-		entrypoint: "bootstrap.js"
-	}, null, 2)}\n`;
-	const files = walkFiles(opts.bundleDir).map((relPath) => ({
-		relPath,
-		content: fs.readFileSync(path.join(opts.bundleDir, relPath))
-	}));
-	files.push({
-		relPath: "bootstrap.js",
-		content: Buffer.from(bootstrap, "utf8")
-	});
-	files.push({
-		relPath: "compute.manifest.json",
-		content: Buffer.from(manifest, "utf8")
-	});
-	files.push({
-		relPath: "bunfig.toml",
-		content: Buffer.from("[install]\nauto = \"disable\"\n", "utf8")
-	});
-	const gz = createDeterministicTarGz(files);
-	const sha256 = crypto$1.createHash("sha256").update(gz).digest("hex");
-	const outDir = path.join(os.tmpdir(), `prisma-composer-compute-${String(os.userInfo().uid)}`, sha256.slice(0, 16));
-	fs.mkdirSync(outDir, { recursive: true });
-	const outPath = path.join(outDir, `${opts.id}.tar.gz`);
-	const tmpPath = path.join(outDir, `.${opts.id}.${crypto$1.randomUUID()}.tmp`);
-	fs.writeFileSync(tmpPath, gz);
-	fs.renameSync(tmpPath, outPath);
-	return {
-		path: outPath,
-		sha256
-	};
-}
-/**
-* The `ServiceKey` Alchemy resource (ADR-0030) — mints a random 256-bit key
-* ONCE at create and keeps it STABLE across deploys, so an unchanged edge
-* no-ops on redeploy. Same mint-once-stable lifecycle as `S3Credentials`
-* (`packages/1-prisma-cloud/1-extensions/target/src/s3-credentials-resource.ts`):
-* Web Crypto only (`crypto.getRandomValues` — no `node:` import), persisted in
-* Alchemy state; on every later apply the provider returns the persisted
-* attributes (`reconcile`'s `output`) unchanged. One resource per RPC edge;
-* rotation is destroy/recreate.
-*/
-/** The `ServiceKey` resource constructor — `yield* Prisma.ServiceKey(id, {})` in the lowering. */
-const ServiceKey = Resource("PrismaCloud.ServiceKey");
-/** A fresh 256-bit key as 64 lowercase hex chars (Web Crypto — no node import). */
-function mintServiceKey() {
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
-	return { value: Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("") };
-}
-/**
-* The `ServiceKey` provider service. `reconcile` runs for create and update;
-* it returns the persisted `output` when present (a redeploy reuses the
-* stored key — the no-op property) and mints a fresh key only on first
-* create. Nothing to enumerate (`list` → `[]`) or tear down (`delete` →
-* no-op; the key lives only in state).
-*/
-const serviceKeyProviderService = {
-	list: () => Effect.succeed([]),
-	reconcile: ({ output }) => Effect.sync(() => output ?? mintServiceKey()),
-	delete: () => Effect.void
-};
-/** The `ServiceKey` provider layer — merged into the Prisma Cloud extension's `providers()`. */
-const ServiceKeyProvider = () => Provider.effect(ServiceKey, Effect.succeed(serviceKeyProviderService));
-//#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/postgres.mjs
-/** A **connection** to a Prisma Postgres database — yields the connection string. */
-const Connection = Resource("Prisma.Connection");
-const ConnectionProvider = () => Provider.effect(Connection, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: ["id", "connectionString"],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			if (output?.id) return output;
-			const created = yield* call(() => client.POST("/v1/databases/{databaseId}/connections", {
-				params: { path: { databaseId: news.databaseId } },
-				body: { name: news.name }
-			}));
-			const endpoints = created.data.endpoints;
-			const dsn = endpoints?.direct?.connectionString ?? endpoints?.pooled?.connectionString;
-			if (dsn === void 0) return yield* Effect.fail(new PrismaApiError({
-				status: 0,
-				message: `connection ${created.data.id} returned no direct/pooled connection string`
-			}));
-			return {
-				id: created.data.id,
-				connectionString: Redacted.make(dsn)
-			};
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/connections/{id}", { params: { path: { id: output.id } } }));
-		})
-	};
-}));
-/** A Prisma **Postgres database** inside a project. */
-const Database = Resource("Prisma.Database");
-const DatabaseProvider = () => Provider.effect(Database, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: ["id"],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } })) : void 0;
-			if (!observed) {
-				const created = yield* call(() => client.POST("/v1/databases", { body: {
-					projectId: news.projectId,
-					name: news.name,
-					region: news.region,
-					...news.isDefault !== void 0 && { isDefault: news.isDefault },
-					...news.branchId !== void 0 && { branchId: news.branchId }
-				} }));
-				return {
-					id: created.data.id,
-					name: created.data.name
-				};
-			}
-			const result = {
-				id: observed.data.id,
-				name: observed.data.name
-			};
-			if (news.branchId !== void 0) {
-				const branchId = news.branchId;
-				yield* call(() => client.PATCH("/v1/databases/{databaseId}", {
-					params: { path: { databaseId: result.id } },
-					body: { branchId }
-				}));
-			}
-			return result;
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } }));
-		}),
-		read: Effect.fn(function* ({ output }) {
-			if (!output?.id) return void 0;
-			const d = yield* callOptional(() => client.GET("/v1/databases/{databaseId}", { params: { path: { databaseId: output.id } } }));
-			return d ? {
-				id: d.data.id,
-				name: d.data.name
-			} : void 0;
-		})
-	};
-}));
-/** A Prisma Developer Platform **Project** — the container for databases and compute services. */
-const Project = Resource("Prisma.Project");
-const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	return {
-		stables: ["id"],
-		list: () => Effect.succeed([]),
-		reconcile: Effect.fn(function* ({ news, output }) {
-			const observed = output?.id ? yield* callOptional(() => client.GET("/v1/projects/{id}", { params: { path: { id: output.id } } })) : void 0;
-			if (observed) return {
-				id: observed.data.id,
-				name: observed.data.name
-			};
-			const created = yield* call(() => client.POST("/v1/projects", { body: {
-				name: news.name,
-				workspaceId: news.workspaceId
-			} }));
-			return {
-				id: created.data.id,
-				name: created.data.name
-			};
-		}),
-		delete: Effect.fn(function* ({ output }) {
-			yield* callVoid(() => client.DELETE("/v1/projects/{id}", { params: { path: { id: output.id } } }));
-		}),
-		read: Effect.fn(function* ({ output }) {
-			if (!output?.id) return void 0;
-			const p = yield* callOptional(() => client.GET("/v1/projects/{id}", { params: { path: { id: output.id } } }));
-			return p ? {
-				id: p.data.id,
-				name: p.data.name
-			} : void 0;
-		})
-	};
-}));
-//#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/index.mjs
-/** Raised with `ensure: false` when the app's Project (or a named stage's Branch) doesn't exist. */
-var ContainerNotFoundError = class extends Data.TaggedError("ContainerNotFoundError") {};
-const listAllProjects = (client) => Effect.gen(function* () {
-	const projects = [];
-	let cursor;
-	for (;;) {
-		const query = cursor === void 0 ? {} : { cursor };
-		const page = yield* call(() => client.GET("/v1/projects", { params: { query } }));
-		projects.push(...page.data);
-		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
-		cursor = page.pagination.nextCursor;
-	}
-	return projects;
-});
-/**
-* Workspace ids circulate in two shapes: `wksp_`-prefixed and bare. Compare
-* bare-to-bare so a `wksp_`-prefixed API id still matches a bare configured
-* one (the same normalization `state/bootstrap.ts` applies to the same
-* `/v1/projects` listing).
-*/
-const bareWorkspaceId = (id) => id.startsWith("wksp_") ? id.slice(5) : id;
-/**
-* Finds the app's Project by name in the workspace — PDP allows duplicate
-* project names, so more than one can match; the oldest wins. Creates one
-* if none match, unless `ensure` is `false` (find-only — `destroy`), in
-* which case an absent Project fails with `ContainerNotFoundError`. No
-* ownership marker and no `--project` override (both deferred — see
-* ADR-0019).
-*/
-const resolveProject = (client, workspaceId, appName, ensure) => Effect.gen(function* () {
-	const oldest = (yield* listAllProjects(client)).filter((p) => bareWorkspaceId(p.workspace.id) === bareWorkspaceId(workspaceId) && p.name === appName).sort((a, b) => a.createdAt.localeCompare(b.createdAt))[0];
-	if (oldest !== void 0) return oldest.id;
-	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({ appName }));
-	return (yield* call(() => client.POST("/v1/projects", { body: {
-		name: appName,
-		workspaceId
-	} }))).data.id;
-});
-const findBranchId = (client, projectId, gitName) => call(() => client.GET("/v1/projects/{projectId}/branches", { params: {
-	path: { projectId },
-	query: { gitName }
-} })).pipe(Effect.map((page) => page.data[0]?.id));
-/**
-* Finds the stage's Branch by its exact `gitName`, creating it if absent
-* unless `ensure` is `false` (find-only — `destroy`), in which case an
-* absent Branch fails with `ContainerNotFoundError`. The Management API has
-* no server-side "create-or-return" idempotency (`POST
-* /v1/projects/:id/branches` 409s on a duplicate `gitName`, with no request
-* field to make that a no-op), so idempotency is client-side: observe
-* first, and on a racing 409 from create, re-observe rather than fail.
-*/
-const resolveBranch = (client, projectId, gitName, appName, ensure) => Effect.gen(function* () {
-	const existing = yield* findBranchId(client, projectId, gitName);
-	if (existing !== void 0) return existing;
-	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({
-		appName,
-		stage: gitName
-	}));
-	return yield* call(() => client.POST("/v1/projects/{projectId}/branches", {
-		params: { path: { projectId } },
-		body: { gitName }
-	})).pipe(Effect.map((r) => r.data.id), Effect.catch((err) => err.status === 409 ? findBranchId(client, projectId, gitName).pipe(Effect.flatMap((id) => id === void 0 ? Effect.fail(err) : Effect.succeed(id))) : Effect.fail(err)));
-});
-/**
-* Resolves the two containers a stage's deploy runs into (ADR-0019): the
-* app's **Project**, found-or-created by name, and — for a named stage
-* only — its **Branch**, found-or-created by `gitName`. The default stage
-* (no `stage`) creates no Branch; `branchId` is omitted. With `ensure:
-* false` (`destroy`), nothing is created — an absent Project or Branch
-* fails with `ContainerNotFoundError` instead.
-*/
-const resolveContainer = (opts) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	const ensure = opts.ensure ?? true;
-	const projectId = yield* resolveProject(client, opts.workspaceId, opts.appName, ensure);
-	if (opts.stage === void 0) return { projectId };
-	return {
-		projectId,
-		branchId: yield* resolveBranch(client, projectId, opts.stage, opts.appName, ensure)
-	};
-});
-/**
-* Soft-deletes a Branch. Tolerates a 404 (already gone). The API refuses if
-* the Branch still has live members or is the production/default Branch —
-* that surfaces as a `PrismaApiError`.
-*/
-const deleteBranch = (branchId) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	yield* callVoid(() => client.DELETE("/v1/branches/{branchId}", { params: { path: { branchId } } }));
-});
-/**
-* Deletes a Project. Tolerates a 404 (already gone). The API refuses with a
-* 400 if the Project still has live dependencies (e.g. another stage's
-* Branch/resources) — that surfaces as a `PrismaApiError`.
-*/
-const deleteProject = (projectId) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	yield* callVoid(() => client.DELETE("/v1/projects/{id}", { params: { path: { id: projectId } } }));
-});
-/** The collection of Prisma resource providers. */
-var Providers = class extends Provider.ProviderCollection()("Prisma") {};
-/**
-* The Prisma provider bundle: every resource provider, the Management API
-* client, and env-based credentials. Plug into a stack with
-* `{ providers: Prisma.providers() }`.
-*/
-const providers = () => Layer.effect(Providers, Provider.collection([
-	Project,
-	Database,
-	Connection,
-	ComputeService,
-	Deployment,
-	EnvironmentVariable,
-	Bucket,
-	BucketKey
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DatabaseProvider(), ConnectionProvider(), ComputeServiceProvider(), DeploymentProvider(), EnvironmentVariableProvider(), BucketProvider(), BucketKeyProvider())), Layer.provideMerge(layer()), Layer.provideMerge(fromEnv()), Layer.orDie);
-//#endregion
 //#region ../../1-prisma-cloud/0-lowering/lowering/dist/state.mjs
 /** The framework-owned database a stage's deploy state lives in — a child of that stage's Branch (ADR-0034). */
 const STATE_DATABASE_NAME = "prisma-composer-state";
@@ -1404,166 +680,6 @@ const prismaStateLayer = (ids) => {
 };
 //#endregion
 //#region ../../1-prisma-cloud/1-extensions/target/dist/control.mjs
-const PRISMA_CLOUD_EXTENSION_ID = "@prisma/composer-prisma-cloud";
-var PrismaCloudContainer = class {
-	input;
-	projectId;
-	branchId;
-	constructor(input, projectId, branchId) {
-		this.input = input;
-		this.projectId = projectId;
-		this.branchId = branchId;
-	}
-	serialize() {
-		return JSON.stringify({
-			input: this.input,
-			projectId: this.projectId,
-			...this.branchId !== void 0 ? { branchId: this.branchId } : {}
-		});
-	}
-};
-/** `instanceof` — parent-side instances and child-side deserialized instances are both constructed by this module. */
-function isPrismaCloudContainer(value) {
-	return value instanceof PrismaCloudContainer;
-}
-/** Narrow-or-throw for hook inputs. */
-function prismaCloudContainerOf(value) {
-	if (!isPrismaCloudContainer(value)) throw new Error("the Prisma Cloud container was not resolved — the extension's container descriptor did not run.");
-	return value;
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-function invalidPayloadError(reason) {
-	return /* @__PURE__ */ new Error(`${PRISMA_CLOUD_EXTENSION_ID}: invalid container transport payload — ${reason}.`);
-}
-/** Reconstructs a `PrismaCloudContainer` from `serialize()`'s JSON output — real narrowing, no casts. */
-function deserialize(serialized) {
-	let parsed;
-	try {
-		parsed = JSON.parse(serialized);
-	} catch (error) {
-		throw invalidPayloadError(`not valid JSON (${error instanceof Error ? error.message : String(error)})`);
-	}
-	if (!isRecord(parsed)) throw invalidPayloadError("not an object");
-	const input = parsed["input"];
-	if (!isRecord(input)) throw invalidPayloadError("\"input\" is not an object");
-	const appName = input["appName"];
-	if (typeof appName !== "string") throw invalidPayloadError("\"input.appName\" is not a string");
-	const stage = input["stage"];
-	if (stage !== void 0 && typeof stage !== "string") throw invalidPayloadError("\"input.stage\" is not a string or absent");
-	const projectId = parsed["projectId"];
-	if (typeof projectId !== "string") throw invalidPayloadError("\"projectId\" is not a string");
-	const branchId = parsed["branchId"];
-	if (branchId !== void 0 && typeof branchId !== "string") throw invalidPayloadError("\"branchId\" is not a string or absent");
-	return new PrismaCloudContainer({
-		appName,
-		stage
-	}, projectId, branchId);
-}
-const workspaceRequiredError = () => /* @__PURE__ */ new Error("environment variable PRISMA_WORKSPACE_ID is required.");
-const tokenRequiredError$2 = () => /* @__PURE__ */ new Error("environment variable PRISMA_SERVICE_TOKEN is required.");
-function requireWorkspaceId() {
-	const workspaceId = process.env["PRISMA_WORKSPACE_ID"];
-	if (workspaceId === void 0 || workspaceId.length === 0) throw workspaceRequiredError();
-	return workspaceId;
-}
-function requireTokenUnlessInjected(deps) {
-	if (deps?.client === void 0 && (process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw tokenRequiredError$2();
-}
-async function ensureContainer(input, deps) {
-	const workspaceId = requireWorkspaceId();
-	requireTokenUnlessInjected(deps);
-	const program = resolveContainer({
-		workspaceId,
-		appName: input.appName,
-		...input.stage !== void 0 ? { stage: input.stage } : {},
-		ensure: true
-	}).pipe(Effect.map((c) => ({
-		ok: true,
-		container: c
-	})), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		message: `Prisma Management API error resolving containers: ${e.message}.`
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (!outcome.ok) throw new Error(outcome.message);
-	return new PrismaCloudContainer(input, outcome.container.projectId, outcome.container.branchId);
-}
-async function locateContainer(input, deps) {
-	const workspaceId = requireWorkspaceId();
-	requireTokenUnlessInjected(deps);
-	const program = resolveContainer({
-		workspaceId,
-		appName: input.appName,
-		...input.stage !== void 0 ? { stage: input.stage } : {},
-		ensure: false
-	}).pipe(Effect.map((c) => ({
-		ok: true,
-		container: c
-	})), Effect.catchTag("ContainerNotFoundError", () => Effect.succeed({ ok: false })), Effect.catchTag("PrismaApiError", (e) => Effect.fail(/* @__PURE__ */ new Error(`Prisma Management API error resolving containers: ${e.message}.`))));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (!outcome.ok) return void 0;
-	return new PrismaCloudContainer(input, outcome.container.projectId, outcome.container.branchId);
-}
-/**
-* Soft-deletes a named stage's Branch after a successful `alchemy destroy`
-* has removed its members — the Management API refuses to delete a Branch
-* that still has live members.
-*/
-async function removeStageBranch(branchId, deps) {
-	requireTokenUnlessInjected(deps);
-	const program = deleteBranch(branchId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		message: `Failed to delete the stage Branch: ${e.message}.`
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (!outcome.ok) throw new Error(outcome.message);
-}
-/**
-* Best-effort cleanup after a successful `--production` destroy: removes
-* the app's Project so hand-run stacks don't accumulate as empty Projects
-* (they eventually hit the workspace's plan limit). Unlike `removeStageBranch`,
-* this never throws: the destroy itself already succeeded, and the API's own
-* 400 ("still has dependencies") is the only check that matters — failing
-* the command over a cleanup step would be worse than leaving a Project shell.
-*/
-async function removeAppProject(projectId, deps) {
-	if (deps?.client === void 0 && (process.env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) {
-		console.warn(`Skipped removing the Project (${projectId}): PRISMA_SERVICE_TOKEN is not set.`);
-		return;
-	}
-	const program = deleteProject(projectId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		error: e
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (outcome.ok) {
-		console.log(`Removed the Project (${projectId}) — nothing was left in it.`);
-		return;
-	}
-	if (outcome.error.status === 400) {
-		console.log(`Kept the Project (${projectId}) — it still has another stage's resources.`);
-		return;
-	}
-	console.warn(`Could not remove the Project (${projectId}) after destroy: ${outcome.error.message}.`);
-}
-function containerDescriptor(deps) {
-	return {
-		ensure: (input) => ensureContainer(input, deps),
-		locate: (input) => locateContainer(input, deps),
-		remove: (instance) => instance.input.stage !== void 0 ? removeStageBranch(instance.branchId ?? missingBranchId(instance), deps) : removeAppProject(instance.projectId, deps),
-		deserialize
-	};
-}
-/** Defensive: a named-stage container always resolves a Branch together with its stage — `ensure`/`locate`/`deserialize` never produce one without the other. */
-function missingBranchId(instance) {
-	throw new Error(`${PRISMA_CLOUD_EXTENSION_ID}: a named-stage ("${instance.input.stage}") container instance is missing its branchId — this is a bug in ensure/locate/deserialize.`);
-}
 const PRISMA_NAME_MIN = 3;
 const PRISMA_NAME_MAX = 65;
 function validateName(value, source) {
@@ -1634,7 +750,7 @@ function computeDescriptor(o) {
 			const svc = yield* ComputeService(`${id}-svc`, {
 				projectId,
 				name: id,
-				region: o.region ?? "us-east-1",
+				region: o().region ?? "us-east-1",
 				...branchId !== void 0 ? { branchId } : {}
 			});
 			return {
@@ -1681,7 +797,7 @@ function computeDescriptor(o) {
 				refs.push(ref);
 				refsByBrand.set(edge.brand, refs);
 			}
-			for (const [brand, entry] of o.providerParams) {
+			for (const [brand, entry] of o().providerParams) {
 				const raw = "valueForService" in entry ? entry.valueForService(provisioned, address) : exposes ? entry.value(refsByBrand.get(brand) ?? []) : void 0;
 				if (raw === void 0) continue;
 				const key = configKey(address, {
@@ -1731,54 +847,6 @@ function computeDescriptor(o) {
 	};
 }
 /**
-* The `PgWarm` Alchemy resource (slice 3, FT-5226) — warm a freshly-provisioned
-* Prisma Postgres database at apply-time so it is ready by deploy-end, and the
-* first real connection (a service's runtime client, or the migration) doesn't
-* eat the cold-start reject.
-*
-* The DB `url` is a lazy `Output` at lowering time, so warming must be an
-* apply-time tracked resource (same pattern as `PnMigration`): its `reconcile`
-* receives the RESOLVED url and connects with `withConnectionRetry` + `select 1`,
-* riding out the cold-start. Shared by BOTH the bare-`postgres` and the
-* `prisma-next` lowerings; keyed on the connection `url`, so an unchanged
-* redeploy is a no-op (warming is idempotent anyway).
-*
-* Deploy-time only: imports `pg` directly + `alchemy`. Imported by `control.ts`
-* and tests, never by `index.ts` / the `./prisma-next` authoring entry — the
-* isolation invariants hold.
-*/
-/** The `PgWarm` resource constructor — `yield* PgWarm(id, { url })` in a lowering. */
-const PgWarm = Resource("PrismaCloud.PgWarm");
-/** Connect (retrying the cold-start) and run `select 1`, then release the connection. */
-async function warmDatabase(url) {
-	await withConnectionRetry(async () => {
-		const client = new pg.Client({ connectionString: normalizeSslMode(url) });
-		await client.connect();
-		try {
-			await client.query("select 1");
-		} finally {
-			await client.end();
-		}
-	});
-}
-/**
-* The `PgWarm` provider service. `reconcile` warms the DB (retrying the
-* cold-start) and echoes the `url` so a downstream resource that reads
-* `warm.url` runs only after the DB is warm. Idempotent — safe on redeploy;
-* nothing to enumerate (`list` → `[]`) or tear down (`delete` → no-op; the DB's
-* own deletion handles teardown). Exported so tests can drive it directly.
-*/
-const pgWarmProviderService = {
-	list: () => Effect.succeed([]),
-	reconcile: ({ news }) => Effect.tryPromise({
-		try: () => warmDatabase(news.url),
-		catch: (error) => error
-	}).pipe(Effect.map(() => ({ url: news.url }))),
-	delete: () => Effect.void
-};
-/** The `PgWarm` provider layer — merged into the extension descriptor's `providers()`. */
-const PgWarmProvider = () => Provider.effect(PgWarm, Effect.succeed(pgWarmProviderService));
-/**
 * One Database per module-provisioned postgres resource — `id` is the
 * module provision id, so a resource shared by several consumers is created
 * exactly once.
@@ -1790,7 +858,7 @@ function postgresDescriptor(o) {
 		const db = yield* Database(`${id}-db`, {
 			projectId: projectIdOf(application),
 			name: id,
-			region: o.region ?? "us-east-1",
+			region: o().region ?? "us-east-1",
 			...branchId !== void 0 ? { branchId } : {}
 		});
 		const conn = yield* Connection(`${id}-conn`, {
@@ -1826,228 +894,6 @@ async function resolveMigrationsDir(configPath) {
 	return resolve(configPath, "..", (await loadConfig(configPath)).migrations?.dir ?? "migrations");
 }
 /**
-* The Prisma Next migration step of the deploy lowering (ADR-0022, slice 2) —
-* the safety-critical decision that brings a live database to a target REF
-* using ONLY Prisma Next's authored migrations.
-*
-* Deploy-time only: this module imports `@prisma-next/postgres/control` (which
-* transitively pulls PN's control/migration machinery + `pg`). It is imported
-* by the deploy descriptors and this package's tests, NEVER by `index.ts` / the
-* `./prisma-next` authoring entry — so it never lands in an app runtime bundle
-* (the index-isolation invariant holds).
-*
-* The target is a ref `{ hash, invariants }` — not a bare `storageHash`. A
-* ref's `invariants` are named postconditions established by `data`-class
-* migration steps (e.g. a backfill), recorded monotonically on the live
-* marker. Keying on the hash alone would make a pure data-invariant change an
-* A→A self-edge the deploy wrongly skips. The decision, given the live marker
-* and the target ref (see {@link decideMigrationAction}):
-*   - marker at ref.hash AND ref.invariants ⊆ marker.invariants → no-op
-*   - no marker (fresh DB) AND no required invariants           → `dbInit`
-*   - otherwise                                                  → `migrate`
-*
-* `dbInit` is additive-only synthesis — it NEVER runs app-space data steps —
-* so it is only correct when the ref requires no invariants; a fresh DB whose
-* target carries invariants goes through `migrate`, which walks the AUTHORED
-* graph (including the invariant-bearing data migrations) from empty.
-*
-* Never `dbUpdate`: synthesized diff-and-apply plans are never run against a
-* deployed database. A no-authored-path (`MIGRATION_PATH_NOT_FOUND`) or a
-* runner failure fails the deploy as a typed `PnMigrationError` (not swallowed).
-* PN applies each migration in its own transaction, so a failed apply is atomic
-* and resume-safe — the marker and schema are left as the last committed step.
-*/
-/** A deploy-failing migration error — surfaced, never swallowed. */
-var PnMigrationError = class extends Error {
-	code;
-	/** PN's structured explanation, when present. */
-	why;
-	constructor(code, summary, why) {
-		super(`prisma-next migrate (${code}): ${summary}`);
-		this.name = "PnMigrationError";
-		this.code = code;
-		this.why = why;
-	}
-};
-/**
-* The target `storageHash` a contract heads to — `contractJson.storage.storageHash`.
-* Read defensively: `contractJson` crosses the boundary as `unknown`.
-*/
-function targetStorageHash(contractJson) {
-	if (typeof contractJson === "object" && contractJson !== null && "storage" in contractJson) {
-		const storage = contractJson.storage;
-		if (typeof storage === "object" && storage !== null && "storageHash" in storage) {
-			const hash = storage.storageHash;
-			if (typeof hash === "string" && hash.length > 0) return hash;
-		}
-	}
-	throw new PnMigrationError("INIT_FAILED", "the contract has no storage.storageHash — cannot determine the target schema version");
-}
-/**
-* Resolve the deploy's target ref from the migrations dir.
-*
-* - `targetRef` named: read `migrations/app/refs/<name>.json` — fail loudly
-*   (`TARGET_REF_NOT_FOUND`) when the ref doesn't exist or can't be parsed.
-* - Default: the app space's head. PN synthesizes the app head from the
-*   emitted contract — `{ hash: contract.storage.storageHash, invariants: [] }`
-*   (`contract emit` writes no app-space `refs/head.json` today; extension
-*   spaces have one on disk). When a future PN version does emit one, the
-*   on-disk `head.json` wins — read via `readContractSpaceHeadRef`, exactly
-*   the loader PN's own migrate uses.
-*/
-async function resolveTargetRef(migrationsDir, contractJson, targetRef) {
-	if (targetRef !== void 0) {
-		const refsDir = spaceRefsDirectory(spaceMigrationDirectory(migrationsDir, APP_SPACE_ID));
-		try {
-			const ref = await readRef(refsDir, targetRef);
-			return {
-				hash: ref.hash,
-				invariants: ref.invariants
-			};
-		} catch (error) {
-			throw new PnMigrationError("TARGET_REF_NOT_FOUND", `targetRef "${targetRef}" could not be read from ${refsDir}`, error instanceof Error ? error.message : String(error));
-		}
-	}
-	const head = await readContractSpaceHeadRef(migrationsDir, APP_SPACE_ID);
-	if (head !== null) return {
-		hash: head.hash,
-		invariants: head.invariants
-	};
-	return {
-		hash: targetStorageHash(contractJson),
-		invariants: []
-	};
-}
-/**
-* The pure migration decision, mirroring PN's own verifier: the database is
-* AT the target when the marker's hash equals the ref's hash AND every ref
-* invariant is on the marker (marker invariants are monotonic). `dbInit` is
-* additive-only synthesis, so it is chosen only for a fresh DB whose
-* effective required invariants (`ref.invariants − marker.invariants`) are
-* empty; anything else — different hash, missing invariant (the A→A
-* data-only self-edge), or a fresh DB with required invariants — walks the
-* authored graph via `migrate`.
-*/
-function decideMigrationAction(marker, ref) {
-	const markerInvariants = new Set(marker?.invariants ?? []);
-	const missing = ref.invariants.filter((id) => !markerInvariants.has(id));
-	if (marker !== null && marker.storageHash === ref.hash && missing.length === 0) return "noop";
-	if (marker === null && missing.length === 0) return "init";
-	return "migrate";
-}
-/**
-* Bring the database at `url` to the target ref via PN's authored migrations.
-* Reads the live marker, decides no-op / init / migrate
-* ({@link decideMigrationAction}), applies, and throws a typed
-* {@link PnMigrationError} on a no-path or runner failure. `migrationsDir` is
-* the on-disk migrations root and `ref` the resolved target
-* ({@link resolveTargetRef} — both resolved by the lowering, which also keys
-* the PnMigration resource on them). `refName` (the resource's `targetRef`,
-* when set) is threaded into `migrate` so PN targets the named ref's hash and
-* plans an invariant-bearing path.
-*/
-async function applyPnMigration(opts) {
-	const connection = normalizeSslMode(opts.url);
-	return withConnectionRetry(() => runMigration(connection, opts.contractJson, opts.migrationsDir, opts.ref, opts.refName), { shouldRetry: (error) => !(error instanceof PnMigrationError) });
-}
-async function runMigration(connection, contractJson, migrationsDir, ref, refName) {
-	const client = createPostgresControlClient({ connection });
-	await client.connect();
-	try {
-		const marker = await client.readMarker();
-		const markerHashBefore = marker?.storageHash ?? null;
-		const action = decideMigrationAction(marker, ref);
-		if (action === "noop") return {
-			action,
-			targetHash: ref.hash,
-			markerHashBefore
-		};
-		if (action === "init") {
-			const result = await client.dbInit({
-				contract: contractJson,
-				mode: "apply",
-				migrationsDir
-			});
-			if (!result.ok) throw new PnMigrationError("INIT_FAILED", result.failure.summary, result.failure.why);
-			return {
-				action,
-				targetHash: ref.hash,
-				markerHashBefore
-			};
-		}
-		const result = await client.migrate({
-			contract: contractJson,
-			migrationsDir,
-			...refName !== void 0 ? {
-				refHash: ref.hash,
-				refInvariants: ref.invariants,
-				refName
-			} : {}
-		});
-		if (!result.ok) throw new PnMigrationError(result.failure.code === "MIGRATION_PATH_NOT_FOUND" ? "MIGRATION_PATH_NOT_FOUND" : "RUNNER_FAILED", result.failure.summary, result.failure.why);
-		return {
-			action,
-			targetHash: ref.hash,
-			markerHashBefore
-		};
-	} finally {
-		await client.close();
-	}
-}
-/**
-* The `PnMigration` Alchemy resource (ADR-0022, slice 2 D2) — the migration
-* step modeled as a tracked resource so it participates in deploy state: keyed
-* on the target REF identity (`targetHash` + sorted `invariants`), an
-* unchanged redeploy is an Alchemy-level no-op (on top of the marker read),
-* and a contract change — or a DATA-ONLY change that adds a ref invariant at
-* the same hash — re-runs the migration.
-*
-* Its provider's `reconcile` receives the RESOLVED props at apply-time — in
-* particular the concrete DB `url` (a lazy `Output` until the Connection
-* provisions) — and delegates to the proven `applyPnMigration` decision. The
-* provider is a standalone `Provider<PnMigration>` layer; the extension
-* descriptor merges it into its `providers()` (`Layer.merge(Prisma.providers(),
-* PnMigrationProvider())`), and Alchemy resolves it at apply via a direct
-* provider-tag lookup (`tryFindProviderByType`) — no change to `@internal/lowering`.
-*
-* Deploy-time only: imports `@prisma-next/postgres/control` (via the helper) +
-* `alchemy`. Imported by `control.ts` and tests, never by `index.ts` / the
-* `./prisma-next` authoring entry — index isolation holds.
-*/
-/** The `PnMigration` resource constructor — `yield* PnMigration(id, props)` in the lowering. */
-const PnMigration = Resource("PrismaNext.Migration");
-/**
-* The `PnMigration` provider service. `reconcile` runs for both create and
-* update (Alchemy's unified lifecycle); `applyPnMigration` is idempotent via
-* the live marker read, so it is safe to run for either — the marker decides
-* no-op / init / migrate. A migration has nothing to enumerate (`list` → `[]`)
-* and nothing to tear down on its own (`delete` → no-op; the DB's own deletion
-* handles teardown). Exported so tests can drive `reconcile` directly, without
-* building an Effect layer.
-*/
-const pnMigrationProviderService = {
-	list: () => Effect.succeed([]),
-	reconcile: ({ news }) => Effect.tryPromise({
-		try: () => applyPnMigration({
-			url: news.url,
-			contractJson: news.contractJson,
-			migrationsDir: news.migrationsDir,
-			ref: {
-				hash: news.targetHash,
-				invariants: news.invariants
-			},
-			...news.refName !== void 0 ? { refName: news.refName } : {}
-		}),
-		catch: (error) => error
-	}).pipe(Effect.map((outcome) => ({
-		storageHash: outcome.targetHash,
-		invariants: news.invariants
-	}))),
-	delete: () => Effect.void
-};
-/** The `PnMigration` provider layer — merged into the extension descriptor's `providers()`. */
-const PnMigrationProvider = () => Provider.effect(PnMigration, Effect.succeed(pnMigrationProviderService));
-/**
 * The migration is a tracked `PnMigration` Alchemy resource keyed on the
 * target REF identity (hash + sorted invariants): unchanged redeploy is a
 * no-op, a contract or ref-invariant change re-migrates.
@@ -2059,7 +905,7 @@ function prismaNextDescriptor(o) {
 		const db = yield* Database(`${id}-db`, {
 			projectId: projectIdOf(application),
 			name: id,
-			region: o.region ?? "us-east-1",
+			region: o().region ?? "us-east-1",
 			...branchId !== void 0 ? { branchId } : {}
 		});
 		const conn = yield* Connection(`${id}-conn`, {
@@ -2091,48 +937,6 @@ function prismaNextDescriptor(o) {
 	return Object.assign(lowering, { kind: "resource" });
 }
 /**
-* The `S3Credentials` Alchemy resource (S5) — mints a random SigV4 key pair
-* ONCE at create and keeps it STABLE across deploys, so an unchanged module
-* no-ops on redeploy. The pair is generated with the Web Crypto global
-* (`crypto.getRandomValues` — no `node:` import, matching this package's
-* runtime-coupling invariant) and persisted in Alchemy state; on every later
-* apply the provider returns the persisted attributes (`reconcile`'s `output`)
-* unchanged — the same way the postgres resource keeps a Connection stable.
-* Rotation is destroy/recreate (a platform ask, not solved here).
-*
-* Deploy-time only: imports `alchemy`. Imported by `control.ts` and tests,
-* never by `index.ts` / the authoring entry.
-*/
-/** The `S3Credentials` resource constructor — `yield* S3Credentials(id, {})` in the lowering. */
-const S3Credentials = Resource("PrismaCloud.S3Credentials");
-function randomBytes(n) {
-	return crypto.getRandomValues(new Uint8Array(n));
-}
-function toHexUpper(bytes) {
-	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
-}
-/** A fresh SigV4 key pair: an AKIA-prefixed id and a 40-char base64 secret. */
-function mintKeyPair() {
-	return {
-		accessKeyId: `AKIA${toHexUpper(randomBytes(8))}`,
-		secretAccessKey: btoa(String.fromCharCode(...randomBytes(30)))
-	};
-}
-/**
-* The `S3Credentials` provider service. `reconcile` runs for create and update;
-* it returns the persisted `output` when present (a redeploy reuses the stored
-* pair — the no-op property) and mints a fresh pair only on first create.
-* Nothing to enumerate (`list` → `[]`) or tear down (`delete` → no-op; the pair
-* lives only in state). Exported so tests can drive it directly.
-*/
-const s3CredentialsProviderService = {
-	list: () => Effect.succeed([]),
-	reconcile: ({ output }) => Effect.sync(() => output ?? mintKeyPair()),
-	delete: () => Effect.void
-};
-/** The `S3Credentials` provider layer — merged into the extension descriptor's `providers()`. */
-const S3CredentialsProvider = () => Provider.effect(S3Credentials, Effect.succeed(s3CredentialsProviderService));
-/**
 * One `S3Credentials` resource per provisioned credentials node — `id` is the
 * module provision id, so a pair shared by the storage service is minted once
 * and kept stable across deploys (the resource's provider preserves it).
@@ -2184,21 +988,6 @@ function s3StoreDescriptor(o) {
 		})
 	};
 }
-/**
-* Deploy preflight (ADR-0029, extended for env-sourced params): before Alchemy
-* runs, verify every secret binding AND every env-sourced param binding in the
-* app's manifests (each a platform env-var NAME) exists on Prisma Cloud for
-* the target stage. A literal-bound param never touches the platform — only
-* `envParam(...)` sources are checked here.
-* A name absent on the platform but present in the deploy shell is provisioned
-* via a direct Management API POST — NEVER an Alchemy resource, so the value
-* never lands in hosted deploy state. A name absent from both fails the deploy,
-* listing exactly what is missing and where to set it.
-*
-* Control-plane only (imported by control.ts → prisma-composer.config.ts); runs
-* in the CLI parent, so it builds its own Management API client from env — the
-* same credential path `container.ts`'s `ensure`/`locate` use.
-*/
 /** production for the default stage; preview for a named stage — matching how the pack writes config rows. */
 const classFor = (branchId) => branchId === void 0 ? "production" : "preview";
 /**
@@ -2274,22 +1063,9 @@ async function managementClient$1() {
 */
 async function runPreflight(input, deps) {
 	const { projectId, branchId } = prismaCloudContainerOf(input.container);
+	const collected = collectPreflightNames(input.graph);
 	const names = /* @__PURE__ */ new Map();
-	for (const binding of provisionManifest(input.graph)) {
-		const name = secretName(binding);
-		if (!names.has(name)) names.set(name, {
-			name,
-			serviceAddress: binding.serviceAddress
-		});
-	}
-	for (const binding of paramManifest(input.graph)) {
-		if (!isEnvParamSource(binding.binding)) continue;
-		const name = paramName(binding);
-		if (!names.has(name)) names.set(name, {
-			name,
-			serviceAddress: binding.serviceAddress
-		});
-	}
+	for (const meta of [...collected.secrets, ...collected.envParams]) if (!names.has(meta.name)) names.set(meta.name, meta);
 	if (names.size === 0) return;
 	const client = deps?.client ?? await managementClient$1();
 	const missing = [];
@@ -2495,12 +1271,18 @@ function buildProviderParams(entries, values) {
 }
 const PROVIDER_PARAMS = buildProviderParams(RESERVED_PROVIDER_PARAMS, PROVIDER_PARAM_VALUES);
 /**
-* Resolves the factory's env-or-option inputs, failing fast with the exact
-* variable name.
+* Resolves the factory's env-or-option inputs. Deliberately does NOT require
+* `PRISMA_WORKSPACE_ID`: nothing in this file reads `ResolvedCloudOptions.workspaceId`
+* downstream — it exists only so a caller MAY pin an explicit workspace, and
+* the real workspace check for a real deploy lives where the value actually
+* matters, `container.ts`'s `ensureContainer`/`locateContainer`. Region
+* validation stays eager-on-call (a garbage `PRISMA_REGION` still fails
+* loudly), but an ABSENT one resolves to `undefined` without touching
+* anything else — required for `prisma-composer dev`, which never sets
+* `PRISMA_REGION` and must not fail on its absence (local-dev spec § 5).
 */
 function resolveOptions(opts) {
-	const workspaceId = opts.workspaceId ?? process.env["PRISMA_WORKSPACE_ID"];
-	if (workspaceId === void 0 || workspaceId.length === 0) throw new Error("prismaCloud(): environment variable PRISMA_WORKSPACE_ID is required.");
+	const workspaceId = opts.workspaceId ?? process.env["PRISMA_WORKSPACE_ID"] ?? "";
 	if (opts.region !== void 0) return {
 		workspaceId,
 		region: opts.region,
@@ -2518,9 +1300,24 @@ function resolveOptions(opts) {
 		providerParams: PROVIDER_PARAMS
 	};
 }
+/**
+* A memoized thunk over `resolveOptions` — evaluated at FIRST LOWERING USE
+* (inside a node descriptor's `provision`/`serialize`), never at `prismaCloud()`
+* construction. The node descriptors take this thunk, not a resolved value
+* (local-dev spec § 5): `prismaCloud()` itself must construct with no
+* environment present, since it also builds the `localTarget` descriptor, which must
+* never require `PRISMA_WORKSPACE_ID`/`PRISMA_REGION`/`PRISMA_SERVICE_TOKEN`.
+*/
+function lazyOptions(opts) {
+	let cached;
+	return () => {
+		cached ??= resolveOptions(opts);
+		return cached;
+	};
+}
 /** The Prisma Cloud extension descriptor — `prisma-composer.config.ts` lists it under `extensions`. */
 const prismaCloud = (opts = {}) => {
-	const o = resolveOptions(opts);
+	const o = lazyOptions(opts);
 	return {
 		id: PRISMA_CLOUD_EXTENSION_ID,
 		container: containerDescriptor(),
@@ -2549,7 +1346,8 @@ const prismaCloud = (opts = {}) => {
 			credentials: s3CredentialsDescriptor(o),
 			"s3-store": s3StoreDescriptor(o),
 			s3: bucketDescriptor(o)
-		}
+		},
+		localTarget: () => import("@prisma/composer-prisma-cloud/local-target").then((m) => m.localTargetDescriptor())
 	};
 };
 //#endregion