@prisma/composer-prisma-cloud 0.6.0-dev.20 → 0.6.0-dev.22

package/dist/control.d.mts

@@ -10,7 +10,7 @@ import { Resource } from "alchemy";
 import "effect/Schedule";
 import * as Output from "alchemy/Output";
 import { ExtensionDescriptor, StateDescriptor } from "@prisma/composer/config";
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute-8Sq4NWg1.d.mts
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/compute-CW3HkgJe.d.mts
 /** Every region Prisma Compute serves — the runtime source of truth; `ComputeRegion` is derived from it so the two can never drift. */
 declare const COMPUTE_REGIONS: readonly ["us-east-1", "us-west-1", "eu-west-3", "eu-central-1", "ap-northeast-1", "ap-southeast-1"];
 type ComputeRegion = (typeof COMPUTE_REGIONS)[number];

package/dist/control.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"control.d.mts","names":[],"sources":["../../../1-prisma-cloud/0-lowering/lowering/dist/compute-8Sq4NWg1.d.mts","../../../1-prisma-cloud/1-extensions/target/dist/control.d.mts"],"mappings":";;;;;;;;;;;;;;cA4Dc;KACT,wBAAwB;;;;;;;;;;;;;;;;;;;UCzCnB,sBAAsB;;;;;;;;WAQrB,QAAQ,6BAA6B,OAAO;;;;;;;;UAQ7C;WACC,gBAAgB,OAAO;;;;;;;;;;;;UAYxB,6BAA6B;WAC5B,kBAAkB,aAAa,8BAA8B,oBAAoB,OAAO;;;;;cAKrF,mBAAmB;UACvB;;EAER;;EAEA,SAAS;;;;;;;;KAQN,qBAAqB,KAAK,0BAA0B,KAAK;;;;;;;;;;iBAU7C,oBAAoB,kBAAkB,sBAAsB,QAAQ,oBAAoB,sBAAsB,oBAAoB,gBAAgB;cACrJ,iBAAiB,oBAAoB,gBAAgB;;cAErD,cAAc,OAAO,uBAAuB"}
+{"version":3,"file":"control.d.mts","names":[],"sources":["../../../1-prisma-cloud/0-lowering/lowering/dist/compute-CW3HkgJe.d.mts","../../../1-prisma-cloud/1-extensions/target/dist/control.d.mts"],"mappings":";;;;;;;;;;;;;;cA4Dc;KACT,wBAAwB;;;;;;;;;;;;;;;;;;;UCzCnB,sBAAsB;;;;;;;;WAQrB,QAAQ,6BAA6B,OAAO;;;;;;;;UAQ7C;WACC,gBAAgB,OAAO;;;;;;;;;;;;UAYxB,6BAA6B;WAC5B,kBAAkB,aAAa,8BAA8B,oBAAoB,OAAO;;;;;cAKrF,mBAAmB;UACvB;;EAER;;EAEA,SAAS;;;;;;;;KAQN,qBAAqB,KAAK,0BAA0B,KAAK;;;;;;;;;;iBAU7C,oBAAoB,kBAAkB,sBAAsB,QAAQ,oBAAoB,sBAAsB,oBAAoB,gBAAgB;cACrJ,iBAAiB,oBAAoB,gBAAgB;;cAErD,cAAc,OAAO,uBAAuB"}

package/dist/control.mjs

@@ -2,11 +2,12 @@ import { o as paramBindingFor, s as paramName } from "./secret-Doubjztg-CWHCDiuX
 import { a as encodeParamPointer, i as encode, l as serializeInput, n as configKey, o as paramEntries } from "./serializer-Ch1Tmx-2-D7cNhkEp.mjs";
 import { a as provisionedEdges, n as SELF_ORIGIN, r as STREAMS_API_KEY, t as RESERVED_PROVIDER_PARAMS } from "./provisioned-edges-COr17uxy-DymAGn_V.mjs";
 import { n as requiredPackHeadOf } from "./required-pack-head-BrrJarzc-DeP50pBu.mjs";
-import { A as packageComputeArtifact, B as call, D as EnvironmentVariable, E as Deployment, F as resolveDefaultBranchId, H as layer, I as MANAGEMENT_API_ORIGIN, L as ManagementClient, M as BucketKey, N as collectPages, O as ServiceKey, P as drivePagesAsync, R as PrismaApiError, S as Database, T as ComputeService, V as fromEnv, _ as resolveTargetRef, a as PgWarmProvider, b as providers, d as collectPreflightNames, f as containerDescriptor, g as resolvePrismaNextConfig, h as prismaCloudContainerOf, i as PgWarm, j as Bucket, k as ServiceKeyProvider, l as S3Credentials, m as packHeadRefHashes, n as GeneratedParamProvider, o as PnMigration, r as PRISMA_CLOUD_EXTENSION_ID, s as PnMigrationProvider, t as GeneratedParam, u as S3CredentialsProvider, w as COMPUTE_REGIONS, x as Connection, z as PrismaCredentials } from "./s3-credentials-resource-BltGd-gG-B_bNhtGi.mjs";
+import { A as packageComputeArtifact, B as PrismaCredentials, D as EnvironmentVariable, E as Deployment, F as resolveDefaultBranchId, H as layer, I as PrismaApiError, L as call, M as BucketKey, N as collectPages, O as ServiceKey, P as drivePagesAsync, R as MANAGEMENT_API_ORIGIN, S as Database, T as ComputeService, V as fromEnv, _ as resolveTargetRef, a as PgWarmProvider, b as providers, d as collectPreflightNames, f as containerDescriptor, g as resolvePrismaNextConfig, h as prismaCloudContainerOf, i as PgWarm, j as Bucket, k as ServiceKeyProvider, l as S3Credentials, m as packHeadRefHashes, n as GeneratedParamProvider, o as PnMigration, r as PRISMA_CLOUD_EXTENSION_ID, s as PnMigrationProvider, t as GeneratedParam, u as S3CredentialsProvider, w as COMPUTE_REGIONS, x as Connection, z as ManagementClient } from "./s3-credentials-resource-BltGd-gG-2K8Cgwoi.mjs";
 import { n as isPnPostgresResourceNode } from "./prisma-next-hB3CQxKI-BYVc-k-F.mjs";
 import { isParamSource } from "@prisma/composer";
 import { blindCast } from "@prisma/composer/casts";
 import { RPC_PEER_KEY } from "@prisma/composer/service-rpc";
+import { createManagementApiClient } from "@prisma/management-api-sdk";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
@@ -18,8 +19,208 @@ import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
 import * as Headers from "effect/unstable/http/Headers";
 import * as Output from "alchemy/Output";
+import { execFileSync } from "node:child_process";
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/resources-rlwsFefZ.mjs
+/**
+* Reporting is observability, so no call may stall the deploy: every request
+* carries this deadline, and an expired one is warned and dropped like any
+* other failure.
+*/
+const REPORT_DEADLINE_MS = 1e4;
+function buildsApi(options) {
+	const { client, warn } = options;
+	/** Runs one call, turning every failure — transport or refusal — into a warning and `undefined`. */
+	const send = async (call, describe) => {
+		let result;
+		try {
+			result = await call();
+		} catch (error) {
+			const detail = error instanceof Error ? error.message : String(error);
+			warn(`Could not reach Prisma Cloud to ${describe}: ${detail}`);
+			return;
+		}
+		if (!result.response.ok) {
+			const detail = result.error === void 0 ? "" : `: ${JSON.stringify(result.error)}`;
+			warn(`Prisma Cloud refused to ${describe} (HTTP ${String(result.response.status)})${detail}`);
+			return;
+		}
+		return result.data ?? {};
+	};
+	return {
+		async create(body) {
+			const created = await send(() => client.POST("/v1/builds", {
+				body,
+				signal: AbortSignal.timeout(REPORT_DEADLINE_MS)
+			}), "record this deploy");
+			if (created === void 0) return void 0;
+			const id = created.data?.id;
+			if (id === void 0 || id.length === 0) {
+				warn("Prisma Cloud recorded this deploy but returned no build id.");
+				return;
+			}
+			return id;
+		},
+		async update(id, body) {
+			return await send(() => client.PATCH("/v1/builds/{buildId}", {
+				params: { path: { buildId: id } },
+				body,
+				signal: AbortSignal.timeout(REPORT_DEADLINE_MS)
+			}), "update this deploy's build") !== void 0;
+		},
+		async reportResource(id, resourceType, resourceId, action) {
+			return await send(() => client.PUT("/v1/builds/{buildId}/resources/{resourceType}/{resourceId}", {
+				params: { path: {
+					buildId: id,
+					resourceType,
+					resourceId
+				} },
+				body: { action },
+				signal: AbortSignal.timeout(REPORT_DEADLINE_MS)
+			}), `record the ${resourceType} this deploy ${action === "acted_on" ? "acted on" : action}`) !== void 0;
+		}
+	};
+}
+/** Names the build a run belongs to. Set by the CLI on the alchemy child, or by a CI runner that created the build itself. */
+const BUILD_ID_ENV = "PRISMA_BUILD_ID";
+/**
+* Alchemy resource type → platform resource type.
+*
+* Two of this package's resources are deliberately absent. `Prisma.BucketKey`
+* has no platform resource type to map onto. `PrismaCloud.ServiceKey` is a
+* value this deploy mints locally, not a platform resource at all — the
+* platform's `service_key` is what `Prisma.Connection` creates.
+*
+* Anything not listed — `PgWarm`, and every resource another extension
+* contributes — is not a Prisma Cloud resource and is not reported.
+*/
+const PLATFORM_RESOURCES = {
+	"Prisma.Project": {
+		type: "project",
+		idField: "id"
+	},
+	"Prisma.Database": {
+		type: "database",
+		idField: "id"
+	},
+	"Prisma.Connection": {
+		type: "service_key",
+		idField: "id"
+	},
+	"Prisma.Bucket": {
+		type: "bucket",
+		idField: "id"
+	},
+	"Prisma.ComputeService": {
+		type: "app",
+		idField: "id"
+	},
+	"Prisma.Deployment": {
+		type: "deployment",
+		idField: "deploymentId"
+	},
+	"Prisma.EnvironmentVariable": {
+		type: "config_variable",
+		idField: "id"
+	}
+};
+/**
+* Terminal status → what the run did to the resource. The intermediate
+* statuses (`creating`, `updating`, `replacing`) are skipped: they say work
+* started, not that it landed, and the terminal write follows immediately.
+*
+* `updated` maps to `acted_on` rather than to nothing, because a reconcile
+* that changed no field is still this run acting on that resource — a
+* migration against an untouched database is an action on it.
+*/
+const ACTION_BY_STATUS = {
+	created: "created",
+	updated: "acted_on",
+	deleting: "deleted"
+};
+const isRecord = (value) => typeof value === "object" && value !== null;
+/**
+* What a persisted state record says this run did, or `undefined` when it
+* says nothing reportable. Reads defensively: the record crosses a wire and
+* carries resources from every extension, not only this one's.
+*/
+function reportableResource(value) {
+	if (!isRecord(value)) return void 0;
+	if (value["kind"] === "action") return void 0;
+	if (value["adopting"] === true) return void 0;
+	const resourceType = value["resourceType"];
+	if (typeof resourceType !== "string") return void 0;
+	const mapping = PLATFORM_RESOURCES[resourceType];
+	if (mapping === void 0) return void 0;
+	const status = value["status"];
+	const action = typeof status === "string" ? ACTION_BY_STATUS[status] : void 0;
+	if (action === void 0) return void 0;
+	const attr = value["attr"];
+	if (!isRecord(attr)) return void 0;
+	const id = attr[mapping.idField];
+	if (typeof id !== "string" || id.length === 0) return void 0;
+	return {
+		type: mapping.type,
+		id,
+		action
+	};
+}
+/**
+* The most a drain will wait, total. Every real report already carries the
+* api layer's per-request deadline, so this never fires for the shipped
+* `BuildsApi`; it is the backstop that keeps the state layer's finalizer —
+* and therefore the deploy lease release — bounded against any implementation.
+*/
+const DRAIN_DEADLINE_MS = 15e3;
+function resourceReporter(api, buildId, warn = (message) => console.warn(message), drainDeadlineMs = DRAIN_DEADLINE_MS) {
+	const inFlight = /* @__PURE__ */ new Set();
+	const reported = /* @__PURE__ */ new Set();
+	return {
+		observe(value) {
+			const resource = reportableResource(value);
+			if (resource === void 0) return;
+			const key = `${resource.type}:${resource.id}:${resource.action}`;
+			if (reported.has(key)) return;
+			reported.add(key);
+			const sent = api.reportResource(buildId, resource.type, resource.id, resource.action).finally(() => inFlight.delete(sent));
+			inFlight.add(sent);
+		},
+		async drain() {
+			const deadline = Date.now() + drainDeadlineMs;
+			while (inFlight.size > 0) {
+				const remaining = deadline - Date.now();
+				if (remaining <= 0) {
+					warn(`Abandoned ${inFlight.size} in-flight resource report(s) after ${drainDeadlineMs}ms.`);
+					return;
+				}
+				await Promise.race([Promise.allSettled([...inFlight]), new Promise((resolve) => setTimeout(resolve, remaining).unref?.())]);
+				if (Date.now() >= deadline && inFlight.size > 0) {
+					warn(`Abandoned ${inFlight.size} in-flight resource report(s) after ${drainDeadlineMs}ms.`);
+					return;
+				}
+			}
+		}
+	};
+}
+//#endregion
 //#region ../../1-prisma-cloud/0-lowering/lowering/dist/state.mjs
 /**
+* Reports on the way out of a successful `set`, never before it: a write that
+* failed leaves the resource unrecorded here, and claiming otherwise would
+* make the build's provenance a guess.
+*/
+function withResourceReporting(inner, api, buildId, warn) {
+	const reporter = resourceReporter(api, buildId, warn);
+	return {
+		store: {
+			...inner,
+			set(request) {
+				return inner.set(request).pipe(Effect.tap(() => Effect.sync(() => reporter.observe(request.value))));
+			}
+		},
+		reporter
+	};
+}
+/**
 * Whether the platform state API holds any resources for (stack, stage).
 * Requires the live deploy lease — the listing runs under it, like every
 * state operation.
@@ -250,10 +451,217 @@ const stateLayerAgainst = (apiOrigin, ids) => {
 			transformClient: (req) => HttpClientRequest.setHeader(req, LEASE_HEADER, Redacted.value(lease.leaseId)),
 			id: "prisma-postgres"
 		}).pipe(Effect.provide(FetchHttpClient.layer));
-		return Effect.succeed(service);
+		const buildId = process.env[BUILD_ID_ENV];
+		if (buildId === void 0 || buildId.length === 0) return Effect.succeed(service);
+		const { store, reporter } = withResourceReporting(service, buildsApi({
+			client: mgmt,
+			warn: (message) => {
+				console.warn(message);
+			}
+		}), buildId);
+		yield* Effect.addFinalizer(() => Effect.promise(() => reporter.drain()));
+		return Effect.succeed(store);
 	}).pipe(Effect.provide(dependencies))).pipe(Layer.orDie, Layer.merge(redactLeaseHeader));
 };
 //#endregion
+//#region ../../1-prisma-cloud/0-lowering/lowering/dist/builds.mjs
+/**
+* Who is deploying, and from what commit — the identity a build is reported
+* under.
+*
+* `commitSha` and `branchName` are required by the platform, and Composer has
+* no other reason to read git, so this is the only place it does. A deploy
+* from a directory that is not a git checkout has neither, and is reported
+* not at all rather than reported with placeholder values: the Console keeps
+* whatever it is told, and "unknown" would sit in a workspace's deploy
+* history permanently.
+*/
+const DIGITS = /^[0-9]+$/;
+const nonEmpty$1 = (value) => value !== void 0 && value.length > 0 ? value : void 0;
+function git(args, cwd) {
+	try {
+		const out = execFileSync("git", [...args], {
+			cwd,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 5e3
+		});
+		return nonEmpty$1(out.trim());
+	} catch {
+		return;
+	}
+}
+/**
+* The GitHub Actions run this is executing inside, when all three parts are
+* present and are the digits the platform's dedup key requires. Partial or
+* malformed input yields nothing rather than half an identity: the key joins
+* its parts with `:`, so a part that is not digits could let two different
+* runs spell the same key.
+*/
+function githubRunIdentity(env) {
+	if (env["GITHUB_ACTIONS"] !== "true") return void 0;
+	const repositoryId = nonEmpty$1(env["GITHUB_REPOSITORY_ID"]);
+	const runId = nonEmpty$1(env["GITHUB_RUN_ID"]);
+	const attempt = nonEmpty$1(env["GITHUB_RUN_ATTEMPT"]) ?? "1";
+	if (repositoryId === void 0 || !DIGITS.test(repositoryId)) return void 0;
+	if (runId === void 0 || !DIGITS.test(runId)) return void 0;
+	if (!DIGITS.test(attempt)) return void 0;
+	const runAttempt = Number.parseInt(attempt, 10);
+	if (!Number.isInteger(runAttempt) || runAttempt < 1) return void 0;
+	return {
+		provider: "github",
+		repositoryId,
+		runId,
+		runAttempt
+	};
+}
+function githubRunUrl(env) {
+	const server = nonEmpty$1(env["GITHUB_SERVER_URL"]) ?? "https://github.com";
+	const repository = nonEmpty$1(env["GITHUB_REPOSITORY"]);
+	const runId = nonEmpty$1(env["GITHUB_RUN_ID"]);
+	if (repository === void 0 || runId === void 0) return void 0;
+	return `${server}/${repository}/actions/runs/${runId}/attempts/${nonEmpty$1(env["GITHUB_RUN_ATTEMPT"]) ?? "1"}`;
+}
+/**
+* The branch this ran on. Inside a pull-request workflow `GITHUB_REF_NAME` is
+* the synthetic merge ref (`123/merge`), so the head branch is preferred —
+* it is the name a person would recognise in the Console.
+*/
+function branchName(env, cwd) {
+	const fromEnv = nonEmpty$1(env["GITHUB_HEAD_REF"]) ?? nonEmpty$1(env["GITHUB_REF_NAME"]);
+	if (fromEnv !== void 0) return fromEnv;
+	const head = git([
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	], cwd);
+	return head === "HEAD" ? void 0 : head;
+}
+/**
+* The identity to report this run under, or `undefined` when there is not
+* enough to report one honestly.
+*/
+function resolveRunIdentity(cwd, env) {
+	const commitSha = nonEmpty$1(env["GITHUB_SHA"]) ?? git(["rev-parse", "HEAD"], cwd);
+	const branch = branchName(env, cwd);
+	if (commitSha === void 0 || branch === void 0) return void 0;
+	const runIdentity = githubRunIdentity(env);
+	return {
+		source: runIdentity === void 0 ? "cli" : "ci",
+		commitSha,
+		branchName: branch,
+		runIdentity,
+		externalLogUrl: runIdentity === void 0 ? void 0 : githubRunUrl(env)
+	};
+}
+/** An empty string is how a shell spells "unset", so it must not be mistaken for a build id. */
+const nonEmpty = (value) => value !== void 0 && value.length > 0 ? value : void 0;
+function buildReporter(options) {
+	return { begin: async (input) => {
+		try {
+			return await beginSession(input, options);
+		} catch (error) {
+			(options.warn ?? ((message) => console.warn(message)))(`Could not start build reporting: ${error instanceof Error ? error.message : String(error)}`);
+			return;
+		}
+	} };
+}
+async function beginSession(input, options) {
+	const env = options.env ?? process.env;
+	const warn = options.warn ?? ((message) => console.warn(message));
+	const injected = input.credentials?.client;
+	const token = env["PRISMA_SERVICE_TOKEN"];
+	if (options.api === void 0 && injected === void 0 && (token === void 0 || token.length === 0)) return;
+	const identity = resolveRunIdentity(input.cwd, env);
+	if (identity === void 0) {
+		warn(`\nNot recording this deploy in Prisma Cloud: ${input.cwd} has no commit and branch to report it under. Deploy from a git checkout to see it in the Console.`);
+		return;
+	}
+	const api = options.api ?? buildsApi({
+		client: injected ?? createManagementApiClient({
+			token: token ?? "",
+			baseUrl: options.origin ?? "https://api.prisma.io"
+		}),
+		warn
+	});
+	const joined = nonEmpty(input.reportId) ?? nonEmpty(env["PRISMA_BUILD_ID"]);
+	const buildId = joined !== void 0 ? joined : await api.create({
+		source: identity.source,
+		commitSha: identity.commitSha,
+		branchName: identity.branchName,
+		...identity.runIdentity !== void 0 ? { runIdentity: identity.runIdentity } : {},
+		...identity.externalLogUrl !== void 0 ? { externalLogUrl: identity.externalLogUrl } : {}
+	});
+	if (buildId === void 0) return void 0;
+	await api.update(buildId, {
+		phase: "deploy",
+		state: "running"
+	});
+	return session(api, buildId, options.refsOf, warn);
+}
+/**
+* The app this run deployed and where it can be reached — but only when the
+* run deployed exactly one compute service.
+*
+* `Build.appId` and `Build.deployedUrl` are each one value, and an app with
+* several services has no single answer. Picking the first would put an
+* arbitrary service's address in the Console and quietly imply it was the
+* app's. Single-service apps are the common case and get a working link;
+* multi-service apps get neither, and their services are all reported through
+* the resources endpoint regardless.
+*
+* Both fields are fill-only, so this is safe to send on a build whose creator
+* already set them to the same values, and a genuine disagreement is a 409
+* the caller logs.
+*/
+function deployedApp(entities) {
+	const services = entities.filter((entity) => entity.kind === "compute-service");
+	const only = services.length === 1 ? services[0] : void 0;
+	if (only === void 0) return {};
+	return {
+		appId: only.id,
+		...only.url !== void 0 ? { deployedUrl: only.url } : {}
+	};
+}
+function session(api, buildId, refsOf, warn) {
+	let finished = false;
+	return {
+		childEnv: () => ({ [BUILD_ID_ENV]: buildId }),
+		/**
+		* Attaches the build to the Project and Branch this deploy resolved.
+		* Sent on its own rather than folded into the progress update above:
+		* the fields are fill-only, so keeping them in their own call means a
+		* 409 from a disagreeing creator costs these references alone.
+		*/
+		async attach(input) {
+			if (input.container === void 0) return;
+			const { projectId, branchId } = refsOf(input.container);
+			await api.update(buildId, {
+				projectId,
+				...branchId !== void 0 ? { branchId } : {}
+			});
+		},
+		async finish(outcome) {
+			if (finished) return;
+			finished = true;
+			try {
+				await api.update(buildId, {
+					state: outcome.ok ? "succeeded" : outcome.cancelled ? "cancelled" : "failed",
+					...outcome.failingStep !== void 0 && !outcome.cancelled ? { failingStep: outcome.failingStep } : {},
+					...outcome.errorMessage !== void 0 && !outcome.cancelled ? { errorMessage: outcome.errorMessage } : {},
+					...deployedApp(outcome.entities)
+				});
+			} catch (error) {
+				warn(`Could not report this deploy's outcome: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		}
+	};
+}
+//#endregion
 //#region ../../1-prisma-cloud/1-extensions/target/dist/control.mjs
 const PRISMA_NAME_MIN = 3;
 const PRISMA_NAME_MAX = 65;
@@ -701,6 +1109,15 @@ function s3StoreDescriptor(o) {
 		})
 	};
 }
+function prismaCloudReporter() {
+	return buildReporter({ refsOf: (container) => {
+		const { projectId, branchId } = prismaCloudContainerOf(container);
+		return {
+			projectId,
+			branchId
+		};
+	} });
+}
 /** The Prisma Cloud–hosted deploy state store; its implementation lives in @internal/lowering. */
 /**
 * ADR-0031's registered provisioner for RPC_PEER_KEY: mints one `ServiceKey`
@@ -908,6 +1325,7 @@ const prismaCloud = (opts = {}) => {
 		container: containerDescriptor(),
 		providers: () => asProvidersLayer(Layer.mergeAll(providers(), PgWarmProvider(), PnMigrationProvider(), S3CredentialsProvider(), GeneratedParamProvider(), ServiceKeyProvider())),
 		preflight: (input) => runPreflight(input),
+		reporter: prismaCloudReporter(),
 		application: { provision: (ctx) => Effect.gen(function* () {
 			const { projectId, branchId } = prismaCloudContainerOf(ctx.container);
 			for (const key of ["DATABASE_URL", "DATABASE_URL_POOLED"]) yield* EnvironmentVariable(`${key}-poison`, {