@prisma/composer 0.1.0-dev.16 → 0.1.0-dev.18

package/dist/{app-config-FyPJc4X--D8hIqPlm.d.mts → app-config-DJdU4ubR-BwioNK8j.d.mts}

@@ -5,7 +5,70 @@ import { Input, StackServices } from "alchemy";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { State } from "alchemy/State/State";
-//#region ../../0-framework/1-core/core/dist/app-config-FyPJc4X-.d.mts
+//#region ../../0-framework/1-core/core/dist/app-config-DJdU4ubR.d.mts
+//#region src/container-transport.d.ts
+/**
+ * Carries resolved containers from the CLI process into the alchemy process
+ * (ADR-0037). A deploy runs as two processes: the CLI resolves each
+ * extension's containers, then spawns `alchemy`, which re-imports the config
+ * from scratch and needs those containers back — and env vars are the only
+ * channel between the two. So the CLI writes each instance's `serialize()`
+ * output into one env var per extension, and in the alchemy process
+ * `deserializeContainers` reads each var back through the same extension's
+ * descriptor. The framework owns the vars; it never reads their contents.
+ */
+/** The key an extension resolves a container from: which app, which stage. */
+interface LocateContainerInput {
+  /** The application name (root node's name, or `--name`). */
+  readonly appName: string;
+  /** The named stage, or `undefined` for the default (production) stage. */
+  readonly stage: string | undefined;
+}
+/**
+ * One resolved container. The framework sees only this interface; the
+ * extension that produced the instance narrows it back to its own concrete
+ * type wherever the framework hands it back (ADR-0037).
+ */
+interface ContainerInstance {
+  readonly input: LocateContainerInput;
+  /** Serialize to a non-empty string for the process transport above. The format is the extension's own; only its `deserialize` reads it. */
+  serialize(): string;
+}
+/**
+ * The platform containers an app deploys into, as one lifecycle. `I` is
+ * the extension's own instance type — the same descriptor produces and
+ * consumes it, so the extension gets full typing internally while the
+ * framework stores the erased form. METHOD SYNTAX REQUIRED on all four
+ * members: the erased assignment into ExtensionDescriptor compiles only
+ * through method bivariance; property-arrow members are checked
+ * contravariantly and the assignment fails (same rule as
+ * ServiceLowering<P, S> — ADR-0033).
+ */
+interface ContainerDescriptor<I extends ContainerInstance = ContainerInstance> {
+  /** Resolve the container for (appName, stage), creating anything absent. Called by `deploy`. */
+  ensure(input: LocateContainerInput): Promise<I>;
+  /** Find the container for (appName, stage); `undefined` when nothing exists. Called by `destroy` — never creates. */
+  locate(input: LocateContainerInput): Promise<I | undefined>;
+  /** Remove the container after a successful destroy, after every extension's `teardown` has run. Failure policy is the extension's. */
+  remove(instance: I): Promise<void>;
+  /** Reconstruct an instance from its own `serialize()` output — the far end of the framework's parent→child transport. */
+  deserialize(serialized: string): I;
+}
+/** '@prisma/composer-prisma-cloud' → 'PRISMA_COMPOSER_CONTAINER_PRISMA_COMPOSER_PRISMA_CLOUD' */
+declare function containerEnvVarName(extensionId: string): string;
+/** The env entries the CLI sets on the alchemy process: `{ [containerEnvVarName(id)]: instance.serialize() }` for every resolved instance. */
+declare function containerEnv(instances: ReadonlyMap<string, ContainerInstance>): Record<string, string>;
+/** The slice of `PrismaAppConfig.extensions` this module needs — kept narrow so this shared-plane module never imports the control-plane `ExtensionDescriptor`/`PrismaAppConfig` types (ADR-0028's plane split). */
+interface ContainerTransportExtension {
+  readonly id: string;
+  readonly container?: ContainerDescriptor;
+}
+/**
+ * The alchemy-process side: for each extension with a container descriptor
+ * whose var is present in `env`, call its deserialize. Absent var → no entry.
+ */
+declare function deserializeContainers(extensions: readonly ContainerTransportExtension[], env: Readonly<Record<string, string | undefined>>): ReadonlyMap<string, ContainerInstance>;
+//#endregion
 //#region src/control/deploy.d.ts
 /** The Layer shape every Alchemy state store must satisfy — what `LowerOptions.state` and `PrismaAppConfig.state` both traffic in. */
 type AlchemyStateLayer = Layer.Layer<State, never, StackServices>;
@@ -92,6 +155,13 @@ interface LowerContext {
    * it with its own type guard.
    */
   readonly application: unknown;
+  /**
+   * The owning extension's resolved container, deserialized from the
+   * framework transport; core never reads it — the extension narrows it
+   * with its own type guard. `undefined` when the extension declares no
+   * container descriptor.
+   */
+  readonly container: ContainerInstance | undefined;
   /** Already-lowered deps (topo order). */
   readonly lowered: ReadonlyMap<NodeId, Outputs>;
   /** Every provisioned param value minted this lowering, keyed by edge id (ADR-0031). */
@@ -219,10 +289,12 @@ declare function joinDeployment(graph: Graph, entries: readonly {
 }[]): readonly DeployedNode[];
 /**
  * The state-layer precedence a deploy resolves to: an explicit opts.state
- * always wins; failing that, the config's own (required) state. A pure
- * function so the precedence is testable without booting Alchemy.
+ * always wins; failing that, the config's own (required) state descriptor,
+ * created with its owning extension's resolved container (`undefined` when
+ * that extension declared none). A pure function so the precedence is
+ * testable without booting Alchemy.
  */
-declare function resolveStateLayer(opts: LowerOptions, config: PrismaAppConfig): AlchemyStateLayer;
+declare function resolveStateLayer(opts: LowerOptions, config: PrismaAppConfig, containers: ReadonlyMap<string, ContainerInstance>): AlchemyStateLayer;
 /**
  * All configured extensions' providers merged, config array order — an
  * extension without `providers` is skipped; no used-extensions-only
@@ -275,24 +347,38 @@ interface ExtensionDescriptor {
    * fail the command handles that itself. Async: it talks to the platform.
    */
   readonly teardown?: (input: TeardownInput) => Promise<void>;
+  /**
+   * The extension's container lifecycle, when its platform has containers
+   * (ADR-0038). The CLI resolves containers after assembly and before any
+   * stack file or Alchemy run (deploy ensures, destroy locates); the
+   * resolved instance reaches the alchemy process through the env transport
+   * in container-transport.ts.
+   */
+  readonly container?: ContainerDescriptor;
+}
+/**
+ * The deploy's one state store. It names its owning extension so core knows
+ * whose resolved container to pass into `create` (ADR-0038).
+ */
+interface StateDescriptor {
+  /** The owning extension's id — matched against `ExtensionDescriptor.id`. */
+  readonly extension: string;
+  /** Build the state layer. `container` is the owning extension's resolved instance; `undefined` when it declared no container descriptor. */
+  create(container: ContainerInstance | undefined): AlchemyStateLayer;
 }
 /** The resolved deploy context handed to an extension's `preflight` hook. */
 interface PreflightInput {
   /** The loaded application graph — the manifest of prerequisites is read from it (`provisionManifest`). */
   readonly graph: Graph;
-  /** The resolved Prisma Cloud Project id. */
-  readonly projectId: string;
-  /** The resolved Branch id for a named stage; `undefined` for the default (production) stage. */
-  readonly branchId: string | undefined;
+  /** The calling extension's own resolved container; `undefined` when it declares no container descriptor. Narrow with the extension's guard. */
+  readonly container: ContainerInstance | undefined;
   /** The stage name (`--stage`), or `undefined` for the default stage — for diagnostics/scope. */
   readonly stage: string | undefined;
 }
 /** The resolved destroy context handed to an extension's `teardown` hook. */
 interface TeardownInput {
-  /** The resolved Prisma Cloud Project id. */
-  readonly projectId: string;
-  /** The resolved Branch id for a named stage; `undefined` for the default (production) stage. */
-  readonly branchId: string | undefined;
+  /** The calling extension's own resolved container; `undefined` when it declares no container descriptor. Narrow with the extension's guard. */
+  readonly container: ContainerInstance | undefined;
   /** The stage name (`--stage`), or `undefined` for the default stage — for diagnostics/scope. */
   readonly stage: string | undefined;
 }
@@ -316,10 +402,10 @@ type NodeDescriptor = ({
  */
 interface PrismaAppConfig {
   readonly extensions: ExtensionDescriptor[];
-  readonly state: () => AlchemyStateLayer;
+  readonly state: StateDescriptor;
 }
 /** Typed identity — exists so `prisma-composer.config.ts` gets checked against PrismaAppConfig where it is written. */
 declare function defineConfig(config: PrismaAppConfig): PrismaAppConfig;
 //#endregion
-export { resolveStateLayer as A, TeardownInput as C, lower as D, joinDeployment as E, lowering as O, ServiceLowering as S, defineConfig as T, PackageInput as _, Bundle as a, ProvisionEdge as b, DeploymentResult as c, LowerError as d, LowerOptions as f, Outputs as g, NodeDescriptor as h, AssembleInput as i, mergedProviders as k, ExtensionDescriptor as l, Lowering as m, ApplicationDescriptor as n, DeployedEntity as o, LoweredResult as p, Artifact as r, DeployedNode as s, AlchemyStateLayer as t, LowerContext as u, PreflightInput as v, buildConfig as w, ProvisionerDescriptor as x, PrismaAppConfig as y };
-//# sourceMappingURL=app-config-FyPJc4X--D8hIqPlm.d.mts.map
+export { containerEnvVarName as A, ProvisionEdge as C, TeardownInput as D, StateDescriptor as E, lowering as F, mergedProviders as I, resolveStateLayer as L, deserializeContainers as M, joinDeployment as N, buildConfig as O, lower as P, PrismaAppConfig as S, ServiceLowering as T, Lowering as _, Bundle as a, PackageInput as b, DeployedEntity as c, ExtensionDescriptor as d, LocateContainerInput as f, LoweredResult as g, LowerOptions as h, AssembleInput as i, defineConfig as j, containerEnv as k, DeployedNode as l, LowerError as m, ApplicationDescriptor as n, ContainerDescriptor as o, LowerContext as p, Artifact as r, ContainerInstance as s, AlchemyStateLayer as t, DeploymentResult as u, NodeDescriptor as v, ProvisionerDescriptor as w, PreflightInput as x, Outputs as y };
+//# sourceMappingURL=app-config-DJdU4ubR-BwioNK8j.d.mts.map

package/dist/bin.mjs

@@ -2,19 +2,9 @@
 import { Cli, Command, Option, UsageError } from "clipanion";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { spawnSync } from "node:child_process";
-import { createManagementApiClient } from "@prisma/management-api-sdk";
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Redacted from "effect/Redacted";
-import * as Config from "effect/Config";
-import * as Data from "effect/Data";
-import * as Provider from "alchemy/Provider";
-import { Resource } from "alchemy";
-import * as Schedule from "effect/Schedule";
 import * as c12 from "c12";
 import { pathToFileURL } from "node:url";
+import { spawnSync } from "node:child_process";
 //#region ../../0-framework/3-tooling/assemble/dist/index.mjs
 /**
 * A user-facing assembly failure with a message that already names the fix
@@ -585,157 +575,34 @@ function Load(root, opts) {
 	throw new LoadError("Load expects a service or module root (received another node kind).");
 }
 //#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CJM0E6rj.mjs
-/**
-* The Prisma service token used to authenticate Management API calls. Kept
-* as a Redacted value so it never lands in logs or error output.
-*/
-var PrismaCredentials = class extends Context.Service()("PrismaCredentials") {};
-/** Resolve the token from the `PRISMA_SERVICE_TOKEN` environment variable. */
-const fromEnv = () => Layer.effect(PrismaCredentials, Effect.gen(function* () {
-	return { token: yield* Config.redacted("PRISMA_SERVICE_TOKEN") };
-}));
-/**
-* The typed Prisma Management API client, built once from the resolved
-* credentials. Providers yield this in their outer Effect and call it inside
-* `reconcile` / `delete`.
-*/
-var ManagementClient = class extends Context.Service()("PrismaManagementClient") {};
-const layer = () => Layer.effect(ManagementClient, Effect.gen(function* () {
-	const { token } = yield* PrismaCredentials;
-	return createManagementApiClient({ token: Redacted.value(token) });
-}));
-/** A non-2xx response from the Management API (or a transport failure). */
-var PrismaApiError = class extends Data.TaggedError("PrismaApiError") {};
-const attempt = (f) => Effect.tryPromise({
-	try: f,
-	catch: (cause) => new PrismaApiError({
-		status: 0,
-		message: String(cause)
-	})
-});
-const fail = (r) => Effect.fail(new PrismaApiError({
-	status: r.response.status,
-	message: JSON.stringify(r.error)
-}));
-/** Unwrap `data`, failing on any API error. Preserves the SDK's response type. */
-const call = (f) => attempt(f).pipe(Effect.flatMap((r) => r.error !== void 0 || r.data === void 0 ? fail(r) : Effect.succeed(r.data)));
-/** Fire-and-forget a call, tolerating a 404 (already deleted). */
-const callVoid = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
-Resource("Prisma.Bucket");
-Resource("Prisma.BucketKey");
-Schedule.both(Schedule.exponential("2 seconds", 2), Schedule.during("5 minutes"));
-Resource("Prisma.ComputeService");
-Resource("Prisma.Deployment");
-Resource("Prisma.EnvironmentVariable");
-Resource("PrismaCloud.ServiceKey");
-Resource("Prisma.Connection");
-Resource("Prisma.Database");
-Resource("Prisma.Project");
-//#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/index.mjs
-/** Raised with `ensure: false` when the app's Project (or a named stage's Branch) doesn't exist. */
-var ContainerNotFoundError = class extends Data.TaggedError("ContainerNotFoundError") {};
-const listAllProjects = (client) => Effect.gen(function* () {
-	const projects = [];
-	let cursor;
-	for (;;) {
-		const query = cursor === void 0 ? {} : { cursor };
-		const page = yield* call(() => client.GET("/v1/projects", { params: { query } }));
-		projects.push(...page.data);
-		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
-		cursor = page.pagination.nextCursor;
+//#region ../../0-framework/1-core/core/dist/container-transport-DKmKg5JQ.mjs
+/** '@prisma/composer-prisma-cloud' → 'PRISMA_COMPOSER_CONTAINER_PRISMA_COMPOSER_PRISMA_CLOUD' */
+function containerEnvVarName(extensionId) {
+	return `PRISMA_COMPOSER_CONTAINER_${extensionId.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "")}`;
+}
+function collisionError(a, b, varName) {
+	return /* @__PURE__ */ new Error(`Extension ids "${a}" and "${b}" both mangle to the container transport variable "${varName}" — rename one of the extensions.`);
+}
+function emptySerializeError(extensionId) {
+	return /* @__PURE__ */ new Error(`Extension "${extensionId}"'s container instance serialized to an empty string — ContainerInstance.serialize() must return a non-empty string.`);
+}
+/** The env entries the CLI sets on the alchemy process: `{ [containerEnvVarName(id)]: instance.serialize() }` for every resolved instance. */
+function containerEnv(instances) {
+	const env = {};
+	const ownerByVarName = /* @__PURE__ */ new Map();
+	for (const [extensionId, instance] of instances) {
+		const varName = containerEnvVarName(extensionId);
+		const owner = ownerByVarName.get(varName);
+		if (owner !== void 0) throw collisionError(owner, extensionId, varName);
+		ownerByVarName.set(varName, extensionId);
+		const serialized = instance.serialize();
+		if (serialized.length === 0) throw emptySerializeError(extensionId);
+		env[varName] = serialized;
 	}
-	return projects;
-});
-/**
-* Workspace ids circulate in two shapes: `wksp_`-prefixed and bare. Compare
-* bare-to-bare so a `wksp_`-prefixed API id still matches a bare configured
-* one (the same normalization `state/bootstrap.ts` applies to the same
-* `/v1/projects` listing).
-*/
-const bareWorkspaceId = (id) => id.startsWith("wksp_") ? id.slice(5) : id;
-/**
-* Finds the app's Project by name in the workspace — PDP allows duplicate
-* project names, so more than one can match; the oldest wins. Creates one
-* if none match, unless `ensure` is `false` (find-only — `destroy`), in
-* which case an absent Project fails with `ContainerNotFoundError`. No
-* ownership marker and no `--project` override (both deferred — see
-* ADR-0019).
-*/
-const resolveProject = (client, workspaceId, appName, ensure) => Effect.gen(function* () {
-	const oldest = (yield* listAllProjects(client)).filter((p) => bareWorkspaceId(p.workspace.id) === bareWorkspaceId(workspaceId) && p.name === appName).sort((a, b) => a.createdAt.localeCompare(b.createdAt))[0];
-	if (oldest !== void 0) return oldest.id;
-	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({ appName }));
-	return (yield* call(() => client.POST("/v1/projects", { body: {
-		name: appName,
-		workspaceId
-	} }))).data.id;
-});
-const findBranchId = (client, projectId, gitName) => call(() => client.GET("/v1/projects/{projectId}/branches", { params: {
-	path: { projectId },
-	query: { gitName }
-} })).pipe(Effect.map((page) => page.data[0]?.id));
-/**
-* Finds the stage's Branch by its exact `gitName`, creating it if absent
-* unless `ensure` is `false` (find-only — `destroy`), in which case an
-* absent Branch fails with `ContainerNotFoundError`. The Management API has
-* no server-side "create-or-return" idempotency (`POST
-* /v1/projects/:id/branches` 409s on a duplicate `gitName`, with no request
-* field to make that a no-op), so idempotency is client-side: observe
-* first, and on a racing 409 from create, re-observe rather than fail.
-*/
-const resolveBranch = (client, projectId, gitName, appName, ensure) => Effect.gen(function* () {
-	const existing = yield* findBranchId(client, projectId, gitName);
-	if (existing !== void 0) return existing;
-	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({
-		appName,
-		stage: gitName
-	}));
-	return yield* call(() => client.POST("/v1/projects/{projectId}/branches", {
-		params: { path: { projectId } },
-		body: { gitName }
-	})).pipe(Effect.map((r) => r.data.id), Effect.catch((err) => err.status === 409 ? findBranchId(client, projectId, gitName).pipe(Effect.flatMap((id) => id === void 0 ? Effect.fail(err) : Effect.succeed(id))) : Effect.fail(err)));
-});
-/**
-* Resolves the two containers a stage's deploy runs into (ADR-0019): the
-* app's **Project**, found-or-created by name, and — for a named stage
-* only — its **Branch**, found-or-created by `gitName`. The default stage
-* (no `stage`) creates no Branch; `branchId` is omitted. With `ensure:
-* false` (`destroy`), nothing is created — an absent Project or Branch
-* fails with `ContainerNotFoundError` instead.
-*/
-const resolveContainer = (opts) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	const ensure = opts.ensure ?? true;
-	const projectId = yield* resolveProject(client, opts.workspaceId, opts.appName, ensure);
-	if (opts.stage === void 0) return { projectId };
-	return {
-		projectId,
-		branchId: yield* resolveBranch(client, projectId, opts.stage, opts.appName, ensure)
-	};
-});
-/**
-* Soft-deletes a Branch. Tolerates a 404 (already gone). The API refuses if
-* the Branch still has live members or is the production/default Branch —
-* that surfaces as a `PrismaApiError`.
-*/
-const deleteBranch = (branchId) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	yield* callVoid(() => client.DELETE("/v1/branches/{branchId}", { params: { path: { branchId } } }));
-});
-/**
-* Deletes a Project. Tolerates a 404 (already gone). The API refuses with a
-* 400 if the Project still has live dependencies (e.g. another stage's
-* Branch/resources) — that surfaces as a `PrismaApiError`.
-*/
-const deleteProject = (projectId) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	yield* callVoid(() => client.DELETE("/v1/projects/{id}", { params: { path: { id: projectId } } }));
-});
-Provider.ProviderCollection()("Prisma");
+	return env;
+}
 //#endregion
-//#region ../../0-framework/3-tooling/cli/dist/cli-BeT-XTbX.mjs
+//#region ../../0-framework/3-tooling/cli/dist/cli-Bc6_i0ls.mjs
 /**
 * A user-facing failure with a message that already names the fix (deploy-cli.md
 * § Error surface). `bin.ts` catches this — and any other Error, including
@@ -747,89 +614,6 @@ var CliError = class extends Error {
 		this.name = "CliError";
 	}
 };
-/**
-* Pipeline pre-stack step: resolves the app's Project + (named stage) Branch
-* via `@internal/lowering`'s `resolveContainer`, before the generated stack file
-* runs — `deploy` creates-if-absent, `destroy` finds only.
-*/
-/** Validates `stage` as a git ref name via `git check-ref-format` — no silent normalization. */
-function validateStageName(stage) {
-	const result = spawnSync("git", ["check-ref-format", `refs/heads/${stage}`], { stdio: "ignore" });
-	if (result.error) throw new CliError(`git is required to validate --stage "${stage}" (git check-ref-format): ${result.error.message}.`);
-	if (result.status !== 0) throw new CliError(`Invalid --stage "${stage}": must be a valid git ref name (git check-ref-format rejected "refs/heads/${stage}").`);
-}
-async function ensureContainers(input, deps) {
-	const env = input.env ?? process.env;
-	const workspaceId = env["PRISMA_WORKSPACE_ID"];
-	if (workspaceId === void 0 || workspaceId.length === 0) throw new CliError("environment variable PRISMA_WORKSPACE_ID is required.");
-	if (deps?.client === void 0 && (env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw new CliError("environment variable PRISMA_SERVICE_TOKEN is required.");
-	if (input.stage !== void 0) validateStageName(input.stage);
-	const program = resolveContainer({
-		workspaceId,
-		appName: input.appName,
-		...input.stage !== void 0 ? { stage: input.stage } : {},
-		ensure: input.command === "deploy"
-	}).pipe(Effect.map((c) => ({
-		ok: true,
-		container: c
-	})), Effect.catchTag("ContainerNotFoundError", (e) => Effect.succeed({
-		ok: false,
-		message: `Nothing deployed for ${e.appName}${e.stage ? `/${e.stage}` : ""} — deploy it first.`
-	})), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		message: `Prisma Management API error resolving containers: ${e.message}.`
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (!outcome.ok) throw new CliError(outcome.message);
-	return outcome.container;
-}
-/**
-* Soft-deletes a named stage's Branch after a successful `alchemy destroy`
-* has removed its members (spec §10) — the Management API refuses to delete
-* a Branch that still has live members.
-*/
-async function deleteStageBranch(input, deps) {
-	const env = input.env ?? process.env;
-	if (deps?.client === void 0 && (env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw new CliError("environment variable PRISMA_SERVICE_TOKEN is required.");
-	const program = deleteBranch(input.branchId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		message: `Failed to delete the stage Branch: ${e.message}.`
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (!outcome.ok) throw new CliError(outcome.message);
-}
-/**
-* Best-effort cleanup after a successful `--production` destroy: removes
-* the app's Project so hand-run stacks don't accumulate as empty Projects
-* (they eventually hit the workspace's plan limit). Unlike `deleteStageBranch`,
-* this never throws: the destroy itself already succeeded, and the API's own
-* 400 ("still has dependencies") is the only check that matters — failing
-* the command over a cleanup step would be worse than leaving a Project shell.
-*/
-async function deleteAppProject(input, deps) {
-	const env = input.env ?? process.env;
-	if (deps?.client === void 0 && (env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) {
-		console.warn(`Skipped removing the Project (${input.projectId}): PRISMA_SERVICE_TOKEN is not set.`);
-		return;
-	}
-	const program = deleteProject(input.projectId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		error: e
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (outcome.ok) {
-		console.log(`Removed the Project (${input.projectId}) — nothing was left in it.`);
-		return;
-	}
-	if (outcome.error.status === 400) {
-		console.log(`Kept the Project (${input.projectId}) — it still has another stage's resources.`);
-		return;
-	}
-	console.warn(`Could not remove the Project (${input.projectId}) after destroy: ${outcome.error.message}.`);
-}
 /** Pipeline step 6: writes a regenerated-every-run, independently runnable stack module at `.prisma-composer/alchemy.run.ts`. */
 const GENERATED_DIR = ".prisma-composer";
 const GENERATED_FILE = "alchemy.run.ts";
@@ -932,7 +716,8 @@ function validateConfigShape(loaded, configPath) {
 		if (seen.has(id)) throw new CliError(`${CONFIG_FILENAME}: extension "${id}" is listed more than once in \`extensions\`.`);
 		seen.add(id);
 	}
-	if (typeof loaded["state"] !== "function") throw fieldError("state", "must be a function returning the deploy state layer (e.g. () => prismaState())");
+	const state = loaded["state"];
+	if (!isRecord(state) || typeof state["extension"] !== "string" || typeof state["create"] !== "function") throw fieldError("state", "must be a state descriptor (e.g. prismaState())");
 	return blindCast(loaded);
 }
 /**
@@ -991,7 +776,7 @@ function resolveAlchemyBin(startDir) {
 		dir = parent;
 	}
 }
-/** Runs `alchemy deploy|destroy <stack file> --yes [--stage <stage>]`, inheriting stdio + env, plus the resolved Project/Branch ids. */
+/** Runs `alchemy deploy|destroy <stack file> --yes [--stage <stage>]`, inheriting stdio + env, plus every extension's resolved container. */
 function runAlchemy(input) {
 	const bin = resolveAlchemyBin(input.cwd);
 	const args = [
@@ -1005,8 +790,7 @@ function runAlchemy(input) {
 		stdio: "inherit",
 		env: {
 			...input.env ?? process.env,
-			PRISMA_PROJECT_ID: input.projectId,
-			...input.branchId !== void 0 ? { PRISMA_BRANCH_ID: input.branchId } : {}
+			...input.containerEnv
 		}
 	});
 	if (result.error !== void 0) throw result.error;
@@ -1032,6 +816,12 @@ function validateRegistryCoverage(graph, config) {
 		lookup(extensions, node.build.extension, node.build.type, "build", `service node "${id}"'s build descriptor`);
 	}
 }
+/** A stage name must be a valid git ref (deploy-cli.md) — checked via `git check-ref-format`, never silently normalized. Runs before anything platform-specific. */
+function validateStageName(stage) {
+	const result = spawnSync("git", ["check-ref-format", `refs/heads/${stage}`], { stdio: "ignore" });
+	if (result.error) throw new CliError(`git is required to validate --stage "${stage}" (git check-ref-format): ${result.error.message}.`);
+	if (result.status !== 0) throw new CliError(`Invalid --stage "${stage}": must be a valid git ref name (git check-ref-format rejected "refs/heads/${stage}").`);
+}
 /**
 * Argument parsing (clipanion — prisma-next's CLI idiom, see
 * prisma-next/packages/1-framework/3-tooling/cli/src/migration-cli.ts) +
@@ -1127,6 +917,7 @@ async function run(argv, deps = {}) {
 		throw error;
 	}
 	const stage = effectiveStage(args);
+	if (stage !== void 0) validateStageName(stage);
 	const cwd = process.cwd();
 	if (args.command === "destroy") warnIfNoLocalDeployState(cwd);
 	const resolvedEntryPath = path.resolve(cwd, args.entry);
@@ -1146,18 +937,32 @@ async function run(argv, deps = {}) {
 		if (args.command === "destroy" && error instanceof Error) throw new CliError(`${error.message}\n\ndestroy evaluates the same stack program as deploy, which packages the built artifacts — so the app must be built first. Run the build, then retry the destroy.`);
 		throw error;
 	}
-	const { projectId, branchId } = await (deps.ensureContainers ?? ensureContainers)({
-		command: args.command,
-		appName: name,
-		stage
-	});
+	const containers = /* @__PURE__ */ new Map();
+	for (const extension of config.extensions) {
+		if (extension.container === void 0) continue;
+		try {
+			if (args.command === "deploy") containers.set(extension.id, await extension.container.ensure({
+				appName: name,
+				stage
+			}));
+			else {
+				const instance = await extension.container.locate({
+					appName: name,
+					stage
+				});
+				if (instance === void 0) throw new CliError(`Nothing deployed for ${name}${stage !== void 0 ? `/${stage}` : ""} — deploy it first.`);
+				containers.set(extension.id, instance);
+			}
+		} catch (error) {
+			throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
+		}
+	}
 	if (args.command === "deploy") for (const extension of config.extensions) {
 		if (extension.preflight === void 0) continue;
 		try {
 			await extension.preflight({
 				graph,
-				projectId,
-				branchId,
+				container: containers.get(extension.id),
 				stage
 			});
 		} catch (error) {
@@ -1177,28 +982,36 @@ async function run(argv, deps = {}) {
 			stackFileRelativePath: GENERATED_STACK_RELATIVE_PATH,
 			cwd,
 			stage,
-			projectId,
-			...branchId !== void 0 ? { branchId } : {}
+			containerEnv: containerEnv(containers)
 		});
 		if (status !== 0) {
 			console.error(`\nGenerated stack file: ${stackPath}`);
 			console.error(`Run \`alchemy ${args.command} ${GENERATED_STACK_RELATIVE_PATH} --yes\` from ${cwd} to reproduce this directly.`);
 			return status;
 		}
-		if (args.command === "destroy") for (const extension of config.extensions) {
-			if (extension.teardown === void 0) continue;
-			try {
-				await extension.teardown({
-					projectId,
-					branchId,
-					stage
-				});
-			} catch (error) {
-				throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
+		if (args.command === "destroy") {
+			for (const extension of config.extensions) {
+				if (extension.teardown === void 0) continue;
+				try {
+					await extension.teardown({
+						container: containers.get(extension.id),
+						stage
+					});
+				} catch (error) {
+					throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
+				}
+			}
+			for (const extension of config.extensions) {
+				if (extension.container === void 0) continue;
+				const instance = containers.get(extension.id);
+				if (instance === void 0) continue;
+				try {
+					await extension.container.remove(instance);
+				} catch (error) {
+					throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
+				}
 			}
 		}
-		if (args.command === "destroy" && branchId !== void 0) await (deps.deleteBranch ?? ((input) => deleteStageBranch(input)))({ branchId });
-		else if (args.command === "destroy") await (deps.deleteProject ?? ((input) => deleteAppProject(input)))({ projectId });
 		return status;
 	} catch (error) {
 		console.error(`\nGenerated stack file: ${stackPath}`);