@prisma/composer 0.1.0 → 0.2.0-dev.10

package/dist/bin.mjs

@@ -2,19 +2,9 @@
 import { Cli, Command, Option, UsageError } from "clipanion";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { spawnSync } from "node:child_process";
-import * as Layer from "effect/Layer";
-import { createManagementApiClient } from "@prisma/management-api-sdk";
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import * as Redacted from "effect/Redacted";
-import * as Config from "effect/Config";
-import * as Data from "effect/Data";
-import * as Provider from "alchemy/Provider";
-import { Resource } from "alchemy";
-import * as Schedule from "effect/Schedule";
 import * as c12 from "c12";
 import { pathToFileURL } from "node:url";
+import { spawnSync } from "node:child_process";
 //#region ../../0-framework/3-tooling/assemble/dist/index.mjs
 /**
 * A user-facing assembly failure with a message that already names the fix
@@ -31,49 +21,26 @@ var AssembleError = class extends Error {
 	}
 };
 /**
-* The wrapper-inlining decision (S2's open question — see the project's
-* design-notes.md and this slice's final report for the write-up).
-*
-* The CLI has no config file, so it can't take per-app `wrapperNoExternal`
-* patterns — it needs one general rule for what an assembler inlines into
-* the wrapper build besides `@prisma/*` (already the assemblers' own
-* default).
-*
-* The rule: inline everything except the runtime's own modules — `bun`,
-* `bun:*` (e.g. bun:sqlite), and `node:*` builtins — which resolve inside
-* the deploy VM at runtime and must never be bundled. Verified (both
-* `@prisma/composer/node/control` and `@prisma/composer/nextjs/control` set
-* `external: ['bun']` ahead of `noExternal` in their tsdown call, and tsdown/
-* rolldown's explicit `external` wins over a `noExternal` match — proven by
-* building an app's wrapper with this exact pattern: the
-* `bun` import stays external while everything else, including the app's own
-* workspace deps, gets inlined) — see this slice's final report for the
-* storefront-auth wrapper proof (arktype + `@storefront-auth/auth/contract`
-* inlined with no other file changes there).
-*/
-const INLINE_EVERYTHING_EXCEPT_RUNTIME_BUILTINS = [/^(?!bun$)(?!bun:)(?!node:).+/];
-/**
-* The registry route for one service's build: descriptor by
-* `build.extension`, control by `build.type`, kind must be "build". The CLI's
-* coverage validation reports the same misses earlier with the config fix;
-* these errors are the backstop for programmatic callers.
+* The registry route for one service's build: extension by
+* `build.extension`, node descriptor by `build.type`, kind must be "build".
+* The CLI's coverage validation reports the same misses earlier with the
+* config fix; these errors are the backstop for programmatic callers.
 */
-function buildControlAssemble(config, node, address, cwd) {
+function buildDescriptorAssemble(config, node, address, cwd) {
 	const { extension, type } = node.build;
-	const descriptor = config.extensions.find((candidate) => candidate.id === extension);
-	if (descriptor === void 0) throw new AssembleError(`No extension "${extension}" is configured (needed by service "${node.name}"'s build) — add it to prisma-composer.config.ts's \`extensions\`.`);
-	const control = descriptor.nodes[type];
-	if (control === void 0) throw new AssembleError(`Extension "${extension}" has no control for build type "${type}" (known: ${Object.keys(descriptor.nodes).join(", ")}).`);
-	if (control.kind !== "build") throw new AssembleError(`Extension "${extension}"'s control for type "${type}" is a "${control.kind}" control — a service build descriptor needs a "build" control.`);
-	return control.assemble({
+	const extensionDescriptor = config.extensions.find((candidate) => candidate.id === extension);
+	if (extensionDescriptor === void 0) throw new AssembleError(`No extension "${extension}" is configured (needed by service "${node.name}"'s build) — add it to prisma-composer.config.ts's \`extensions\`.`);
+	const nodeDescriptor = extensionDescriptor.nodes[type];
+	if (nodeDescriptor === void 0) throw new AssembleError(`Extension "${extension}" has no descriptor for build type "${type}" (known: ${Object.keys(extensionDescriptor.nodes).join(", ")}).`);
+	if (nodeDescriptor.kind !== "build") throw new AssembleError(`Extension "${extension}"'s descriptor for type "${type}" is a "${nodeDescriptor.kind}" descriptor — assembling a service build needs a "build" descriptor.`);
+	return nodeDescriptor.assemble({
 		build: node.build,
-		wrapperNoExternal: INLINE_EVERYTHING_EXCEPT_RUNTIME_BUILTINS,
 		address,
 		cwd
 	});
 }
 async function assembleServices(graph, config, cwd, run) {
-	const runAssembler = run ?? ((node, address, nodeCwd) => buildControlAssemble(config, node, address, nodeCwd));
+	const runAssembler = run ?? ((node, address, nodeCwd) => buildDescriptorAssemble(config, node, address, nodeCwd));
 	const serviceNodes = graph.nodes.filter((n) => n.node.kind === "service");
 	if (serviceNodes.length === 0) throw new AssembleError("The loaded graph has no service to assemble.");
 	const bundles = {};
@@ -121,7 +88,7 @@ function blindCast(input) {
 	return input;
 }
 //#endregion
-//#region ../../0-framework/1-core/core/dist/graph-BYdCQKya.mjs
+//#region ../../0-framework/1-core/core/dist/graph-CP16cJyH.mjs
 /** Thrown by Load when the graph is malformed. */
 var LoadError = class extends Error {
 	constructor(message) {
@@ -139,6 +106,20 @@ const SECRET_SOURCE = blindCast(Symbol.for("prisma:secret-source"));
 function isSecretSource(value) {
 	return typeof value === "object" && value !== null && blindCast(value)[SECRET_SOURCE] === true;
 }
+const PARAM_SOURCE = blindCast(Symbol.for("prisma:param-source"));
+/** True if `value` is a param source (an `envParam` result or a forwarded ctx.params ref). */
+function isParamSource(value) {
+	return typeof value === "object" && value !== null && blindCast(value)[PARAM_SOURCE] === true;
+}
+/**
+* Core's grammar for every name that becomes a config-key segment —
+* addresses, input/param/secret names: ASCII letters and digits only.
+* Conservative by design so any target medium — POSIX env-var keys
+* included — can uppercase and "_"-join segments without escaping.
+*/
+function isConfigKeySegment(name) {
+	return /^[A-Za-z0-9]+$/.test(name);
+}
 /**
 * True if `value` was constructed by this module's factories. Checks the
 * brand only, never a prototype — a graph may mix nodes from a different
@@ -238,7 +219,8 @@ function loadService(root, rootId) {
 		root: rootGraphNode,
 		nodes: [...topoSort(nodes, edges), rootGraphNode],
 		edges,
-		secrets: []
+		secrets: [],
+		params: []
 	};
 }
 /**
@@ -285,6 +267,8 @@ function producerIdOf(ref) {
 const MODULE_INPUT_KEY = Symbol("prisma:module-input-key");
 /** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.secrets` forwarding channel. */
 const MODULE_SECRET_KEY = Symbol("prisma:module-secret-key");
+/** Same per-key identity trick as MODULE_INPUT_KEY, for the parallel `ctx.params` forwarding channel. */
+const MODULE_PARAM_KEY = Symbol("prisma:module-param-key");
 /** Whether `ref` carries a callable `satisfies` that accepts `required` truthily. */
 function satisfiesRequired(ref, required) {
 	return typeof ref === "object" && ref !== null && "satisfies" in ref && typeof ref.satisfies === "function" && ref.satisfies(required);
@@ -344,6 +328,29 @@ function validateSecretBinding(child, id, secretWiring, enclosingModuleName) {
 	for (const slot of Object.keys(secretWiring)) if (!Object.hasOwn(child.secretSlots, slot)) throw new LoadError(`The secrets for "${id}" name "${slot}", which is not a secret slot of that ${kind} (module "${enclosingModuleName}").`);
 }
 /**
+* Checks the params wired into a provisioned SERVICE: unlike a secret slot, a
+* declared param is never required to be bound here — it may fall back to its
+* own `default` (checked later, at `buildConfig`) — so this only rejects a
+* wired key that names something other than a real declared param.
+*/
+function validateServiceParamBinding(child, id, paramWiring, enclosingModuleName) {
+	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.params, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param of that service (module "${enclosingModuleName}").`);
+}
+/**
+* Checks the params wired into a provisioned MODULE: every declared
+* param-forwarding slot must be bound to a real `ParamSource` — a slot has no
+* schema of its own, so (unlike a service param) it cannot fall back to a
+* literal or a default; the param analog of `validateSecretBinding`.
+*/
+function validateParamNeedBinding(child, id, paramWiring, enclosingModuleName) {
+	for (const slot of Object.keys(child.paramSlots)) {
+		const bound = paramWiring[slot];
+		if (bound === void 0) throw new LoadError(`Param slot "${slot}" of provisioned module "${id}" is not bound (module "${enclosingModuleName}") — bind it with a param source (e.g. envParam('NAME')) or forward ctx.params.`);
+		if (!isParamSource(bound)) throw new LoadError(`Param slot "${slot}" of "${id}" (module "${enclosingModuleName}") was wired with a non-source value — a module param-forwarding slot carries no schema to validate a literal against; use envParam('NAME') or a forwarded ctx.params ref.`);
+	}
+	for (const slot of Object.keys(paramWiring)) if (!Object.hasOwn(child.paramSlots, slot)) throw new LoadError(`The params for "${id}" name "${slot}", which is not a param slot of that module (module "${enclosingModuleName}").`);
+}
+/**
 * Recursively flattens one module's body into the shared graph state and
 * returns its resolved ModuleOutputs (one ref-port per expose key) for the
 * caller (the enclosing provision() call, or Load itself for the root) to
@@ -357,10 +364,11 @@ function validateSecretBinding(child, id, secretWiring, enclosingModuleName) {
 * forward in a producer provisioned by an ancestor scope, and it is the
 * shared `byId` (keyed by full address) that lets that resolve.
 */
-function flatten(moduleNode, address, wiring, secretWiring, nodes, edges, pending, secretBindings, byId) {
+function flatten(moduleNode, address, wiring, secretWiring, paramWiring, nodes, edges, pending, secretBindings, paramBindings, byId) {
 	const localIds = /* @__PURE__ */ new Set();
 	const used = /* @__PURE__ */ new Set();
 	const usedSecrets = /* @__PURE__ */ new Set();
+	const usedParams = /* @__PURE__ */ new Set();
 	const ctxInputs = {};
 	for (const key of Object.keys(moduleNode.deps)) {
 		const wired = wiring[key];
@@ -383,12 +391,24 @@ function flatten(moduleNode, address, wiring, secretWiring, nodes, edges, pendin
 	const markSecretsUsed = (values) => {
 		for (const value of Object.values(values)) for (const key of Object.keys(ctxSecrets)) if (value === ctxSecrets[key]) usedSecrets.add(key);
 	};
+	const ctxParams = {};
+	for (const key of Object.keys(moduleNode.paramSlots)) {
+		const bound = paramWiring[key];
+		ctxParams[key] = typeof bound === "object" && bound !== null ? {
+			...bound,
+			[MODULE_PARAM_KEY]: key
+		} : bound;
+	}
+	const markParamsUsed = (values) => {
+		for (const value of Object.values(values)) for (const key of Object.keys(ctxParams)) if (value === ctxParams[key]) usedParams.add(key);
+	};
 	const provision = (child, opts) => {
 		const id = opts?.id ?? child.name;
 		const provisionWiring = opts?.deps;
 		const provisionSecrets = opts?.secrets;
+		const provisionParams = opts?.params;
 		if (typeof id !== "string" || id.length === 0) throw new LoadError(`provision() requires a non-empty id (module "${moduleNode.name}").`);
-		if (id.includes("_") || id.includes(".")) throw new LoadError(`provision() id "${id}" (module "${moduleNode.name}") may not contain "_" or "." — "_" is the config-key separator and "." the node-id path separator; either inside an id collides with the joined form of other names.`);
+		if (!isConfigKeySegment(id)) throw new LoadError(`provision() id "${id}" (module "${moduleNode.name}") must contain only ASCII letters and digits ([A-Za-z0-9]) — the id becomes an address segment, and addresses derive deterministic config keys (segments uppercased and joined with "_"). "${id}" would put "${id.toUpperCase()}" inside the derived key. ("_" collides with the key separator and "." with the address separator.)`);
 		if (localIds.has(id)) throw new LoadError(`Duplicate provision id "${id}" in module "${moduleNode.name}".`);
 		const untrusted = child;
 		if (!isNode(untrusted) || untrusted.kind !== "service" && untrusted.kind !== "resource" && untrusted.kind !== "module") throw new LoadError(`provision("${id}") expects a branded service, resource, or module node (construct it with the service()/resource()/module() factories or a pack's own).`);
@@ -397,6 +417,7 @@ function flatten(moduleNode, address, wiring, secretWiring, nodes, edges, pendin
 		if (child.kind === "resource") {
 			if (provisionWiring !== void 0) throw new LoadError(`provision("${id}") received deps for a resource — a resource has no dependency slots to satisfy.`);
 			if (provisionSecrets !== void 0) throw new LoadError(`provision("${id}") received secrets for a resource — a resource has no secret slots to satisfy.`);
+			if (provisionParams !== void 0) throw new LoadError(`provision("${id}") received params for a resource — a resource has no params to satisfy.`);
 			if (child.type.length === 0) throw new LoadError(`provision("${id}") received a resource with an empty node type.`);
 			byId.set(fullAddress, child);
 			nodes.push({
@@ -410,6 +431,8 @@ function flatten(moduleNode, address, wiring, secretWiring, nodes, edges, pendin
 		const localSecrets = { ...provisionSecrets ?? {} };
 		markSecretsUsed(localSecrets);
 		validateSecretBinding(child, id, localSecrets, moduleNode.name);
+		const localParams = { ...provisionParams ?? {} };
+		markParamsUsed(localParams);
 		if (child.kind === "service") {
 			for (const slot of Object.keys(child.secretSlots)) {
 				const bound = localSecrets[slot];
@@ -419,6 +442,12 @@ function flatten(moduleNode, address, wiring, secretWiring, nodes, edges, pendin
 					source: bound
 				});
 			}
+			validateServiceParamBinding(child, id, localParams, moduleNode.name);
+			for (const [slot, binding] of Object.entries(localParams)) paramBindings.push({
+				serviceAddress: fullAddress,
+				slot,
+				binding
+			});
 			const inputs = serviceInputs(child, fullAddress);
 			nodes.push(...inputs.nodes, {
 				id: fullAddress,
@@ -435,6 +464,7 @@ function flatten(moduleNode, address, wiring, secretWiring, nodes, edges, pendin
 			byId.set(fullAddress, child);
 			return refFor(fullAddress, child);
 		}
+		validateParamNeedBinding(child, id, localParams, moduleNode.name);
 		edges.push(...wiringEdges(localWiring, fullAddress));
 		pending.push({
 			deps: child.deps,
@@ -443,7 +473,7 @@ function flatten(moduleNode, address, wiring, secretWiring, nodes, edges, pendin
 			targetKind: "module",
 			enclosingModuleName: moduleNode.name
 		});
-		const childOutputs = flatten(child, fullAddress, localWiring, localSecrets, nodes, edges, pending, secretBindings, byId);
+		const childOutputs = flatten(child, fullAddress, localWiring, localSecrets, localParams, nodes, edges, pending, secretBindings, paramBindings, byId);
 		nodes.push({
 			id: fullAddress,
 			node: child
@@ -457,12 +487,14 @@ function flatten(moduleNode, address, wiring, secretWiring, nodes, edges, pendin
 	const ctx = blindCast({
 		inputs: ctxInputs,
 		secrets: ctxSecrets,
+		params: ctxParams,
 		provision: blindCast(provision)
 	});
 	const outputs = blindCast(moduleNode.body(ctx) ?? {});
 	markUsed(outputs);
 	for (const key of Object.keys(moduleNode.deps)) if (!used.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares input "${key}" but never forwards it into a provision nor returns it as an output.`);
 	for (const key of Object.keys(moduleNode.secretSlots)) if (!usedSecrets.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares secret "${key}" but never forwards it into a provision.`);
+	for (const key of Object.keys(moduleNode.paramSlots)) if (!usedParams.has(key)) throw new LoadError(`Module "${moduleNode.name}" declares param "${key}" but never forwards it into a provision.`);
 	for (const [key, contract] of Object.entries(moduleNode.expose)) {
 		const port = outputs[key];
 		if (port === void 0) throw new LoadError(`Module "${moduleNode.name}" declares expose "${key}" but its body did not return a port for it.`);
@@ -482,12 +514,18 @@ function loadModule(root, opts) {
 		const names = rootSecretKeys.map((k) => `"${k}"`).join(", ");
 		throw new LoadError(`Module "${root.name}" declares secret${rootSecretKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds secrets with envSecret('NAME'), it does not declare secret slots of its own.`);
 	}
+	const rootParamKeys = Object.keys(root.paramSlots);
+	if (rootParamKeys.length > 0) {
+		const names = rootParamKeys.map((k) => `"${k}"`).join(", ");
+		throw new LoadError(`Module "${root.name}" declares param${rootParamKeys.length > 1 ? "s" : ""} ${names} but is being deployed as the root — a root has no enclosing scope to bind them; the root binds params directly on each provision() call, it does not declare param-forwarding slots of its own.`);
+	}
 	const nodes = [];
 	const edges = [];
 	const pending = [];
 	const secretBindings = [];
+	const paramBindings = [];
 	const byId = /* @__PURE__ */ new Map();
-	flatten(root, void 0, {}, {}, nodes, edges, pending, secretBindings, byId);
+	flatten(root, void 0, {}, {}, {}, nodes, edges, pending, secretBindings, paramBindings, byId);
 	for (const entry of pending) validateWiring(entry, byId);
 	assertDependencyDag(edges);
 	const rootGraphNode = {
@@ -498,7 +536,8 @@ function loadModule(root, opts) {
 		root: rootGraphNode,
 		nodes: [...topoSort(nodes, edges), rootGraphNode],
 		edges,
-		secrets: secretBindings
+		secrets: secretBindings,
+		params: paramBindings
 	};
 }
 /**
@@ -545,145 +584,34 @@ function Load(root, opts) {
 	throw new LoadError("Load expects a service or module root (received another node kind).");
 }
 //#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/http-CxGdfSAP.mjs
-/**
-* The Prisma service token used to authenticate Management API calls. Kept
-* as a Redacted value so it never lands in logs or error output.
-*/
-var PrismaCredentials = class extends Context.Service()("PrismaCredentials") {};
-/** Resolve the token from the `PRISMA_SERVICE_TOKEN` environment variable. */
-const fromEnv = () => Layer.effect(PrismaCredentials, Effect.gen(function* () {
-	return { token: yield* Config.redacted("PRISMA_SERVICE_TOKEN") };
-}));
-/**
-* The typed Prisma Management API client, built once from the resolved
-* credentials. Providers yield this in their outer Effect and call it inside
-* `reconcile` / `delete`.
-*/
-var ManagementClient = class extends Context.Service()("PrismaManagementClient") {};
-const layer = () => Layer.effect(ManagementClient, Effect.gen(function* () {
-	const { token } = yield* PrismaCredentials;
-	return createManagementApiClient({ token: Redacted.value(token) });
-}));
-/** A non-2xx response from the Management API (or a transport failure). */
-var PrismaApiError = class extends Data.TaggedError("PrismaApiError") {};
-const attempt = (f) => Effect.tryPromise({
-	try: f,
-	catch: (cause) => new PrismaApiError({
-		status: 0,
-		message: String(cause)
-	})
-});
-const fail = (r) => Effect.fail(new PrismaApiError({
-	status: r.response.status,
-	message: JSON.stringify(r.error)
-}));
-/** Unwrap `data`, failing on any API error. Preserves the SDK's response type. */
-const call = (f) => attempt(f).pipe(Effect.flatMap((r) => r.error !== void 0 || r.data === void 0 ? fail(r) : Effect.succeed(r.data)));
-/** Fire-and-forget a call, tolerating a 404 (already deleted). */
-const callVoid = (f) => attempt(f).pipe(Effect.flatMap((r) => r.response.status === 404 || r.error === void 0 ? Effect.void : fail(r)));
-Schedule.both(Schedule.exponential("2 seconds", 2), Schedule.during("5 minutes"));
-Resource("Prisma.ComputeService");
-Resource("Prisma.Deployment");
-Resource("Prisma.EnvironmentVariable");
-Resource("Prisma.Connection");
-Resource("Prisma.Database");
-Resource("Prisma.Project");
-//#endregion
-//#region ../../1-prisma-cloud/0-lowering/lowering/dist/index.mjs
-/** Raised with `ensure: false` when the app's Project (or a named stage's Branch) doesn't exist. */
-var ContainerNotFoundError = class extends Data.TaggedError("ContainerNotFoundError") {};
-const listAllProjects = (client) => Effect.gen(function* () {
-	const projects = [];
-	let cursor;
-	for (;;) {
-		const query = cursor === void 0 ? {} : { cursor };
-		const page = yield* call(() => client.GET("/v1/projects", { params: { query } }));
-		projects.push(...page.data);
-		if (!page.pagination.hasMore || page.pagination.nextCursor === null) break;
-		cursor = page.pagination.nextCursor;
+//#region ../../0-framework/1-core/core/dist/container-transport-DKmKg5JQ.mjs
+/** '@prisma/composer-prisma-cloud' → 'PRISMA_COMPOSER_CONTAINER_PRISMA_COMPOSER_PRISMA_CLOUD' */
+function containerEnvVarName(extensionId) {
+	return `PRISMA_COMPOSER_CONTAINER_${extensionId.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "")}`;
+}
+function collisionError(a, b, varName) {
+	return /* @__PURE__ */ new Error(`Extension ids "${a}" and "${b}" both mangle to the container transport variable "${varName}" — rename one of the extensions.`);
+}
+function emptySerializeError(extensionId) {
+	return /* @__PURE__ */ new Error(`Extension "${extensionId}"'s container instance serialized to an empty string — ContainerInstance.serialize() must return a non-empty string.`);
+}
+/** The env entries the CLI sets on the alchemy process: `{ [containerEnvVarName(id)]: instance.serialize() }` for every resolved instance. */
+function containerEnv(instances) {
+	const env = {};
+	const ownerByVarName = /* @__PURE__ */ new Map();
+	for (const [extensionId, instance] of instances) {
+		const varName = containerEnvVarName(extensionId);
+		const owner = ownerByVarName.get(varName);
+		if (owner !== void 0) throw collisionError(owner, extensionId, varName);
+		ownerByVarName.set(varName, extensionId);
+		const serialized = instance.serialize();
+		if (serialized.length === 0) throw emptySerializeError(extensionId);
+		env[varName] = serialized;
 	}
-	return projects;
-});
-/**
-* Workspace ids circulate in two shapes: `wksp_`-prefixed and bare. Compare
-* bare-to-bare so a `wksp_`-prefixed API id still matches a bare configured
-* one (the same normalization `state/bootstrap.ts` applies to the same
-* `/v1/projects` listing).
-*/
-const bareWorkspaceId = (id) => id.startsWith("wksp_") ? id.slice(5) : id;
-/**
-* Finds the app's Project by name in the workspace — PDP allows duplicate
-* project names, so more than one can match; the oldest wins. Creates one
-* if none match, unless `ensure` is `false` (find-only — `destroy`), in
-* which case an absent Project fails with `ContainerNotFoundError`. No
-* ownership marker and no `--project` override (both deferred — see
-* ADR-0019).
-*/
-const resolveProject = (client, workspaceId, appName, ensure) => Effect.gen(function* () {
-	const oldest = (yield* listAllProjects(client)).filter((p) => bareWorkspaceId(p.workspace.id) === bareWorkspaceId(workspaceId) && p.name === appName).sort((a, b) => a.createdAt.localeCompare(b.createdAt))[0];
-	if (oldest !== void 0) return oldest.id;
-	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({ appName }));
-	return (yield* call(() => client.POST("/v1/projects", { body: {
-		name: appName,
-		workspaceId
-	} }))).data.id;
-});
-const findBranchId = (client, projectId, gitName) => call(() => client.GET("/v1/projects/{projectId}/branches", { params: {
-	path: { projectId },
-	query: { gitName }
-} })).pipe(Effect.map((page) => page.data[0]?.id));
-/**
-* Finds the stage's Branch by its exact `gitName`, creating it if absent
-* unless `ensure` is `false` (find-only — `destroy`), in which case an
-* absent Branch fails with `ContainerNotFoundError`. The Management API has
-* no server-side "create-or-return" idempotency (`POST
-* /v1/projects/:id/branches` 409s on a duplicate `gitName`, with no request
-* field to make that a no-op), so idempotency is client-side: observe
-* first, and on a racing 409 from create, re-observe rather than fail.
-*/
-const resolveBranch = (client, projectId, gitName, appName, ensure) => Effect.gen(function* () {
-	const existing = yield* findBranchId(client, projectId, gitName);
-	if (existing !== void 0) return existing;
-	if (!ensure) return yield* Effect.fail(new ContainerNotFoundError({
-		appName,
-		stage: gitName
-	}));
-	return yield* call(() => client.POST("/v1/projects/{projectId}/branches", {
-		params: { path: { projectId } },
-		body: { gitName }
-	})).pipe(Effect.map((r) => r.data.id), Effect.catch((err) => err.status === 409 ? findBranchId(client, projectId, gitName).pipe(Effect.flatMap((id) => id === void 0 ? Effect.fail(err) : Effect.succeed(id))) : Effect.fail(err)));
-});
-/**
-* Resolves the two containers a stage's deploy runs into (ADR-0019): the
-* app's **Project**, found-or-created by name, and — for a named stage
-* only — its **Branch**, found-or-created by `gitName`. The default stage
-* (no `stage`) creates no Branch; `branchId` is omitted. With `ensure:
-* false` (`destroy`), nothing is created — an absent Project or Branch
-* fails with `ContainerNotFoundError` instead.
-*/
-const resolveContainer = (opts) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	const ensure = opts.ensure ?? true;
-	const projectId = yield* resolveProject(client, opts.workspaceId, opts.appName, ensure);
-	if (opts.stage === void 0) return { projectId };
-	return {
-		projectId,
-		branchId: yield* resolveBranch(client, projectId, opts.stage, opts.appName, ensure)
-	};
-});
-/**
-* Soft-deletes a Branch. Tolerates a 404 (already gone). The API refuses if
-* the Branch still has live members or is the production/default Branch —
-* that surfaces as a `PrismaApiError`.
-*/
-const deleteBranch = (branchId) => Effect.gen(function* () {
-	const client = yield* ManagementClient;
-	yield* callVoid(() => client.DELETE("/v1/branches/{branchId}", { params: { path: { branchId } } }));
-});
-Provider.ProviderCollection()("Prisma");
+	return env;
+}
 //#endregion
-//#region ../../0-framework/3-tooling/cli/dist/cli-BGF4efRK.mjs
+//#region ../../0-framework/3-tooling/cli/dist/cli-riJGhp7G.mjs
 /**
 * A user-facing failure with a message that already names the fix (deploy-cli.md
 * § Error surface). `bin.ts` catches this — and any other Error, including
@@ -695,59 +623,6 @@ var CliError = class extends Error {
 		this.name = "CliError";
 	}
 };
-/**
-* Pipeline pre-stack step: resolves the app's Project + (named stage) Branch
-* via `@internal/lowering`'s `resolveContainer`, before the generated stack file
-* runs — `deploy` creates-if-absent, `destroy` finds only.
-*/
-/** Validates `stage` as a git ref name via `git check-ref-format` — no silent normalization. */
-function validateStageName(stage) {
-	const result = spawnSync("git", ["check-ref-format", `refs/heads/${stage}`], { stdio: "ignore" });
-	if (result.error) throw new CliError(`git is required to validate --stage "${stage}" (git check-ref-format): ${result.error.message}.`);
-	if (result.status !== 0) throw new CliError(`Invalid --stage "${stage}": must be a valid git ref name (git check-ref-format rejected "refs/heads/${stage}").`);
-}
-async function ensureContainers(input, deps) {
-	const env = input.env ?? process.env;
-	const workspaceId = env["PRISMA_WORKSPACE_ID"];
-	if (workspaceId === void 0 || workspaceId.length === 0) throw new CliError("environment variable PRISMA_WORKSPACE_ID is required.");
-	if (deps?.client === void 0 && (env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw new CliError("environment variable PRISMA_SERVICE_TOKEN is required.");
-	if (input.stage !== void 0) validateStageName(input.stage);
-	const program = resolveContainer({
-		workspaceId,
-		appName: input.appName,
-		...input.stage !== void 0 ? { stage: input.stage } : {},
-		ensure: input.command === "deploy"
-	}).pipe(Effect.map((c) => ({
-		ok: true,
-		container: c
-	})), Effect.catchTag("ContainerNotFoundError", (e) => Effect.succeed({
-		ok: false,
-		message: `Nothing deployed for ${e.appName}${e.stage ? `/${e.stage}` : ""} — deploy it first.`
-	})), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		message: `Prisma Management API error resolving containers: ${e.message}.`
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (!outcome.ok) throw new CliError(outcome.message);
-	return outcome.container;
-}
-/**
-* Soft-deletes a named stage's Branch after a successful `alchemy destroy`
-* has removed its members (spec §10) — the Management API refuses to delete
-* a Branch that still has live members.
-*/
-async function deleteStageBranch(input, deps) {
-	const env = input.env ?? process.env;
-	if (deps?.client === void 0 && (env["PRISMA_SERVICE_TOKEN"] ?? "").length === 0) throw new CliError("environment variable PRISMA_SERVICE_TOKEN is required.");
-	const program = deleteBranch(input.branchId).pipe(Effect.map(() => ({ ok: true })), Effect.catchTag("PrismaApiError", (e) => Effect.succeed({
-		ok: false,
-		message: `Failed to delete the stage Branch: ${e.message}.`
-	})));
-	const provided = deps?.client !== void 0 ? program.pipe(Effect.provideService(ManagementClient, deps.client)) : program.pipe(Effect.provide(layer().pipe(Layer.provide(fromEnv()))));
-	const outcome = await Effect.runPromise(provided);
-	if (!outcome.ok) throw new CliError(outcome.message);
-}
 /** Pipeline step 6: writes a regenerated-every-run, independently runnable stack module at `.prisma-composer/alchemy.run.ts`. */
 const GENERATED_DIR = ".prisma-composer";
 const GENERATED_FILE = "alchemy.run.ts";
@@ -768,6 +643,7 @@ function renderOptions(input) {
 	lines.push("  bundles: {");
 	for (const [id, bundle] of Object.entries(input.assembled.bundles)) lines.push(`    ${quote(id)}: ${renderBundle(bundle)},`);
 	lines.push("  },");
+	lines.push("  report: deploymentReport,");
 	return lines.join("\n");
 }
 /** Renders the stack module's source (tests assert on it without touching disk) — uses `//` headers, not a block comment, since a cwd path with a star-slash could close one early. */
@@ -782,6 +658,7 @@ function renderStackFile(input) {
 //
 // bisects a CLI bug from an Alchemy bug (deploy-cli.md § Implementation decisions).
 import { lower } from '@prisma/composer/deploy';
+import { deploymentReport } from '@prisma/composer/report';
 import config from ${quote(configImport)};
 import app from ${quote(appImport)};
 
@@ -848,7 +725,8 @@ function validateConfigShape(loaded, configPath) {
 		if (seen.has(id)) throw new CliError(`${CONFIG_FILENAME}: extension "${id}" is listed more than once in \`extensions\`.`);
 		seen.add(id);
 	}
-	if (typeof loaded["state"] !== "function") throw fieldError("state", "must be a function returning the deploy state layer (e.g. () => prismaState())");
+	const state = loaded["state"];
+	if (!isRecord(state) || typeof state["extension"] !== "string" || typeof state["create"] !== "function") throw fieldError("state", "must be a state descriptor (e.g. prismaState())");
 	return blindCast(loaded);
 }
 /**
@@ -873,6 +751,41 @@ async function loadAppConfig(configPath) {
 	};
 }
 /**
+* `loadEntry` imports a user's topology with the host runtime's own module
+* loader — under node (the CLI's shebang runtime), that loader strips
+* TypeScript types but has no JSX transform (ADR-0005: the framework
+* doesn't bundle or transform the app's code; deploy loading is no
+* exception). A `.tsx`/`.jsx` file anywhere in the topology's import graph
+* dies with node's raw `ERR_UNKNOWN_FILE_EXTENSION`, which names the file
+* but not the cause or the fix. This turns that one case into a CliError
+* message that does — every other load failure (syntax errors, missing
+* files, non-JSX unknown extensions) is untouched, re-thrown as-is.
+*/
+const UNKNOWN_EXTENSION_CODE = "ERR_UNKNOWN_FILE_EXTENSION";
+const JSX_EXTENSIONS = [".tsx", ".jsx"];
+function errorCode(error) {
+	return "code" in error && typeof error.code === "string" ? error.code : void 0;
+}
+function unknownExtensionPath(error) {
+	if (!(error instanceof Error)) return void 0;
+	if (errorCode(error) !== UNKNOWN_EXTENSION_CODE) return void 0;
+	return /Unknown file extension "\.\w+" for (.+)$/.exec(error.message)?.[1];
+}
+/**
+* Returns a CliError-ready message when `error` is node's
+* `ERR_UNKNOWN_FILE_EXTENSION` for a `.tsx`/`.jsx` file — `undefined` for
+* every other error (including unknown-extension failures for some other
+* extension), so the caller can fall through to its normal rethrow.
+*/
+function explainJsxLoadError(error, entryPath) {
+	const offendingPath = unknownExtensionPath(error);
+	if (offendingPath === void 0) return void 0;
+	if (!JSX_EXTENSIONS.some((ext) => offendingPath.endsWith(ext))) return void 0;
+	return `"${offendingPath}" can't be loaded: deploy loads "${entryPath}"'s topology with node's own module loader, which strips TypeScript types but has no JSX transform — so a .tsx/.jsx file can't sit anywhere in that import graph.
+
+Precompile that file in your own build (transform the JSX away, keep the real npm packages external) and import the compiled output instead of the raw .tsx/.jsx — see examples/email/scripts/build.ts in the prisma/composer repo for a worked example.`;
+}
+/**
 * Pipeline step 1 (deploy-cli.md § The pipeline): import the entry module
 * (resolved against cwd) and require its default export to be a node — a
 * service or module, branded by core's factories. Whatever this module exports
@@ -880,7 +793,15 @@ async function loadAppConfig(configPath) {
 */
 async function loadEntry(entryArg, cwd) {
 	const resolvedPath = path.resolve(cwd, entryArg);
-	const root = (await import(pathToFileURL(resolvedPath).href)).default;
+	let mod;
+	try {
+		mod = await import(pathToFileURL(resolvedPath).href);
+	} catch (error) {
+		const explained = explainJsxLoadError(error, resolvedPath);
+		if (explained !== void 0) throw new CliError(explained);
+		throw error;
+	}
+	const root = blindCast(mod).default;
 	if (!isNode(root) || root.kind === "dependency" || root.kind === "resource") throw new CliError(`Entry module "${resolvedPath}" must default-export a node (a service or a module) — construct it with service() or module() from @prisma/composer.`);
 	return {
 		path: resolvedPath,
@@ -907,7 +828,7 @@ function resolveAlchemyBin(startDir) {
 		dir = parent;
 	}
 }
-/** Runs `alchemy deploy|destroy <stack file> --yes [--stage <stage>]`, inheriting stdio + env, plus the resolved Project/Branch ids. */
+/** Runs `alchemy deploy|destroy <stack file> --yes [--stage <stage>]`, inheriting stdio + env, plus every extension's resolved container. */
 function runAlchemy(input) {
 	const bin = resolveAlchemyBin(input.cwd);
 	const args = [
@@ -921,8 +842,7 @@ function runAlchemy(input) {
 		stdio: "inherit",
 		env: {
 			...input.env ?? process.env,
-			PRISMA_PROJECT_ID: input.projectId,
-			...input.branchId !== void 0 ? { PRISMA_BRANCH_ID: input.branchId } : {}
+			...input.containerEnv
 		}
 	});
 	if (result.error !== void 0) throw result.error;
@@ -948,6 +868,12 @@ function validateRegistryCoverage(graph, config) {
 		lookup(extensions, node.build.extension, node.build.type, "build", `service node "${id}"'s build descriptor`);
 	}
 }
+/** A stage name must be a valid git ref (deploy-cli.md) — checked via `git check-ref-format`, never silently normalized. Runs before anything platform-specific. */
+function validateStageName(stage) {
+	const result = spawnSync("git", ["check-ref-format", `refs/heads/${stage}`], { stdio: "ignore" });
+	if (result.error) throw new CliError(`git is required to validate --stage "${stage}" (git check-ref-format): ${result.error.message}.`);
+	if (result.status !== 0) throw new CliError(`Invalid --stage "${stage}": must be a valid git ref name (git check-ref-format rejected "refs/heads/${stage}").`);
+}
 /**
 * Argument parsing (clipanion — prisma-next's CLI idiom, see
 * prisma-next/packages/1-framework/3-tooling/cli/src/migration-cli.ts) +
@@ -1043,6 +969,7 @@ async function run(argv, deps = {}) {
 		throw error;
 	}
 	const stage = effectiveStage(args);
+	if (stage !== void 0) validateStageName(stage);
 	const cwd = process.cwd();
 	if (args.command === "destroy") warnIfNoLocalDeployState(cwd);
 	const resolvedEntryPath = path.resolve(cwd, args.entry);
@@ -1062,18 +989,32 @@ async function run(argv, deps = {}) {
 		if (args.command === "destroy" && error instanceof Error) throw new CliError(`${error.message}\n\ndestroy evaluates the same stack program as deploy, which packages the built artifacts — so the app must be built first. Run the build, then retry the destroy.`);
 		throw error;
 	}
-	const { projectId, branchId } = await (deps.ensureContainers ?? ensureContainers)({
-		command: args.command,
-		appName: name,
-		stage
-	});
+	const containers = /* @__PURE__ */ new Map();
+	for (const extension of config.extensions) {
+		if (extension.container === void 0) continue;
+		try {
+			if (args.command === "deploy") containers.set(extension.id, await extension.container.ensure({
+				appName: name,
+				stage
+			}));
+			else {
+				const instance = await extension.container.locate({
+					appName: name,
+					stage
+				});
+				if (instance === void 0) throw new CliError(`Nothing deployed for ${name}${stage !== void 0 ? `/${stage}` : ""} — deploy it first.`);
+				containers.set(extension.id, instance);
+			}
+		} catch (error) {
+			throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
+		}
+	}
 	if (args.command === "deploy") for (const extension of config.extensions) {
 		if (extension.preflight === void 0) continue;
 		try {
 			await extension.preflight({
 				graph,
-				projectId,
-				branchId,
+				container: containers.get(extension.id),
 				stage
 			});
 		} catch (error) {
@@ -1093,15 +1034,36 @@ async function run(argv, deps = {}) {
 			stackFileRelativePath: GENERATED_STACK_RELATIVE_PATH,
 			cwd,
 			stage,
-			projectId,
-			...branchId !== void 0 ? { branchId } : {}
+			containerEnv: containerEnv(containers)
 		});
 		if (status !== 0) {
 			console.error(`\nGenerated stack file: ${stackPath}`);
 			console.error(`Run \`alchemy ${args.command} ${GENERATED_STACK_RELATIVE_PATH} --yes\` from ${cwd} to reproduce this directly.`);
 			return status;
 		}
-		if (args.command === "destroy" && branchId !== void 0) await (deps.deleteBranch ?? ((input) => deleteStageBranch(input)))({ branchId });
+		if (args.command === "destroy") {
+			for (const extension of config.extensions) {
+				if (extension.teardown === void 0) continue;
+				try {
+					await extension.teardown({
+						container: containers.get(extension.id),
+						stage
+					});
+				} catch (error) {
+					throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
+				}
+			}
+			for (const extension of config.extensions) {
+				if (extension.container === void 0) continue;
+				const instance = containers.get(extension.id);
+				if (instance === void 0) continue;
+				try {
+					await extension.container.remove(instance);
+				} catch (error) {
+					throw error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
+				}
+			}
+		}
 		return status;
 	} catch (error) {
 		console.error(`\nGenerated stack file: ${stackPath}`);