alchemy 2.0.0-beta.64 → 2.0.0-beta.66

package/src/Prisma/ComputeBuild.ts

@@ -0,0 +1,1652 @@
+import * as Effect from "effect/Effect";
+import * as Duration from "effect/Duration";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import * as Option from "effect/Option";
+import type { Scope } from "effect/Scope";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { nodeFileTrace } from "@vercel/nft";
+import { normalizeEntrypoint } from "./ComputeArchive.ts";
+
+export type ComputeAutoBuildFramework =
+  | "auto"
+  | "nextjs"
+  | "nuxt"
+  | "astro"
+  | "nestjs"
+  | "tanstack-start"
+  | "bun";
+
+export interface ComputeAutoBuildOptions {
+  /**
+   * Application root.
+   */
+  appPath: string;
+  /**
+   * Entrypoint used by the Bun fallback strategy.
+   */
+  entrypoint?: string;
+  /**
+   * Framework to build. `auto` tries Next.js, Nuxt, Astro, TanStack Start,
+   * then Bun.
+   *
+   * @default "auto"
+   */
+  framework?: ComputeAutoBuildFramework;
+  /**
+   * Environment variables supplied to the build command.
+   * Ambient `PRISMA_SERVICE_TOKEN` and `PRISMA_API_TOKEN` credentials are not
+   * inherited; include one here explicitly only when the application build
+   * genuinely needs Prisma Management API access.
+   *
+   * Plain strings are persisted in Alchemy state when this is configured
+   * through `Prisma.Compute`. Wrap secrets with `Redacted.make(secret)`.
+   *
+   * ```typescript
+   * env: { NPM_TOKEN: Redacted.make(process.env.NPM_TOKEN!) }
+   * ```
+   */
+  env?: Record<string, string | Redacted.Redacted<string> | undefined>;
+  /**
+   * Maximum bytes retained from each build output stream.
+   *
+   * @default 1048576 (1 MiB)
+   */
+  outputLimitBytes?: number;
+  /**
+   * Maximum wall-clock time for the framework build command.
+   *
+   * @default 900 (15 minutes)
+   */
+  timeoutSeconds?: number;
+}
+
+export interface ComputeBuildArtifact {
+  /**
+   * Directory to archive and upload.
+   */
+  directory: string;
+  /**
+   * Entrypoint relative to `directory`.
+   */
+  entrypoint: string;
+  /**
+   * Default HTTP port for framework conventions.
+   */
+  defaultPort?: number;
+  /**
+   * Removes temporary build output.
+   */
+  cleanup: Effect.Effect<void, never, FileSystem.FileSystem>;
+}
+
+interface BuildStrategy {
+  name: Exclude<ComputeAutoBuildFramework, "auto">;
+  canBuild: (appPath: string) => Effect.Effect<boolean, unknown, BuildServices>;
+  execute: (
+    options: Required<Pick<ComputeAutoBuildOptions, "appPath">> &
+      Omit<ComputeAutoBuildOptions, "appPath">,
+  ) => Effect.Effect<ComputeBuildArtifact, unknown, BuildServices>;
+}
+
+interface DirectoryEntry {
+  name: string;
+  type: "Directory" | "File" | "SymbolicLink" | "Other";
+}
+
+type BuildServices =
+  | ChildProcessSpawner
+  | FileSystem.FileSystem
+  | Path.Path
+  | Scope;
+
+export interface RunBuildCommandOptions {
+  command: string;
+  cwd?: string;
+  /**
+   * Explicit environment variables supplied to the build command. Ambient
+   * Prisma Management API credentials are withheld unless they are provided
+   * here intentionally.
+   */
+  env?: Record<string, string>;
+  /**
+   * Maximum bytes retained from each output stream before the build is
+   * interrupted. This prevents noisy build tools from exhausting memory.
+   *
+   * @default 1048576 (1 MiB)
+   */
+  outputLimitBytes?: number;
+  /**
+   * Maximum wall-clock time for the build command.
+   *
+   * @default 900 (15 minutes)
+   */
+  timeoutSeconds?: number;
+}
+
+const DEFAULT_BUILD_OUTPUT_LIMIT_BYTES = 1024 * 1024;
+const DEFAULT_BUILD_TIMEOUT_SECONDS = 15 * 60;
+const STAGING_MAX_ENTRIES = 50_000;
+const STAGING_MAX_TOTAL_BYTES = 256 * 1024 * 1024;
+const STAGING_MAX_FILE_BYTES = 128 * 1024 * 1024;
+const STAGING_TIMEOUT_SECONDS = 2 * 60;
+const PRISMA_MANAGEMENT_CREDENTIAL_ENV_NAMES = new Set([
+  "PRISMA_SERVICE_TOKEN",
+  "PRISMA_API_TOKEN",
+]);
+
+interface StagingBudget {
+  entries: number;
+  totalBytes: number;
+  readonly deadline: number;
+}
+
+const collectBoundedOutput = (
+  stream: Stream.Stream<Uint8Array, unknown>,
+  label: string,
+  limit: number,
+) =>
+  Stream.runFoldEffect(
+    stream,
+    () => ({ chunks: [] as Uint8Array[], bytes: 0 }),
+    (state, chunk) => {
+      const bytes = state.bytes + chunk.byteLength;
+      return bytes > limit
+        ? Effect.fail(
+            new Error(
+              `Build ${label} exceeded the ${limit} byte output safety limit. Reduce build verbosity or raise outputLimitBytes explicitly.`,
+            ),
+          )
+        : Effect.sync(() => {
+            state.chunks.push(chunk);
+            return { chunks: state.chunks, bytes };
+          });
+    },
+  ).pipe(
+    Effect.map(({ chunks, bytes }) => {
+      const output = new Uint8Array(bytes);
+      let offset = 0;
+      for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+      }
+      return { text: new TextDecoder().decode(output), bytes };
+    }),
+  );
+
+/**
+ * Run a shell build command, dying on non-zero exit. Local stand-in for the
+ * removed `Build/Command.ts` helper. Build commands inherit the ambient
+ * environment except for Prisma Management API credentials, which must be
+ * passed explicitly through `env` when a build genuinely needs them.
+ */
+export const runBuildCommand = Effect.fn(function* ({
+  command,
+  cwd,
+  env,
+  outputLimitBytes = DEFAULT_BUILD_OUTPUT_LIMIT_BYTES,
+  timeoutSeconds = DEFAULT_BUILD_TIMEOUT_SECONDS,
+}: RunBuildCommandOptions) {
+  if (!Number.isSafeInteger(outputLimitBytes) || outputLimitBytes <= 0) {
+    return yield* Effect.fail(
+      new Error("outputLimitBytes must be a positive safe integer"),
+    );
+  }
+  if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) {
+    return yield* Effect.fail(
+      new Error("timeoutSeconds must be a positive finite number"),
+    );
+  }
+  const spawner = yield* ChildProcessSpawner;
+  const path = yield* Path.Path;
+  const resultOption = yield* Effect.scoped(
+    Effect.gen(function* () {
+      const handle = yield* spawner.spawn(
+        ChildProcess.make(command, [], {
+          cwd: path.resolve(cwd ?? "."),
+          shell: true,
+          env: buildProcessEnvironment(env),
+          extendEnv: false,
+          stdin: "ignore",
+          stdout: "pipe",
+          stderr: "pipe",
+          killSignal: "SIGKILL",
+        }),
+      );
+      const result = yield* Effect.all(
+        {
+          exitCode: handle.exitCode,
+          stdout: collectBoundedOutput(
+            handle.stdout,
+            "stdout",
+            outputLimitBytes,
+          ),
+          stderr: collectBoundedOutput(
+            handle.stderr,
+            "stderr",
+            outputLimitBytes,
+          ),
+        },
+        { concurrency: "unbounded" },
+      );
+      // A successful build shell can still leave daemonized descendants in
+      // its detached process group. Always reap the group after output has
+      // closed; ESRCH is expected when no descendants remain.
+      yield* handle.kill({ killSignal: "SIGKILL" }).pipe(Effect.ignore);
+      return result;
+    }).pipe(Effect.timeoutOption(Duration.seconds(timeoutSeconds))),
+  );
+  if (Option.isNone(resultOption)) {
+    return yield* Effect.fail(
+      new Error(`Build command timed out after ${timeoutSeconds} seconds.`),
+    );
+  }
+  const result = resultOption.value;
+
+  if (result.exitCode !== 0) {
+    return yield* Effect.fail(
+      new Error(
+        `Build command failed with exit code ${result.exitCode} (stdout: ${result.stdout.bytes} bytes; stderr: ${result.stderr.bytes} bytes).`,
+      ),
+    );
+  }
+
+  yield* Effect.logDebug("Build command completed", {
+    stdoutBytes: result.stdout.bytes,
+    stderrBytes: result.stderr.bytes,
+  });
+
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.text,
+    stderr: result.stderr.text,
+  };
+});
+
+const buildProcessEnvironment = (
+  explicitEnv: Record<string, string> = {},
+): Record<string, string> => ({
+  ...Object.fromEntries(
+    Object.entries(process.env).filter(
+      (entry): entry is [string, string] =>
+        entry[1] !== undefined &&
+        !PRISMA_MANAGEMENT_CREDENTIAL_ENV_NAMES.has(entry[0].toUpperCase()),
+    ),
+  ),
+  ...explicitEnv,
+});
+
+const NEXT_CONFIG_FILENAMES = [
+  "next.config.js",
+  "next.config.mjs",
+  "next.config.ts",
+  "next.config.mts",
+] as const;
+
+const NUXT_CONFIG_FILENAMES = [
+  "nuxt.config.js",
+  "nuxt.config.mjs",
+  "nuxt.config.cjs",
+  "nuxt.config.ts",
+  "nuxt.config.mts",
+] as const;
+
+const ASTRO_CONFIG_FILENAMES = [
+  "astro.config.js",
+  "astro.config.mjs",
+  "astro.config.cjs",
+  "astro.config.ts",
+  "astro.config.mts",
+] as const;
+
+const NEST_CLI_FILENAME = "nest-cli.json";
+const NEST_TSCONFIG_FILENAMES = [
+  "tsconfig.build.json",
+  "tsconfig.json",
+] as const;
+const NEST_DEFAULT_COMPILED_ENTRYPOINTS = [
+  "dist/src/main.js",
+  "dist/main.js",
+] as const;
+
+const TANSTACK_START_PACKAGES = [
+  "@tanstack/react-start",
+  "@tanstack/solid-start",
+] as const;
+
+const strategies: readonly BuildStrategy[] = [
+  {
+    name: "nextjs",
+    canBuild: (appPath) =>
+      Effect.gen(function* () {
+        return (
+          (yield* hasRootFile(appPath, NEXT_CONFIG_FILENAMES)) ||
+          (yield* hasPackageDependency(appPath, ["next"]))
+        );
+      }),
+    execute: (options) =>
+      buildFramework({
+        appPath: options.appPath,
+        env: options.env,
+        outputLimitBytes: options.outputLimitBytes,
+        timeoutSeconds: options.timeoutSeconds,
+        cliName: "next",
+        args: ["build"],
+        failurePrefix: "Next.js",
+        missingMessage:
+          "Could not find an installed Next.js CLI. Install `next` in the application or workspace before deploying.",
+        sourceDir: ".next/standalone",
+        entrypoint: "server.js",
+        defaultPort: 3000,
+        allowNestedEntrypoint: true,
+        extrasRelativeToEntrypoint: true,
+        missingOutputMessage:
+          'Next.js build did not produce standalone output. Add output: "standalone" to your next.config file.',
+        extras: [
+          { from: "public", to: "public" },
+          { from: ".next/static", to: ".next/static" },
+        ],
+      }),
+  },
+  {
+    name: "nuxt",
+    canBuild: (appPath) =>
+      Effect.gen(function* () {
+        return (
+          (yield* hasRootFile(appPath, NUXT_CONFIG_FILENAMES)) ||
+          (yield* hasPackageDependency(appPath, ["nuxt"]))
+        );
+      }),
+    execute: (options) =>
+      buildFramework({
+        appPath: options.appPath,
+        env: options.env,
+        outputLimitBytes: options.outputLimitBytes,
+        timeoutSeconds: options.timeoutSeconds,
+        cliName: "nuxt",
+        args: ["build"],
+        failurePrefix: "Nuxt",
+        missingMessage:
+          "Could not find an installed Nuxt CLI. Install `nuxt` in the application or workspace before deploying.",
+        sourceDir: ".output",
+        entrypoint: "server/index.mjs",
+        defaultPort: 3000,
+        requiredFile: ".output/server/index.mjs",
+        missingOutputMessage:
+          "Nuxt build did not produce a Nitro node server entrypoint at .output/server/index.mjs. Ensure nitro.preset is 'node-server' (the default).",
+      }),
+  },
+  {
+    name: "astro",
+    canBuild: (appPath) =>
+      Effect.gen(function* () {
+        return (
+          (yield* hasRootFile(appPath, ASTRO_CONFIG_FILENAMES)) ||
+          (yield* hasPackageDependency(appPath, ["astro"]))
+        );
+      }),
+    execute: (options) =>
+      buildFramework({
+        appPath: options.appPath,
+        env: options.env,
+        outputLimitBytes: options.outputLimitBytes,
+        timeoutSeconds: options.timeoutSeconds,
+        cliName: "astro",
+        args: ["build"],
+        failurePrefix: "Astro",
+        missingMessage:
+          "Could not find an installed Astro CLI. Install `astro` in the application or workspace before deploying.",
+        sourceDir: "dist",
+        entrypoint: "server/entry.mjs",
+        defaultPort: 4321,
+        requiredFile: "dist/server/entry.mjs",
+        missingOutputMessage:
+          'Astro build did not produce a standalone server entrypoint. Install @astrojs/node and configure it with adapter: node({ mode: "standalone" }) in your astro.config file.',
+      }),
+  },
+  {
+    name: "nestjs",
+    canBuild: (appPath) =>
+      Effect.gen(function* () {
+        return (
+          (yield* hasRootFile(appPath, [NEST_CLI_FILENAME])) ||
+          (yield* hasPackageDependency(appPath, ["@nestjs/core"]))
+        );
+      }),
+    execute: (options) => buildNestjs(options),
+  },
+  {
+    name: "tanstack-start",
+    canBuild: (appPath) =>
+      hasPackageDependency(appPath, TANSTACK_START_PACKAGES),
+    execute: (options) =>
+      buildFramework({
+        appPath: options.appPath,
+        env: options.env,
+        outputLimitBytes: options.outputLimitBytes,
+        timeoutSeconds: options.timeoutSeconds,
+        cliName: "vite",
+        args: ["build"],
+        failurePrefix: "TanStack Start",
+        missingMessage:
+          "Could not find an installed Vite CLI. Install `vite` in the application or workspace before deploying.",
+        sourceDir: ".output",
+        entrypoint: "server/index.mjs",
+        defaultPort: 3000,
+        requiredFile: ".output/server/index.mjs",
+        missingOutputMessage:
+          "TanStack Start build did not produce a Nitro node server entrypoint at .output/server/index.mjs. Ensure your vite.config includes the TanStack Start and Nitro plugins with the default node preset.",
+      }),
+  },
+  {
+    name: "bun",
+    canBuild: () => Effect.succeed(true),
+    execute: (options) => buildBun(options),
+  },
+] as const;
+
+export const runComputeAutoBuild = Effect.fn(function* (
+  options: ComputeAutoBuildOptions,
+) {
+  const requested = options.framework ?? "auto";
+  const candidates =
+    requested === "auto"
+      ? strategies
+      : strategies.filter((strategy) => strategy.name === requested);
+
+  for (const strategy of candidates) {
+    if (yield* strategy.canBuild(options.appPath)) {
+      return yield* strategy.execute(options);
+    }
+  }
+
+  return yield* Effect.fail(
+    new Error("No suitable Prisma Compute auto-build strategy found."),
+  );
+});
+
+const buildFramework = Effect.fn(function* (options: {
+  appPath: string;
+  env?: Record<string, string | Redacted.Redacted<string> | undefined>;
+  outputLimitBytes?: number;
+  timeoutSeconds?: number;
+  cliName: string;
+  args: string[];
+  failurePrefix: string;
+  missingMessage: string;
+  sourceDir: string;
+  entrypoint: string;
+  defaultPort: number;
+  allowNestedEntrypoint?: boolean;
+  requiredFile?: string;
+  missingOutputMessage: string;
+  extrasRelativeToEntrypoint?: boolean;
+  extras?: ReadonlyArray<{ from: string; to: string }>;
+}) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  yield* runBuildCommand({
+    command: yield* packageCliCommand(
+      options.appPath,
+      options.cliName,
+      options.args,
+      options.missingMessage,
+    ),
+    cwd: options.appPath,
+    env: processBuildEnv(options.env),
+    outputLimitBytes: options.outputLimitBytes,
+    timeoutSeconds: options.timeoutSeconds,
+  });
+
+  const requiredPath = path.join(
+    options.appPath,
+    options.requiredFile ?? options.sourceDir,
+  );
+  if (!(yield* fs.exists(requiredPath))) {
+    return yield* Effect.fail(new Error(options.missingOutputMessage));
+  }
+
+  const temp = yield* makeTempArtifactDir();
+  const budget = makeStagingBudget();
+  const build = Effect.gen(function* () {
+    return yield* withStagingDeadline(
+      Effect.gen(function* () {
+        yield* copyDirectoryPreserveSymlinks(
+          path.join(options.appPath, options.sourceDir),
+          temp.artifactDir,
+          temp.artifactDir,
+          options.appPath,
+          budget,
+        );
+        yield* materializeBunNodeModuleAliases(
+          temp.artifactDir,
+          path.join(options.appPath, options.sourceDir),
+          budget,
+        );
+        const entrypoint = yield* resolveFrameworkEntrypoint(
+          temp.artifactDir,
+          options.entrypoint,
+          options.allowNestedEntrypoint ?? false,
+        );
+        const extrasBaseDir = options.extrasRelativeToEntrypoint
+          ? path.dirname(path.join(temp.artifactDir, entrypoint))
+          : temp.artifactDir;
+        for (const extra of options.extras ?? []) {
+          const extraSource = path.join(options.appPath, extra.from);
+          if (yield* directoryExists(extraSource)) {
+            const extraTarget = path.join(extrasBaseDir, extra.to);
+            yield* copyDirectoryPreserveSymlinks(
+              extraSource,
+              extraTarget,
+              temp.artifactDir,
+              options.appPath,
+              budget,
+            );
+          }
+        }
+        return {
+          directory: temp.artifactDir,
+          entrypoint,
+          defaultPort: options.defaultPort,
+          cleanup: temp.cleanup,
+        };
+      }),
+      budget,
+    );
+  });
+
+  return yield* build.pipe(
+    Effect.catch((error) =>
+      temp.cleanup.pipe(Effect.andThen(Effect.fail(error))),
+    ),
+  );
+});
+
+const buildNestjs = Effect.fn(function* (options: ComputeAutoBuildOptions) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const buildScript = yield* readPackageScript(options.appPath, "build");
+
+  yield* runBuildCommand({
+    command:
+      buildScript === undefined
+        ? yield* packageCliCommand(
+            options.appPath,
+            "nest",
+            ["build"],
+            "Could not find an installed Nest CLI. Add a `build` script to package.json or install `@nestjs/cli` in the application or workspace before deploying.",
+          )
+        : packageScriptCommand("build"),
+    cwd: options.appPath,
+    env: processBuildEnv(options.env),
+    outputLimitBytes: options.outputLimitBytes,
+    timeoutSeconds: options.timeoutSeconds,
+  });
+
+  const compiledEntry = yield* resolveNestjsCompiledEntrypoint(options.appPath);
+  const temp = yield* makeTempArtifactDir();
+  const budget = makeStagingBudget();
+  const build = Effect.gen(function* () {
+    const entrypoint = yield* withStagingDeadline(
+      stageTracedNestjsArtifact({
+        appPath: options.appPath,
+        artifactDir: temp.artifactDir,
+        compiledEntry,
+        budget,
+      }),
+      budget,
+    );
+    return {
+      directory: temp.artifactDir,
+      entrypoint,
+      defaultPort: 3000,
+      cleanup: temp.cleanup,
+    };
+  });
+
+  return yield* build.pipe(
+    Effect.catch((error) =>
+      fs
+        .remove(path.dirname(temp.artifactDir), { recursive: true })
+        .pipe(Effect.ignore, Effect.andThen(Effect.fail(error))),
+    ),
+  );
+});
+
+const resolveNestjsCompiledEntrypoint = Effect.fn(function* (appPath: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const candidates = [
+    yield* readPackageMain(appPath),
+    yield* configuredNestjsCompiledEntrypoint(appPath),
+    ...NEST_DEFAULT_COMPILED_ENTRYPOINTS,
+  ].flatMap((candidate) => {
+    if (candidate === undefined) return [];
+    const normalized = normalizeRelativePath(candidate);
+    return normalized === undefined ? [] : [normalized];
+  });
+
+  for (const candidate of candidates) {
+    const stat = yield* fs
+      .stat(path.join(appPath, candidate))
+      .pipe(Effect.catch(() => Effect.succeed(undefined)));
+    if (stat?.type === "File") return candidate;
+  }
+
+  return yield* Effect.fail(
+    new Error(
+      `NestJS build did not produce a compiled entrypoint. Looked for ${candidates.join(", ")} under ${appPath}. Ensure \`nest build\` ran and check package.json main, nest-cli.json, or tsconfig outDir.`,
+    ),
+  );
+});
+
+const configuredNestjsCompiledEntrypoint = Effect.fn(function* (
+  appPath: string,
+) {
+  const path = yield* Path.Path;
+  const config = yield* readNestCliConfig(appPath);
+  const sourceRoot = normalizeRelativePath(config.sourceRoot ?? "src") ?? "src";
+  const entryFile = config.entryFile ?? "main";
+  const outDir = yield* readNestjsOutDir(appPath);
+  return sourceRoot === "."
+    ? path.join(outDir, `${entryFile}.js`)
+    : path.join(outDir, sourceRoot, `${entryFile}.js`);
+});
+
+const stageTracedNestjsArtifact = Effect.fn(function* (options: {
+  appPath: string;
+  artifactDir: string;
+  compiledEntry: string;
+  budget: StagingBudget;
+}) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const sourceRoot = yield* resolveSourceRoot(options.appPath);
+  const realSourceRoot = yield* fs.realPath(sourceRoot);
+  const artifactRoot = path.resolve(options.artifactDir);
+  const entry = path.join(options.appPath, options.compiledEntry);
+  const entrypoint = path.relative(sourceRoot, entry).replaceAll("\\", "/");
+  const fileList = yield* Effect.tryPromise({
+    try: () =>
+      nodeFileTrace([entry], { base: sourceRoot }).then((result) =>
+        Array.from(result.fileList),
+      ),
+    catch: (cause) =>
+      cause instanceof Error
+        ? cause
+        : new Error(`Failed to trace NestJS artifact: ${String(cause)}`),
+  });
+
+  const sortedFiles = fileList.sort((a, b) => a.localeCompare(b));
+  if (sortedFiles.length > STAGING_MAX_ENTRIES) {
+    return yield* Effect.fail(
+      new Error(
+        `Compute artifact staging exceeded the ${STAGING_MAX_ENTRIES} entry safety limit while tracing NestJS dependencies.`,
+      ),
+    );
+  }
+  for (const file of sortedFiles) {
+    const normalized = normalizeRelativePath(file);
+    if (normalized === undefined || normalized === ".") {
+      return yield* Effect.fail(
+        new Error(`NestJS dependency trace returned an unsafe path: ${file}`),
+      );
+    }
+    yield* stageTracedPath(
+      path.join(sourceRoot, normalized),
+      path.join(options.artifactDir, normalized),
+      [realSourceRoot],
+      artifactRoot,
+      options.budget,
+    );
+  }
+
+  return entrypoint;
+});
+
+const copyDirectoryPreserveSymlinks = Effect.fn(function* (
+  sourceDir: string,
+  targetDir: string,
+  targetRoot: string,
+  sourceBoundary: string,
+  budget: StagingBudget,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const realSourceRoot = yield* fs.realPath(sourceDir);
+  const realSourceBoundary = yield* fs.realPath(sourceBoundary);
+  yield* assertPathWithinRoots(realSourceRoot, [realSourceBoundary], sourceDir);
+  yield* copyDirectoryWithinRoots(
+    sourceDir,
+    targetDir,
+    [realSourceRoot],
+    path.resolve(targetRoot),
+    budget,
+  );
+});
+
+const copyDirectoryWithinRoots: (
+  sourceDir: string,
+  targetDir: string,
+  allowedRoots: readonly string[],
+  targetRoot: string,
+  budget: StagingBudget,
+) => Effect.Effect<void, unknown, FileSystem.FileSystem | Path.Path> =
+  Effect.fn(function* (sourceDir, targetDir, allowedRoots, targetRoot, budget) {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    yield* assertRealPathWithinRoots(sourceDir, allowedRoots);
+    yield* assertSafeStagingDestination(targetDir, targetRoot);
+    yield* fs.makeDirectory(targetDir, { recursive: true });
+
+    const entries = (yield* readDirectoryEntries(sourceDir)).sort((a, b) =>
+      a.name.localeCompare(b.name),
+    );
+    for (const entry of entries) {
+      const source = path.join(sourceDir, entry.name);
+      const target = path.join(targetDir, entry.name);
+      if (entry.type === "SymbolicLink") {
+        const symlinkTarget = yield* validateStagedSymlink(
+          source,
+          allowedRoots,
+        );
+        yield* accountStagingEntry(budget, source, 0);
+        yield* assertSafeStagingDestination(target, targetRoot);
+        yield* assertPathWithinRoots(
+          path.resolve(path.dirname(target), symlinkTarget),
+          [targetRoot],
+          target,
+        );
+        yield* fs.remove(target, { recursive: true, force: true });
+        yield* fs.symlink(symlinkTarget, target);
+        continue;
+      }
+
+      if (entry.type === "Directory") {
+        yield* assertRealPathWithinRoots(source, allowedRoots);
+        yield* accountStagingEntry(budget, source, 0);
+        yield* copyDirectoryWithinRoots(
+          source,
+          target,
+          allowedRoots,
+          targetRoot,
+          budget,
+        );
+        continue;
+      }
+
+      if (entry.type === "File") {
+        yield* assertRealPathWithinRoots(source, allowedRoots);
+        const stat = yield* fs.stat(source);
+        const size = yield* safeFileSize(source, stat.size);
+        yield* accountStagingEntry(budget, source, size);
+        yield* assertSafeStagingDestination(target, targetRoot);
+        yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+        yield* fs.copyFile(source, target);
+        const copied = yield* fs.stat(target);
+        if (copied.type !== "File" || Number(copied.size) !== size) {
+          yield* fs.remove(target, { force: true }).pipe(Effect.ignore);
+          return yield* Effect.fail(
+            new Error(`Compute artifact file changed while staging: ${source}`),
+          );
+        }
+        yield* fs.chmod(target, stat.mode & 0o777);
+        continue;
+      }
+
+      yield* accountStagingEntry(budget, source, 0);
+      return yield* Effect.fail(
+        new Error(
+          `Unsupported filesystem entry in compute artifact: ${source}`,
+        ),
+      );
+    }
+  });
+
+const readDirectoryEntries = Effect.fn(function* (directory: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const names = yield* fs.readDirectory(directory);
+  if (names.length > STAGING_MAX_ENTRIES) {
+    return yield* Effect.fail(
+      new Error(
+        `Compute artifact directory exceeds the ${STAGING_MAX_ENTRIES} entry safety limit: ${directory}`,
+      ),
+    );
+  }
+  return yield* Effect.forEach(names, (name) =>
+    Effect.gen(function* () {
+      const file = path.join(directory, name);
+      const isSymlink = yield* fs.readLink(file).pipe(
+        Effect.as(true),
+        Effect.catch(() => Effect.succeed(false)),
+      );
+      if (isSymlink) {
+        return { name, type: "SymbolicLink" } satisfies DirectoryEntry;
+      }
+      const stat = yield* fs.stat(file);
+      return {
+        name,
+        type:
+          stat.type === "Directory" || stat.type === "File"
+            ? stat.type
+            : "Other",
+      } satisfies DirectoryEntry;
+    }),
+  );
+});
+
+const materializeBunNodeModuleAliases = Effect.fn(function* (
+  artifactDir: string,
+  sourceDir: string,
+  budget: StagingBudget,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const nodeModules = path.join(artifactDir, "node_modules");
+  const aliasRoot = path.join(nodeModules, ".bun", "node_modules");
+  if (!(yield* directoryExists(aliasRoot))) return;
+  const allowedRoots = [
+    yield* fs.realPath(artifactDir),
+    yield* fs.realPath(sourceDir),
+  ];
+  const targetRoot = path.resolve(artifactDir);
+
+  for (const entry of yield* fs.readDirectory(aliasRoot)) {
+    const source = path.join(aliasRoot, entry);
+    const stat = yield* fs
+      .stat(source)
+      .pipe(Effect.catch(() => Effect.succeed(undefined)));
+    if (stat?.type !== "Directory") continue;
+
+    if (entry.startsWith("@")) {
+      const targetScope = path.join(nodeModules, entry);
+      yield* assertSafeStagingDestination(targetScope, targetRoot);
+      yield* fs.makeDirectory(targetScope, { recursive: true });
+      for (const packageName of yield* fs.readDirectory(source)) {
+        yield* copyAliasIfMissing(
+          allowedRoots,
+          path.join(source, packageName),
+          path.join(targetScope, packageName),
+          targetRoot,
+          budget,
+        );
+      }
+    } else {
+      yield* copyAliasIfMissing(
+        allowedRoots,
+        source,
+        path.join(nodeModules, entry),
+        targetRoot,
+        budget,
+      );
+    }
+  }
+});
+
+const copyAliasIfMissing = Effect.fn(function* (
+  allowedRoots: readonly string[],
+  source: string,
+  target: string,
+  targetRoot: string,
+  budget: StagingBudget,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  if (yield* fs.exists(target)) return;
+  const realSource = yield* fs.realPath(source);
+  yield* assertPathWithinRoots(realSource, allowedRoots, source);
+  const stat = yield* fs.stat(realSource);
+  yield* assertSafeStagingDestination(target, targetRoot);
+  if (stat.type === "Directory") {
+    yield* accountStagingEntry(budget, source, 0);
+    yield* copyDirectoryWithinRoots(
+      realSource,
+      target,
+      allowedRoots,
+      targetRoot,
+      budget,
+    );
+    return;
+  }
+  if (stat.type === "File") {
+    const size = yield* safeFileSize(source, stat.size);
+    yield* accountStagingEntry(budget, source, size);
+    yield* fs.copyFile(realSource, target);
+    const copied = yield* fs.stat(target);
+    if (copied.type !== "File" || Number(copied.size) !== size) {
+      yield* fs.remove(target, { force: true }).pipe(Effect.ignore);
+      return yield* Effect.fail(
+        new Error(`Compute artifact file changed while staging: ${source}`),
+      );
+    }
+    yield* fs.chmod(target, stat.mode & 0o777);
+    return;
+  }
+  return yield* Effect.fail(
+    new Error(`Unsupported Bun package alias source: ${source}`),
+  );
+});
+
+const resolveFrameworkEntrypoint = Effect.fn(function* (
+  artifactDir: string,
+  entrypoint: string,
+  allowNested: boolean,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  if (!allowNested) {
+    return entrypoint;
+  }
+
+  const entrypointFile = path.basename(entrypoint);
+  const candidates = (yield* fs.readDirectory(artifactDir, { recursive: true }))
+    .map((file) => file.replaceAll("\\", "/"))
+    .filter((file) => {
+      const parts = file.split("/");
+      return (
+        path.basename(file) === entrypointFile &&
+        !parts.includes("node_modules") &&
+        !parts.includes(".next")
+      );
+    })
+    .sort((a, b) => {
+      const depth = a.split(/[\\/]/).length - b.split(/[\\/]/).length;
+      return depth === 0 ? a.localeCompare(b) : depth;
+    });
+
+  if (candidates.length === 1) return candidates[0]!;
+  if (candidates.length > 1) {
+    return yield* Effect.fail(
+      new Error(
+        `Next.js standalone output has multiple ${entrypointFile} files (${candidates.join(", ")}). Cannot determine the application entrypoint.`,
+      ),
+    );
+  }
+
+  return yield* Effect.fail(
+    new Error(
+      `Could not find framework entrypoint ${entrypoint} inside ${artifactDir}.`,
+    ),
+  );
+});
+
+function buildBun(options: ComputeAutoBuildOptions) {
+  return Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const entrypoint = yield* resolveBunEntrypoint(
+      options.appPath,
+      options.entrypoint,
+    );
+    const absoluteEntrypoint = path.join(options.appPath, entrypoint);
+    const temp = yield* makeTempArtifactDir("bundle");
+
+    const build = Effect.gen(function* () {
+      yield* runBuildCommand({
+        command: [
+          "bun",
+          "build",
+          shellQuote(absoluteEntrypoint),
+          "--outdir",
+          shellQuote(temp.artifactDir),
+          "--target",
+          "bun",
+          "--sourcemap=external",
+        ].join(" "),
+        cwd: options.appPath,
+        env: processBuildEnv(options.env),
+        outputLimitBytes: options.outputLimitBytes,
+        timeoutSeconds: options.timeoutSeconds,
+      });
+
+      const budget = makeStagingBudget();
+      yield* withStagingDeadline(
+        validateStagedDirectory(temp.artifactDir, budget),
+        budget,
+      );
+
+      const outputFiles = (yield* fs.readDirectory(temp.artifactDir))
+        .filter((file) => file.endsWith(".js"))
+        .sort();
+      if (outputFiles.length === 0) {
+        return yield* Effect.fail(
+          new Error("Bun build produced no JavaScript output."),
+        );
+      }
+
+      const expected = `${path.basename(
+        absoluteEntrypoint,
+        path.extname(absoluteEntrypoint),
+      )}.js`;
+      return {
+        directory: temp.artifactDir,
+        entrypoint: outputFiles.includes(expected) ? expected : outputFiles[0]!,
+        cleanup: temp.cleanup,
+      };
+    });
+
+    return yield* build.pipe(
+      Effect.catch((error) =>
+        temp.cleanup.pipe(Effect.andThen(Effect.fail(error))),
+      ),
+    );
+  });
+}
+
+const resolveBunEntrypoint = Effect.fn(function* (
+  appPath: string,
+  entrypoint: string | undefined,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const candidate = entrypoint ?? (yield* readPackageMain(appPath));
+  if (!candidate) {
+    return yield* Effect.fail(
+      new Error(
+        "Prisma Compute auto-build needs an entrypoint for Bun apps. Set `entrypoint` or package.json `main`.",
+      ),
+    );
+  }
+  const normalized = yield* normalizeEntrypoint(candidate);
+  const entrypointPath = path.join(appPath, normalized);
+  if (!(yield* fs.exists(entrypointPath))) {
+    return yield* Effect.fail(
+      new Error(`Entrypoint file does not exist: ${entrypointPath}`),
+    );
+  }
+  const realAppPath = yield* fs.realPath(appPath);
+  const realEntrypointPath = yield* fs.realPath(entrypointPath);
+  yield* assertPathWithinRoots(
+    realEntrypointPath,
+    [realAppPath],
+    entrypointPath,
+  );
+  return normalized;
+});
+
+const makeTempArtifactDir = Effect.fn(function* (leaf = "app") {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const tempDir = yield* fs.makeTempDirectory({
+    prefix: "alchemy-prisma-compute-build-",
+  });
+  const artifactDir = path.join(tempDir, leaf);
+  yield* fs.makeDirectory(artifactDir, { recursive: true });
+  return {
+    artifactDir,
+    cleanup: fs.remove(tempDir, { recursive: true }).pipe(Effect.ignore),
+  };
+});
+
+const hasRootFile = Effect.fn(function* (
+  appPath: string,
+  filenames: readonly string[],
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const entries = yield* fs
+    .readDirectory(appPath)
+    .pipe(Effect.catch(() => Effect.succeed([] as string[])));
+  return entries.some((entry) => filenames.includes(entry));
+});
+
+const hasPackageDependency = Effect.fn(function* (
+  appPath: string,
+  packageNames: readonly string[],
+) {
+  const parsed = yield* readPackageJson(appPath);
+  if (!parsed) return false;
+  const deps = isRecord(parsed.dependencies) ? parsed.dependencies : {};
+  const devDeps = isRecord(parsed.devDependencies)
+    ? parsed.devDependencies
+    : {};
+  return packageNames.some((name) => name in deps || name in devDeps);
+});
+
+const readPackageMain = Effect.fn(function* (appPath: string) {
+  const parsed = yield* readPackageJson(appPath);
+  return typeof parsed?.main === "string" ? parsed.main : undefined;
+});
+
+const readPackageScript = Effect.fn(function* (
+  appPath: string,
+  scriptName: string,
+) {
+  const parsed = yield* readPackageJson(appPath);
+  const scripts = isRecord(parsed?.scripts) ? parsed.scripts : undefined;
+  const script = scripts?.[scriptName];
+  return typeof script === "string" && script.trim() !== ""
+    ? script
+    : undefined;
+});
+
+const readPackageJson = Effect.fn(function* (appPath: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const packagePath = path.join(appPath, "package.json");
+  const text = yield* fs
+    .readFileString(packagePath)
+    .pipe(
+      Effect.catch((error) =>
+        error._tag === "PlatformError" && error.reason._tag === "NotFound"
+          ? Effect.succeed(undefined)
+          : Effect.fail(error),
+      ),
+    );
+  if (!text) return undefined;
+  return yield* Effect.try({
+    try: () => JSON.parse(text) as Record<string, unknown>,
+    catch: (cause) =>
+      new Error(`Failed to parse package.json in ${appPath}: ${cause}`),
+  });
+});
+
+const readNestCliConfig = Effect.fn(function* (appPath: string) {
+  const parsed = yield* readJsonObjectFile(appPath, NEST_CLI_FILENAME);
+  return {
+    sourceRoot:
+      typeof parsed?.sourceRoot === "string" ? parsed.sourceRoot : undefined,
+    entryFile:
+      typeof parsed?.entryFile === "string" ? parsed.entryFile : undefined,
+  };
+});
+
+const readNestjsOutDir = Effect.fn(function* (appPath: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  for (const fileName of NEST_TSCONFIG_FILENAMES) {
+    const filePath = path.join(appPath, fileName);
+    const text = yield* fs
+      .readFileString(filePath)
+      .pipe(Effect.catch(() => Effect.succeed(undefined)));
+    if (text === undefined) continue;
+    const outDir = yield* parseTsconfigOutDir(text);
+    if (outDir !== undefined) return outDir;
+  }
+  return "dist";
+});
+
+const parseTsconfigOutDir = Effect.fn(function* (content: string) {
+  const parsed = yield* Effect.try({
+    try: () =>
+      JSON.parse(stripJsonComments(content)) as {
+        compilerOptions?: { outDir?: unknown };
+      },
+    catch: (cause) =>
+      cause instanceof Error ? cause : new Error(String(cause)),
+  }).pipe(Effect.catch(() => Effect.succeed(undefined)));
+  const outDir = parsed?.compilerOptions?.outDir;
+  return typeof outDir === "string" ? normalizeRelativePath(outDir) : undefined;
+});
+
+const readJsonObjectFile = Effect.fn(function* (
+  directory: string,
+  fileName: string,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const text = yield* fs
+    .readFileString(path.join(directory, fileName))
+    .pipe(Effect.catch(() => Effect.succeed(undefined)));
+  if (text === undefined) return undefined;
+  return yield* Effect.try({
+    try: () => {
+      const parsed = JSON.parse(text) as unknown;
+      return isRecord(parsed) ? parsed : undefined;
+    },
+    catch: (cause) =>
+      cause instanceof Error ? cause : new Error(String(cause)),
+  }).pipe(Effect.catch(() => Effect.succeed(undefined)));
+});
+
+const directoryExists = Effect.fn(function* (dirPath: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const stat = yield* fs
+    .stat(dirPath)
+    .pipe(Effect.catch(() => Effect.succeed(undefined)));
+  return stat?.type === "Directory";
+});
+
+const stageTracedPath = Effect.fn(function* (
+  sourcePath: string,
+  destinationPath: string,
+  allowedRoots: readonly string[],
+  targetRoot: string,
+  budget: StagingBudget,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const symlinkTarget = yield* fs
+    .readLink(sourcePath)
+    .pipe(Effect.catch(() => Effect.succeed(undefined)));
+  const stat = yield* fs
+    .stat(sourcePath)
+    .pipe(Effect.catch(() => Effect.succeed(undefined)));
+  if (stat === undefined && symlinkTarget === undefined) {
+    return yield* Effect.fail(
+      new Error(`NestJS dependency disappeared while staging: ${sourcePath}`),
+    );
+  }
+
+  yield* assertSafeStagingDestination(destinationPath, targetRoot);
+  yield* fs.makeDirectory(path.dirname(destinationPath), { recursive: true });
+  if (symlinkTarget !== undefined) {
+    const validatedTarget = yield* validateStagedSymlink(
+      sourcePath,
+      allowedRoots,
+    );
+    yield* accountStagingEntry(budget, sourcePath, 0);
+    yield* assertPathWithinRoots(
+      path.resolve(path.dirname(destinationPath), validatedTarget),
+      [targetRoot],
+      destinationPath,
+    );
+    yield* fs.remove(destinationPath, { recursive: true, force: true });
+    yield* fs.symlink(validatedTarget, destinationPath);
+    return;
+  }
+
+  if (stat?.type === "File") {
+    yield* assertRealPathWithinRoots(sourcePath, allowedRoots);
+    const size = yield* safeFileSize(sourcePath, stat.size);
+    yield* accountStagingEntry(budget, sourcePath, size);
+    yield* fs.copyFile(sourcePath, destinationPath);
+    const copied = yield* fs.stat(destinationPath);
+    if (copied.type !== "File" || Number(copied.size) !== size) {
+      yield* fs.remove(destinationPath, { force: true }).pipe(Effect.ignore);
+      return yield* Effect.fail(
+        new Error(`Compute artifact file changed while staging: ${sourcePath}`),
+      );
+    }
+    yield* fs.chmod(destinationPath, stat.mode & 0o777);
+    return;
+  }
+
+  yield* accountStagingEntry(budget, sourcePath, 0);
+  return yield* Effect.fail(
+    new Error(
+      `Unsupported filesystem entry in NestJS dependency trace: ${sourcePath}`,
+    ),
+  );
+});
+
+const makeStagingBudget = (): StagingBudget => ({
+  entries: 0,
+  totalBytes: 0,
+  deadline: Date.now() + STAGING_TIMEOUT_SECONDS * 1000,
+});
+
+const withStagingDeadline = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+  budget: StagingBudget,
+): Effect.Effect<A, E | Error, R> =>
+  effect.pipe(
+    Effect.timeoutOption(
+      Duration.millis(Math.max(1, budget.deadline - Date.now())),
+    ),
+    Effect.flatMap((result) =>
+      Option.isSome(result)
+        ? Effect.succeed(result.value)
+        : Effect.fail(
+            new Error(
+              `Compute artifact staging timed out after ${STAGING_TIMEOUT_SECONDS} seconds.`,
+            ),
+          ),
+    ),
+  );
+
+const accountStagingEntry = (
+  budget: StagingBudget,
+  source: string,
+  size: number,
+) => {
+  if (Date.now() > budget.deadline) {
+    return Effect.fail(
+      new Error(
+        `Compute artifact staging timed out after ${STAGING_TIMEOUT_SECONDS} seconds.`,
+      ),
+    );
+  }
+  if (size > STAGING_MAX_FILE_BYTES) {
+    return Effect.fail(
+      new Error(
+        `Compute artifact file exceeds the ${STAGING_MAX_FILE_BYTES} byte per-file safety limit: ${source}`,
+      ),
+    );
+  }
+  const entries = budget.entries + 1;
+  if (entries > STAGING_MAX_ENTRIES) {
+    return Effect.fail(
+      new Error(
+        `Compute artifact staging exceeded the ${STAGING_MAX_ENTRIES} entry safety limit.`,
+      ),
+    );
+  }
+  const totalBytes = budget.totalBytes + size;
+  if (
+    !Number.isSafeInteger(totalBytes) ||
+    totalBytes > STAGING_MAX_TOTAL_BYTES
+  ) {
+    return Effect.fail(
+      new Error(
+        `Compute artifact staging exceeded the ${STAGING_MAX_TOTAL_BYTES} byte total safety limit.`,
+      ),
+    );
+  }
+  budget.entries = entries;
+  budget.totalBytes = totalBytes;
+  return Effect.void;
+};
+
+const safeFileSize = (source: string, rawSize: FileSystem.Size) => {
+  const size = Number(rawSize);
+  return Number.isSafeInteger(size) && size >= 0
+    ? Effect.succeed(size)
+    : Effect.fail(
+        new Error(`Compute artifact has an invalid file size: ${source}`),
+      );
+};
+
+const assertRealPathWithinRoots = Effect.fn(function* (
+  source: string,
+  allowedRoots: readonly string[],
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const realSource = yield* fs.realPath(source);
+  yield* assertPathWithinRoots(realSource, allowedRoots, source);
+  return realSource;
+});
+
+const assertSafeStagingDestination = Effect.fn(function* (
+  destination: string,
+  targetRoot: string,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const absoluteDestination = path.resolve(destination);
+  const absoluteTargetRoot = path.resolve(targetRoot);
+  yield* assertPathWithinRoots(
+    absoluteDestination,
+    [absoluteTargetRoot],
+    destination,
+  );
+
+  let existingAncestor = absoluteDestination;
+  while (!(yield* fs.exists(existingAncestor))) {
+    const isDanglingSymlink = yield* fs.readLink(existingAncestor).pipe(
+      Effect.as(true),
+      Effect.catch(() => Effect.succeed(false)),
+    );
+    if (isDanglingSymlink) {
+      return yield* Effect.fail(
+        new Error(
+          `Compute artifact destination contains a dangling symlink: ${existingAncestor}`,
+        ),
+      );
+    }
+    const parent = path.dirname(existingAncestor);
+    if (parent === existingAncestor) {
+      return yield* Effect.fail(
+        new Error(
+          `Could not establish a safe compute artifact destination: ${destination}`,
+        ),
+      );
+    }
+    existingAncestor = parent;
+  }
+
+  const realAncestor = yield* fs.realPath(existingAncestor);
+  const realTargetRoot = yield* fs.realPath(absoluteTargetRoot);
+  yield* assertPathWithinRoots(realAncestor, [realTargetRoot], destination);
+});
+
+const assertPathWithinRoots = Effect.fn(function* (
+  realSource: string,
+  allowedRoots: readonly string[],
+  displaySource: string,
+) {
+  const path = yield* Path.Path;
+  if (
+    allowedRoots.some((root) => {
+      const relative = path.relative(root, realSource);
+      return (
+        relative !== ".." &&
+        !relative.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(relative)
+      );
+    })
+  ) {
+    return;
+  }
+  return yield* Effect.fail(
+    new Error(
+      `Compute artifact path escapes its staging root: ${displaySource}`,
+    ),
+  );
+});
+
+const validateStagedSymlink = Effect.fn(function* (
+  source: string,
+  allowedRoots: readonly string[],
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const target = yield* fs.readLink(source);
+  if (path.isAbsolute(target) || /^[a-zA-Z]:[\\/]/.test(target)) {
+    return yield* Effect.fail(
+      new Error(`Compute artifact contains an absolute symlink: ${source}`),
+    );
+  }
+  yield* assertRealPathWithinRoots(source, allowedRoots);
+  return target;
+});
+
+const validateStagedDirectory = Effect.fn(function* (
+  root: string,
+  budget: StagingBudget,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const realRoot = yield* fs.realPath(root);
+
+  const visit: (
+    directory: string,
+  ) => Effect.Effect<void, unknown, FileSystem.FileSystem | Path.Path> =
+    Effect.fn(function* (directory) {
+      yield* assertRealPathWithinRoots(directory, [realRoot]);
+      const entries = (yield* readDirectoryEntries(directory)).sort((a, b) =>
+        a.name.localeCompare(b.name),
+      );
+      for (const entry of entries) {
+        const source = path.join(directory, entry.name);
+        if (entry.type === "SymbolicLink") {
+          yield* validateStagedSymlink(source, [realRoot]);
+          yield* accountStagingEntry(budget, source, 0);
+          continue;
+        }
+        if (entry.type === "Directory") {
+          yield* assertRealPathWithinRoots(source, [realRoot]);
+          yield* accountStagingEntry(budget, source, 0);
+          yield* visit(source);
+          continue;
+        }
+        if (entry.type === "File") {
+          yield* assertRealPathWithinRoots(source, [realRoot]);
+          const stat = yield* fs.stat(source);
+          yield* accountStagingEntry(
+            budget,
+            source,
+            yield* safeFileSize(source, stat.size),
+          );
+          continue;
+        }
+        yield* accountStagingEntry(budget, source, 0);
+        return yield* Effect.fail(
+          new Error(
+            `Unsupported filesystem entry in compute artifact: ${source}`,
+          ),
+        );
+      }
+    });
+
+  yield* visit(root);
+});
+
+const resolveSourceRoot = Effect.fn(function* (startPath: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const original = path.resolve(startPath);
+  let current = original;
+
+  while (true) {
+    if (
+      (yield* fs.exists(path.join(current, ".git"))) ||
+      (yield* fs.exists(path.join(current, "pnpm-workspace.yaml"))) ||
+      (yield* fs.exists(path.join(current, "bun.lock"))) ||
+      (yield* fs.exists(path.join(current, "bun.lockb"))) ||
+      (yield* packageJsonDeclaresWorkspaces(current))
+    ) {
+      return current;
+    }
+
+    const parent = path.dirname(current);
+    if (parent === current) return original;
+    current = parent;
+  }
+});
+
+const packageJsonDeclaresWorkspaces = Effect.fn(function* (directory: string) {
+  const parsed = yield* readJsonObjectFile(directory, "package.json");
+  return parsed?.workspaces !== undefined;
+});
+
+const packageCliCommand = Effect.fn(function* (
+  appPath: string,
+  cliName: string,
+  args: readonly string[],
+  missingMessage: string,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const sourceRoot = yield* resolveSourceRoot(appPath);
+  const executable = process.platform === "win32" ? `${cliName}.cmd` : cliName;
+  const candidates = Array.from(
+    new Set(
+      [appPath, sourceRoot].map((root) =>
+        path.join(root, "node_modules", ".bin", executable),
+      ),
+    ),
+  );
+  for (const candidate of candidates) {
+    const stat = yield* fs
+      .stat(candidate)
+      .pipe(Effect.catch(() => Effect.succeed(undefined)));
+    if (
+      stat?.type === "File" &&
+      (process.platform === "win32" || (stat.mode & 0o111) !== 0)
+    ) {
+      const argText = args.map(shellQuote).join(" ");
+      return `${shellQuote(candidate)}${argText.length > 0 ? ` ${argText}` : ""}`;
+    }
+  }
+  return yield* Effect.fail(new Error(missingMessage));
+});
+
+const packageScriptCommand = (scriptName: string) =>
+  [
+    "if command -v bun >/dev/null 2>&1; then",
+    `bun run ${shellQuote(scriptName)};`,
+    "elif command -v npm >/dev/null 2>&1; then",
+    `npm run ${shellQuote(scriptName)};`,
+    "else",
+    `echo ${shellQuote("Could not find bun or npm to run package scripts.")} >&2; exit 127;`,
+    "fi",
+  ].join(" ");
+
+const processBuildEnv = (
+  env: Record<string, string | Redacted.Redacted<string> | undefined> = {},
+) =>
+  Object.fromEntries(
+    Object.entries(env).flatMap(([key, value]) =>
+      value === undefined
+        ? []
+        : [[key, Redacted.isRedacted(value) ? Redacted.value(value) : value]],
+    ),
+  ) as Record<string, string>;
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === "object" && value !== null;
+
+const normalizeRelativePath = (value: string) => {
+  const raw = value.trim().replaceAll("\\", "/");
+  if (raw.length === 0 || raw.startsWith("/") || /^[a-zA-Z]:\//.test(raw)) {
+    return undefined;
+  }
+  const parts: string[] = [];
+  for (const part of raw.split("/")) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") {
+      if (parts.length === 0) return undefined;
+      parts.pop();
+      continue;
+    }
+    parts.push(part);
+  }
+  return parts.join("/") || ".";
+};
+
+const stripJsonComments = (content: string) => {
+  let result = "";
+  let inString = false;
+  let escaped = false;
+
+  for (let i = 0; i < content.length; i++) {
+    const char = content[i];
+
+    if (inString) {
+      result += char;
+      if (escaped) {
+        escaped = false;
+      } else if (char === "\\") {
+        escaped = true;
+      } else if (char === '"') {
+        inString = false;
+      }
+      continue;
+    }
+
+    if (char === '"') {
+      inString = true;
+      result += char;
+      continue;
+    }
+
+    const next = content[i + 1];
+    if (char === "/" && next === "/") {
+      while (i < content.length && content[i] !== "\n") {
+        i++;
+      }
+      if (i < content.length) result += content[i];
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      i += 2;
+      while (
+        i < content.length &&
+        !(content[i] === "*" && content[i + 1] === "/")
+      ) {
+        i++;
+      }
+      i++;
+      continue;
+    }
+
+    result += char;
+  }
+
+  return result;
+};
+
+const shellQuote = (value: string) => `'${value.replaceAll("'", "'\\''")}'`;