alchemy 2.0.0-beta.65 → 2.0.0-beta.67

package/src/Prisma/Compute.ts

@@ -0,0 +1,2878 @@
+import * as Effect from "effect/Effect";
+import * as Duration from "effect/Duration";
+import * as Exit from "effect/Exit";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+import * as Result from "effect/Result";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import type { HttpClientResponse } from "effect/unstable/http/HttpClientResponse";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import type { ChildProcessHandle } from "effect/unstable/process/ChildProcessSpawner";
+import type * as rolldown from "rolldown";
+import { AlchemyContext } from "../AlchemyContext.ts";
+import { Unowned } from "../AdoptPolicy.ts";
+import * as Bundle from "../Bundle/Bundle.ts";
+import { findCwdForBundle } from "../Bundle/TempRoot.ts";
+import { createPhysicalName } from "../PhysicalName.ts";
+import { isResolved } from "../Diff.ts";
+import { HttpServer, type HttpEffect } from "../Http.ts";
+import type { InputProps } from "../Input.ts";
+import * as Output from "../Output.ts";
+import { Platform, type Main, type PlatformProps } from "../Platform.ts";
+import * as Provider from "../Provider.ts";
+import { Resource, type ResourceBinding } from "../Resource.ts";
+import { RuntimeContext } from "../RuntimeContext.ts";
+import type * as Server from "../Server/index.ts";
+import { Self } from "../Self.ts";
+import { Stack } from "../Stack.ts";
+import { sha256Object } from "../Util/sha256.ts";
+import {
+  PrismaApiError,
+  PrismaClient,
+  isNotFound,
+  type PrismaManagementClient,
+} from "./Client.ts";
+import {
+  runBuildCommand,
+  runComputeAutoBuild,
+  type ComputeAutoBuildFramework,
+} from "./ComputeBuild.ts";
+import { createComputeArchive, normalizeEntrypoint } from "./ComputeArchive.ts";
+import {
+  destroyApp,
+  destroyDeployment,
+  isConflict,
+  toDeploymentUrl,
+  waitForDeploymentStatus,
+} from "./ComputeLifecycle.ts";
+import {
+  startDeploymentIdempotent,
+  stopDeploymentIdempotent,
+} from "./Internal/DeploymentActions.ts";
+import { ensureAppImmutableIdentity } from "./Internal/AppIdentity.ts";
+import {
+  promoteAppObserved,
+  waitForAppDeploymentTarget,
+} from "./Internal/AppPromotion.ts";
+import { normalizeBundleFilePath } from "./Internal/BundlePaths.ts";
+import { aggregateCleanupFailure } from "./Internal/CleanupFailure.ts";
+import { ensureDeploymentMembership } from "./Internal/DeploymentIdentity.ts";
+import { observeDeployment } from "./Internal/DeploymentObserve.ts";
+import { tailDeploymentLogs } from "./PrismaLogs.ts";
+import type { Project } from "./Project.ts";
+import type { Providers } from "./Providers.ts";
+import {
+  concreteIdsChanged,
+  isInputObject,
+  isPrismaDevId,
+  resolveProjectId,
+  unresolvedProjectIdOf,
+} from "./Refs.ts";
+import type {
+  App as ApiApp,
+  Deployment as ApiDeployment,
+  EnvironmentVariable as ApiEnvironmentVariable,
+  PrismaRegionId,
+} from "./Types.ts";
+import { readUploadArtifact, uploadArtifact } from "./Deployment.ts";
+
+type ObservedDeployment = Omit<ApiDeployment, "createdAt"> & {
+  createdAt?: string;
+};
+
+const ComputeTypeId = "Prisma.Compute" as const;
+type ComputeTypeId = typeof ComputeTypeId;
+
+export interface ComputeCommandBuild {
+  /**
+   * Shell command that creates the deployable output directory.
+   */
+  command: string;
+  /**
+   * Working directory for the build command.
+   *
+   * @default path
+   */
+  cwd?: string;
+  /**
+   * Build output directory, relative to `cwd`.
+   */
+  outdir: string;
+  /**
+   * Entrypoint inside `outdir`.
+   */
+  entrypoint?: string;
+  /**
+   * Environment variables supplied to the build command.
+   * Ambient `PRISMA_SERVICE_TOKEN` and `PRISMA_API_TOKEN` credentials are not
+   * inherited; include one here explicitly only when the application build
+   * genuinely needs Prisma Management API access.
+   *
+   * Plain strings are persisted in Alchemy state. Wrap secrets with
+   * `Redacted.make(secret)`; Prisma-side encryption does not protect a value
+   * already stored in Alchemy state.
+   *
+   * ```typescript
+   * env: { NPM_TOKEN: Redacted.make(process.env.NPM_TOKEN!) }
+   * ```
+   */
+  env?: Record<string, string | Redacted.Redacted<string> | undefined>;
+  /**
+   * Maximum bytes retained from each build output stream.
+   *
+   * @default 1048576 (1 MiB)
+   */
+  outputLimitBytes?: number;
+  /**
+   * Maximum wall-clock time for the build command.
+   *
+   * @default 900 (15 minutes)
+   */
+  timeoutSeconds?: number;
+}
+
+export interface ComputeAutoBuild {
+  /**
+   * Auto-detect a Prisma Compute build strategy, or force one framework.
+   */
+  type: "auto";
+  /**
+   * Framework build strategy.
+   *
+   * @default "auto"
+   */
+  framework?: ComputeAutoBuildFramework;
+  /**
+   * Environment variables supplied to the build command.
+   * Ambient `PRISMA_SERVICE_TOKEN` and `PRISMA_API_TOKEN` credentials are not
+   * inherited; include one here explicitly only when the application build
+   * genuinely needs Prisma Management API access.
+   *
+   * Plain strings are persisted in Alchemy state. Wrap secrets with
+   * `Redacted.make(secret)`.
+   *
+   * ```typescript
+   * env: { NPM_TOKEN: Redacted.make(process.env.NPM_TOKEN!) }
+   * ```
+   */
+  env?: Record<string, string | Redacted.Redacted<string> | undefined>;
+  /**
+   * Maximum bytes retained from each framework build output stream.
+   *
+   * @default 1048576 (1 MiB)
+   */
+  outputLimitBytes?: number;
+  /**
+   * Maximum wall-clock time for the framework build command.
+   *
+   * @default 900 (15 minutes)
+   */
+  timeoutSeconds?: number;
+}
+
+export type ComputeBuild = ComputeCommandBuild | ComputeAutoBuild;
+
+export interface ComputeBundleOptions {
+  /**
+   * Rolldown input options for effect-native Compute bundles.
+   */
+  input?: Partial<rolldown.InputOptions>;
+  /**
+   * Rolldown output options for effect-native Compute bundles.
+   */
+  output?: Partial<rolldown.OutputOptions>;
+  /**
+   * Additional Alchemy bundle options for effect-native Compute bundles.
+   */
+  extra?: Bundle.BundleExtraOptions;
+}
+
+export interface ComputeDev {
+  /**
+   * Local command to run during `alchemy dev`.
+   */
+  command?: string;
+  /**
+   * Working directory for the dev command.
+   *
+   * @default path
+   */
+  cwd?: string;
+  /**
+   * Local development port.
+   */
+  port?: number;
+  /**
+   * Explicit local URL to expose in the resource output.
+   */
+  url?: string;
+  /**
+   * Extra environment variables for the dev command.
+   * Plain strings are persisted in Alchemy state. Wrap secrets with
+   * `Redacted.make(secret)`.
+   */
+  env?: Record<string, string | Redacted.Redacted<string> | undefined>;
+}
+
+export interface ComputeHealthCheck {
+  /**
+   * Absolute application path to probe after the deployment starts and after
+   * promotion.
+   *
+   * @example "/api/health"
+   */
+  path: string;
+  /**
+   * Exact HTTP status codes that indicate readiness. When omitted, any 2xx
+   * response is healthy.
+   *
+   * @default Any status from 200 through 299
+   */
+  statusCodes?: readonly number[];
+}
+
+export interface ComputeProps extends PlatformProps {
+  /**
+   * Project ID or `project.projectId` output that owns the App.
+   */
+  project: string | Project;
+  /**
+   * App display name. If omitted, Alchemy generates a stable physical name.
+   */
+  appName?: string;
+  /**
+   * Region where the App is placed.
+   *
+   * @default The project's default region, falling back to "us-east-1"
+   */
+  regionId?: PrismaRegionId;
+  /**
+   * Branch ID to attach the App to. Mutually exclusive with branchGitName.
+   * If both branch fields are omitted, Alchemy attaches to the project's
+   * current default branch.
+   */
+  branchId?: string;
+  /**
+   * Branch git name to attach the App to. Mutually exclusive with branchId.
+   *
+   * @default The project's current default branch
+   */
+  branchGitName?: string;
+  /**
+   * Application directory used for pre-built artifacts and build commands.
+   *
+   * @default "."
+   */
+  path?: string;
+  /**
+   * Additional artifact-relative files or directories to exclude from path
+   * deployments. `*` and `**` wildcards are supported; absolute paths,
+   * parent segments, and negated patterns are rejected. `.env*`, `.git`, and
+   * `.alchemy` are always excluded.
+   */
+  archiveIgnore?: readonly string[];
+  /**
+   * Entrypoint relative to the deployed artifact directory.
+   * If omitted, Alchemy reads `package.json#main`.
+   */
+  entrypoint?: string;
+  /**
+   * Entry module for an effect-native Compute app.
+   *
+   * This is required when you pass an inline Effect implementation to
+   * `Prisma.Compute`, and ignored for external path deployments.
+   */
+  main?: string;
+  /**
+   * Exported symbol inside `main` for effect-native Compute apps.
+   *
+   * @default "default"
+   */
+  handler?: string;
+  /**
+   * Bundler options for effect-native Compute apps.
+   */
+  bundle?: ComputeBundleOptions;
+  /**
+   * Effect-native runtime exports populated by the Platform constructor.
+   *
+   * @internal
+   */
+  exports?: string[] | Record<string, unknown>;
+  /**
+   * Build command and output directory. Set to `"auto"` or `{ type: "auto" }`
+   * to use Prisma Compute-style framework detection for Next.js, Nuxt, Astro,
+   * TanStack Start, or Bun. Set to `false` to upload `path` as a pre-built
+   * artifact.
+   */
+  build?: ComputeBuild | false | "auto";
+  /**
+   * Path to a pre-created `tar.gz` artifact file. When supplied, Alchemy reads
+   * and uploads it directly.
+   */
+  artifactPath?: string;
+  /**
+   * HTTP port exposed by the application.
+   *
+   * @default 8080
+   */
+  port?: number;
+  /**
+   * Runtime environment variables to sync through Prisma's environment
+   * variable API before creating a new deployment. Set a value to `null`
+   * to delete that variable.
+   *
+   * Plain strings are persisted in Alchemy state. For secrets, use
+   * `Redacted.make(secret)`; encryption in the Prisma Management API does not
+   * protect a plain value already recorded in Alchemy state.
+   *
+   * The Management API exposes neither an idempotency key nor ownership
+   * metadata for environment variables, and reads return redacted values. If
+   * a process crashes after Prisma commits a create but before Alchemy saves
+   * its returned ID, the next deploy safely refuses to claim that natural-key
+   * match. Use standalone `Prisma.EnvironmentVariable` resources for critical
+   * keys that need independent lifecycle management and explicit adoption.
+   *
+   * ```typescript
+   * env: {
+   *   LOG_LEVEL: "info",
+   *   API_TOKEN: Redacted.make(process.env.API_TOKEN!),
+   * }
+   * ```
+   */
+  env?: Record<string, string | Redacted.Redacted<string> | null | undefined>;
+  /**
+   * Prisma environment variable class used by the `env` convenience property.
+   *
+   * @default "production"
+   */
+  envClass?: "production" | "preview";
+  /**
+   * Create the next deployment by reusing the previous code artifact.
+   *
+   * @default false
+   */
+  skipCodeUpload?: boolean;
+  /**
+   * Start the created/reused deployment.
+   * Set `skipPromote: true` when disabling start.
+   *
+   * @default true
+   */
+  start?: boolean;
+  /**
+   * Do not promote the deployment to the stable App endpoint.
+   *
+   * @default false
+   */
+  skipPromote?: boolean;
+  /**
+   * Delete the previously promoted deployment after the new one is promoted.
+   *
+   * @default false
+   */
+  destroyOldDeployment?: boolean;
+  /**
+   * Poll timeout while waiting for start/stop.
+   *
+   * @default 120
+   */
+  timeoutSeconds?: number;
+  /**
+   * Poll interval while waiting for start/stop.
+   *
+   * @default 1000
+   */
+  pollIntervalMs?: number;
+  /**
+   * Verify that Prisma's public preview/App URL has reached the edge after
+   * the Management API reports the deployment as running.
+   *
+   * @default true
+   */
+  verifyUrl?: boolean;
+  /**
+   * Optional application-level health check. Without this option, URL
+   * verification only waits for Prisma edge routing to stop returning its
+   * platform-level service-not-found response. With this option, Alchemy also
+   * sends a public GET to the preview URL before promotion and to the stable
+   * App URL afterward. Redirects are not followed. Each probe phase gets the
+   * full `urlReadinessTimeoutSeconds` budget.
+   *
+   * Health checks run only during cloud deployment, not `alchemy dev`, and
+   * cannot be combined with `verifyUrl: false` or `start: false`.
+   */
+  healthCheck?: ComputeHealthCheck;
+  /**
+   * Maximum time to wait for Prisma's public URL to stop returning the
+   * platform-level "Service not found" page.
+   *
+   * @default 60
+   */
+  urlReadinessTimeoutSeconds?: number;
+  /**
+   * Local development behavior for `alchemy dev`.
+   */
+  dev?: ComputeDev;
+}
+
+export interface Compute extends Resource<
+  ComputeTypeId,
+  ComputeProps,
+  {
+    /**
+     * Prisma App ID.
+     */
+    appId: string;
+    /**
+     * Prisma deployment ID created for the current deployment.
+     */
+    deploymentId: string | undefined;
+    /**
+     * Project ID that owns the app.
+     */
+    projectId: string;
+    /**
+     * App display name.
+     */
+    appName: string;
+    /**
+     * Region ID where the App is placed.
+     */
+    regionId: string;
+    /**
+     * Preview endpoint domain for the deployment.
+     */
+    deploymentEndpointDomain: string | undefined;
+    /**
+     * HTTPS URL for the deployment endpoint.
+     */
+    deploymentUrl: string | undefined;
+    /**
+     * Stable App endpoint domain after promotion.
+     */
+    appEndpointDomain: string | undefined;
+    /**
+     * Preferred URL for the app, local in dev or stable/preview in deploys.
+     */
+    url: string | undefined;
+    /**
+     * Whether the current deployment was promoted to the stable endpoint.
+     */
+    promoted: boolean;
+    /**
+     * Previously promoted deployment ID observed before deploy.
+     */
+    previousDeploymentId: string | null | undefined;
+    /**
+     * Action taken for the previous deployment.
+     */
+    previousDeploymentAction:
+      | "stopped"
+      | "destroyed"
+      | "still-active"
+      | null
+      | undefined;
+    /** Stable App endpoint readiness observed after promotion. */
+    readinessStatus?: "ready" | "pending" | "skipped";
+    /** Old deployment cleanup that will be retried before another generation. */
+    pendingDeploymentCleanup?: {
+      deploymentId: string;
+      action: "stop" | "destroy";
+    };
+    /**
+     * Environment variable keys managed by this Compute resource.
+     *
+     * This includes explicit `env` props and env vars added by bindings.
+     */
+    environmentKeys?: string[];
+    /**
+     * Environment variable IDs created by this Compute resource, keyed by
+     * variable name. IDs are the ownership boundary for shared branch/project
+     * environment-variable namespaces.
+     */
+    environmentVariableIds?: Record<string, string>;
+    /**
+     * Prisma environment class used for the managed environment variable keys.
+     */
+    environmentClass?: "production" | "preview";
+    /**
+     * Branch ID used for managed preview branch environment overrides, or null
+     * for project-level environment templates.
+     */
+    environmentBranchId?: string | null;
+    /**
+     * Fingerprint of the uploaded artifact/reused artifact inputs and the
+     * branch attachment that Prisma resolves environment variables from.
+     */
+    artifactHash: Redacted.Redacted<string> | undefined;
+    /**
+     * Whether the app output represents a local dev process.
+     */
+    local: boolean;
+  },
+  {
+    env?: Record<string, string | Redacted.Redacted<string> | null | undefined>;
+  },
+  Providers
+> {}
+
+export type ComputeRuntimeServices = Server.ProcessServices;
+
+export type ComputeShape = Main<ComputeRuntimeServices>;
+
+export interface ComputeRuntimeContext extends Server.ProcessContext {
+  readonly Type: ComputeTypeId;
+}
+
+export const isCompute = (value: unknown): value is Compute =>
+  typeof value === "object" &&
+  value !== null &&
+  "Type" in value &&
+  value.Type === ComputeTypeId;
+
+const hasEffectNativeComputeInput = (props: ComputeProps) =>
+  props.isExternal !== true &&
+  (props.main !== undefined || props.exports !== undefined);
+
+const isEffectNativeCompute = (props: ComputeProps) =>
+  hasEffectNativeComputeInput(props);
+
+/**
+ * Build and deploy an application to Prisma Compute.
+ *
+ * Prisma's create-deployment API exposes neither an idempotency key nor a
+ * caller-defined recovery key. If the API commits a deployment but its create
+ * response is lost before Alchemy persists the returned ID, that deployment
+ * can remain orphaned and a later deploy may create another one. Alchemy does
+ * not guess that the App's latest deployment is owned, because it could belong
+ * to another actor. Use a durable, locked state backend and inspect the App's
+ * deployment history after an interrupted create.
+ *
+ * @section Deploying an App
+ * @example Deploy a directory with an entrypoint
+ * ```typescript
+ * const app = yield* Prisma.Compute("api", {
+ *   project: project.projectId,
+ *   path: "./apps/api",
+ *   entrypoint: "server.ts",
+ *   port: 3000,
+ * });
+ * ```
+ *
+ * @example Deploy an Effect-native HTTP app
+ * ```typescript
+ * export default Prisma.Compute(
+ *   "api",
+ *   {
+ *     project,
+ *     appName: "api",
+ *     main: import.meta.filename,
+ *     port: 8080,
+ *   },
+ *   Effect.gen(function* () {
+ *     return {
+ *       fetch: Effect.succeed(HttpServerResponse.text("ok")),
+ *     };
+ *   }),
+ * );
+ * ```
+ *
+ * @section Runtime Bindings
+ * @example Bind a Prisma Connection
+ * ```typescript
+ * export default Prisma.Compute(
+ *   "api",
+ *   {
+ *     project,
+ *     appName: "api",
+ *     main: import.meta.filename,
+ *   },
+ *   Effect.gen(function* () {
+ *     const db = yield* Prisma.Connect(connection);
+ *     const sql = yield* SQL.Postgres({ url: db.databaseUrl });
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const users = yield* sql`SELECT * FROM users`;
+ *         return yield* HttpServerResponse.json(users);
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Prisma.ConnectBinding)),
+ * );
+ * ```
+ *
+ * @example Build before upload and replace old versions
+ * ```typescript
+ * const app = yield* Prisma.Compute("api", {
+ *   project: project.projectId,
+ *   path: "./apps/api",
+ *   build: {
+ *     command: "bun build src/server.ts --target bun --outdir dist",
+ *     outdir: "dist",
+ *     entrypoint: "server.js",
+ *   },
+ *   port: 8080,
+ *   env: {
+ *     // Use this for a standalone Connection. A project's default database
+ *     // is injected by Prisma without an explicit DATABASE_URL entry.
+ *     DATABASE_URL: connection.databaseUrl,
+ *   },
+ *   destroyOldDeployment: true,
+ * });
+ * ```
+ *
+ * @example Auto-build a framework app
+ * ```typescript
+ * const app = yield* Prisma.Compute("api", {
+ *   project: project.projectId,
+ *   path: "./apps/web",
+ *   build: "auto",
+ *   destroyOldDeployment: true,
+ * });
+ * ```
+ *
+ * @example Deploy a prebuilt tar.gz artifact
+ * ```typescript
+ * const app = yield* Prisma.Compute("api", {
+ *   project: project.projectId,
+ *   artifactPath: "./dist/app.tar.gz",
+ *   port: 8080,
+ * });
+ * ```
+ *
+ * @section Deployment Health
+ * @example Require application readiness before promotion
+ * ```typescript
+ * const app = yield* Prisma.Compute("api", {
+ *   project,
+ *   path: "./apps/api",
+ *   entrypoint: "server.ts",
+ *   healthCheck: {
+ *     path: "/api/health",
+ *     // Defaults to any 2xx response when omitted.
+ *     statusCodes: [200, 204],
+ *   },
+ * });
+ * ```
+ *
+ * @section Local Development
+ * @example Run locally during alchemy dev
+ * ```typescript
+ * const app = yield* Prisma.Compute("api", {
+ *   project: project.projectId,
+ *   path: "./apps/api",
+ *   entrypoint: "server.ts",
+ *   dev: {
+ *     command: "bun run dev",
+ *     port: 3000,
+ *   },
+ * });
+ * ```
+ *
+ * @resource
+ */
+export const Compute: Platform<
+  Compute,
+  ComputeRuntimeServices,
+  ComputeShape,
+  ComputeRuntimeContext
+> & {
+  <PropsReq = never>(
+    id: string,
+    props:
+      | InputProps<ComputeProps>
+      | Effect.Effect<InputProps<ComputeProps>, never, PropsReq>,
+  ): Effect.Effect<Compute, never, Providers | PropsReq>;
+} = Platform(ComputeTypeId, {
+  createRuntimeContext: (id): ComputeRuntimeContext => {
+    const runners: Effect.Effect<void, never, unknown>[] = [];
+    const env: Record<string, unknown> = {};
+    let runtimeContext: ComputeRuntimeContext;
+    const run: Server.ProcessContext["run"] = (effect) =>
+      Effect.sync(() => {
+        runners.push(effect);
+      });
+
+    const serve = <Req = never>(handler: HttpEffect<Req>) =>
+      Effect.sync(() => {
+        runners.push(
+          Effect.gen(function* () {
+            const httpServer = yield* Effect.serviceOption(HttpServer).pipe(
+              Effect.map(Option.getOrUndefined),
+            );
+            if (httpServer) {
+              yield* httpServer.serve(
+                handler.pipe(
+                  Effect.provideService(RuntimeContext, runtimeContext),
+                ),
+              );
+              yield* Effect.never;
+            }
+          }).pipe(Effect.catch((error: unknown) => Effect.die(error))),
+        );
+      });
+
+    runtimeContext = {
+      Type: ComputeTypeId,
+      id,
+      env,
+      set: (bindingId: string, output: Output.Output) =>
+        Effect.sync(() => {
+          const key = bindingId.replaceAll(/[^a-zA-Z0-9]/g, "_");
+          env[key] = output.pipe(
+            Output.map((value) =>
+              Redacted.isRedacted(value)
+                ? Redacted.make(
+                    JSON.stringify({
+                      _tag: "Redacted",
+                      value: Redacted.value(value),
+                    }),
+                  )
+                : JSON.stringify(value),
+            ),
+          );
+          return key;
+        }),
+      get: <T>(key: string) =>
+        // Runtime ConfigProvider lookups call back into RuntimeContext.get.
+        // Read the process env directly here to avoid re-entering that path.
+        Effect.sync(() => {
+          const value = process.env[key];
+          if (value === undefined) {
+            return undefined;
+          }
+          try {
+            const parsed = JSON.parse(value);
+            if (
+              parsed !== null &&
+              typeof parsed === "object" &&
+              (parsed as { _tag?: unknown })._tag === "Redacted" &&
+              "value" in (parsed as object)
+            ) {
+              return Redacted.make((parsed as { value: string }).value) as T;
+            }
+            return parsed as T;
+          } catch {
+            return value as T;
+          }
+        }),
+      run,
+      serve,
+      exports: Effect.sync(() => ({
+        default: Effect.all(
+          runners.map((effect) =>
+            Effect.forever(
+              effect.pipe(
+                Effect.tapError((error) => Effect.logError(error)),
+                Effect.ignore,
+              ),
+            ),
+          ),
+          { concurrency: "unbounded" },
+        ),
+      })),
+    };
+    return runtimeContext;
+  },
+});
+
+const devProcesses = new Map<string, ChildProcessHandle>();
+
+const stopTrackedDevProcess = Effect.fn(function* (processKey: string) {
+  const existing = devProcesses.get(processKey);
+  if (!existing) return;
+
+  const running = yield* existing.isRunning;
+  if (running) {
+    // Keep the handle tracked when termination fails so a later reconcile or
+    // destroy can retry instead of losing the only reference to the process.
+    yield* existing.kill();
+  }
+  devProcesses.delete(processKey);
+});
+
+const projectConsistencySchedule = Schedule.max([
+  Schedule.exponential(Duration.millis(500)),
+  Schedule.recurs(6),
+]);
+
+const isAppProvisioningNotFound = (error: unknown): boolean =>
+  error instanceof PrismaApiError &&
+  error.status === 404 &&
+  (error.path.startsWith("/v1/projects/") ||
+    error.path === "/v1/apps" ||
+    error.path.startsWith("/v1/apps/"));
+
+const desiredComputeBranchId = Effect.fn(function* (
+  client: PrismaManagementClient,
+  projectId: string,
+  props: Pick<ComputeProps, "branchId" | "branchGitName">,
+) {
+  if (props.branchId !== undefined && !isPrismaDevId(props.branchId)) {
+    return { resolved: true as const, id: props.branchId };
+  }
+  const branches = yield* client.listBranches(
+    projectId,
+    props.branchGitName === undefined
+      ? { limit: 100 }
+      : { gitName: props.branchGitName, limit: 100 },
+  );
+  const matchingBranches =
+    props.branchGitName === undefined
+      ? branches.filter((branch) => branch.isDefault)
+      : branches;
+  if (matchingBranches.length > 1) {
+    return yield* Effect.fail(
+      new Error(
+        props.branchGitName === undefined
+          ? `Prisma returned multiple default branches for project '${projectId}'; refusing an ambiguous Compute App match.`
+          : `Prisma returned multiple branches named '${props.branchGitName}' in project '${projectId}'; refusing an ambiguous Compute App match.`,
+      ),
+    );
+  }
+  const branch = matchingBranches[0];
+  return branch
+    ? { resolved: true as const, id: branch.id }
+    : { resolved: false as const };
+});
+
+const createAppName = (id: string, appName: string | undefined) =>
+  appName === undefined ? createPhysicalName({ id }) : Effect.succeed(appName);
+
+const findApp = Effect.fn(function* (
+  client: PrismaManagementClient,
+  projectId: string,
+  appName: string,
+  props: Pick<ComputeProps, "branchId" | "branchGitName">,
+) {
+  const candidates = (yield* client.listApps({
+    projectId,
+    limit: 100,
+  })).filter((app) => app.name === appName);
+  if (candidates.length === 0) return undefined;
+  const branch = yield* desiredComputeBranchId(client, projectId, props);
+  if (!branch.resolved) return undefined;
+  const matches = candidates.filter((app) => app.branchId === branch.id);
+  if (matches.length > 1) {
+    return yield* Effect.fail(
+      new Error(
+        `Prisma returned multiple Apps named '${appName}' on branch '${branch.id}' in project '${projectId}'; refusing an ambiguous ownership match.`,
+      ),
+    );
+  }
+  return matches[0];
+});
+
+const createApp = (
+  client: PrismaManagementClient,
+  projectId: string,
+  props: ComputeProps & { appName: string },
+  branchId: string,
+) =>
+  client.createApp({
+    projectId,
+    displayName: props.appName,
+    regionId: props.regionId,
+    branchId,
+    branchGitName: undefined,
+  });
+
+const plainEnv = (
+  env: Record<
+    string,
+    string | Redacted.Redacted<string> | null | undefined
+  > = {},
+) =>
+  Object.fromEntries(
+    Object.entries(env).flatMap(([key, value]) =>
+      value === undefined
+        ? []
+        : [[key, Redacted.isRedacted(value) ? Redacted.value(value) : value]],
+    ),
+  ) as Record<string, string | null>;
+
+const persistedArtifactHashValue = (
+  value: Redacted.Redacted<string> | string | undefined,
+) => (Redacted.isRedacted(value) ? Redacted.value(value) : value);
+
+const managedEnvKeys = (
+  env: Record<
+    string,
+    string | Redacted.Redacted<string> | null | undefined
+  > = {},
+) =>
+  Object.entries(plainEnv(env))
+    .flatMap(([key, value]) => (value === null ? [] : [key]))
+    .sort();
+
+const ENV_KEY_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+const ENV_VALUE_MAX_BYTES = 8 * 1024;
+const EXPORT_IDENTIFIER_PATTERN = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+
+const computeEnvValue = (value: string | Redacted.Redacted<string>) =>
+  Redacted.isRedacted(value) ? Redacted.value(value) : value;
+
+const validateComputeEnvironmentKey = (key: string) =>
+  Effect.gen(function* () {
+    if (key.length < 1 || key.length > 256 || !ENV_KEY_PATTERN.test(key)) {
+      return yield* Effect.fail(
+        new Error(
+          `Prisma environment variable key '${key}' must match POSIX env-var key shape: [A-Z_][A-Z0-9_]* and be at most 256 characters.`,
+        ),
+      );
+    }
+  });
+
+const validateComputeEnvironmentWrite = (
+  key: string,
+  value: string | Redacted.Redacted<string>,
+) =>
+  Effect.gen(function* () {
+    yield* validateComputeEnvironmentKey(key);
+    const raw = computeEnvValue(value);
+    if (raw.length === 0) {
+      return yield* Effect.fail(
+        new Error(
+          `Prisma environment variable '${key}' value must be non-empty.`,
+        ),
+      );
+    }
+    const byteLength = yield* Effect.sync(
+      () => new TextEncoder().encode(raw).byteLength,
+    );
+    if (byteLength > ENV_VALUE_MAX_BYTES) {
+      return yield* Effect.fail(
+        new Error(
+          `Prisma environment variable '${key}' value exceeds ${ENV_VALUE_MAX_BYTES} bytes.`,
+        ),
+      );
+    }
+  });
+
+const validateComputeHealthCheck = (
+  healthCheck: ComputeHealthCheck | undefined,
+) =>
+  Effect.gen(function* () {
+    if (healthCheck === undefined) return;
+    if (
+      !healthCheck.path.startsWith("/") ||
+      healthCheck.path.startsWith("//") ||
+      healthCheck.path.includes("\\") ||
+      /\s/.test(healthCheck.path)
+    ) {
+      return yield* Effect.fail(
+        new Error(
+          "healthCheck.path must be an absolute application path beginning with one '/'.",
+        ),
+      );
+    }
+    if (
+      healthCheck.statusCodes !== undefined &&
+      healthCheck.statusCodes.length === 0
+    ) {
+      return yield* Effect.fail(
+        new Error("healthCheck.statusCodes must contain at least one status."),
+      );
+    }
+    for (const status of healthCheck.statusCodes ?? []) {
+      if (!Number.isInteger(status) || status < 100 || status > 599) {
+        return yield* Effect.fail(
+          new Error(
+            "healthCheck.statusCodes must contain HTTP status integers from 100 through 599.",
+          ),
+        );
+      }
+    }
+  });
+
+const validateComputeProps = (props: ComputeProps) =>
+  Effect.gen(function* () {
+    yield* validateComputeHealthCheck(props.healthCheck);
+    if (props.healthCheck !== undefined && props.verifyUrl === false) {
+      return yield* Effect.fail(
+        new Error("healthCheck cannot be combined with verifyUrl: false."),
+      );
+    }
+    if (props.healthCheck !== undefined && props.start === false) {
+      return yield* Effect.fail(
+        new Error("healthCheck requires start to be enabled."),
+      );
+    }
+    for (const [name, value] of [
+      ["timeoutSeconds", props.timeoutSeconds],
+      ["pollIntervalMs", props.pollIntervalMs],
+      ["urlReadinessTimeoutSeconds", props.urlReadinessTimeoutSeconds],
+    ] as const) {
+      if (value !== undefined && (!Number.isFinite(value) || value <= 0)) {
+        return yield* Effect.fail(
+          new Error(`${name} must be a positive finite number.`),
+        );
+      }
+    }
+    for (const [name, value] of [
+      ["port", props.port],
+      ["dev.port", props.dev?.port],
+    ] as const) {
+      if (
+        value !== undefined &&
+        (!Number.isInteger(value) || value < 1 || value > 65_535)
+      ) {
+        return yield* Effect.fail(
+          new Error(`${name} must be an integer between 1 and 65535.`),
+        );
+      }
+    }
+    for (const [key, value] of Object.entries(props.env ?? {})) {
+      if (value === undefined) continue;
+      if (value === null) {
+        yield* validateComputeEnvironmentKey(key);
+      } else {
+        yield* validateComputeEnvironmentWrite(key, value);
+      }
+    }
+    if ((props.skipPromote ?? false) && (props.destroyOldDeployment ?? false)) {
+      return yield* Effect.fail(
+        new Error(
+          "destroyOldDeployment cannot be combined with skipPromote because the previous deployment stays active when promotion is skipped.",
+        ),
+      );
+    }
+    if (props.start === false && !(props.skipPromote ?? false)) {
+      return yield* Effect.fail(
+        new Error(
+          "start: false requires skipPromote: true because Prisma Compute promotion requires a running deployment.",
+        ),
+      );
+    }
+    if (props.branchId !== undefined && props.branchGitName !== undefined) {
+      return yield* Effect.fail(
+        new Error("branchId and branchGitName are mutually exclusive."),
+      );
+    }
+    if (props.branchId === null || props.branchGitName === null) {
+      return yield* Effect.fail(
+        new Error(
+          "Prisma.Compute requires an attached branch because deployment creation resolves environment variables from the App branch. Omit branchGitName to use the project's default branch, or set branchId/branchGitName.",
+        ),
+      );
+    }
+    if ((props.skipCodeUpload ?? false) && props.artifactPath !== undefined) {
+      return yield* Effect.fail(
+        new Error("skipCodeUpload cannot be combined with artifactPath."),
+      );
+    }
+    if ((props.skipCodeUpload ?? false) && props.build !== undefined) {
+      return yield* Effect.fail(
+        new Error("skipCodeUpload cannot be combined with build."),
+      );
+    }
+    if (hasEffectNativeComputeInput(props)) {
+      const handler = props.handler ?? "default";
+      if (handler !== "default" && !EXPORT_IDENTIFIER_PATTERN.test(handler)) {
+        return yield* Effect.fail(
+          new Error(
+            "Effect-native Prisma Compute handler must be `default` or a valid JavaScript export identifier.",
+          ),
+        );
+      }
+      if (props.main === undefined) {
+        return yield* Effect.fail(
+          new Error(
+            "Effect-native Prisma Compute apps require `main`. Set `main: import.meta.filename`.",
+          ),
+        );
+      }
+      if (props.artifactPath !== undefined) {
+        return yield* Effect.fail(
+          new Error(
+            "Effect-native Prisma Compute apps cannot use artifactPath.",
+          ),
+        );
+      }
+      if (props.build !== undefined) {
+        return yield* Effect.fail(
+          new Error("Effect-native Prisma Compute apps cannot use build."),
+        );
+      }
+      if (props.skipCodeUpload) {
+        return yield* Effect.fail(
+          new Error(
+            "Effect-native Prisma Compute apps cannot skip code upload.",
+          ),
+        );
+      }
+    }
+  });
+
+const processEnv = (
+  env: Record<
+    string,
+    string | Redacted.Redacted<string> | null | undefined
+  > = {},
+) =>
+  Object.fromEntries(
+    Object.entries(env).flatMap(([key, value]) =>
+      value === undefined || value === null
+        ? []
+        : [[key, Redacted.isRedacted(value) ? Redacted.value(value) : value]],
+    ),
+  ) as Record<string, string>;
+
+const isPrismaEdgeServiceNotFound = (status: number, body: string) =>
+  status === 404 &&
+  (body.includes("There is no service on this URL") ||
+    body.includes("<title>Service not found</title>"));
+
+const URL_READINESS_BODY_PREFIX_BYTES = 64 * 1024;
+
+const readResponseBodyPrefix = (response: HttpClientResponse) =>
+  Effect.gen(function* () {
+    const chunks: Uint8Array[] = [];
+    let bytes = 0;
+    yield* Stream.runForEachWhile(response.stream, (chunk) =>
+      Effect.sync(() => {
+        const remaining = URL_READINESS_BODY_PREFIX_BYTES - bytes;
+        if (remaining <= 0) return false;
+        const kept =
+          chunk.byteLength > remaining ? chunk.slice(0, remaining) : chunk;
+        chunks.push(kept);
+        bytes += kept.byteLength;
+        return bytes < URL_READINESS_BODY_PREFIX_BYTES;
+      }),
+    );
+    const prefix = new Uint8Array(bytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+      prefix.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(prefix);
+  });
+
+export const waitForDeploymentUrl = Effect.fn(function* (
+  url: string | undefined,
+  props: ComputeProps,
+) {
+  yield* validateComputeHealthCheck(props.healthCheck);
+  if (props.healthCheck !== undefined && props.verifyUrl === false) {
+    return yield* Effect.fail(
+      new Error("healthCheck cannot be combined with verifyUrl: false."),
+    );
+  }
+  if (props.verifyUrl === false) return;
+  if (!url) {
+    return yield* Effect.fail(
+      new Error(
+        props.healthCheck === undefined
+          ? "Prisma Compute did not return a public URL for readiness verification."
+          : "Prisma Compute did not return a public URL for the configured healthCheck.",
+      ),
+    );
+  }
+  const httpOption = yield* Effect.serviceOption(HttpClient.HttpClient);
+  if (Option.isNone(httpOption)) {
+    return props.healthCheck === undefined
+      ? undefined
+      : yield* Effect.fail(
+          new Error(
+            "Prisma Compute healthCheck requires an HTTP client service.",
+          ),
+        );
+  }
+
+  const http = httpOption.value;
+  const probeUrl =
+    props.healthCheck === undefined
+      ? url
+      : new URL(props.healthCheck.path, url).toString();
+  const acceptsStatus = (status: number) =>
+    props.healthCheck === undefined ||
+    (props.healthCheck.statusCodes === undefined
+      ? status >= 200 && status <= 299
+      : props.healthCheck.statusCodes.includes(status));
+  const timeoutSeconds = props.urlReadinessTimeoutSeconds ?? 60;
+  const intervalMs = props.pollIntervalMs ?? 1_000;
+  if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) {
+    return yield* Effect.fail(
+      new Error("urlReadinessTimeoutSeconds must be a positive finite number."),
+    );
+  }
+  if (!Number.isFinite(intervalMs) || intervalMs <= 0) {
+    return yield* Effect.fail(
+      new Error("pollIntervalMs must be a positive finite number."),
+    );
+  }
+  const timeoutMs = timeoutSeconds * 1_000;
+  const startedAt = yield* Effect.sync(() => Date.now());
+  let lastStatus: number | undefined;
+  let lastBody = "";
+
+  while (true) {
+    const beforeRequest = yield* Effect.sync(() => Date.now());
+    const remainingBeforeRequest = timeoutMs - (beforeRequest - startedAt);
+    if (remainingBeforeRequest <= 0) {
+      return yield* Effect.fail(
+        deploymentUrlTimeoutError(probeUrl, lastStatus, lastBody),
+      );
+    }
+    const requestTimeoutMs = Math.min(5_000, remainingBeforeRequest);
+    const response = yield* http.execute(HttpClientRequest.get(probeUrl)).pipe(
+      Effect.provideService(FetchHttpClient.RequestInit, {
+        redirect: "manual",
+      }),
+      Effect.timeoutOption(Duration.millis(requestTimeoutMs)),
+      Effect.map(Option.getOrUndefined),
+      Effect.catch(() => Effect.succeed(undefined)),
+    );
+    if (response) {
+      lastStatus = response.status;
+      // Without an application health check, any non-404 response proves that
+      // edge routing is live. A configured health check must also match its
+      // status contract. Do not consume non-404 bodies: application responses
+      // may intentionally stream.
+      if (response.status !== 404 && acceptsStatus(response.status)) {
+        return;
+      }
+      const beforeBody = yield* Effect.sync(() => Date.now());
+      const remainingBeforeBody = timeoutMs - (beforeBody - startedAt);
+      if (remainingBeforeBody > 0) {
+        const bodyPrefix = yield* readResponseBodyPrefix(response).pipe(
+          Effect.timeoutOption(
+            Duration.millis(Math.min(2_000, remainingBeforeBody)),
+          ),
+          Effect.catch(() => Effect.succeed(Option.none<string>())),
+        );
+        if (Option.isSome(bodyPrefix)) {
+          lastBody = bodyPrefix.value;
+          if (
+            !isPrismaEdgeServiceNotFound(response.status, lastBody) &&
+            acceptsStatus(response.status)
+          ) {
+            return;
+          }
+        }
+      }
+    }
+
+    const elapsed = yield* Effect.sync(() => Date.now() - startedAt);
+    if (elapsed >= timeoutMs) {
+      return yield* Effect.fail(
+        deploymentUrlTimeoutError(probeUrl, lastStatus, lastBody),
+      );
+    }
+
+    yield* Effect.sleep(
+      Duration.millis(Math.min(intervalMs, timeoutMs - elapsed)),
+    );
+  }
+});
+
+const deploymentUrlTimeoutError = (
+  url: string,
+  lastStatus: number | undefined,
+  lastBody: string,
+) =>
+  new Error(
+    [
+      `Timed out waiting for Prisma Compute URL '${url}' to become reachable.`,
+      lastStatus
+        ? `Last response: HTTP ${lastStatus}.`
+        : "No HTTP response was received.",
+      lastBody.includes("There is no service on this URL")
+        ? "The Prisma edge returned: There is no service on this URL."
+        : undefined,
+    ]
+      .filter((line): line is string => line !== undefined)
+      .join(" "),
+  );
+
+const isAutoBuild = (
+  build: ComputeProps["build"],
+): build is "auto" | ComputeAutoBuild =>
+  build === "auto" ||
+  (typeof build === "object" &&
+    build !== null &&
+    "type" in build &&
+    build.type === "auto");
+
+const readPackageMain = Effect.fn(function* (directory: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const text = yield* fs
+    .readFileString(path.join(directory, "package.json"))
+    .pipe(
+      Effect.catchIf(
+        (error) =>
+          error._tag === "PlatformError" && error.reason._tag === "NotFound",
+        () => Effect.succeed(undefined),
+      ),
+    );
+  if (!text) return undefined;
+  return yield* Effect.try({
+    try: () => {
+      const parsed = JSON.parse(text) as { main?: unknown };
+      return typeof parsed.main === "string" ? parsed.main : undefined;
+    },
+    catch: (cause) =>
+      new Error(`Failed to parse package.json in ${directory}: ${cause}`),
+  });
+});
+
+const writeBundleDirectory = Effect.fn(function* (bundle: Bundle.BundleOutput) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  if (bundle.files.length === 0) {
+    return yield* Effect.fail(
+      new Error("Effect-native Compute bundler produced no output files."),
+    );
+  }
+  const normalizedFiles = yield* Effect.forEach(bundle.files, (file) =>
+    normalizeBundleFilePath(file.path).pipe(
+      Effect.map((normalizedPath) => ({ file, normalizedPath })),
+    ),
+  );
+  const seen = new Set<string>();
+  for (const { normalizedPath } of normalizedFiles) {
+    if (seen.has(normalizedPath)) {
+      return yield* Effect.fail(
+        new Error(
+          `Effect-native Compute bundler produced duplicate output path '${normalizedPath}'.`,
+        ),
+      );
+    }
+    seen.add(normalizedPath);
+  }
+  const directory = yield* fs.makeTempDirectory({
+    prefix: "alchemy-prisma-compute-",
+  });
+
+  return yield* Effect.gen(function* () {
+    for (const { file, normalizedPath } of normalizedFiles) {
+      const target = path.join(directory, normalizedPath);
+      yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+      if (typeof file.content === "string") {
+        yield* fs.writeFileString(target, file.content);
+      } else {
+        yield* fs.writeFile(target, file.content);
+      }
+    }
+
+    return {
+      directory,
+      entrypoint: normalizedFiles[0].normalizedPath,
+      cleanup: fs
+        .remove(directory, { recursive: true })
+        .pipe(Effect.catch(() => Effect.void)),
+    };
+  }).pipe(
+    Effect.onError(() =>
+      fs.remove(directory, { recursive: true }).pipe(Effect.ignore),
+    ),
+  );
+});
+
+const bundleEffectCompute = Effect.fn(function* (props: ComputeProps) {
+  if (!props.main) {
+    return yield* Effect.fail(
+      new Error(
+        "Effect-native Prisma Compute apps require `main`. Set `main: import.meta.filename`.",
+      ),
+    );
+  }
+
+  const fs = yield* FileSystem.FileSystem;
+  const stack = yield* Effect.serviceOption(Stack).pipe(
+    Effect.map(
+      Option.getOrElse(() => ({
+        name: "alchemy",
+        stage: "dev",
+        bindings: {},
+        resources: {},
+      })),
+    ),
+  );
+  const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+  const realMain = yield* fs.realPath(props.main);
+  const cwd = yield* findCwdForBundle(realMain);
+  const handler = props.handler ?? "default";
+  const defaultPort = props.port ?? 8080;
+
+  const importEntrypoint =
+    handler === "default"
+      ? "import entrypoint"
+      : `import { ${handler} as entrypoint }`;
+
+  const bundle = yield* Bundle.build(
+    {
+      ...props.bundle?.input,
+      input: realMain,
+      cwd,
+      platform: "node",
+      plugins: [
+        props.bundle?.input?.plugins,
+        virtualEntryPlugin(
+          (importPath) => `
+import { BunServices } from "@effect/platform-bun";
+import { BunHttpServer } from "alchemy/Http";
+import { Stack } from "alchemy/Stack";
+import { Stage } from "alchemy/Stage";
+import { makeEntrypointLayer } from "alchemy/Runtime";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import { MinimumLogLevel } from "effect/References";
+
+${importEntrypoint} from ${JSON.stringify(importPath)};
+
+process.env.PORT ??= ${JSON.stringify(String(defaultPort))};
+
+const tag = Context.Service("${Self.key}");
+const layer = makeEntrypointLayer(tag, entrypoint);
+
+const platform = Layer.mergeAll(
+  BunServices.layer,
+  FetchHttpClient.layer,
+  Logger.layer([Logger.consolePretty()]),
+);
+
+const stack = Layer.mergeAll(
+  Layer.succeed(Stack, {
+    name: ${JSON.stringify(stack.name)},
+    stage: ${JSON.stringify(stack.stage)},
+    bindings: {},
+    resources: {},
+  }),
+  Layer.succeed(Stage, ${JSON.stringify(stack.stage)}),
+);
+
+const program = tag.pipe(
+  Effect.flatMap((app) => app.RuntimeContext.exports),
+  Effect.flatMap((exports) => exports.default),
+  Effect.provide(
+    layer.pipe(
+      Layer.provideMerge(stack),
+      Layer.provideMerge(BunHttpServer({ hostname: "0.0.0.0" })),
+      Layer.provideMerge(platform),
+      Layer.provideMerge(
+        Layer.succeed(
+          ConfigProvider.ConfigProvider,
+          ConfigProvider.orElse(
+            ConfigProvider.fromUnknown({ ALCHEMY_PHASE: "runtime" }),
+            ConfigProvider.fromEnv(),
+          ),
+        ),
+      ),
+      Layer.provideMerge(
+        Layer.succeed(
+          MinimumLogLevel,
+          process.env.DEBUG ? "Debug" : "Info",
+        ),
+      ),
+    ),
+  ),
+  Effect.scoped,
+);
+
+console.log("Prisma Compute bootstrap starting...");
+await Effect.runPromise(program).catch((error) => {
+  console.error("Prisma Compute bootstrap failed:", error);
+  process.exit(1);
+});
+`,
+        ),
+      ],
+      checks: {
+        unresolvedImport: false,
+        ineffectiveDynamicImport: false,
+      },
+    },
+    {
+      ...props.bundle?.output,
+      format: "esm",
+      sourcemap: props.bundle?.output?.sourcemap ?? "hidden",
+      minify: props.bundle?.output?.minify ?? true,
+      entryFileNames: "index.js",
+    },
+    props.bundle?.extra,
+  );
+
+  const artifact = yield* writeBundleDirectory(bundle);
+  const file = yield* createComputeArchive({
+    directory: artifact.directory,
+    entrypoint: artifact.entrypoint,
+    ignore: props.archiveIgnore,
+    output: "file",
+  }).pipe(Effect.ensuring(artifact.cleanup));
+
+  return {
+    file,
+    bundleHash: bundle.hash,
+  };
+});
+
+const resolveArtifact = Effect.fn(function* (props: ComputeProps) {
+  const env = plainEnv(props.env);
+  const envClass = props.envClass ?? "production";
+  const defaultPort = props.port ?? 8080;
+  if (isEffectNativeCompute(props)) {
+    if (props.artifactPath !== undefined) {
+      return yield* Effect.fail(
+        new Error("Effect-native Prisma Compute apps cannot use artifactPath."),
+      );
+    }
+    if (props.skipCodeUpload) {
+      return yield* Effect.fail(
+        new Error("Effect-native Prisma Compute apps cannot skip code upload."),
+      );
+    }
+    if (props.build !== undefined) {
+      return yield* Effect.fail(
+        new Error("Effect-native Prisma Compute apps cannot use build."),
+      );
+    }
+    const artifact = yield* bundleEffectCompute(props);
+    return {
+      file: artifact.file,
+      hash: yield* sha256Object({
+        bundle: artifact.bundleHash,
+        env,
+        envClass,
+        port: defaultPort,
+      }),
+      port: defaultPort,
+    };
+  }
+
+  if (props.skipCodeUpload) {
+    return {
+      file: undefined,
+      hash: yield* sha256Object({
+        skipCodeUpload: true,
+        env,
+        envClass,
+        port: defaultPort,
+      }),
+      port: defaultPort,
+    };
+  }
+
+  if (props.artifactPath !== undefined) {
+    const file = yield* readUploadArtifact({
+      artifactPath: props.artifactPath,
+      output: "file",
+    });
+    return {
+      file: file!,
+      hash: yield* sha256Object({
+        artifact: file!.sha256,
+        env,
+        envClass,
+        port: defaultPort,
+      }),
+      port: defaultPort,
+    };
+  }
+
+  const path = yield* Path.Path;
+  const appPath = path.resolve(props.path ?? ".");
+  let directory = appPath;
+  let entrypoint = props.entrypoint;
+  let port = defaultPort;
+
+  if (isAutoBuild(props.build)) {
+    const auto = props.build === "auto" ? undefined : props.build;
+    const artifact = yield* runComputeAutoBuild({
+      appPath,
+      entrypoint,
+      framework: auto?.framework,
+      env: auto?.env,
+      outputLimitBytes: auto?.outputLimitBytes,
+      timeoutSeconds: auto?.timeoutSeconds,
+    });
+    const file = yield* createComputeArchive({
+      directory: artifact.directory,
+      entrypoint: artifact.entrypoint,
+      ignore: props.archiveIgnore,
+      output: "file",
+    }).pipe(Effect.ensuring(artifact.cleanup));
+    port = props.port ?? artifact.defaultPort ?? 8080;
+    return {
+      file,
+      hash: yield* sha256Object({
+        artifact: file.sha256,
+        env,
+        envClass,
+        port,
+      }),
+      port,
+    };
+  }
+
+  if (props.build) {
+    const cwd = props.build.cwd ? path.resolve(props.build.cwd) : appPath;
+    yield* runBuildCommand({
+      command: props.build.command,
+      cwd,
+      env: processEnv(props.build.env),
+      outputLimitBytes: props.build.outputLimitBytes,
+      timeoutSeconds: props.build.timeoutSeconds,
+    });
+    directory = path.resolve(cwd, props.build.outdir);
+    entrypoint = props.build.entrypoint ?? entrypoint;
+  }
+
+  entrypoint ??= yield* readPackageMain(directory);
+  if (!entrypoint) {
+    return yield* Effect.fail(
+      new Error(
+        "Prisma Compute app entrypoint is required. Set `entrypoint` or package.json `main`.",
+      ),
+    );
+  }
+
+  const normalizedEntrypoint = yield* normalizeEntrypoint(entrypoint);
+  const file = yield* createComputeArchive({
+    directory,
+    entrypoint: normalizedEntrypoint,
+    ignore: props.archiveIgnore,
+    output: "file",
+  });
+  return {
+    file,
+    hash: yield* sha256Object({
+      artifact: file.sha256,
+      env,
+      envClass,
+      port,
+    }),
+    port,
+  };
+});
+
+const findExistingApp = Effect.fn(function* (
+  client: PrismaManagementClient,
+  output: Compute["Attributes"] | undefined,
+) {
+  const appId =
+    output?.appId && !isPrismaDevId(output.appId) ? output.appId : undefined;
+  return appId
+    ? yield* client
+        .getApp(appId)
+        .pipe(Effect.catchIf(isNotFound, () => Effect.succeed(undefined)))
+    : undefined;
+});
+
+const ensureApp = Effect.fn(function* (
+  client: PrismaManagementClient,
+  projectId: string,
+  props: ComputeProps & { appName: string },
+  output: Compute["Attributes"] | undefined,
+  observedApp?: ApiApp,
+) {
+  let app = observedApp ?? (yield* findExistingApp(client, output));
+  const branch = yield* desiredComputeBranchId(client, projectId, props);
+  if (!branch.resolved) {
+    return yield* Effect.fail(
+      new Error(
+        props.branchGitName === undefined
+          ? `Prisma project '${projectId}' has no default branch to attach Compute App '${props.appName}'. Create or promote a default branch, or specify branchId/branchGitName.`
+          : `Prisma project '${projectId}' has no branch named '${props.branchGitName}' to attach Compute App '${props.appName}'.`,
+      ),
+    );
+  }
+
+  let createdApp = false;
+  if (!app) {
+    const result = yield* createApp(client, projectId, props, branch.id).pipe(
+      Effect.map((app) => ({ app, created: true })),
+      Effect.catchIf(isConflict, (conflict) =>
+        findApp(client, projectId, props.appName, props).pipe(
+          Effect.flatMap((app) =>
+            app && output?.appId !== undefined && app.id === output.appId
+              ? Effect.succeed({ app, created: false })
+              : Effect.fail(
+                  new Error(
+                    `Prisma App '${props.appName}' already exists on the requested branch but is not owned by this Compute resource. Import it with explicit adoption or choose a different App name.`,
+                    { cause: conflict },
+                  ),
+                ),
+          ),
+        ),
+      ),
+    );
+    app = result.app;
+    createdApp = result.created;
+  }
+
+  yield* ensureAppImmutableIdentity(
+    app,
+    projectId,
+    props.regionId ?? output?.regionId ?? app.region.id,
+  );
+  if (app.name !== props.appName || app.branchId !== branch.id) {
+    app = yield* client.updateApp(app.id, {
+      displayName: props.appName,
+      branchId: branch.id,
+      branchGitName: undefined,
+    });
+  }
+
+  return { app, created: createdApp };
+});
+
+const ensureSkipCodeUploadCanFork = (
+  props: ComputeProps,
+  app: ApiApp | undefined,
+) =>
+  Effect.gen(function* () {
+    if (!(props.skipCodeUpload ?? false)) return;
+    if (app?.latestDeploymentId) return;
+    return yield* Effect.fail(
+      new Error(
+        "skipCodeUpload requires an existing Prisma deployment to fork from. Upload and start a deployment first, or remove skipCodeUpload.",
+      ),
+    );
+  });
+
+const findEnvironmentVariable = (
+  client: PrismaManagementClient,
+  projectId: string,
+  cls: "production" | "preview",
+  key: string,
+  branchId?: string | null,
+) =>
+  client
+    .listEnvironmentVariables({
+      projectId,
+      class: cls,
+      key,
+      ...(branchId ? { branchId } : {}),
+      limit: 100,
+    })
+    .pipe(
+      Effect.map((variables: ApiEnvironmentVariable[]) =>
+        variables.find((variable) => variable.branchId === (branchId ?? null)),
+      ),
+    );
+
+const systemManagedEnvironmentVariableError = (key: string) =>
+  new Error(
+    `Prisma environment variable '${key}' is managed by Prisma and cannot be managed by Alchemy.`,
+  );
+
+const ensureUserManagedEnvironmentVariable = (
+  variable: ApiEnvironmentVariable,
+) =>
+  Effect.gen(function* () {
+    if (variable.isManagedBySystem) {
+      return yield* Effect.fail(
+        systemManagedEnvironmentVariableError(variable.key),
+      );
+    }
+  });
+
+const environmentVariableOwnershipError = (key: string, variableId: string) =>
+  new Error(
+    `Prisma environment variable '${key}' (${variableId}) already exists in this branch/class scope but is not owned by this Compute resource. It may be foreign or left by an interrupted prior Compute deploy; the Management API exposes no ownership marker or plaintext value that would make takeover safe. Use one standalone Prisma.EnvironmentVariable resource as the independently manageable owner, choose a different key, explicitly adopt that resource, or remove the existing variable before deploying.`,
+  );
+
+interface ComputeEnvironmentScope {
+  class: "production" | "preview";
+  branchId: string | null;
+}
+
+const environmentScope = (
+  cls: "production" | "preview",
+  branchId?: string | null,
+): ComputeEnvironmentScope => ({
+  class: cls,
+  branchId: branchId ?? null,
+});
+
+const sameEnvironmentScope = (
+  left: ComputeEnvironmentScope,
+  right: ComputeEnvironmentScope,
+) => left.class === right.class && left.branchId === right.branchId;
+
+const resolveComputeEnvironmentScope = Effect.fn(function* (
+  client: PrismaManagementClient,
+  app: ApiApp,
+  props: ComputeProps,
+) {
+  if (!app.branchId) {
+    return yield* Effect.fail(
+      new Error(
+        "Prisma.Compute requires an attached branch because deployment creation resolves environment variables from the App branch.",
+      ),
+    );
+  }
+
+  const branch = yield* client.getBranch(app.branchId);
+  const inferredClass = branch.role;
+  if (props.envClass !== undefined && props.envClass !== inferredClass) {
+    return yield* Effect.fail(
+      new Error(
+        `Prisma.Compute envClass '${props.envClass}' does not match attached branch role '${inferredClass}'. Omit envClass to let Alchemy infer the correct environment variable scope.`,
+      ),
+    );
+  }
+
+  return environmentScope(
+    inferredClass,
+    inferredClass === "preview" ? app.branchId : null,
+  );
+});
+
+interface ComputeEnvironmentPlan {
+  key: string;
+  value: string | null;
+  variable: ApiEnvironmentVariable | undefined;
+}
+
+const rollbackCreatedEnvironmentVariables = Effect.fn(function* (
+  client: PrismaManagementClient,
+  createdIds: ReadonlyArray<{ key: string; id: string }>,
+  originalError: unknown,
+) {
+  if (createdIds.length === 0) {
+    return yield* Effect.fail(originalError);
+  }
+  const cleanupErrors: unknown[] = [];
+  for (const created of [...createdIds].reverse()) {
+    const result = yield* Effect.result(
+      client
+        .deleteEnvironmentVariable(created.id)
+        .pipe(Effect.catchIf(isNotFound, () => Effect.void)),
+    );
+    if (Result.isFailure(result)) {
+      cleanupErrors.push(result.failure);
+    }
+  }
+  if (cleanupErrors.length > 0) {
+    return yield* Effect.fail(
+      new AggregateError(
+        [originalError, ...cleanupErrors],
+        `Failed to roll back newly created Prisma environment variables after reconcile failed. Manual cleanup: ${createdIds.map(({ id }) => `DELETE /v1/environment-variables/${id}`).join(", ")}.`,
+      ),
+    );
+  }
+  return yield* Effect.fail(originalError);
+});
+
+const syncComputeEnvironmentInternal = Effect.fn(function* (
+  client: PrismaManagementClient,
+  projectId: string,
+  cls: "production" | "preview",
+  env: Record<
+    string,
+    string | Redacted.Redacted<string> | null | undefined
+  > = {},
+  branchId?: string | null,
+  ownedIds: Readonly<Record<string, string>> = {},
+) {
+  const synced: string[] = [];
+  const deleted: string[] = [];
+  const nextOwnedIds: Record<string, string> = {};
+  const createdIds: Array<{ key: string; id: string }> = [];
+  const plans: ComputeEnvironmentPlan[] = [];
+
+  // Observe and validate the entire scope before the first write. In
+  // particular, a foreign/system-owned key discovered late in the input must
+  // not leave earlier keys partially created.
+  for (const [key, value] of Object.entries(plainEnv(env))) {
+    if (value === null) {
+      yield* validateComputeEnvironmentKey(key);
+    } else {
+      yield* validateComputeEnvironmentWrite(key, value);
+    }
+    const variable = yield* findEnvironmentVariable(
+      client,
+      projectId,
+      cls,
+      key,
+      branchId,
+    );
+    if (variable) {
+      yield* ensureUserManagedEnvironmentVariable(variable);
+      if (ownedIds[key] !== variable.id) {
+        return yield* Effect.fail(
+          environmentVariableOwnershipError(key, variable.id),
+        );
+      }
+    }
+    plans.push({ key, value, variable });
+  }
+
+  const apply = Effect.gen(function* () {
+    for (const { key, value, variable } of plans) {
+      if (value === null) continue;
+      if (variable) {
+        yield* client.updateEnvironmentVariable(variable.id, { value });
+        nextOwnedIds[key] = variable.id;
+      } else {
+        const created = yield* client.createEnvironmentVariable({
+          projectId,
+          ...(branchId ? { branchId } : {}),
+          class: cls,
+          key,
+          value,
+        });
+        createdIds.push({ key, id: created.id });
+        nextOwnedIds[key] = created.id;
+      }
+      synced.push(key);
+    }
+    // Apply explicit deletions only after all ownership checks and upserts.
+    for (const { key, value, variable } of plans) {
+      if (value !== null || !variable) continue;
+      yield* client
+        .deleteEnvironmentVariable(variable.id)
+        .pipe(Effect.catchIf(isNotFound, () => Effect.void));
+      deleted.push(key);
+    }
+    return { synced, deleted, ownedIds: nextOwnedIds, createdIds };
+  });
+
+  return yield* apply.pipe(
+    Effect.catch((error) =>
+      rollbackCreatedEnvironmentVariables(client, createdIds, error),
+    ),
+  );
+});
+
+export const syncComputeEnvironment = Effect.fn(function* (
+  client: PrismaManagementClient,
+  projectId: string,
+  cls: "production" | "preview",
+  env: Record<
+    string,
+    string | Redacted.Redacted<string> | null | undefined
+  > = {},
+  branchId?: string | null,
+  ownedIds: Readonly<Record<string, string>> = {},
+) {
+  const result = yield* syncComputeEnvironmentInternal(
+    client,
+    projectId,
+    cls,
+    env,
+    branchId,
+    ownedIds,
+  );
+  return {
+    synced: result.synced,
+    deleted: result.deleted,
+    ownedIds: result.ownedIds,
+  };
+});
+
+const destroyComputeEnvironment = Effect.fn(function* (
+  client: PrismaManagementClient,
+  projectId: string,
+  scope: ComputeEnvironmentScope,
+  ownedIds: Readonly<Record<string, string>> = {},
+) {
+  const deleted: string[] = [];
+  for (const [key, ownedId] of Object.entries(ownedIds)) {
+    const variable = yield* findEnvironmentVariable(
+      client,
+      projectId,
+      scope.class,
+      key,
+      scope.branchId,
+    ).pipe(Effect.catchIf(isNotFound, () => Effect.succeed(undefined)));
+    if (!variable) continue;
+    if (variable.id !== ownedId || variable.isManagedBySystem) continue;
+    yield* client
+      .deleteEnvironmentVariable(variable.id)
+      .pipe(Effect.catchIf(isNotFound, () => Effect.void));
+    deleted.push(key);
+  }
+  return { deleted };
+});
+
+const cleanupRemovedComputeEnvironment = Effect.fn(function* (
+  client: PrismaManagementClient,
+  projectId: string,
+  oldScope: ComputeEnvironmentScope,
+  oldOwnedIds: Readonly<Record<string, string>>,
+  newScope: ComputeEnvironmentScope,
+  newEnv:
+    | Record<string, string | Redacted.Redacted<string> | null | undefined>
+    | undefined,
+) {
+  const newValues = plainEnv(newEnv);
+  const deleted: string[] = [];
+  for (const [key, ownedId] of Object.entries(oldOwnedIds)) {
+    if (sameEnvironmentScope(oldScope, newScope) && key in newValues) continue;
+    const variable = yield* findEnvironmentVariable(
+      client,
+      projectId,
+      oldScope.class,
+      key,
+      oldScope.branchId,
+    );
+    if (!variable) continue;
+    if (variable.id !== ownedId || variable.isManagedBySystem) continue;
+    yield* client
+      .deleteEnvironmentVariable(variable.id)
+      .pipe(Effect.catchIf(isNotFound, () => Effect.void));
+    deleted.push(key);
+  }
+  return { deleted };
+});
+
+const startDev = Effect.fn(function* (id: string, props: ComputeProps) {
+  const path = yield* Path.Path;
+  const dev = props.dev;
+  const processKey = `dev:${id}`;
+  const localUrl =
+    dev?.url ??
+    ((dev?.port ?? props.port)
+      ? `http://localhost:${dev?.port ?? props.port}`
+      : undefined);
+  if (!dev?.command) {
+    return localUrl;
+  }
+
+  yield* stopTrackedDevProcess(processKey);
+
+  const cwd = dev.cwd ? path.resolve(dev.cwd) : path.resolve(props.path ?? ".");
+  const env = {
+    ...processEnv(props.env),
+    ...processEnv(dev.env),
+    ...((dev.port ?? props.port)
+      ? { PORT: String(dev.port ?? props.port) }
+      : {}),
+  };
+  const handle = yield* ChildProcess.make(dev.command, [], {
+    shell: true,
+    cwd,
+    env,
+    extendEnv: true,
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    detached: false,
+  });
+  devProcesses.set(processKey, handle);
+  return localUrl;
+});
+
+const activeBindingEnv = (
+  bindings: ResourceBinding<Compute["Binding"]>[],
+): Record<string, string | Redacted.Redacted<string> | null | undefined> =>
+  bindings
+    .filter(
+      (binding: ResourceBinding<Compute["Binding"]> & { action?: string }) =>
+        binding.action !== "delete",
+    )
+    .map((binding) => binding.data?.env)
+    .reduce<
+      Record<string, string | Redacted.Redacted<string> | null | undefined>
+    >(
+      (acc, env) => (env ? { ...acc, ...env } : acc),
+      {} as Record<
+        string,
+        string | Redacted.Redacted<string> | null | undefined
+      >,
+    );
+
+export const ComputeProvider = () =>
+  Provider.effect(
+    Compute,
+    Effect.gen(function* () {
+      const client = yield* PrismaClient;
+      return {
+        stables: ["appId"],
+        // Compute is a composite over App + Deployment. AppProvider owns nuke
+        // enumeration to avoid deleting the same canonical App twice.
+        list: () => Effect.succeed([]),
+        diff: Effect.fn(function* ({ olds, news, output }) {
+          if (!isInputObject(news)) return undefined;
+          if (output?.local || isPrismaDevId(output?.appId)) {
+            return { action: "update" } as const;
+          }
+          const oldProjectId =
+            output?.projectId ?? unresolvedProjectIdOf(olds.project);
+          const newProjectId = isResolved(news.project)
+            ? unresolvedProjectIdOf(news.project)
+            : undefined;
+          if (concreteIdsChanged(oldProjectId, newProjectId)) {
+            // A different project is a distinct API uniqueness scope, so the
+            // old and replacement Apps can safely coexist.
+            return { action: "replace" } as const;
+          }
+          if (isResolved(news.regionId) && news.regionId !== undefined) {
+            const currentRegionId = output?.regionId ?? olds.regionId;
+            if (
+              currentRegionId !== undefined &&
+              news.regionId !== currentRegionId
+            ) {
+              return yield* Effect.fail(
+                new Error(
+                  `Prisma Compute App region is immutable and cannot be changed atomically without deleting the live App first. Deploy a second Compute App under a different appName in the target region, cut traffic over, then remove the original.`,
+                ),
+              );
+            }
+          }
+          // Source files/build output can change with no prop change, so
+          // reconcile must rerun and decide from the computed artifact hash.
+          return { action: "update" } as const;
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          if (output?.local) return output;
+          const appId =
+            output?.appId && !isPrismaDevId(output.appId)
+              ? output.appId
+              : undefined;
+          const app = appId
+            ? yield* client
+                .getApp(appId)
+                .pipe(
+                  Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+                )
+            : yield* Effect.gen(function* () {
+                const projectId = unresolvedProjectIdOf(olds.project);
+                return projectId
+                  ? yield* findApp(
+                      client,
+                      projectId,
+                      yield* createAppName(id, olds.appName),
+                      olds,
+                    )
+                  : undefined;
+              });
+          if (!app) return undefined;
+          const readDeployment = (id: string) =>
+            observeDeployment(client, id).pipe(
+              Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+            );
+          const outputDeployment = output?.deploymentId
+            ? yield* readDeployment(output.deploymentId)
+            : undefined;
+          if (outputDeployment) {
+            yield* ensureDeploymentMembership(
+              client,
+              app.id,
+              outputDeployment,
+              app.latestDeploymentId,
+            );
+          }
+          const latestDeployment =
+            !outputDeployment && app.latestDeploymentId
+              ? yield* readDeployment(app.latestDeploymentId)
+              : undefined;
+          const deployment = outputDeployment ?? latestDeployment;
+          const deploymentUrl = toDeploymentUrl(
+            deployment?.previewDomain ?? undefined,
+          );
+          const appUrl = toDeploymentUrl(app.appEndpointDomain);
+          const promoted =
+            app.latestDeploymentId !== null &&
+            deployment?.id === app.latestDeploymentId;
+          const attrs: Compute["Attributes"] = {
+            appId: app.id,
+            deploymentId: deployment?.id,
+            projectId: app.projectId ?? output?.projectId,
+            appName: app.name,
+            regionId: app.region.id,
+            deploymentEndpointDomain: deployment?.previewDomain ?? undefined,
+            deploymentUrl,
+            appEndpointDomain:
+              app.appEndpointDomain ?? output?.appEndpointDomain,
+            url: promoted ? (appUrl ?? deploymentUrl) : deploymentUrl,
+            promoted,
+            previousDeploymentId: output?.previousDeploymentId,
+            previousDeploymentAction: output?.previousDeploymentAction,
+            readinessStatus: output?.readinessStatus,
+            pendingDeploymentCleanup: output?.pendingDeploymentCleanup,
+            environmentKeys: output?.environmentKeys,
+            environmentVariableIds: output?.environmentVariableIds,
+            environmentClass: output?.environmentClass ?? olds.envClass,
+            environmentBranchId: output?.environmentBranchId,
+            // A latest-deployment fallback is unrelated to a missing saved
+            // deployment. Never transfer its artifact identity to other code.
+            artifactHash: outputDeployment ? output?.artifactHash : undefined,
+            local: false,
+          };
+          return appId ? attrs : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, olds, output, bindings }) {
+          const bindingEnv = activeBindingEnv(bindings);
+          const effectiveNews = {
+            ...news,
+            appName: yield* createAppName(id, news.appName),
+            env: {
+              ...bindingEnv,
+              ...news.env,
+            },
+          };
+          yield* validateComputeProps(effectiveNews);
+          const projectId = yield* resolveProjectId(effectiveNews.project);
+          const artifact = yield* resolveArtifact(effectiveNews);
+          const cleanupArtifact = artifact.file?.cleanup ?? Effect.void;
+          const releaseArtifactOnFailure = <A, E, R>(
+            effect: Effect.Effect<A, E, R>,
+          ) =>
+            effect.pipe(
+              Effect.onExit((exit) =>
+                Exit.isSuccess(exit) ? Effect.void : cleanupArtifact,
+              ),
+            );
+          const observedApp = effectiveNews.skipCodeUpload
+            ? yield* releaseArtifactOnFailure(
+                findExistingApp(client, output).pipe(
+                  Effect.retry({
+                    while: isAppProvisioningNotFound,
+                    schedule: projectConsistencySchedule,
+                  }),
+                ),
+              )
+            : undefined;
+          yield* releaseArtifactOnFailure(
+            ensureSkipCodeUploadCanFork(effectiveNews, observedApp),
+          );
+          const ensuredApp = yield* releaseArtifactOnFailure(
+            ensureApp(
+              client,
+              projectId,
+              effectiveNews,
+              output,
+              observedApp,
+            ).pipe(
+              Effect.retry({
+                while: isAppProvisioningNotFound,
+                schedule: projectConsistencySchedule,
+              }),
+            ),
+          );
+          let app = ensuredApp.app;
+          let preserveCreatedAppOnFailure = false;
+          const cleanupCreatedAppOnFailure = (error: unknown) =>
+            ensuredApp.created && !preserveCreatedAppOnFailure
+              ? destroyApp(client, app.id).pipe(
+                  Effect.catch((cleanupError) =>
+                    Effect.fail(
+                      aggregateCleanupFailure(
+                        "App",
+                        app.id,
+                        `/v1/apps/${app.id}`,
+                        error,
+                        cleanupError,
+                      ),
+                    ),
+                  ),
+                  Effect.andThen(() => Effect.fail(error)),
+                )
+              : Effect.fail(error);
+
+          let createdEnvironmentVariableIds: Array<{
+            key: string;
+            id: string;
+          }> = [];
+          let deploymentConverged = false;
+
+          return yield* Effect.gen(function* () {
+            const currentEnvironmentScope =
+              yield* resolveComputeEnvironmentScope(client, app, effectiveNews);
+            const deploymentHash = yield* sha256Object({
+              artifact: artifact.hash,
+              branchId: app.branchId,
+              environmentClass: currentEnvironmentScope.class,
+              environmentBranchId: currentEnvironmentScope.branchId,
+            });
+            const outputArtifactHash = persistedArtifactHashValue(
+              output?.artifactHash as
+                | Redacted.Redacted<string>
+                | string
+                | undefined,
+            );
+            const persistedDeployment = output?.deploymentId
+              ? yield* observeDeployment(client, output.deploymentId).pipe(
+                  Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+                )
+              : undefined;
+            const terminalFailedDeploymentId =
+              persistedDeployment?.status === "failed"
+                ? persistedDeployment.id
+                : undefined;
+            const promotionRequested = !(effectiveNews.skipPromote ?? false);
+            let persistedPendingCleanup = output?.pendingDeploymentCleanup;
+            const cleanupPreviousDeployment = Effect.fn(function* (
+              deploymentId: string,
+              action: "stop" | "destroy",
+            ) {
+              const observed = yield* observeDeployment(
+                client,
+                deploymentId,
+              ).pipe(
+                Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+              );
+              if (!observed) {
+                return (action === "destroy" ? "destroyed" : "stopped") as
+                  | "destroyed"
+                  | "stopped";
+              }
+              yield* ensureDeploymentMembership(
+                client,
+                app.id,
+                observed,
+                app.latestDeploymentId,
+              );
+              if (action === "destroy") {
+                yield* destroyDeployment(client, deploymentId, effectiveNews);
+                return "destroyed" as const;
+              }
+              yield* stopDeploymentIdempotent(client, deploymentId).pipe(
+                Effect.catchIf(isNotFound, () => Effect.void),
+              );
+              yield* waitForDeploymentStatus(
+                client,
+                deploymentId,
+                "stopped",
+                effectiveNews,
+              ).pipe(
+                Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+              );
+              return "stopped" as const;
+            });
+
+            if (
+              terminalFailedDeploymentId !== undefined &&
+              promotionRequested &&
+              output?.promoted === true &&
+              app.latestDeploymentId !== null &&
+              app.latestDeploymentId !== terminalFailedDeploymentId
+            ) {
+              return yield* Effect.fail(
+                new AggregateError(
+                  [],
+                  `Prisma Compute state preserves terminal failed deployment '${terminalFailedDeploymentId}', but App '${app.id}' reports deployment '${app.latestDeploymentId}' as latest. Alchemy cannot prove that the live deployment is the interrupted replacement, and the persisted failed deployment is not a safe rollback target. No new deployment was created and neither deployment was deleted.`,
+                ),
+              );
+            }
+
+            // Apply persists the previous stable Attributes before reconcile.
+            // If a prior attempt promoted a new generation, failed its stable
+            // health check, and could not roll back, that durable output still
+            // identifies the deployment we must restore while the App points
+            // at the displaced unhealthy generation. Recover that transition
+            // before changing env or creating another deployment, otherwise a
+            // retry would use the unhealthy generation as its rollback target.
+            if (
+              promotionRequested &&
+              output?.promoted === true &&
+              output.deploymentId !== undefined &&
+              terminalFailedDeploymentId === undefined &&
+              outputArtifactHash !== deploymentHash &&
+              app.latestDeploymentId !== null &&
+              app.latestDeploymentId !== output.deploymentId
+            ) {
+              const persistedDeploymentId = output.deploymentId;
+              const displacedDeploymentId = app.latestDeploymentId;
+              const rollback = yield* client
+                .rollbackApp(app.id, {
+                  deploymentId: persistedDeploymentId,
+                })
+                .pipe(Effect.result);
+              const observedAfterRollback = yield* waitForAppDeploymentTarget(
+                client,
+                app.id,
+                persistedDeploymentId,
+                effectiveNews,
+              ).pipe(Effect.result);
+
+              if (Result.isFailure(observedAfterRollback)) {
+                return yield* Effect.fail(
+                  new AggregateError(
+                    [
+                      ...(Result.isFailure(rollback) ? [rollback.failure] : []),
+                      ...(Result.isFailure(observedAfterRollback)
+                        ? [observedAfterRollback.failure]
+                        : []),
+                    ],
+                    `Prisma App '${app.id}' has live deployment '${displacedDeploymentId}', while Alchemy state preserves deployment '${persistedDeploymentId}' as the prior promoted generation. Recovery via POST /v1/apps/${app.id}/rollback did not converge, so no environment variables or new deployment were changed and neither deployment was deleted.`,
+                  ),
+                );
+              }
+
+              app = observedAfterRollback.success;
+              yield* destroyDeployment(
+                client,
+                displacedDeploymentId,
+                effectiveNews,
+              ).pipe(
+                Effect.catch((cleanupError) =>
+                  Effect.fail(
+                    new AggregateError(
+                      [
+                        ...(Result.isFailure(rollback)
+                          ? [rollback.failure]
+                          : []),
+                        cleanupError,
+                      ],
+                      `Prisma App '${app.id}' was restored to deployment '${persistedDeploymentId}', but displaced deployment '${displacedDeploymentId}' could not be deleted. No new deployment was created; retry cleanup with DELETE /v1/deployments/${displacedDeploymentId}.`,
+                    ),
+                  ),
+                ),
+              );
+            }
+
+            if (
+              output?.readinessStatus === "pending" &&
+              outputArtifactHash !== deploymentHash
+            ) {
+              return yield* Effect.fail(
+                new Error(
+                  `Prisma Compute deployment '${output.deploymentId ?? "unknown"}' still has pending stable-endpoint readiness. Reconcile the existing generation before changing code or environment inputs.`,
+                ),
+              );
+            }
+            // Keep one cleanup candidate. A non-live older candidate is
+            // drained before any env/deploy mutation; a candidate that is
+            // still live is derived from app.latestDeploymentId below.
+            if (
+              persistedPendingCleanup !== undefined &&
+              output?.readinessStatus !== "pending" &&
+              persistedPendingCleanup.deploymentId !== app.latestDeploymentId
+            ) {
+              yield* cleanupPreviousDeployment(
+                persistedPendingCleanup.deploymentId,
+                persistedPendingCleanup.action,
+              );
+              persistedPendingCleanup = undefined;
+            } else if (
+              persistedPendingCleanup?.deploymentId === app.latestDeploymentId
+            ) {
+              persistedPendingCleanup = undefined;
+            }
+            const previousEnvironmentScope = environmentScope(
+              olds?.envClass ?? output?.environmentClass ?? "production",
+              output?.environmentBranchId,
+            );
+            const previousEnvironmentVariableIds =
+              output?.environmentVariableIds ?? {};
+            const environmentResult = yield* syncComputeEnvironmentInternal(
+              client,
+              projectId,
+              currentEnvironmentScope.class,
+              effectiveNews.env,
+              currentEnvironmentScope.branchId,
+              sameEnvironmentScope(
+                previousEnvironmentScope,
+                currentEnvironmentScope,
+              )
+                ? previousEnvironmentVariableIds
+                : {},
+            );
+            createdEnvironmentVariableIds = environmentResult.createdIds;
+
+            // Deployment creation snapshots the App branch environment. Remove
+            // formerly-owned keys before creating it so deleted keys cannot be
+            // captured into the new runtime. Any failure here happens before
+            // deployment creation and rolls back newly-created variables.
+            yield* cleanupRemovedComputeEnvironment(
+              client,
+              projectId,
+              previousEnvironmentScope,
+              previousEnvironmentVariableIds,
+              currentEnvironmentScope,
+              effectiveNews.env,
+            );
+
+            let deployment: ObservedDeployment | undefined =
+              outputArtifactHash === deploymentHash
+                ? persistedDeployment
+                : undefined;
+            // A failed deployment is terminal and cannot be repaired by
+            // replaying start/promotion. Preserve it as the cleanup target,
+            // but create a fresh generation and do not delete the failed one
+            // until the replacement has passed preview + stable readiness and
+            // promotion is observed.
+            if (
+              persistedDeployment !== undefined &&
+              (deployment !== undefined ||
+                terminalFailedDeploymentId !== undefined)
+            ) {
+              yield* ensureDeploymentMembership(
+                client,
+                app.id,
+                persistedDeployment,
+                app.latestDeploymentId,
+              );
+            }
+            if (terminalFailedDeploymentId !== undefined) {
+              deployment = undefined;
+            }
+            let createdDeploymentId: string | undefined;
+            const cleanupCreatedDeploymentOnFailure = (
+              failedDeploymentId: string,
+              error: unknown,
+            ) =>
+              createdDeploymentId === failedDeploymentId
+                ? destroyDeployment(
+                    client,
+                    failedDeploymentId,
+                    effectiveNews,
+                  ).pipe(
+                    Effect.catch((cleanupError) =>
+                      Effect.fail(
+                        aggregateCleanupFailure(
+                          "deployment",
+                          failedDeploymentId,
+                          `/v1/deployments/${failedDeploymentId}`,
+                          error,
+                          cleanupError,
+                        ),
+                      ),
+                    ),
+                    Effect.andThen(() => Effect.fail(error)),
+                  )
+                : Effect.fail(error);
+
+            if (!deployment) {
+              const created = yield* client.createAppDeployment(app.id, {
+                portMapping: { http: artifact.port },
+                skipCodeUpload: effectiveNews.skipCodeUpload,
+              });
+              createdDeploymentId = created.id;
+              if (artifact.file !== undefined && !created.uploadUrl) {
+                return yield* cleanupCreatedDeploymentOnFailure(
+                  created.id,
+                  new Error(
+                    "Prisma deployment creation did not return an upload URL.",
+                  ),
+                );
+              }
+              if (created.uploadUrl && artifact.file !== undefined) {
+                yield* uploadArtifact(
+                  created.uploadUrl,
+                  artifact.file,
+                  "application/gzip",
+                ).pipe(
+                  Effect.catch((error) =>
+                    cleanupCreatedDeploymentOnFailure(created.id, error),
+                  ),
+                );
+              }
+              deployment = yield* observeDeployment(client, created.id).pipe(
+                Effect.catchIf(isNotFound, () =>
+                  Effect.succeed({
+                    id: created.id,
+                    type: "deployment" as const,
+                    url: created.url,
+                    foundryVersionId: created.foundryVersionId,
+                    status: "new",
+                    previewDomain: null,
+                    createdAt: undefined,
+                  }),
+                ),
+                Effect.catch((error) =>
+                  cleanupCreatedDeploymentOnFailure(created.id, error),
+                ),
+              );
+            }
+            if (!deployment) {
+              return yield* Effect.fail(
+                new Error(
+                  "Prisma deployment could not be resolved after creation.",
+                ),
+              );
+            }
+
+            const previousDeploymentId =
+              terminalFailedDeploymentId ??
+              persistedPendingCleanup?.deploymentId ??
+              (app.latestDeploymentId !== null &&
+              app.latestDeploymentId !== deployment.id
+                ? app.latestDeploymentId
+                : null);
+            const rollbackDeploymentId =
+              previousDeploymentId === terminalFailedDeploymentId
+                ? null
+                : previousDeploymentId;
+
+            if (effectiveNews.start ?? true) {
+              const currentDeployment = deployment;
+              const currentDeploymentId = currentDeployment.id;
+              deployment = yield* Effect.gen(function* () {
+                if (
+                  currentDeployment.status !== "running" &&
+                  currentDeployment.status !== "provisioning"
+                ) {
+                  yield* startDeploymentIdempotent(
+                    client,
+                    currentDeployment.id,
+                  );
+                }
+                const running = yield* waitForDeploymentStatus(
+                  client,
+                  currentDeployment.id,
+                  "running",
+                  effectiveNews,
+                );
+                yield* waitForDeploymentUrl(
+                  toDeploymentUrl(running.previewDomain),
+                  effectiveNews,
+                );
+                return running;
+              }).pipe(
+                Effect.catch((error) =>
+                  cleanupCreatedDeploymentOnFailure(currentDeploymentId, error),
+                ),
+              );
+            }
+
+            let appEndpointDomain = app.appEndpointDomain;
+            let previousDeploymentAction:
+              | "stopped"
+              | "destroyed"
+              | "still-active"
+              | null = previousDeploymentId ? "still-active" : null;
+            let promoted = app.latestDeploymentId === deployment.id;
+            if (promotionRequested) {
+              // Replay promotion even when latestDeploymentId already matches.
+              // Promotion also repairs endpoint/custom-domain routing drift.
+              preserveCreatedAppOnFailure = true;
+              const promotedApp = yield* promoteAppObserved(
+                client,
+                app.id,
+                deployment.id,
+                effectiveNews,
+              );
+              appEndpointDomain = promotedApp.appEndpointDomain;
+              promoted = true;
+            }
+
+            const deploymentUrl = toDeploymentUrl(deployment.previewDomain);
+            const appUrl =
+              toDeploymentUrl(appEndpointDomain) ??
+              toDeploymentUrl(deployment.previewDomain);
+            let readinessStatus: "ready" | "pending" | "skipped" = "skipped";
+            if (promoted && effectiveNews.verifyUrl !== false) {
+              const readiness = yield* waitForDeploymentUrl(
+                appUrl,
+                effectiveNews,
+              ).pipe(Effect.result);
+              if (Result.isSuccess(readiness)) {
+                readinessStatus = "ready";
+              } else if (rollbackDeploymentId) {
+                const rollback = yield* client
+                  .rollbackApp(app.id, {
+                    deploymentId: rollbackDeploymentId,
+                  })
+                  .pipe(Effect.result);
+                const observedAfterRollback = yield* waitForAppDeploymentTarget(
+                  client,
+                  app.id,
+                  rollbackDeploymentId,
+                  effectiveNews,
+                ).pipe(Effect.result);
+                if (Result.isSuccess(observedAfterRollback)) {
+                  return yield* cleanupCreatedDeploymentOnFailure(
+                    deployment.id,
+                    Result.isSuccess(rollback)
+                      ? readiness.failure
+                      : new AggregateError(
+                          [readiness.failure, rollback.failure],
+                          `Prisma App '${app.id}' endpoint was restored to deployment '${rollbackDeploymentId}', but the rollback response was lost.`,
+                        ),
+                  );
+                }
+
+                return yield* Effect.fail(
+                  new AggregateError(
+                    [
+                      readiness.failure,
+                      ...(Result.isFailure(rollback) ? [rollback.failure] : []),
+                      observedAfterRollback.failure,
+                    ],
+                    `Prisma App '${app.id}' promoted deployment '${deployment.id}', but its stable endpoint failed readiness and rollback to deployment '${rollbackDeploymentId}' did not converge. Alchemy preserved the prior deployment in state and deleted neither deployment; the next reconcile will retry recovery via POST /v1/apps/${app.id}/rollback before making any new cloud changes.`,
+                  ),
+                );
+              } else {
+                // A first deployment has no safe rollback target. Never report
+                // a successful stack deployment while the production endpoint
+                // is unreachable. A newly created App can be fully cleaned up;
+                // a pre-existing App is preserved for observed-state recovery.
+                if (ensuredApp.created) {
+                  preserveCreatedAppOnFailure = false;
+                } else {
+                  deploymentConverged = true;
+                }
+                if (terminalFailedDeploymentId !== undefined) {
+                  return yield* Effect.fail(
+                    new AggregateError(
+                      [readiness.failure],
+                      `Prisma App '${app.id}' promoted replacement deployment '${deployment.id}', but stable readiness failed and persisted deployment '${terminalFailedDeploymentId}' is terminal failed, so no safe rollback target exists. Neither deployment was deleted; a retry will refuse to create another generation while the live target differs from persisted state.`,
+                    ),
+                  );
+                }
+                return yield* Effect.fail(readiness.failure);
+              }
+            }
+
+            deploymentConverged = true;
+            let pendingDeploymentCleanup =
+              promoted &&
+              previousDeploymentId &&
+              previousDeploymentId !== deployment.id
+                ? {
+                    deploymentId: previousDeploymentId,
+                    action:
+                      persistedPendingCleanup?.deploymentId ===
+                      previousDeploymentId
+                        ? persistedPendingCleanup.action
+                        : previousDeploymentId === terminalFailedDeploymentId
+                          ? ("destroy" as const)
+                          : effectiveNews.destroyOldDeployment
+                            ? ("destroy" as const)
+                            : ("stop" as const),
+                  }
+                : undefined;
+            if (promoted && pendingDeploymentCleanup) {
+              const cleanup = yield* cleanupPreviousDeployment(
+                pendingDeploymentCleanup.deploymentId,
+                pendingDeploymentCleanup.action,
+              ).pipe(Effect.result);
+              if (Result.isSuccess(cleanup)) {
+                previousDeploymentAction = cleanup.success;
+                pendingDeploymentCleanup = undefined;
+              } else {
+                yield* Effect.logWarning(
+                  `Prisma deployment '${pendingDeploymentCleanup.deploymentId}' cleanup is pending and will be retried before another Compute generation is created.`,
+                );
+              }
+            }
+
+            return {
+              appId: app.id,
+              deploymentId: deployment.id,
+              projectId,
+              appName: app.name,
+              regionId: app.region.id,
+              deploymentEndpointDomain: deployment.previewDomain ?? undefined,
+              deploymentUrl,
+              appEndpointDomain,
+              url: promoted ? appUrl : deploymentUrl,
+              promoted,
+              previousDeploymentId,
+              previousDeploymentAction,
+              readinessStatus,
+              pendingDeploymentCleanup,
+              environmentKeys: managedEnvKeys(effectiveNews.env),
+              environmentVariableIds: environmentResult.ownedIds,
+              environmentClass: currentEnvironmentScope.class,
+              environmentBranchId: currentEnvironmentScope.branchId,
+              artifactHash: Redacted.make(deploymentHash),
+              local: false,
+            };
+          }).pipe(
+            Effect.catch((error) =>
+              deploymentConverged
+                ? Effect.fail(error)
+                : rollbackCreatedEnvironmentVariables(
+                    client,
+                    createdEnvironmentVariableIds,
+                    error,
+                  ),
+            ),
+            Effect.catch(cleanupCreatedAppOnFailure),
+            Effect.ensuring(cleanupArtifact),
+          );
+        }),
+        delete: Effect.fn(function* ({ olds, output }) {
+          if (output.local || isPrismaDevId(output.appId)) {
+            yield* stopTrackedDevProcess(output.appId);
+            return;
+          }
+          yield* destroyComputeEnvironment(
+            client,
+            output.projectId,
+            environmentScope(
+              olds?.envClass ?? output.environmentClass ?? "production",
+              output.environmentBranchId,
+            ),
+            output.environmentVariableIds,
+          );
+          yield* destroyApp(client, output.appId);
+        }),
+        tail: ({ output }) =>
+          output.deploymentId
+            ? tailDeploymentLogs(client, output.deploymentId)
+            : Stream.empty,
+      };
+    }),
+  );
+
+export const ComputeDevProvider = () =>
+  Provider.effect(
+    Compute,
+    Effect.gen(function* () {
+      const ctx = yield* AlchemyContext;
+      return {
+        stables: ["appId"],
+        list: () => Effect.succeed([]),
+        diff: Effect.fn(function* () {
+          return { action: "update" } as const;
+        }),
+        read: Effect.fn(function* ({ output }) {
+          return output?.local ? output : undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, bindings }) {
+          const bindingEnv = activeBindingEnv(bindings);
+          const effectiveNews = {
+            ...news,
+            env: {
+              ...bindingEnv,
+              ...news.env,
+            },
+          };
+          yield* validateComputeProps(effectiveNews);
+          const projectId = yield* resolveProjectId(effectiveNews.project);
+          if (!ctx.dev) {
+            return yield* Effect.fail(
+              new Error("ComputeDevProvider requires Alchemy dev mode."),
+            );
+          }
+          const localUrl = yield* startDev(id, effectiveNews);
+          return {
+            appId: output?.appId ?? `dev:${id}`,
+            deploymentId: undefined,
+            projectId,
+            appName: effectiveNews.appName ?? id,
+            regionId: effectiveNews.regionId ?? "us-east-1",
+            deploymentEndpointDomain: localUrl,
+            deploymentUrl: localUrl,
+            appEndpointDomain: localUrl,
+            url: localUrl,
+            promoted: false,
+            previousDeploymentId: undefined,
+            previousDeploymentAction: undefined,
+            readinessStatus: "skipped",
+            pendingDeploymentCleanup: undefined,
+            environmentKeys: managedEnvKeys(effectiveNews.env),
+            environmentVariableIds: {},
+            environmentClass: effectiveNews.envClass ?? "production",
+            environmentBranchId: null,
+            artifactHash: undefined,
+            local: true,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* stopTrackedDevProcess(output.appId);
+        }),
+      };
+    }),
+  );