alchemy 2.0.0-beta.76 → 2.0.0-beta.78

package/src/Prisma/Compute.ts

@@ -32,22 +32,34 @@ import { RuntimeContext } from "../RuntimeContext.ts";
 import type * as Server from "../Server/index.ts";
 import { Stack } from "../Stack.ts";
 import { sha256Object } from "../Util/sha256.ts";
+import { Retry } from "@distilled.cloud/prisma";
 import {
-  PrismaApiError,
-  PrismaClient,
-  isNotFound,
-  type PrismaManagementClient,
-} from "./Client.ts";
+  type GetServicesResponse,
+  type GetEnvironmentVariablesResponse,
+  type GetProjectBranchesResponse,
+  deleteEnvironmentVariable,
+  getServices,
+  getService,
+  getBranch,
+  getEnvironmentVariables,
+  getProjectBranches,
+  updateService,
+  updateEnvironmentVariable,
+  createService,
+  createServiceDeployment,
+  createServiceRollback,
+  createEnvironmentVariable,
+} from "@distilled.cloud/prisma/management";
 import {
   runBuildCommand,
   runComputeAutoBuild,
+  runComputeStaticBuild,
   type ComputeAutoBuildFramework,
 } from "./ComputeBuild.ts";
 import { createComputeArchive, normalizeEntrypoint } from "./ComputeArchive.ts";
 import {
   destroyApp,
   destroyDeployment,
-  isConflict,
   toDeploymentUrl,
   waitForDeploymentStatus,
 } from "./ComputeLifecycle.ts";
@@ -74,18 +86,15 @@ import {
   resolveProjectId,
   unresolvedProjectIdOf,
 } from "./Refs.ts";
+import type { PrismaRegionId } from "./Types.ts";
 import type {
-  App as ApiApp,
-  Deployment as ApiDeployment,
-  EnvironmentVariable as ApiEnvironmentVariable,
-  PrismaRegionId,
-} from "./Types.ts";
+  ObservedApp,
+  ObservedDeployment,
+  ObservedEnvironmentVariable,
+} from "./Internal/Observed.ts";
+import { PrismaPaginationError } from "./Internal/Pagination.ts";
 import { readUploadArtifact, uploadArtifact } from "./Deployment.ts";
 
-type ObservedDeployment = Omit<ApiDeployment, "createdAt"> & {
-  createdAt?: string;
-};
-
 const ComputeTypeId = "Prisma.Compute" as const;
 type ComputeTypeId = typeof ComputeTypeId;
 
@@ -176,7 +185,70 @@ export interface ComputeAutoBuild {
   timeoutSeconds?: number;
 }
 
-export type ComputeBuild = ComputeCommandBuild | ComputeAutoBuild;
+export interface ComputeStaticBuild {
+  /**
+   * Build a static site and package it with a production HTTP server.
+   */
+  type: "static";
+  /**
+   * Static output directory, relative to `cwd`.
+   */
+  outdir: string;
+  /**
+   * Optional shell command that creates the static output directory. Omit it
+   * when `outdir` already contains the files to deploy.
+   */
+  command?: string;
+  /**
+   * Working directory for the build command and `outdir`.
+   *
+   * @default path
+   */
+  cwd?: string;
+  /**
+   * HTML file served at the root and for SPA fallbacks.
+   *
+   * @default "index.html"
+   */
+  indexPage?: string;
+  /**
+   * Serve the index page when no static file matches the request.
+   *
+   * @default false
+   */
+  spa?: boolean;
+  /**
+   * Environment variables supplied to the build command.
+   * Ambient `PRISMA_SERVICE_TOKEN` and `PRISMA_API_TOKEN` credentials are not
+   * inherited; include one here explicitly only when the application build
+   * genuinely needs Prisma Management API access.
+   *
+   * Plain strings are persisted in Alchemy state. Wrap secrets with
+   * `Redacted.make(secret)`.
+   *
+   * ```typescript
+   * env: { NPM_TOKEN: Redacted.make(process.env.NPM_TOKEN!) }
+   * ```
+   */
+  env?: Record<string, string | Redacted.Redacted<string> | undefined>;
+  /**
+   * Maximum bytes retained from each build output stream.
+   *
+   * @default 1048576 (1 MiB)
+   */
+  outputLimitBytes?: number;
+  /**
+   * Maximum wall-clock time for the build command.
+   *
+   * @default 900 (15 minutes)
+   */
+  timeoutSeconds?: number;
+}
+
+export type ComputeBuild =
+  | ComputeCommandBuild
+  | ComputeAutoBuild
+  | ComputeStaticBuild;
 
 export interface ComputeBundleOptions {
   /**
@@ -271,10 +343,12 @@ export interface ComputeProps extends PlatformProps {
    */
   path?: string;
   /**
-   * Additional artifact-relative files or directories to exclude from path
-   * deployments. `*` and `**` wildcards are supported; absolute paths,
-   * parent segments, and negated patterns are rejected. `.env*`, `.git`, and
-   * `.alchemy` are always excluded.
+   * Additional files or directories to exclude from path deployments. Static
+   * build patterns are relative to the configured output directory; other
+   * patterns are artifact-relative. `*` and `**` wildcards are supported;
+   * absolute paths, parent segments, and negated patterns are rejected.
+   * `.env*`, `.git`, and `.alchemy` are always excluded. Static index pages
+   * must remain present after exclusions.
    */
   archiveIgnore?: readonly string[];
   /**
@@ -308,8 +382,8 @@ export interface ComputeProps extends PlatformProps {
   /**
    * Build command and output directory. Set to `"auto"` or `{ type: "auto" }`
    * to use Prisma Compute-style framework detection for Next.js, Nuxt, Astro,
-   * TanStack Start, or Bun. Set to `false` to upload `path` as a pre-built
-   * artifact.
+   * TanStack Start, Vite, or Bun. Set to `false` to upload `path` as a
+   * pre-built artifact.
    */
   build?: ComputeBuild | false | "auto";
   /**
@@ -585,16 +659,13 @@ const isEffectNativeCompute = (props: ComputeProps) =>
  * ```
  *
  * ### Bundling & Tree-shaking
- * `main` is bundled with rolldown at deploy time. Top-level calls in the
- * `effect`, `@effect/*`, `alchemy`, `@alchemy.run/*`, and
- * `@distilled.cloud/*` packages receive `#__PURE__` annotations by
- * default, so anything the app doesn't use from those packages is
- * tree-shaken out of the bundle. Any other package — including your own
- * app — is left untouched unless you list it explicitly.
+ * `main` is bundled with rolldown at deploy time. Unused code is
+ * tree-shaken. `effect`, alchemy, and `@distilled.cloud` are marked
+ * pure so unused parts prune more aggressively. Your app is not
+ * marked pure.
  *
- * **Example:** Treat additional packages as pure
- * Pass package names (or picomatch globs) via `bundle.extra.pure.packages` to
- * annotate them in addition to the defaults.
+ * **Example:** Mark additional packages as pure
+ * Only list packages with no top-level side effects.
  * ```typescript
  * {
  *   main: "./src/app.ts",
@@ -604,18 +675,7 @@ const isEffectNativeCompute = (props: ComputeProps) =>
  * }
  * ```
  *
- * Listing a package annotates calls whose result is bound (variable
- * initializers, exports) — safe anywhere. If a listed package also
- * declares `"sideEffects": false` (or `[]`) in its `package.json`, that
- * combination opts it into full annotation: top-level calls whose result
- * is discarded (e.g. `router.on("/path", handler)` registrations) are
- * also marked pure and deleted under minification when unused. Only list
- * a `sideEffects: false` package if its modules really are free of
- * meaningful top-level side effects. The `effect`, `alchemy`, and
- * `@distilled.cloud` defaults declare exactly that, on purpose — their
- * modules are designed to be fully tree-shakeable.
- *
- * **Example:** Disable pure annotations
+ * **Example:** Turn it off
  * ```typescript
  * {
  *   main: "./src/app.ts",
@@ -677,6 +737,18 @@ const isEffectNativeCompute = (props: ComputeProps) =>
  * });
  * ```
  *
+ * **Example:** Deploy a static site
+ * ```typescript
+ * const web = yield* Prisma.Compute("web", {
+ *   project,
+ *   path: "./site",
+ *   build: {
+ *     type: "static",
+ *     outdir: ".",
+ *   },
+ * });
+ * ```
+ *
  * **Example:** Deploy a prebuilt tar.gz artifact
  * ```typescript
  * const app = yield* Prisma.Compute("api", {
@@ -846,27 +918,78 @@ const projectConsistencySchedule = Schedule.max([
   Schedule.recurs(6),
 ]);
 
-const isAppProvisioningNotFound = (error: unknown): boolean =>
-  error instanceof PrismaApiError &&
-  error.status === 404 &&
-  (error.path.startsWith("/v1/projects/") ||
-    error.path === "/v1/apps" ||
-    error.path.startsWith("/v1/apps/"));
+// Only project/branch/app reads and the app create flow through the
+// provisioning-consistency retries, so a NotFound there is exactly the
+// post-create lag the schedule exists to absorb.
+// The retried effects mix distilled's tagged operation errors with plain
+// `Error` failures of their own (an unresolvable branch, a foreign App), so
+// narrow before reading the tag.
+const isAppProvisioningNotFound = (error: Error | { readonly _tag: string }) =>
+  "_tag" in error && error._tag === "NotFound";
+
+// Distilled emits the cursor-paginated list operations as plain ops, so
+// callers walk `pagination` themselves (see `src/Neon/Project.ts`).
+const listBranches = (projectId: string, gitName?: string) =>
+  Effect.gen(function* () {
+    const branches: GetProjectBranchesResponse["data"][number][] = [];
+    let cursor: string | undefined;
+    while (true) {
+      const page = yield* getProjectBranches({
+        projectId,
+        limit: 100,
+        ...(gitName === undefined ? {} : { gitName }),
+        ...(cursor === undefined ? {} : { cursor }),
+      });
+      branches.push(...page.data);
+      const nextCursor = page.pagination.nextCursor;
+      if (!page.pagination.hasMore) break;
+      if (nextCursor === null) {
+        return yield* Effect.fail(
+          new PrismaPaginationError({
+            message:
+              "Invalid Prisma Management API pagination response from getProjectBranches: hasMore was true without a non-empty nextCursor",
+          }),
+        );
+      }
+      cursor = nextCursor;
+    }
+    return branches;
+  });
+
+const listApps = (projectId: string) =>
+  Effect.gen(function* () {
+    const apps: GetServicesResponse["data"][number][] = [];
+    let cursor: string | undefined;
+    while (true) {
+      const page = yield* getServices(
+        cursor === undefined
+          ? { projectId, limit: 100 }
+          : { projectId, limit: 100, cursor },
+      );
+      apps.push(...page.data);
+      const nextCursor = page.pagination.nextCursor;
+      if (!page.pagination.hasMore) break;
+      if (nextCursor === null) {
+        return yield* Effect.fail(
+          new PrismaPaginationError({
+            message:
+              "Invalid Prisma Management API pagination response from getServices: hasMore was true without a non-empty nextCursor",
+          }),
+        );
+      }
+      cursor = nextCursor;
+    }
+    return apps;
+  });
 
 const desiredComputeBranchId = Effect.fn(function* (
-  client: PrismaManagementClient,
   projectId: string,
   props: Pick<ComputeProps, "branchId" | "branchGitName">,
 ) {
   if (props.branchId !== undefined && !isPrismaDevId(props.branchId)) {
     return { resolved: true as const, id: props.branchId };
   }
-  const branches = yield* client.listBranches(
-    projectId,
-    props.branchGitName === undefined
-      ? { limit: 100 }
-      : { gitName: props.branchGitName, limit: 100 },
-  );
+  const branches = yield* listBranches(projectId, props.branchGitName);
   const matchingBranches =
     props.branchGitName === undefined
       ? branches.filter((branch) => branch.isDefault)
@@ -890,17 +1013,15 @@ const createAppName = (id: string, appName: string | undefined) =>
   appName === undefined ? createPhysicalName({ id }) : Effect.succeed(appName);
 
 const findApp = Effect.fn(function* (
-  client: PrismaManagementClient,
   projectId: string,
   appName: string,
   props: Pick<ComputeProps, "branchId" | "branchGitName">,
 ) {
-  const candidates = (yield* client.listApps({
-    projectId,
-    limit: 100,
-  })).filter((app) => app.name === appName);
+  const candidates = (yield* listApps(projectId)).filter(
+    (app) => app.name === appName,
+  );
   if (candidates.length === 0) return undefined;
-  const branch = yield* desiredComputeBranchId(client, projectId, props);
+  const branch = yield* desiredComputeBranchId(projectId, props);
   if (!branch.resolved) return undefined;
   const matches = candidates.filter((app) => app.branchId === branch.id);
   if (matches.length > 1) {
@@ -914,18 +1035,21 @@ const findApp = Effect.fn(function* (
 });
 
 const createApp = (
-  client: PrismaManagementClient,
   projectId: string,
   props: ComputeProps & { appName: string },
   branchId: string,
 ) =>
-  client.createApp({
+  createService({
     projectId,
     displayName: props.appName,
-    regionId: props.regionId,
     branchId,
-    branchGitName: undefined,
-  });
+    ...(props.regionId === undefined ? {} : { regionId: props.regionId }),
+  }).pipe(
+    // A replayed create would make a second App; the retry policy cannot
+    // see the request, so opt out explicitly.
+    Retry.none,
+    Effect.map((response) => response.data),
+  );
 
 const plainEnv = (
   env: Record<
@@ -1345,6 +1469,14 @@ const isAutoBuild = (
     "type" in build &&
     build.type === "auto");
 
+const isStaticBuild = (
+  build: ComputeProps["build"],
+): build is ComputeStaticBuild =>
+  typeof build === "object" &&
+  build !== null &&
+  "type" in build &&
+  build.type === "static";
+
 const readPackageMain = Effect.fn(function* (directory: string) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
@@ -1589,6 +1721,41 @@ const resolveArtifact = Effect.fn(function* (props: ComputeProps) {
       directory: artifact.directory,
       entrypoint: artifact.entrypoint,
       ignore: props.archiveIgnore,
+      ignorePrefix: artifact.archiveIgnorePrefix,
+      requiredFiles: artifact.requiredFiles,
+      output: "file",
+    }).pipe(Effect.ensuring(artifact.cleanup));
+    port = props.port ?? artifact.defaultPort ?? 8080;
+    return {
+      file,
+      hash: yield* sha256Object({
+        artifact: file.sha256,
+        env,
+        envClass,
+        port,
+      }),
+      port,
+    };
+  }
+
+  if (isStaticBuild(props.build)) {
+    const artifact = yield* runComputeStaticBuild({
+      appPath,
+      command: props.build.command,
+      cwd: props.build.cwd,
+      outdir: props.build.outdir,
+      indexPage: props.build.indexPage,
+      spa: props.build.spa,
+      env: props.build.env,
+      outputLimitBytes: props.build.outputLimitBytes,
+      timeoutSeconds: props.build.timeoutSeconds,
+    });
+    const file = yield* createComputeArchive({
+      directory: artifact.directory,
+      entrypoint: artifact.entrypoint,
+      ignore: props.archiveIgnore,
+      ignorePrefix: artifact.archiveIgnorePrefix,
+      requiredFiles: artifact.requiredFiles,
       output: "file",
     }).pipe(Effect.ensuring(artifact.cleanup));
     port = props.port ?? artifact.defaultPort ?? 8080;
@@ -1646,27 +1813,27 @@ const resolveArtifact = Effect.fn(function* (props: ComputeProps) {
 });
 
 const findExistingApp = Effect.fn(function* (
-  client: PrismaManagementClient,
   output: Compute["Attributes"] | undefined,
 ) {
   const appId =
     output?.appId && !isPrismaDevId(output.appId) ? output.appId : undefined;
   return appId
-    ? yield* client
-        .getApp(appId)
-        .pipe(Effect.catchIf(isNotFound, () => Effect.succeed(undefined)))
+    ? yield* getService({ serviceId: appId }).pipe(
+        Effect.map((response) => response.data),
+        Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+      )
     : undefined;
 });
 
 const ensureApp = Effect.fn(function* (
-  client: PrismaManagementClient,
   projectId: string,
   props: ComputeProps & { appName: string },
   output: Compute["Attributes"] | undefined,
-  observedApp?: ApiApp,
+  observedApp?: ObservedApp,
 ) {
-  let app = observedApp ?? (yield* findExistingApp(client, output));
-  const branch = yield* desiredComputeBranchId(client, projectId, props);
+  let app: ObservedApp | undefined =
+    observedApp ?? (yield* findExistingApp(output));
+  const branch = yield* desiredComputeBranchId(projectId, props);
   if (!branch.resolved) {
     return yield* Effect.fail(
       new Error(
@@ -1679,10 +1846,10 @@ const ensureApp = Effect.fn(function* (
 
   let createdApp = false;
   if (!app) {
-    const result = yield* createApp(client, projectId, props, branch.id).pipe(
+    const result = yield* createApp(projectId, props, branch.id).pipe(
       Effect.map((app) => ({ app, created: true })),
-      Effect.catchIf(isConflict, (conflict) =>
-        findApp(client, projectId, props.appName, props).pipe(
+      Effect.catchTag("Conflict", (conflict) =>
+        findApp(projectId, props.appName, props).pipe(
           Effect.flatMap((app) =>
             app && output?.appId !== undefined && app.id === output.appId
               ? Effect.succeed({ app, created: false })
@@ -1706,11 +1873,11 @@ const ensureApp = Effect.fn(function* (
     props.regionId ?? output?.regionId ?? app.region.id,
   );
   if (app.name !== props.appName || app.branchId !== branch.id) {
-    app = yield* client.updateApp(app.id, {
+    app = yield* updateService({
+      serviceId: app.id,
       displayName: props.appName,
       branchId: branch.id,
-      branchGitName: undefined,
-    });
+    }).pipe(Effect.map((response) => response.data));
   }
 
   return { app, created: createdApp };
@@ -1718,7 +1885,7 @@ const ensureApp = Effect.fn(function* (
 
 const ensureSkipCodeUploadCanFork = (
   props: ComputeProps,
-  app: ApiApp | undefined,
+  app: ObservedApp | undefined,
 ) =>
   Effect.gen(function* () {
     if (!(props.skipCodeUpload ?? false)) return;
@@ -1731,25 +1898,42 @@ const ensureSkipCodeUploadCanFork = (
   });
 
 const findEnvironmentVariable = (
-  client: PrismaManagementClient,
   projectId: string,
   cls: "production" | "preview",
   key: string,
   branchId?: string | null,
 ) =>
-  client
-    .listEnvironmentVariables({
-      projectId,
-      class: cls,
-      key,
-      ...(branchId ? { branchId } : {}),
-      limit: 100,
-    })
-    .pipe(
-      Effect.map((variables: ApiEnvironmentVariable[]) =>
-        variables.find((variable) => variable.branchId === (branchId ?? null)),
-      ),
+  Effect.gen(function* () {
+    // Distilled emits the cursor-paginated list operations as plain ops, so
+    // callers walk `pagination` themselves (see `src/Neon/Project.ts`).
+    const variables: GetEnvironmentVariablesResponse["data"][number][] = [];
+    let cursor: string | undefined;
+    while (true) {
+      const page = yield* getEnvironmentVariables({
+        projectId,
+        class: cls,
+        key,
+        limit: 100,
+        ...(branchId ? { branchId } : {}),
+        ...(cursor === undefined ? {} : { cursor }),
+      });
+      variables.push(...page.data);
+      const nextCursor = page.pagination.nextCursor;
+      if (!page.pagination.hasMore) break;
+      if (nextCursor === null) {
+        return yield* Effect.fail(
+          new PrismaPaginationError({
+            message:
+              "Invalid Prisma Management API pagination response from getEnvironmentVariables: hasMore was true without a non-empty nextCursor",
+          }),
+        );
+      }
+      cursor = nextCursor;
+    }
+    return variables.find(
+      (variable) => variable.branchId === (branchId ?? null),
     );
+  });
 
 const systemManagedEnvironmentVariableError = (key: string) =>
   new Error(
@@ -1757,7 +1941,7 @@ const systemManagedEnvironmentVariableError = (key: string) =>
   );
 
 const ensureUserManagedEnvironmentVariable = (
-  variable: ApiEnvironmentVariable,
+  variable: ObservedEnvironmentVariable,
 ) =>
   Effect.gen(function* () {
     if (variable.isManagedBySystem) {
@@ -1791,8 +1975,7 @@ const sameEnvironmentScope = (
 ) => left.class === right.class && left.branchId === right.branchId;
 
 const resolveComputeEnvironmentScope = Effect.fn(function* (
-  client: PrismaManagementClient,
-  app: ApiApp,
+  app: ObservedApp,
   props: ComputeProps,
 ) {
   if (!app.branchId) {
@@ -1803,7 +1986,9 @@ const resolveComputeEnvironmentScope = Effect.fn(function* (
     );
   }
 
-  const branch = yield* client.getBranch(app.branchId);
+  const branch = yield* getBranch({
+    branchId: app.branchId,
+  }).pipe(Effect.map((response) => response.data));
   const inferredClass = branch.role;
   if (props.envClass !== undefined && props.envClass !== inferredClass) {
     return yield* Effect.fail(
@@ -1822,11 +2007,10 @@ const resolveComputeEnvironmentScope = Effect.fn(function* (
 interface ComputeEnvironmentPlan {
   key: string;
   value: string | null;
-  variable: ApiEnvironmentVariable | undefined;
+  variable: ObservedEnvironmentVariable | undefined;
 }
 
 const rollbackCreatedEnvironmentVariables = Effect.fn(function* (
-  client: PrismaManagementClient,
   createdIds: ReadonlyArray<{ key: string; id: string }>,
   originalError: unknown,
 ) {
@@ -1836,9 +2020,9 @@ const rollbackCreatedEnvironmentVariables = Effect.fn(function* (
   const cleanupErrors: unknown[] = [];
   for (const created of [...createdIds].reverse()) {
     const result = yield* Effect.result(
-      client
-        .deleteEnvironmentVariable(created.id)
-        .pipe(Effect.catchIf(isNotFound, () => Effect.void)),
+      deleteEnvironmentVariable({ envVarId: created.id }).pipe(
+        Effect.catchTag("NotFound", () => Effect.void),
+      ),
     );
     if (Result.isFailure(result)) {
       cleanupErrors.push(result.failure);
@@ -1856,7 +2040,6 @@ const rollbackCreatedEnvironmentVariables = Effect.fn(function* (
 });
 
 const syncComputeEnvironmentInternal = Effect.fn(function* (
-  client: PrismaManagementClient,
   projectId: string,
   cls: "production" | "preview",
   env: Record<
@@ -1882,7 +2065,6 @@ const syncComputeEnvironmentInternal = Effect.fn(function* (
       yield* validateComputeEnvironmentWrite(key, value);
     }
     const variable = yield* findEnvironmentVariable(
-      client,
       projectId,
       cls,
       key,
@@ -1903,16 +2085,24 @@ const syncComputeEnvironmentInternal = Effect.fn(function* (
     for (const { key, value, variable } of plans) {
       if (value === null) continue;
       if (variable) {
-        yield* client.updateEnvironmentVariable(variable.id, { value });
+        yield* updateEnvironmentVariable({
+          envVarId: variable.id,
+          value,
+        });
         nextOwnedIds[key] = variable.id;
       } else {
-        const created = yield* client.createEnvironmentVariable({
+        const created = yield* createEnvironmentVariable({
           projectId,
           ...(branchId ? { branchId } : {}),
           class: cls,
           key,
           value,
-        });
+        }).pipe(
+          // A replayed create would make a second variable; the retry policy
+          // cannot see the request, so opt out explicitly.
+          Retry.none,
+          Effect.map((response) => response.data),
+        );
         createdIds.push({ key, id: created.id });
         nextOwnedIds[key] = created.id;
       }
@@ -1921,9 +2111,9 @@ const syncComputeEnvironmentInternal = Effect.fn(function* (
     // Apply explicit deletions only after all ownership checks and upserts.
     for (const { key, value, variable } of plans) {
       if (value !== null || !variable) continue;
-      yield* client
-        .deleteEnvironmentVariable(variable.id)
-        .pipe(Effect.catchIf(isNotFound, () => Effect.void));
+      yield* deleteEnvironmentVariable({
+        envVarId: variable.id,
+      }).pipe(Effect.catchTag("NotFound", () => Effect.void));
       deleted.push(key);
     }
     return { synced, deleted, ownedIds: nextOwnedIds, createdIds };
@@ -1931,13 +2121,12 @@ const syncComputeEnvironmentInternal = Effect.fn(function* (
 
   return yield* apply.pipe(
     Effect.catch((error) =>
-      rollbackCreatedEnvironmentVariables(client, createdIds, error),
+      rollbackCreatedEnvironmentVariables(createdIds, error),
     ),
   );
 });
 
 export const syncComputeEnvironment = Effect.fn(function* (
-  client: PrismaManagementClient,
   projectId: string,
   cls: "production" | "preview",
   env: Record<
@@ -1948,7 +2137,6 @@ export const syncComputeEnvironment = Effect.fn(function* (
   ownedIds: Readonly<Record<string, string>> = {},
 ) {
   const result = yield* syncComputeEnvironmentInternal(
-    client,
     projectId,
     cls,
     env,
@@ -1963,7 +2151,6 @@ export const syncComputeEnvironment = Effect.fn(function* (
 });
 
 const destroyComputeEnvironment = Effect.fn(function* (
-  client: PrismaManagementClient,
   projectId: string,
   scope: ComputeEnvironmentScope,
   ownedIds: Readonly<Record<string, string>> = {},
@@ -1971,24 +2158,22 @@ const destroyComputeEnvironment = Effect.fn(function* (
   const deleted: string[] = [];
   for (const [key, ownedId] of Object.entries(ownedIds)) {
     const variable = yield* findEnvironmentVariable(
-      client,
       projectId,
       scope.class,
       key,
       scope.branchId,
-    ).pipe(Effect.catchIf(isNotFound, () => Effect.succeed(undefined)));
+    ).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
     if (!variable) continue;
     if (variable.id !== ownedId || variable.isManagedBySystem) continue;
-    yield* client
-      .deleteEnvironmentVariable(variable.id)
-      .pipe(Effect.catchIf(isNotFound, () => Effect.void));
+    yield* deleteEnvironmentVariable({
+      envVarId: variable.id,
+    }).pipe(Effect.catchTag("NotFound", () => Effect.void));
     deleted.push(key);
   }
   return { deleted };
 });
 
 const cleanupRemovedComputeEnvironment = Effect.fn(function* (
-  client: PrismaManagementClient,
   projectId: string,
   oldScope: ComputeEnvironmentScope,
   oldOwnedIds: Readonly<Record<string, string>>,
@@ -2002,7 +2187,6 @@ const cleanupRemovedComputeEnvironment = Effect.fn(function* (
   for (const [key, ownedId] of Object.entries(oldOwnedIds)) {
     if (sameEnvironmentScope(oldScope, newScope) && key in newValues) continue;
     const variable = yield* findEnvironmentVariable(
-      client,
       projectId,
       oldScope.class,
       key,
@@ -2010,9 +2194,9 @@ const cleanupRemovedComputeEnvironment = Effect.fn(function* (
     );
     if (!variable) continue;
     if (variable.id !== ownedId || variable.isManagedBySystem) continue;
-    yield* client
-      .deleteEnvironmentVariable(variable.id)
-      .pipe(Effect.catchIf(isNotFound, () => Effect.void));
+    yield* deleteEnvironmentVariable({
+      envVarId: variable.id,
+    }).pipe(Effect.catchTag("NotFound", () => Effect.void));
     deleted.push(key);
   }
   return { deleted };
@@ -2078,7 +2262,6 @@ const ProviderLive = () =>
   Provider.effect(
     Compute,
     Effect.gen(function* () {
-      const client = yield* PrismaClient;
       return {
         stables: ["appId"],
         // Compute is a composite over App + Deployment. AppProvider owns nuke
@@ -2123,16 +2306,14 @@ const ProviderLive = () =>
               ? output.appId
               : undefined;
           const app = appId
-            ? yield* client
-                .getApp(appId)
-                .pipe(
-                  Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
-                )
+            ? yield* getService({ serviceId: appId }).pipe(
+                Effect.map((response) => response.data),
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+              )
             : yield* Effect.gen(function* () {
                 const projectId = unresolvedProjectIdOf(olds.project);
                 return projectId
                   ? yield* findApp(
-                      client,
                       projectId,
                       yield* createAppName(id, olds.appName),
                       olds,
@@ -2141,15 +2322,14 @@ const ProviderLive = () =>
               });
           if (!app) return undefined;
           const readDeployment = (id: string) =>
-            observeDeployment(client, id).pipe(
-              Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+            observeDeployment(id).pipe(
+              Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
             );
           const outputDeployment = output?.deploymentId
             ? yield* readDeployment(output.deploymentId)
             : undefined;
           if (outputDeployment) {
             yield* ensureDeploymentMembership(
-              client,
               app.id,
               outputDeployment,
               app.latestDeploymentId,
@@ -2218,7 +2398,7 @@ const ProviderLive = () =>
             );
           const observedApp = effectiveNews.skipCodeUpload
             ? yield* releaseArtifactOnFailure(
-                findExistingApp(client, output).pipe(
+                findExistingApp(output).pipe(
                   Effect.retry({
                     while: isAppProvisioningNotFound,
                     schedule: projectConsistencySchedule,
@@ -2230,13 +2410,7 @@ const ProviderLive = () =>
             ensureSkipCodeUploadCanFork(effectiveNews, observedApp),
           );
           const ensuredApp = yield* releaseArtifactOnFailure(
-            ensureApp(
-              client,
-              projectId,
-              effectiveNews,
-              output,
-              observedApp,
-            ).pipe(
+            ensureApp(projectId, effectiveNews, output, observedApp).pipe(
               Effect.retry({
                 while: isAppProvisioningNotFound,
                 schedule: projectConsistencySchedule,
@@ -2247,13 +2421,13 @@ const ProviderLive = () =>
           let preserveCreatedAppOnFailure = false;
           const cleanupCreatedAppOnFailure = (error: unknown) =>
             ensuredApp.created && !preserveCreatedAppOnFailure
-              ? destroyApp(client, app.id).pipe(
+              ? destroyApp(app.id).pipe(
                   Effect.catch((cleanupError) =>
                     Effect.fail(
                       aggregateCleanupFailure(
                         "App",
                         app.id,
-                        `/v1/apps/${app.id}`,
+                        `/v1/services/${app.id}`,
                         error,
                         cleanupError,
                       ),
@@ -2271,7 +2445,7 @@ const ProviderLive = () =>
 
           return yield* Effect.gen(function* () {
             const currentEnvironmentScope =
-              yield* resolveComputeEnvironmentScope(client, app, effectiveNews);
+              yield* resolveComputeEnvironmentScope(app, effectiveNews);
             const deploymentHash = yield* sha256Object({
               artifact: artifact.hash,
               branchId: app.branchId,
@@ -2285,8 +2459,8 @@ const ProviderLive = () =>
                 | undefined,
             );
             const persistedDeployment = output?.deploymentId
-              ? yield* observeDeployment(client, output.deploymentId).pipe(
-                  Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+              ? yield* observeDeployment(output.deploymentId).pipe(
+                  Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
                 )
               : undefined;
             const terminalFailedDeploymentId =
@@ -2299,11 +2473,8 @@ const ProviderLive = () =>
               deploymentId: string,
               action: "stop" | "destroy",
             ) {
-              const observed = yield* observeDeployment(
-                client,
-                deploymentId,
-              ).pipe(
-                Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+              const observed = yield* observeDeployment(deploymentId).pipe(
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
               );
               if (!observed) {
                 return (action === "destroy" ? "destroyed" : "stopped") as
@@ -2311,25 +2482,23 @@ const ProviderLive = () =>
                   | "stopped";
               }
               yield* ensureDeploymentMembership(
-                client,
                 app.id,
                 observed,
                 app.latestDeploymentId,
               );
               if (action === "destroy") {
-                yield* destroyDeployment(client, deploymentId, effectiveNews);
+                yield* destroyDeployment(deploymentId, effectiveNews);
                 return "destroyed" as const;
               }
-              yield* stopDeploymentIdempotent(client, deploymentId).pipe(
-                Effect.catchIf(isNotFound, () => Effect.void),
+              yield* stopDeploymentIdempotent(deploymentId).pipe(
+                Effect.catchTag("NotFound", () => Effect.void),
               );
               yield* waitForDeploymentStatus(
-                client,
                 deploymentId,
                 "stopped",
                 effectiveNews,
               ).pipe(
-                Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
               );
               return "stopped" as const;
             });
@@ -2367,13 +2536,14 @@ const ProviderLive = () =>
             ) {
               const persistedDeploymentId = output.deploymentId;
               const displacedDeploymentId = app.latestDeploymentId;
-              const rollback = yield* client
-                .rollbackApp(app.id, {
-                  deploymentId: persistedDeploymentId,
-                })
-                .pipe(Effect.result);
+              const rollback = yield* createServiceRollback({
+                serviceId: app.id,
+                deploymentId: persistedDeploymentId,
+              }).pipe(
+                Effect.map((response) => response.data),
+                Effect.result,
+              );
               const observedAfterRollback = yield* waitForAppDeploymentTarget(
-                client,
                 app.id,
                 persistedDeploymentId,
                 effectiveNews,
@@ -2388,14 +2558,13 @@ const ProviderLive = () =>
                         ? [observedAfterRollback.failure]
                         : []),
                     ],
-                    `Prisma App '${app.id}' has live deployment '${displacedDeploymentId}', while Alchemy state preserves deployment '${persistedDeploymentId}' as the prior promoted generation. Recovery via POST /v1/apps/${app.id}/rollback did not converge, so no environment variables or new deployment were changed and neither deployment was deleted.`,
+                    `Prisma App '${app.id}' has live deployment '${displacedDeploymentId}', while Alchemy state preserves deployment '${persistedDeploymentId}' as the prior promoted generation. Recovery via POST /v1/services/${app.id}/rollback did not converge, so no environment variables or new deployment were changed and neither deployment was deleted.`,
                   ),
                 );
               }
 
               app = observedAfterRollback.success;
               yield* destroyDeployment(
-                client,
                 displacedDeploymentId,
                 effectiveNews,
               ).pipe(
@@ -2450,7 +2619,6 @@ const ProviderLive = () =>
             const previousEnvironmentVariableIds =
               output?.environmentVariableIds ?? {};
             const environmentResult = yield* syncComputeEnvironmentInternal(
-              client,
               projectId,
               currentEnvironmentScope.class,
               effectiveNews.env,
@@ -2469,7 +2637,6 @@ const ProviderLive = () =>
             // captured into the new runtime. Any failure here happens before
             // deployment creation and rolls back newly-created variables.
             yield* cleanupRemovedComputeEnvironment(
-              client,
               projectId,
               previousEnvironmentScope,
               previousEnvironmentVariableIds,
@@ -2492,7 +2659,6 @@ const ProviderLive = () =>
                 terminalFailedDeploymentId !== undefined)
             ) {
               yield* ensureDeploymentMembership(
-                client,
                 app.id,
                 persistedDeployment,
                 app.latestDeploymentId,
@@ -2507,11 +2673,7 @@ const ProviderLive = () =>
               error: unknown,
             ) =>
               createdDeploymentId === failedDeploymentId
-                ? destroyDeployment(
-                    client,
-                    failedDeploymentId,
-                    effectiveNews,
-                  ).pipe(
+                ? destroyDeployment(failedDeploymentId, effectiveNews).pipe(
                     Effect.catch((cleanupError) =>
                       Effect.fail(
                         aggregateCleanupFailure(
@@ -2528,10 +2690,18 @@ const ProviderLive = () =>
                 : Effect.fail(error);
 
             if (!deployment) {
-              const created = yield* client.createAppDeployment(app.id, {
+              const created = yield* createServiceDeployment({
+                serviceId: app.id,
                 portMapping: { http: artifact.port },
-                skipCodeUpload: effectiveNews.skipCodeUpload,
-              });
+                ...(effectiveNews.skipCodeUpload === undefined
+                  ? {}
+                  : { skipCodeUpload: effectiveNews.skipCodeUpload }),
+              }).pipe(
+                // A replayed create would make a second deployment; the retry
+                // policy cannot see the request, so opt out explicitly.
+                Retry.none,
+                Effect.map((response) => response.data),
+              );
               createdDeploymentId = created.id;
               if (artifact.file !== undefined && !created.uploadUrl) {
                 return yield* cleanupCreatedDeploymentOnFailure(
@@ -2552,12 +2722,10 @@ const ProviderLive = () =>
                   ),
                 );
               }
-              deployment = yield* observeDeployment(client, created.id).pipe(
-                Effect.catchIf(isNotFound, () =>
+              deployment = yield* observeDeployment(created.id).pipe(
+                Effect.catchTag("NotFound", () =>
                   Effect.succeed({
                     id: created.id,
-                    type: "deployment" as const,
-                    url: created.url,
                     foundryVersionId: created.foundryVersionId,
                     status: "new",
                     previewDomain: null,
@@ -2597,13 +2765,9 @@ const ProviderLive = () =>
                   currentDeployment.status !== "running" &&
                   currentDeployment.status !== "provisioning"
                 ) {
-                  yield* startDeploymentIdempotent(
-                    client,
-                    currentDeployment.id,
-                  );
+                  yield* startDeploymentIdempotent(currentDeployment.id);
                 }
                 const running = yield* waitForDeploymentStatus(
-                  client,
                   currentDeployment.id,
                   "running",
                   effectiveNews,
@@ -2632,7 +2796,6 @@ const ProviderLive = () =>
               // Promotion also repairs endpoint/custom-domain routing drift.
               preserveCreatedAppOnFailure = true;
               const promotedApp = yield* promoteAppObserved(
-                client,
                 app.id,
                 deployment.id,
                 effectiveNews,
@@ -2654,13 +2817,14 @@ const ProviderLive = () =>
               if (Result.isSuccess(readiness)) {
                 readinessStatus = "ready";
               } else if (rollbackDeploymentId) {
-                const rollback = yield* client
-                  .rollbackApp(app.id, {
-                    deploymentId: rollbackDeploymentId,
-                  })
-                  .pipe(Effect.result);
+                const rollback = yield* createServiceRollback({
+                  serviceId: app.id,
+                  deploymentId: rollbackDeploymentId,
+                }).pipe(
+                  Effect.map((response) => response.data),
+                  Effect.result,
+                );
                 const observedAfterRollback = yield* waitForAppDeploymentTarget(
-                  client,
                   app.id,
                   rollbackDeploymentId,
                   effectiveNews,
@@ -2684,7 +2848,7 @@ const ProviderLive = () =>
                       ...(Result.isFailure(rollback) ? [rollback.failure] : []),
                       observedAfterRollback.failure,
                     ],
-                    `Prisma App '${app.id}' promoted deployment '${deployment.id}', but its stable endpoint failed readiness and rollback to deployment '${rollbackDeploymentId}' did not converge. Alchemy preserved the prior deployment in state and deleted neither deployment; the next reconcile will retry recovery via POST /v1/apps/${app.id}/rollback before making any new cloud changes.`,
+                    `Prisma App '${app.id}' promoted deployment '${deployment.id}', but its stable endpoint failed readiness and rollback to deployment '${rollbackDeploymentId}' did not converge. Alchemy preserved the prior deployment in state and deleted neither deployment; the next reconcile will retry recovery via POST /v1/services/${app.id}/rollback before making any new cloud changes.`,
                   ),
                 );
               } else {
@@ -2769,7 +2933,6 @@ const ProviderLive = () =>
               deploymentConverged
                 ? Effect.fail(error)
                 : rollbackCreatedEnvironmentVariables(
-                    client,
                     createdEnvironmentVariableIds,
                     error,
                   ),
@@ -2784,7 +2947,6 @@ const ProviderLive = () =>
             return;
           }
           yield* destroyComputeEnvironment(
-            client,
             output.projectId,
             environmentScope(
               olds?.envClass ?? output.environmentClass ?? "production",
@@ -2792,11 +2954,11 @@ const ProviderLive = () =>
             ),
             output.environmentVariableIds,
           );
-          yield* destroyApp(client, output.appId);
+          yield* destroyApp(output.appId);
         }),
         tail: ({ output }) =>
           output.deploymentId
-            ? tailDeploymentLogs(client, output.deploymentId)
+            ? tailDeploymentLogs(output.deploymentId)
             : Stream.empty,
       };
     }),