* chore(drive): spec and plan the node-addressing project
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore(drive): record the Alchemy rename spike's findings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore(drive): specify and plan slice A1, fully qualified node identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): decide that a node's address is its full path from the app name
ADR-0056 supersedes ADR-0051. Addresses start with the deployed app name,
resource IDs and COMPOSER_ env keys are built from them, and existing
stages migrate on their next deploy through renamedFrom declarations.
The index marks ADR-0051 superseded and notes the amendments to ADR-0006,
ADR-0019, ADR-0048, ADR-0052 and ADR-0053.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): describe fully qualified addresses in the principles, glossary and domain docs
The address principle, the glossary entry, core-model, deploy-cli,
alchemy-lowering, pdp-data-model, config-params, local-dev and
module-composition now describe addresses that start with the app name,
dotted resource IDs with their previous IDs, and env keys built from the
full address.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* feat(core): start every node address with the deployed app name
Load now joins every child to the root's id, so addresses read
shop.catalog and shop.auth.api instead of catalog and auth.api. The CLI
resolves the app name (the root's name or --name) before Load, so its
graph and the deploy lowering share one root, and the topology's root
logicalId equals the Project's. logicalIds, bundle keys, reports and
errors follow from the graph. The name-length error now names the
address it measured. Tests use the full form (ADR-0056).
Resource IDs still use the old suffix pattern on top of the new address;
the next change replaces them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* feat(prisma-cloud): build COMPOSER_ keys from the full address, with - turned into _
An app name may contain -, which no POSIX variable name may. configKey,
generatedParamVarName and local dev's copies of the key rule now map it
to _, so my-shop.api gives COMPOSER_MY_SHOP_API_... (ADR-0056).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(prisma-cloud): say serviceOrigin() takes the full address
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* feat(local-target): find a database's or bucket's instance by its resource ID
The resource ID of a Database or Bucket is now the node's address, which
is also the node's key in the directory's record. Keying by it frees the
name prop to stay a label in its old form, so recordKeyOf goes away.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* feat(prisma-cloud): give every resource a dotted ID and rename it from its old one
Each node's main resource is now its address (shop.catalog) and every
other piece is <address>.<role> (shop.catalog.conn, shop.web.env.<KEY>,
shop.web.generated.<path>, <consumer>.servicekey.<input>,
<provider>.streamskey). Every resource declares the ID the previous
release built with renamedFrom, computed in legacy-resource-ids.ts, so an
existing stage moves its state instead of recreating databases, buckets,
generated values and service keys.
Names whose change makes upstream replace a resource (Connection,
BucketAccessKey, Bucket, branchless Database) stay the address without
the app name, so credentials are not rotated (ADR-0056).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): record which props force replacement and how env rows migrate
Also corrects where an unknown serviceOrigin() address fails: while the
deploy builds its plan, not at Load.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* feat(local-target): keep local instances, ports and bucket data across the address upgrade
A record keyed by addresses without the app name now reads with the app
name in front of each such key, and is written back that way, so the
first prisma dev after upgrading reuses every instance and port. The
rule lives in legacy-address-keys.ts. A bucket's objects stay in
buckets/<app>/<address without the app name>, the folder earlier
releases used, so an existing bucket instance keeps its directory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): say how local dev's record and bucket folders survive the upgrade
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* fix(cli): print the deploy tree once under the app name
Every address now starts with the app name, so the tree built from the
addresses had the app as its only top-level node, under a first line
that already names the app. The tree now starts below it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* test(prisma-cloud): use full addresses in the local current-app and attach tests
These tests run against local-target's built output, so they kept passing
with short addresses until it was rebuilt with the app-relative bucket
folders.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs: write full addresses everywhere users see them, and remove apps with project delete
Guides, the agent skill, the auth module's README and examples now write
addresses with the app name (serviceOrigin('auth-example.api'),
prisma dev url my-app.gateway, COMPOSER_MY_APP_... keys). The deploying
guide explains the upgrade to full addresses, and points whole-app
teardown at prisma project delete, keeping the destroy operation for a
single stage.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* feat(core): refuse an app name that cannot start every address
The app name (the root module's name or --name) is the first segment of
every address and of every COMPOSER_ key, so Load now requires letters,
digits, - and _, starting with a letter or digit, before anything is
assembled or deployed. A provision edge also carries the app name, so a
provisioner can build names below it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* feat(local-target): mark the dev record's format instead of guessing old keys
Every write stores formatVersion 2. A record without it was written
before node keys were full addresses, so every one of its keys gets the
app name in front, including a child named like the app. A versioned
record is read as is.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* feat(prisma-cloud): name every platform resource below the app, with noun roles
addressBelowApp removes the known app name from an address. It is the
one place that computes it, used for every legacy ID and for every
platform name Composer writes: the App display name, the branchless
Database name, and the Connection, Bucket and access key names. Those
names are labels inside the app's own Project and stay within the
65-character limit however long the app name is. validateName checks
that name and says plainly that fixing it changes the node's identity.
Roles are now nouns: connection, accesskey, deployment, warmup,
migration, streamkey. The local App provider finds its instance by
resource ID, like databases and buckets, and the emulators hook keys
every node through resourceId, with a test pinning the two together.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): record the platform name rule, noun roles, the record format and serviceOrigin with --name
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore(drive): add A1 review artifacts and the project handover draft
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore(drive): bring the node-addressing handover up to date
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore(drive): every platform name is the full address; plan the merge and rename dispatches
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore(drive): make no data loss on upgrade a critical done condition, including state outside the graph
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): renumber the identity decision to ADR-0057
Main took ADR-0056 for the dev-server decision. The identity record and
every reference that means it now say ADR-0057; references to the
dev-server record keep ADR-0056.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* style: format two files the branch left unformatted
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore(drive): record what the upgrade deploy does to each resource
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* feat(prisma-cloud): name every platform row by the node's full address
The App display name, the local dev Database name, and the Connection,
Bucket and bucket access key names are now the full address. Name
validation checks each kind against the platform's own limit (Connection
65, Bucket 100, App 256, access key none) and names the address on
failure. addressBelowApp moves into legacy-resource-ids.ts, the only place
that still needs it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): every platform name is the full address
ADR-0057, the glossary, the principle, the lowering doc, core-model and
the deploying guide now say every platform name is the address, and that
the upgrade recreates Composer's Connections and access keys with new
credentials that its services receive in the same deploy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* fix(prisma-cloud): limit a Connection's address to 52 characters
Upstream appends `-` and a 12-character token to every Connection name
and cuts what does not fit in the platform's 65, so 52 keeps the whole
address. A new test records that a module named like the app gives one
node's new env key the value of another node's old key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): Connection name suffix, hosted database names, the env key clash
ADR-0057 and alchemy-lowering.md say upstream adds `-` and a 12-character
token to every Connection name, and that a hosted database takes its name
from upstream, not Composer. ADR-0057 records that an app with a module
named like the app fails its upgrade with a conflict and deletes nothing;
renaming one node first fixes it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore(drive): add round-2 review artifacts, plan the fixes and the QA checks for state outside the graph
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* feat(prisma-cloud): stop the upgrade before a COMPOSER_ key changes owner
The move to full addresses can give one row's new key to another row's
old key: a module or service named like the app in any letter case, or
modules spelling an app name with `-` or `_`. Upstream then fails partway
with a conflict that names neither node. Deploy preflight now computes
every row's new and old key from the graph and, while the old owner's
row still holds the key on the stage and has not moved, fails before any
change, naming both addresses, the variable and the
`prisma project env delete` command that clears it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore: give Load back its doc comment and cite ADR-0057 for row adoption
APP_NAME and assertAppName had been inserted between Load and its doc
comment. Two comments still cited the superseded ADR-0051 for the rule
that the row holding a node's logicalId is that node's row.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): the env key clash, default connection rotation, emulator labels
ADR-0057 no longer says keys cannot collide during the move, describes
every form of the clash and the preflight that stops it, and replaces the
advice to rename a node, which would delete its rows, with deleting the
one old variable. The deploying guide gives the same fix and notes that
emulator instances keep their old address labels until --fresh.
upgrade-effects.md states when a Database update rotates its default
connection: never for a stage last deployed by v0.34.0. The glossary says
a Connection's platform name carries upstream's suffix; core-model's
sketch names the Connection by its address.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore(drive): add the round-3 review and update the handover's QA steps
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* fix(prisma-cloud): report a whole chain of env key clashes in one run
With `shop.x`, `shop.shop.x` and `shop.shop.shop.x`, the middle node's new
key is the last node's old key, so it exists before any move and hid the
first clash. A row under the old owner's new key now counts as moved only
when that key's own clash is not pending. The error also says what is
true: no resource has been created, changed or deleted, but the Branch's
topology has been replaced and the build recorded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): say what the env key clash check has already changed
ADR-0057, the deploying guide and upgrade-effects.md no longer say the
deploy stops before changing anything. They say, as the ADR does for
serviceOrigin, that no resource has been created, changed or deleted but
the Branch's topology has been replaced, and that a chain of clashes is
reported in one run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* docs(design): a chain of env key clashes names several variables to delete
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore(drive): record A1 upgrade QA on the real platform
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* chore: classify the new prisma-cloud target files for the architecture check
env-key-clash.ts, legacy-resource-ids.ts and resource-ids.ts are only
imported by deploy-time code (descriptors, control, preflight, the local
target), so they join the control plane of the prisma-cloud extensions
layer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* ci: find deployed apps by logicalId in the e2e verify scripts and canaries
App display names are now the full address, so looking an App up by its
short name (`storefront`, `blobs`, `widgets`, `jobs`, `streams.service`,
`cron.runner`) finds nothing. The scripts now match the App's logicalId,
the full address built from STACK_NAME, which every CI deploy passes as
`--name`. The cold-start canary also looks for the streams artifact under
its full-address file name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* fix(prisma-cloud): address review comments on platform names and the clash error
- Remove the architecture rule for the deleted service-app.ts.
- validatePlatformName enforces the Management API's minimums as well as
its maximums (Connection 3 to 52 after upstream's suffix, Bucket 1 to
100, App 1 to 256) and names the address and both limits.
- The env key clash error single-quotes the key, project id and stage in
the printed delete command, so it is safe to paste; the guide's example
is quoted the same way.
- serializer.ts's header describes the current key scheme: the full
address from the app name, `-` turned into `_`; only the boot stash is
address-free.
- The core-concepts skill says short provision ids are fine, since every
platform name is the full address, and gives each kind's real limits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
* fix(prisma-cloud): quote the project and stage in the missing-setting command
missingError printed `--branch "<stage>"` with the stage unescaped, so a
stage containing `"`, `$` or a space printed a command unsafe to paste. It
now single-quotes the `KEY=<value>` pair, the project id and the stage
with the same shellQuote the env key clash error uses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
---------
Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
