feat(deploy): report what each node became (ADR-0032)

[wmadden-electric]

Proposes that prisma-composer deploy report what it did: a map from each graph node to the entity it became, keyed by the node's address (site → its compute service + public URL; catalog.database → its database, with no connection information).

ADR + implementation. lowering() already built the map and returned a hardcoded { outputs: {} } — the empty object every deploy log ends in. The stack's outputs are now that report.

Why this is more than a nicety

The map already exists and we throw it away. lowering() walks the graph holding lowered — node id → that node's descriptor.deploy(...) result — and ends with a hardcoded return { outputs: {} }. The print path exists too: the generated stack's default export is lower(app, config, opts), and Alchemy prints a stack's outputs. The { outputs: {} } at the end of every deploy log is that mechanism working correctly with nothing in it.

The interesting value is already computed. The compute descriptor already returns outputs: { url: deployment.deployedUrl, projectId }. The deployed URL — the thing a person or CI job most wants after a deploy — is derived, used for wiring, then discarded.

Recovering it afterwards is archaeology, and it's ambiguous. website/scripts/verify-deployed.ts exists solely to reconstruct this: an SDK dependency, a project-name lookup, a poll loop, and a guard — because the API reports branchId: null for every compute service, so a production site and a staged site are indistinguishable. The deploy never has to ask; it's holding the id.

The load-bearing decision

Each entry is projected by the descriptor that owns the entity — an allowlist — rather than core filtering a dump.

The reason is concrete: field names don't carry sensitivity. url is a public HTTP endpoint on a compute node and a Postgres connection string on a prisma-next node. Same name, opposite sensitivity. And the S3 credentials resource keeps its secrets in accessKeyId/secretAccessKey, not in anything called url — so a rule phrased over field names would print them untouched. Core can't tell these apart, and shouldn't: LoweredNode.outputs is extension-defined and opaque to it.

Because the report is constructed rather than filtered, a mistake omits a field instead of exposing one.

On redaction

Redacting known secrets from log output is recorded as a separate follow-on (.drive/deferred.md), not folded in here. It's genuinely worth having over the strings we don't author — Alchemy progress lines, errors echoing a DSN, stack traces. But it can't be what makes this report safe: some credentials are minted mid-run (s3Credentials mints a SigV4 pair, so anything printed before registration is unmasked), and values are transformed before printing (a password in a DSN is percent-encoded, JSON escapes it again), which defeats literal matching. Defense-in-depth, not the wall — and it matches how this codebase already carries sensitivity in the type (SecretBox, Effect's Redacted) rather than scrubbing text at the edge.

What each descriptor now publishes

Node	Reports	Withholds
compute	id, url, projectId	the artifact hash and the service environment — the environment is where the secrets are
postgres / prisma-next	id	url — here it's the connection string
s3-credentials	{} — listed by identity alone	the minted SigV4 pair, which is its entire output
s3-store	compute's report + bucket	the SigV4 pair its deploy spreads into outputs

Verification

• The tests were checked against the failure they claim to catch. Mutating the collector to spread outputs into the report fails two of the three new cases (including the secrets one); reverting passes 37/37. They don't pass vacuously.
• Full sweep green: 47 test tasks, 56 typecheck tasks, 27 builds, lint:deps, biome.
• lint:framework-vocabulary caught a real defect in my first cut — a core comment naming postgres, which core must never do. Fixed.

Two notes for the reviewer

• Descriptors deliberately don't read ctx.node. My first cut had each one take node.name for its report; that broke 18 existing partial-context fakes in control-lowering.test.ts. Having core stamp the graph identity instead removes the coupling entirely — the whole prisma-cloud suite (159 tests) passes untouched. The test churn was the design telling me the seam was in the wrong place.
• lower()'s return value is published surface via @prisma/composer/deploy, so this changes a public type and the stack's printed outputs.

🤖 Generated with Claude Code

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@prisma/composer@101

npm i https://pkg.pr.new/@prisma/composer-prisma-cloud@101

commit: 3031730