Unbreak the publish run: transition exceptions name the pins the families actually have (#227)

## What

Every publish run on `main` since #225 fails conformance (`4 failing, 0
allowed`), so **engine 0.2.3 cannot ship** and the dev channel is
stalled.

**Why:** #225 bumped the engine to 0.2.3 and copied the transition
exceptions with `familyPin: "0.2.0"`. But `@prisma/composer-cli@0.13.0`
and `@prisma/orm-toolchain@8.0.0-rc.6` released peering **0.2.2** in
between (prisma/composer#256, prisma/prisma#30111), and an exception
only covers the exact triple it names — so the publish run's observed
mismatch (0.2.2 → 0.2.3) goes unsuppressed.

## Changes

- Committed family pins move to the current releases
(`update-product-versions --channel release`): composer-cli 0.13.0,
orm-toolchain 8.0.0-rc.6, composer 0.13.0 — so the PR check (committed
pins) and the dev publish (rewritten pins) observe the same triple.
- The transition exceptions name (0.2.2 → 0.2.3).
- Composer 0.13.0 delivers the node-utils exit-hook fix upstream
(alchemy 2.0.0-beta.74; the vendored patch is retired), so the isolation
canary now asserts an executor import leaves **zero** signal listeners,
and the deferred entry tracking that patch chain is closed.

## Not the release

The committed version stays 8.0.0-rc.9 — already on npm — so merging
publishes a dev build and `@prisma/cli-engine@0.2.3` only. The held
rc.10 release PR (family pins already in place here; exceptions to
remove once the families re-release peering 0.2.3) comes separately.

## Verification

Conformance on both channels: **0 failing, 6 allowed** (the recorded
transition triples). CLI suite 61 files, engine suite 35 files, all
green. Lint/typecheck green.

## After merge

Engine 0.2.3 publishes → composer and prisma/prisma release again
peering 0.2.3 (same one-line peer move) → the rc.10 release PR pins
those and empties the exception list.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>

Author: wmadden-electric

.drive/projects/prisma-cli-v8/deferred.md

@@ -227,8 +227,15 @@ CLI does not do, and each restarts as engine work if wanted:
 
 ## Upstream, not ours to land
 
-- **alchemy-run/node-utils#6** (scope exit hooks to owned locks) is
-  open. Vendored as a pnpm patch in composer
+- **alchemy-run/node-utils#6** (scope exit hooks to owned locks).
+  **Closed by composer 0.13.0 (2026-08-25):** the release chain
+  delivered — alchemy 2.0.0-beta.74 carries the node-utils fix and
+  composer #254 retired the vendored patch, so a `prisma` install now
+  resolves a node-utils that registers no import-time signal listener.
+  The canary (`packages/cli/tests/composer-isolation.test.ts`) now
+  asserts zero listeners, so a regression in that chain says so. The
+  original entry follows for the record.
+  Was: open. Vendored as a pnpm patch in composer
   (`patches/@alchemy.run__node-utils@0.0.5.patch`, applied to both
   `lib/lockfile.js` and `src/lockfile.ts` because the exports map
   sends bun to `src/`). **Delete the patch when the release chain

packages/cli/package.json

@@ -50,19 +50,19 @@
   "dependencies": {
     "@manypkg/tools": "^2.1.2",
     "@prisma/cli-engine": "workspace:0.2.3",
-    "@prisma/composer-cli": "0.12.0",
+    "@prisma/composer-cli": "0.13.0",
     "@prisma/compute-sdk": "0.39.0",
     "@prisma/credentials-store": "^7.8.0",
     "@prisma/management-api-sdk": "1.55.0",
-    "@prisma/orm-toolchain": "8.0.0-rc.5",
+    "@prisma/orm-toolchain": "8.0.0-rc.6",
     "@vercel/detect-agent": "^1.2.3",
     "better-result": "^2.9.2",
     "dotenv": "^17.4.2",
     "execa": "^9.6.1",
     "open": "^11.0.0"
   },
   "devDependencies": {
-    "@prisma/composer": "0.11.0",
+    "@prisma/composer": "0.13.0",
     "@repo/cli-conformance": "workspace:8.0.0-rc.9",
     "@repo/cli-telemetry": "workspace:8.0.0-rc.9",
     "@repo/tsconfig": "workspace:8.0.0-rc.9",

packages/cli/scripts/conformance.ts

@@ -122,15 +122,15 @@ async function tarball(): Promise<readonly Finding[]> {
       exceptions: [
         {
           familyPackage: "@prisma/composer-cli",
-          familyPin: "0.2.0",
+          familyPin: "0.2.2",
           shellPin: "0.2.3",
           reason: "engine 0.2.3 must publish before composer-cli can peer it",
           removeWhen:
             "composer-cli releases peering 0.2.3 and the follow-up bump PR pins that release",
         },
         {
           familyPackage: "@prisma/orm-toolchain",
-          familyPin: "0.2.0",
+          familyPin: "0.2.2",
           shellPin: "0.2.3",
           reason: "engine 0.2.3 must publish before orm-toolchain can peer it",
           removeWhen:

packages/cli/tests/composer-isolation.test.ts

@@ -81,7 +81,7 @@ describe("composer's family costs an unrelated command nothing", () => {
     expect(report.signalListeners).toEqual({ SIGINT: 0, SIGTERM: 0 });
   }, 120_000);
 
-  test("canary: the executor import a composer command makes loads the constellation, and one signal listener per signal comes with it", async () => {
+  test("canary: the executor import a composer command makes loads the constellation, and no signal listener comes with it", async () => {
     const report = await runProbe("canary");
 
     expect(report.constellation.length).toBeGreaterThan(0);
@@ -91,10 +91,11 @@ describe("composer's family costs an unrelated command nothing", () => {
     expect(report.constellation.some((id) => id.startsWith("effect/"))).toBe(
       true,
     );
-    // The unpatched @alchemy.run/node-utils registers these at import time
-    // and never removes them; their handlers exit 130/143 themselves. The
-    // count is what the deferred entry on that patch reports, so it is
-    // asserted rather than only recorded.
-    expect(report.signalListeners).toEqual({ SIGINT: 1, SIGTERM: 1 });
+    // Zero since composer 0.13.0: alchemy 2.0.0-beta.74 carries the
+    // node-utils fix (alchemy-run/node-utils#6) that used to register a
+    // SIGINT and SIGTERM listener at import time, whose handlers exited
+    // 130/143 out from under the engine's own teardown. Asserted so a
+    // regression in that chain reintroducing the listeners says so.
+    expect(report.signalListeners).toEqual({ SIGINT: 0, SIGTERM: 0 });
   }, 120_000);
 });

packages/prisma/package.json

@@ -50,11 +50,11 @@
   "dependencies": {
     "@manypkg/tools": "^2.1.2",
     "@prisma/cli-engine": "workspace:0.2.3",
-    "@prisma/composer-cli": "0.12.0",
+    "@prisma/composer-cli": "0.13.0",
     "@prisma/compute-sdk": "0.39.0",
     "@prisma/credentials-store": "^7.8.0",
     "@prisma/management-api-sdk": "1.55.0",
-    "@prisma/orm-toolchain": "8.0.0-rc.5",
+    "@prisma/orm-toolchain": "8.0.0-rc.6",
     "@vercel/detect-agent": "^1.2.3",
     "better-result": "^2.9.2",
     "dotenv": "^17.4.2",