diff --git a/.github/workflows/publish-website.yml b/.github/workflows/publish-website.yml
index 88c47a4034..5961f2748b 100644
--- a/.github/workflows/publish-website.yml
+++ b/.github/workflows/publish-website.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: metatypedev/setup-ghjk@32fe7ad4eab41d5e62189208afa6fe17112a5563
+      - uses: metatypedev/setup-ghjk@a7bbf22959e3c0f80b8ba9f800b0a9f1ff17fa7b
       - uses: actions/cache@v4
         with:
           path: .venv
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e88b17f381..a337670564 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -98,7 +98,7 @@ jobs:
         with:
           targets: ${{ matrix.target }}
       # some targets don't use cross so will require the deps in the host
-      - uses: metatypedev/setup-ghjk@32fe7ad4eab41d5e62189208afa6fe17112a5563
+      - uses: metatypedev/setup-ghjk@a7bbf22959e3c0f80b8ba9f800b0a9f1ff17fa7b
       - uses: Swatinem/rust-cache@v2
         with:
           key: ${{ runner.os }}-${{ matrix.target }}
@@ -172,7 +172,7 @@ jobs:
       - uses: denoland/setup-deno@v1
         with:
           deno-version: ${{ env.DENO_VERSION }}
-      - uses: metatypedev/setup-ghjk@32fe7ad4eab41d5e62189208afa6fe17112a5563
+      - uses: metatypedev/setup-ghjk@a7bbf22959e3c0f80b8ba9f800b0a9f1ff17fa7b
       - shell: bash
         env:
           POETRY_PYPI_TOKEN_PYPI: ${{ secrets.PYPI_TOKEN }}
@@ -305,7 +305,7 @@ jobs:
           fetch-depth: 0
       - uses: WyriHaximus/github-action-get-previous-tag@v1.4.0
         id: latest-tag
-      - uses: metatypedev/setup-ghjk@32fe7ad4eab41d5e62189208afa6fe17112a5563
+      - uses: metatypedev/setup-ghjk@a7bbf22959e3c0f80b8ba9f800b0a9f1ff17fa7b
       - shell: bash
         run: |
           cd dev-tools
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index faaa4457bb..6416fcf9fe 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -70,7 +70,7 @@ jobs:
       - uses: denoland/setup-deno@v1
         with:
           deno-version: ${{ env.DENO_VERSION }}
-      - uses: metatypedev/setup-ghjk@32fe7ad4eab41d5e62189208afa6fe17112a5563
+      - uses: metatypedev/setup-ghjk@a7bbf22959e3c0f80b8ba9f800b0a9f1ff17fa7b
       - shell: bash
         run: |
           sudo apt update
@@ -98,7 +98,7 @@ jobs:
         with:
           path: ${{ env.DENO_DIR }}
           key: deno-mac-${{ hashFiles('**/deno.lock') }}
-      - uses: metatypedev/setup-ghjk@32fe7ad4eab41d5e62189208afa6fe17112a5563
+      - uses: metatypedev/setup-ghjk@a7bbf22959e3c0f80b8ba9f800b0a9f1ff17fa7b
       - name: Cache .venv dir
         uses: actions/cache@v4
         with:
@@ -146,7 +146,10 @@ jobs:
         with:
           path: .venv
           key: ${{ runner.os }}-venv-${{ hashFiles('**/poetry.lock', '.ghjk/lock.json') }}
-      - uses: metatypedev/setup-ghjk@32fe7ad4eab41d5e62189208afa6fe17112a5563
+      - uses: metatypedev/setup-ghjk@a7bbf22959e3c0f80b8ba9f800b0a9f1ff17fa7b
+        with:
+          # temporary fix
+          cache-key-prefix: ${{ matrix.os }}
       - shell: bash
         env: 
           WASM_FILE: target/debug/typegraph_core.wasm
@@ -290,7 +293,7 @@ jobs:
       - run: |
           sudo apt update
           sudo apt install -y --no-install-recommends zstd
-      - uses: metatypedev/setup-ghjk@32fe7ad4eab41d5e62189208afa6fe17112a5563
+      - uses: metatypedev/setup-ghjk@a7bbf22959e3c0f80b8ba9f800b0a9f1ff17fa7b
       - shell: bash
         env: 
           WASM_FILE: target/debug/typegraph_core.wasm
@@ -357,7 +360,7 @@ jobs:
       - uses: denoland/setup-deno@v1
         with:
           deno-version: ${{ env.DENO_VERSION }}
-      - uses: metatypedev/setup-ghjk@32fe7ad4eab41d5e62189208afa6fe17112a5563
+      - uses: metatypedev/setup-ghjk@a7bbf22959e3c0f80b8ba9f800b0a9f1ff17fa7b
       - shell: bash
         run: |
           cd dev-tools
diff --git a/Cargo.lock b/Cargo.lock
index b3d3571c46..265638600b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -155,9 +155,9 @@ dependencies = [
 
 [[package]]
 name = "ahash"
-version = "0.7.7"
+version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a824f2aa7e75a0c98c5a504fceb80649e9c35265d44525b5f94de4771a395cd"
+checksum = "891477e0c6a8957309ee5c45a6368af3ae14bb510732d2684ffa19af310920f9"
 dependencies = [
  "getrandom 0.2.12",
  "once_cell",
@@ -166,9 +166,9 @@ dependencies = [
 
 [[package]]
 name = "ahash"
-version = "0.8.7"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77c3a9648d43b9cd48db467b3f87fdd6e146bcc88ab0180006cef2179fe11d01"
+checksum = "42cd52102d3df161c77a887b608d7a4897d7cc112886a9537b738a887a03aaff"
 dependencies = [
  "cfg-if",
  "getrandom 0.2.12",
@@ -1000,12 +1000,12 @@ version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce21468c1c9c154a85696bb25c20582511438edb6ad67f846ba1378ffdd80222"
 dependencies = [
- "ahash 0.8.7",
+ "ahash 0.8.8",
  "base64 0.13.1",
  "bitvec",
  "chrono",
  "hex",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "js-sys",
  "once_cell",
  "rand 0.8.5",
@@ -1157,9 +1157,9 @@ checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
 
 [[package]]
 name = "chrono"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f13690e35a5e4ace198e7beea2895d29f3a9cc55015fcebe6336bd2010af9eb"
+checksum = "5bc015644b92d5890fab7489e49d21f879d5c990186827d42ec511919404f38b"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -1360,7 +1360,7 @@ dependencies = [
  "colored",
  "flate2",
  "ignore",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "indoc",
  "itertools 0.11.0",
  "reqwest",
@@ -1950,7 +1950,7 @@ dependencies = [
  "glob",
  "hex",
  "import_map",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "jsonc-parser",
  "junction",
  "lazy-regex",
@@ -2068,7 +2068,7 @@ checksum = "2bbb245d9a3719b5eb2b5195aaaa25108c3c93d1762b181a20fb1af1c7703eaf"
 dependencies = [
  "anyhow",
  "deno_media_type",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "log",
  "once_cell",
  "parking_lot 0.12.1",
@@ -2099,7 +2099,7 @@ checksum = "aca0a5b9d2693efb14c8c80d66a052464f24cbf6b3473648037e282c0c616917"
 dependencies = [
  "anyhow",
  "glob",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "jsonc-parser",
  "log",
  "percent-encoding",
@@ -2210,7 +2210,7 @@ dependencies = [
  "handlebars",
  "html-escape",
  "import_map",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "lazy_static 1.4.0",
  "regex",
  "serde 1.0.196",
@@ -2313,7 +2313,7 @@ dependencies = [
  "deno_semver",
  "futures",
  "import_map",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "log",
  "monch",
  "once_cell",
@@ -2517,7 +2517,7 @@ dependencies = [
  "hkdf",
  "http 0.2.11",
  "idna 0.3.0",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "k256",
  "lazy-regex",
  "libc",
@@ -3142,7 +3142,7 @@ checksum = "7227b28d24aafee21ff72512336c797fa00bb3ea803186b1b105a68abc97660b"
 dependencies = [
  "anyhow",
  "bumpalo",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "rustc-hash",
  "serde 1.0.196",
  "unicode-width",
@@ -3453,9 +3453,9 @@ dependencies = [
 
 [[package]]
 name = "enumflags2"
-version = "0.7.8"
+version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5998b4f30320c9d93aed72f63af821bfdac50465b75428fce77b48ec482c3939"
+checksum = "3278c9d5fb675e0a51dabcf4c0d355f692b064171535ba72361be1528a9d8e8d"
 dependencies = [
  "enumflags2_derive",
  "serde 1.0.196",
@@ -3463,9 +3463,9 @@ dependencies = [
 
 [[package]]
 name = "enumflags2_derive"
-version = "0.7.8"
+version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f95e2801cd355d4a1a3e3953ce6ee5ae9603a5c833455343a8bfe3f44d418246"
+checksum = "5c785274071b1b420972453b306eeca06acf4633829db4223b58a2a8c5953bc4"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4427,7 +4427,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http 0.2.11",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "slab",
  "tokio",
  "tokio-util 0.7.10",
@@ -4446,7 +4446,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http 1.0.0",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "slab",
  "tokio",
  "tokio-util 0.7.10",
@@ -4484,7 +4484,7 @@ version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab5ef0d4909ef3724cc8cce6ccc8572c5c817592e9285f5464f8e86f8bd3726e"
 dependencies = [
- "ahash 0.7.7",
+ "ahash 0.7.8",
 ]
 
 [[package]]
@@ -4493,7 +4493,7 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 dependencies = [
- "ahash 0.7.7",
+ "ahash 0.7.8",
 ]
 
 [[package]]
@@ -4502,7 +4502,7 @@ version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "43a3c133739dddd0d2990f9a4bdf8eb4b21ef50e4851ca85ab661199821d510e"
 dependencies = [
- "ahash 0.8.7",
+ "ahash 0.8.8",
 ]
 
 [[package]]
@@ -4511,7 +4511,7 @@ version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
 dependencies = [
- "ahash 0.8.7",
+ "ahash 0.8.8",
  "allocator-api2",
 ]
 
@@ -4935,7 +4935,7 @@ version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "556779a5de0289679854a5344c22f466698fd2661f7170db90df7fa5013b281e"
 dependencies = [
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "log",
  "serde 1.0.196",
  "serde_json",
@@ -4974,9 +4974,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.2.2"
+version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824b2ae422412366ba479e8111fd301f7b5faece8149317bb81925979a53f520"
+checksum = "233cf39063f058ea2caae4091bf4a3ef70a653afbc026f5c4a4135d114e3c177"
 dependencies = [
  "equivalent",
  "hashbrown 0.14.3",
@@ -5775,7 +5775,7 @@ dependencies = [
  "grep",
  "ignore",
  "include_dir",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "indoc",
  "insta",
  "itertools 0.11.0",
@@ -5826,7 +5826,7 @@ version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2e52eb6380b6d2a10eb3434aec0885374490f5b82c8aaf5cd487a183c98be834"
 dependencies = [
- "ahash 0.7.7",
+ "ahash 0.7.8",
  "metrics-macros",
 ]
 
@@ -5836,7 +5836,7 @@ version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "142c53885123b68d94108295a09d4afe1a1388ed95b54d5dacd9a454753030f2"
 dependencies = [
- "ahash 0.7.7",
+ "ahash 0.7.8",
  "metrics-macros",
 ]
 
@@ -6184,7 +6184,7 @@ dependencies = [
  "bitflags 2.4.2",
  "codespan-reporting",
  "hexf-parse",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "log",
  "num-traits 0.2.18",
  "rustc-hash",
@@ -7059,7 +7059,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
 dependencies = [
  "fixedbitset 0.4.2",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
 ]
 
 [[package]]
@@ -7817,7 +7817,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b9599bffc2cd7511355996e0cfd979266b2cfa3f3ff5247d07a3a6e1ded6158"
 dependencies = [
  "chrono",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "nextest-workspace-hack",
  "quick-xml 0.31.0",
  "strip-ansi-escapes",
@@ -8319,9 +8319,9 @@ dependencies = [
 
 [[package]]
 name = "rust_decimal"
-version = "1.34.2"
+version = "1.34.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "755392e1a2f77afd95580d3f0d0e94ac83eeeb7167552c9b5bca549e61a94d83"
+checksum = "b39449a79f45e8da28c57c341891b69a183044b29518bb8f86dbac9df60bb7df"
 dependencies = [
  "arrayvec 0.7.4",
  "borsh",
@@ -8640,7 +8640,7 @@ checksum = "45a28f4c49489add4ce10783f7911893516f15afe45d015608d41faca6bc4d29"
 dependencies = [
  "dyn-clone",
  "indexmap 1.9.3",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "schemars_derive",
  "serde 1.0.196",
  "serde_json",
@@ -8984,7 +8984,7 @@ version = "1.0.113"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69801b70b1c3dac963ecb03a364ba0ceda9cf60c71cfe475e99864759c8b8a79"
 dependencies = [
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "itoa",
  "ryu",
  "serde 1.0.196",
@@ -9057,7 +9057,7 @@ dependencies = [
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "serde 1.0.196",
  "serde_derive",
  "serde_json",
@@ -9095,7 +9095,7 @@ version = "0.9.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "adf8a49373e98a4c5f0ceb5d05aa7c648d75f63774981ed95b7c7443bbd50c6e"
 dependencies = [
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "itoa",
  "ryu",
  "serde 1.0.196",
@@ -9653,7 +9653,7 @@ checksum = "4d7530df85b1a56f6a879ca102dc59718db4bcd6bfff55fb8bb379fbeab6c88c"
 dependencies = [
  "anyhow",
  "crc",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "is-macro",
  "once_cell",
  "parking_lot 0.12.1",
@@ -9709,7 +9709,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "112884e66b60e614c0f416138b91b8b82b7fea6ed0ecc5e26bad4726c57a6c99"
 dependencies = [
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "serde 1.0.196",
  "serde_json",
  "swc_config_macro",
@@ -9831,7 +9831,7 @@ checksum = "6d4ab26ec124b03e47f54d4daade8e9a9dcd66d3a4ca3cd47045f138d267a60e"
 dependencies = [
  "better_scoped_tls",
  "bitflags 2.4.2",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "once_cell",
  "phf",
  "rustc-hash",
@@ -9879,7 +9879,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fec185cf4d18e90b7c8b18b0d1f04a5707e6f4c7b57c1bfd5086392cd07b75a9"
 dependencies = [
  "dashmap",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "once_cell",
  "petgraph 0.6.4",
  "rustc-hash",
@@ -9924,7 +9924,7 @@ checksum = "e31a2f879fd21d18080b6c42e633e0ae8c6f3d54b83c1de876767d82b458c999"
 dependencies = [
  "base64 0.21.7",
  "dashmap",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "once_cell",
  "serde 1.0.196",
  "sha-1",
@@ -9963,7 +9963,7 @@ version = "0.125.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cead1083e46b0f072a82938f16d366014468f7510350957765bb4d013496890"
 dependencies = [
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "num_cpus",
  "once_cell",
  "rustc-hash",
@@ -10006,7 +10006,7 @@ version = "0.21.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8acfc056067a0fbfe26a4763c1eb246e813fdbe6b376415d07915e96e15481b6"
 dependencies = [
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "petgraph 0.6.4",
  "rustc-hash",
  "swc_common",
@@ -10236,18 +10236,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.56"
+version = "1.0.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d54378c645627613241d077a3a79db965db602882668f9136ac42af9ecb730ad"
+checksum = "1e45bcbe8ed29775f228095caf2cd67af7a4ccf756ebff23a306bf3e8b47b24b"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.56"
+version = "1.0.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa0faa943b50f3db30a20aa7e265dbc66076993efed8463e8de414e5d06d3471"
+checksum = "a953cb265bef375dae3de6663da4d3804eee9682ea80d8e2542529b73c531c81"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -10569,7 +10569,7 @@ version = "0.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8534fd7f78b5405e860340ad6575217ce99f38d4d5c8f2442cb5ecb50090e1"
 dependencies = [
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "toml_datetime",
  "winnow",
 ]
@@ -10580,7 +10580,7 @@ version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c9ffdf896f8daaabf9b66ba8e77ea1ed5ed0f72821b398aba62352e95062951"
 dependencies = [
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "serde 1.0.196",
  "serde_spanned",
  "toml_datetime",
@@ -11096,7 +11096,7 @@ dependencies = [
  "common",
  "enum_dispatch",
  "graphql-parser 0.4.0",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "indoc",
  "insta",
  "once_cell",
@@ -11673,7 +11673,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "977038054fd97977d2b7889005b5f20b62fd3563f2dc8dedfb534e3fdea6b7a7"
 dependencies = [
  "anyhow",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "serde 1.0.196",
  "serde_derive",
  "serde_json",
@@ -11765,7 +11765,7 @@ version = "0.113.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "286049849b5a5bd09a8773171be96824afabffc7cc3df6caaf33a38db6cd07ae"
 dependencies = [
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "semver 1.0.21",
 ]
 
@@ -11776,7 +11776,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99ffe16b4aa1ebab8724f61c9ee38cd5481c89caf10bf1a5af9eab8f0c2e6c05"
 dependencies = [
  "bitflags 2.4.2",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "semver 1.0.21",
 ]
 
@@ -12247,7 +12247,7 @@ checksum = "66981fe851118de3b6b7a92f51ce8a86b919569c37becbeca8df9bd30141da25"
 dependencies = [
  "anyhow",
  "bitflags 2.4.2",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "log",
  "serde 1.0.196",
  "serde_json",
@@ -12265,7 +12265,7 @@ checksum = "a39edca9abb16309def3843af73b58d47d243fe33a9ceee572446bcc57556b9a"
 dependencies = [
  "anyhow",
  "id-arena",
- "indexmap 2.2.2",
+ "indexmap 2.2.3",
  "log",
  "pulldown-cmark",
  "semver 1.0.21",
diff --git a/dev/lock.yml b/dev/lock.yml
index 622b2279d3..fda048d89d 100644
--- a/dev/lock.yml
+++ b/dev/lock.yml
@@ -75,7 +75,7 @@ dev:
       '(import\s+.+\s+from "npm:@typegraph\/sdk@)[^\/]+(\/.+";)': PUBLISHED_VERSION
   lock:
     GHJK_VERSION: f380522
-    GHJK_ACTION_VERSION: 32fe7ad4eab41d5e62189208afa6fe17112a5563
+    GHJK_ACTION_VERSION: a7bbf22959e3c0f80b8ba9f800b0a9f1ff17fa7b
     PYTHON_VERSION: 3.8.18
     POETRY_VERSION: 1.7.0
     PROTOC_VERSION: v24.1
diff --git a/examples/deploy/deploy.mjs b/examples/deploy/deploy.mjs
index e079ed5d15..3fad67c93a 100644
--- a/examples/deploy/deploy.mjs
+++ b/examples/deploy/deploy.mjs
@@ -2,7 +2,11 @@ import { Policy, t, typegraph } from "@typegraph/sdk/index.js";
 import { DenoRuntime } from "@typegraph/sdk/runtimes/deno.js";
 import { PythonRuntime } from "@typegraph/sdk/runtimes/python.js";
 import { WasmEdgeRuntime } from "@typegraph/sdk/runtimes/wasmedge.js";
-import { tgDeploy } from "@typegraph/sdk/tg_deploy.js";
+import { PrismaRuntime } from "@typegraph/sdk/providers/prisma.js";
+import { BasicAuth, tgDeploy } from "@typegraph/sdk/tg_deploy.js";
+import { wit_utils } from "@typegraph/sdk/wit.js";
+import * as path from "path";
+
 
 // deno
 // import { Policy, t, typegraph } from "../../typegraph/node/sdk/dist/index.js";
@@ -18,8 +22,16 @@ const tg = typegraph({
     const deno = new DenoRuntime();
     const python = new PythonRuntime();
     const wasmedge = new WasmEdgeRuntime();
+    const prisma = new PrismaRuntime("prisma", "POSTGRES")
     const pub = Policy.public();
-
+    const student = t.struct(
+      {
+        id: t.integer({}, { asId: true }),
+        name: t.string(),
+      },
+      { name: "Student" },
+    );
+  
     g.expose({
       test: deno.static(t.struct({ a: t.string() }), { a: "HELLO" }),
       // Deno
@@ -50,19 +62,51 @@ const tg = typegraph({
         t.integer(),
         { wasm: "wasi/rust.wasm", func: "add" }
       ),
+      // Prisma
+      createStudent: prisma.create(student),
+      findManyStudent: prisma.findMany(student),
     }, pub);
   },
 );
 
+const artifactsConfig = {
+  prismaMigration: {
+    action: {
+      create: true,
+      reset: false
+    },
+    migrationDir: "prisma-migrations"
+  }
+};
+const baseUrl = "http://localhost:7890";
+const auth = new BasicAuth("admin", "password");
+
 tgDeploy(tg, {
-  baseUrl: "http://localhost:7890",
-  cliVersion: "0.3.3",
-  auth: {
-    username: "admin",
-    password: "password",
+  baseUrl,
+  cliVersion: "0.3.4",
+  auth,
+  secrets: {
+    TG_DEPLOY_EXAMPLE_NODE_POSTGRES: "postgresql://postgres:password@localhost:5432/db?schema=e2e7894"
+  },
+  artifactsConfig: {
+    ...artifactsConfig,
+    // dir: "."
   },
-}).then((result) => {
-  console.log("gate:", result);
-  // console.log(result, tg);
+}).then(({ typegate }) => {
+  const selection = typegate?.data?.addTypegraph;
+  if (selection) {
+    const { migrations, messages } = selection;
+    // migration status.. etc
+    console.log(messages.map(({ text }) => text).join("\n"));
+    migrations.map(({ runtime, migrations }) => {
+      const baseDir = artifactsConfig.prismaMigration.migrationDir;
+      // Convention, however if migrationDir is absolute then you might want to use that instead
+      const fullPath = path.join(baseDir, tg.name, runtime);
+      wit_utils.unpackTarb64(migrations,  fullPath);
+      console.log(`Unpacked migrations at ${fullPath}`)
+    });
+  } else {
+    throw new Error(JSON.stringify(typegate));
+  }
 })
   .catch(console.error);
diff --git a/examples/deploy/deploy.py b/examples/deploy/deploy.py
index 71d6c3def3..f6f4f15744 100644
--- a/examples/deploy/deploy.py
+++ b/examples/deploy/deploy.py
@@ -1,9 +1,18 @@
 from typegraph import typegraph, Policy, t, Graph
+from typegraph.providers.prisma import PrismaRuntime
 from typegraph.runtimes.deno import DenoRuntime
 
-from typegraph.graph.tg_deploy import tg_deploy, TypegraphDeployParams, BasicAuth
+from typegraph.graph.tg_deploy import (
+    tg_deploy,
+    TypegraphDeployParams,
+    BasicAuth,
+)
 from typegraph.runtimes.python import PythonRuntime
 from typegraph.runtimes.wasmedge import WasmEdgeRuntime
+from typegraph.utils import unpack_tarb64
+from typegraph.wit import ArtifactResolutionConfig, MigrationConfig, MigrationAction
+
+from os import path
 
 
 @typegraph(disable_auto_serialization=True)  # disable print
@@ -11,8 +20,17 @@ def deploy_example_python(g: Graph):
     deno = DenoRuntime()
     python = PythonRuntime()
     wasmedge = WasmEdgeRuntime()
+    prisma = PrismaRuntime("prisma", "POSTGRES")
     pub = Policy.public()
 
+    student = t.struct(
+        {
+            "id": t.integer(as_id=True),
+            "name": t.string(),
+        },
+        name="Student",
+    )
+
     g.expose(
         pub,
         test=deno.static(t.struct({"a": t.string()}), {"a": "HELLO"}),
@@ -47,18 +65,47 @@ def deploy_example_python(g: Graph):
             wasm="wasi/rust.wasm",
             func="add",
         ),
+        # Prisma
+        createStudent=prisma.create(student),
+        findManyStudent=prisma.find_many(student),
     )
 
 
+# Self-deploy
 auth = BasicAuth(username="admin", password="password")
 
+config_params = MigrationConfig(
+    migration_dir="prisma-migrations", action=MigrationAction(create=True, reset=True)
+)
+artifacts_config = ArtifactResolutionConfig(prisma_migration=config_params, dir=None)
+
+tg = deploy_example_python()
+
 res = tg_deploy(
-    deploy_example_python(),
+    tg,
     TypegraphDeployParams(
         base_url="http://localhost:7890",
         auth=auth,
-        cli_version="0.3.3",
+        cli_version="0.3.4",
+        artifacts_config=artifacts_config,
+        secrets={
+            "TG_DEPLOY_EXAMPLE_PYTHON_POSTGRES": "postgresql://postgres:password@localhost:5432/db?schema=e2e7894"
+        },
     ),
 )
 
-print(res)
+# print(res.serialized)
+
+# migration status.. etc
+print(
+    "\n".join([msg["text"] for msg in res.typegate["data"]["addTypegraph"]["messages"]])
+)
+
+migrations = res.typegate["data"]["addTypegraph"]["migrations"] or []
+for item in migrations:
+    # what to do with the migration files?
+    base_dir = artifacts_config.prisma_migration.migration_dir
+    # Convention, however if migration_dir is absolute then you might want to use that instead
+    full_path = path.join(base_dir, tg.name, item["runtime"])
+    unpack_tarb64(item["migrations"], full_path)
+    print(f"Unpacked migrations at {full_path}")
diff --git a/libs/common/src/archive.rs b/libs/common/src/archive.rs
index d1ba62947b..dfe31923b5 100644
--- a/libs/common/src/archive.rs
+++ b/libs/common/src/archive.rs
@@ -6,7 +6,11 @@ use base64::{engine::general_purpose::STANDARD, Engine};
 use flate2::{read::GzDecoder, write::GzEncoder, Compression};
 use ignore::{Walk, WalkBuilder};
 use indexmap::IndexMap;
-use std::{fs, path::Path};
+use std::{
+    fs,
+    io::Read,
+    path::{Path, PathBuf},
+};
 use tar::{Archive, Header};
 
 pub fn unpack<P: AsRef<Path>>(dest: P, migrations: Option<impl AsRef<[u8]>>) -> Result<()> {
@@ -21,6 +25,35 @@ pub fn unpack<P: AsRef<Path>>(dest: P, migrations: Option<impl AsRef<[u8]>>) ->
     Ok(())
 }
 
+pub fn tarb64_unpack_entries_as_map(
+    tarb64: Option<impl AsRef<[u8]>>,
+) -> Result<IndexMap<PathBuf, Vec<u8>>> {
+    let Some(tarb64) = tarb64 else {
+        return Ok(IndexMap::new());
+    };
+    let tar_bytes = STANDARD.decode(tarb64)?;
+    let decoder = GzDecoder::new(tar_bytes.as_slice());
+    let mut archive = Archive::new(decoder);
+    archive
+        .entries()?
+        .filter_map(|e| match e {
+            Ok(entry) => {
+                if entry.header().entry_type().is_dir() {
+                    None
+                } else {
+                    Some(entry)
+                }
+            }
+            _ => None,
+        })
+        .map(|entry| -> Result<(PathBuf, Vec<u8>)> {
+            let path = entry.path()?.to_path_buf();
+            let bytes = entry.bytes().collect::<Result<Vec<u8>, _>>()?;
+            Ok((path, bytes))
+        })
+        .collect::<Result<IndexMap<PathBuf, Vec<u8>>>>()
+}
+
 pub fn archive<P: AsRef<Path>>(folder: P) -> Result<Option<String>> {
     if !folder.as_ref().try_exists()? {
         return Ok(None);
@@ -60,9 +93,7 @@ pub fn archive_entries(dir_walker: Walk, prefix: Option<&Path>) -> Result<Option
                             Err(_) => archive_path,
                         };
                     }
-                    // println!("file {} => {}", path.display(), archive_path.display());
-                    tar.append_file(archive_path, &mut file)
-                        .context("Adding file to tarball")?;
+                    tar.append_file(archive_path, &mut file)?;
                 }
                 empty = false;
                 Ok(())
@@ -92,8 +123,7 @@ pub fn archive_entries_from_bytes(entries: IndexMap<String, Vec<u8>>) -> Result<
         header.set_mode(0o666); // rw-rw-rw
         header.set_cksum();
 
-        tar.append_data(&mut header, path, bytes.as_slice())
-            .context("Adding file to tarball")?;
+        tar.append_data(&mut header, path, bytes.as_slice())?;
     }
 
     let bytes = tar.into_inner()?.finish()?;
diff --git a/typegate/tests/e2e/self_deploy/scripts/main.ts b/typegate/tests/e2e/self_deploy/scripts/main.ts
new file mode 100644
index 0000000000..fb47d1a825
--- /dev/null
+++ b/typegate/tests/e2e/self_deploy/scripts/main.ts
@@ -0,0 +1,6 @@
+// Copyright Metatype OÜ, licensed under the Elastic License 2.0.
+// SPDX-License-Identifier: Elastic-2.0
+
+export function sayHello({ name }: any) {
+  return `Hello ${name}`;
+}
diff --git a/typegate/tests/e2e/self_deploy/self_deploy.mjs b/typegate/tests/e2e/self_deploy/self_deploy.mjs
new file mode 100644
index 0000000000..f3103bc59a
--- /dev/null
+++ b/typegate/tests/e2e/self_deploy/self_deploy.mjs
@@ -0,0 +1,29 @@
+// Copyright Metatype OÜ, licensed under the Elastic License 2.0.
+// SPDX-License-Identifier: Elastic-2.0
+
+import { Policy, t, typegraph } from "@typegraph/sdk/index.js";
+import { DenoRuntime } from "@typegraph/sdk/runtimes/deno.js";
+
+// export the typegraph
+export const tg = typegraph({
+  name: "self-deploy",
+  disableAutoSerialization: true, // disable print
+}, (g) => {
+  const deno = new DenoRuntime();
+  const pub = Policy.public();
+
+  g.expose({
+    test: deno.static(t.struct({ a: t.string() }), { a: "HELLO" }),
+    sayHello: deno.import(
+      t.struct({ name: t.string() }),
+      t.string(),
+      // relative to cwd
+      { module: "scripts/main.ts", name: "sayHello" },
+    ),
+    sayHelloLambda: deno.func(
+      t.struct({ name: t.string() }),
+      t.string(),
+      { code: "({ name }) => `Hello ${name} from deno lambda`" },
+    ),
+  }, pub);
+});
diff --git a/typegate/tests/e2e/self_deploy/self_deploy_test.ts b/typegate/tests/e2e/self_deploy/self_deploy_test.ts
new file mode 100644
index 0000000000..b28bd70a9f
--- /dev/null
+++ b/typegate/tests/e2e/self_deploy/self_deploy_test.ts
@@ -0,0 +1,47 @@
+// Copyright Metatype OÜ, licensed under the Elastic License 2.0.
+// SPDX-License-Identifier: Elastic-2.0
+import { BasicAuth, tgDeploy, tgRemove } from "@typegraph/sdk/tg_deploy.js";
+
+import { Meta } from "test-utils/mod.ts";
+import { tg } from "./self_deploy.mjs"; // FIXME: deno coverage issues with transpiled version of this file
+import { testDir } from "test-utils/dir.ts";
+import { join } from "std/path/join.ts";
+import { assertEquals, assertExists } from "std/assert/mod.ts";
+import { get_version } from "native";
+
+const version = await get_version();
+const port = 7898;
+const auth = new BasicAuth("admin", "password");
+const gate = `http://localhost:${port}`;
+const cwdDir = join(testDir, "e2e", "self_deploy");
+
+Meta.test("deploy and undeploy typegraph without meta-cli", async (_) => {
+  const { serialized, typegate: gateResponseAdd } = await tgDeploy(tg, {
+    cliVersion: version,
+    baseUrl: gate,
+    auth,
+    secrets: {},
+    artifactsConfig: {
+      prismaMigration: {
+        action: {
+          create: true,
+          reset: false,
+        },
+        migrationDir: "prisma-migrations",
+      },
+      dir: cwdDir,
+    },
+  });
+  assertExists(serialized, "serialized has a value");
+  assertEquals(gateResponseAdd, {
+    data: {
+      addTypegraph: { name: "self-deploy", messages: [], migrations: [] },
+    },
+  });
+
+  const { typegate: gateResponseRem } = await tgRemove(tg, {
+    baseUrl: gate,
+    auth,
+  });
+  assertEquals(gateResponseRem, { data: { removeTypegraphs: true } });
+}, { port, systemTypegraphs: true });
diff --git a/typegate/tests/metatype.yml b/typegate/tests/metatype.yml
index 86338340d3..7aa77c533b 100644
--- a/typegate/tests/metatype.yml
+++ b/typegate/tests/metatype.yml
@@ -43,6 +43,10 @@ typegates:
       TG_PRISMA_POSTGRES: "postgresql://postgres:password@localhost:5432/db?schema=e2e7897"
       TG_MIGRATION_FAILURE_TEST_POSTGRES: "postgresql://postgres:password@localhost:5432/db?schema=e2e7897alt"
 
+  dev7898:
+    <<: *dev
+    url: "http://localhost:7898"
+
 typegraphs:
   materializers:
     prisma:
diff --git a/typegraph/core/src/global_store.rs b/typegraph/core/src/global_store.rs
index b269c99db1..5936db41e6 100644
--- a/typegraph/core/src/global_store.rs
+++ b/typegraph/core/src/global_store.rs
@@ -15,6 +15,7 @@ use crate::wit::core::TypegraphFinalizeMode;
 use crate::wit::runtimes::{Effect, MaterializerDenoPredefined, MaterializerId};
 use graphql_parser::parse_query;
 use indexmap::IndexMap;
+use std::path::PathBuf;
 use std::rc::Rc;
 use std::{cell::RefCell, collections::HashMap};
 
@@ -58,6 +59,8 @@ pub struct Store {
     typegraph_runtime: RuntimeId,
     graphql_endpoints: Vec<String>,
     auths: Vec<common::typegraph::Auth>,
+
+    deploy_cwd_dir: Option<PathBuf>,
 }
 
 impl Store {
@@ -190,6 +193,16 @@ impl Store {
         })
     }
 
+    pub fn set_deploy_cwd(value: Option<String>) {
+        with_store_mut(|s| {
+            s.deploy_cwd_dir = value.map(PathBuf::from);
+        })
+    }
+
+    pub fn get_deploy_cwd() -> Option<PathBuf> {
+        with_store(|s| s.deploy_cwd_dir.clone())
+    }
+
     pub fn pick_branch_by_path(supertype_id: TypeId, path: &[String]) -> Result<(Type, TypeId)> {
         let (_, supertype) = supertype_id.resolve_ref()?;
         let supertype = &supertype;
diff --git a/typegraph/core/src/typegraph.rs b/typegraph/core/src/typegraph.rs
index ddf1de65a9..bdfcbb971c 100644
--- a/typegraph/core/src/typegraph.rs
+++ b/typegraph/core/src/typegraph.rs
@@ -6,6 +6,7 @@ use crate::conversion::types::TypeConversion;
 use crate::global_store::SavedState;
 use crate::types::{TypeDef, TypeDefExt, TypeId};
 use crate::utils::postprocess::deno_rt::DenoProcessor;
+use crate::utils::postprocess::prisma_rt::PrismaProcessor;
 use crate::utils::postprocess::python_rt::PythonProcessor;
 use crate::utils::postprocess::wasmedge_rt::WasmedgeProcessor;
 use crate::utils::postprocess::PostProcessor;
@@ -217,7 +218,11 @@ pub fn finalize(mode: TypegraphFinalizeMode) -> Result<String> {
     };
 
     match mode {
-        TypegraphFinalizeMode::ResolveArtifacts => {
+        TypegraphFinalizeMode::ResolveArtifacts(config) => {
+            if let Some(config) = config {
+                Store::set_deploy_cwd(config.dir);
+                PrismaProcessor::new(config.prisma_migration).postprocess(&mut tg)?;
+            }
             DenoProcessor.postprocess(&mut tg)?;
             PythonProcessor.postprocess(&mut tg)?;
             WasmedgeProcessor.postprocess(&mut tg)?;
diff --git a/typegraph/core/src/utils/fs_host.rs b/typegraph/core/src/utils/fs_host.rs
index 2bcad1d69c..99f095cd24 100644
--- a/typegraph/core/src/utils/fs_host.rs
+++ b/typegraph/core/src/utils/fs_host.rs
@@ -3,10 +3,15 @@
 
 use std::path::{Path, PathBuf};
 
-use common::archive::{archive_entries_from_bytes, encode_bytes_to_base_64};
+use common::archive::{
+    archive_entries_from_bytes, encode_bytes_to_base_64, tarb64_unpack_entries_as_map,
+};
 use indexmap::IndexMap;
 
-use crate::wit::metatype::typegraph::host::{expand_glob, get_cwd, read_file, write_file};
+use crate::{
+    global_store::Store,
+    wit::metatype::typegraph::host::{expand_glob, get_cwd, read_file, write_file},
+};
 
 pub fn read_text_file<P: Into<String>>(path: P) -> Result<String, String> {
     read_file(&path.into()).and_then(|bytes| {
@@ -16,7 +21,7 @@ pub fn read_text_file<P: Into<String>>(path: P) -> Result<String, String> {
 }
 
 #[allow(unused)]
-pub fn write_text_file<P: Into<String>, S: Into<String>>(path: P, text: S) -> Result<(), String> {
+pub fn write_text_file<P: Into<String>>(path: P, text: P) -> Result<(), String> {
     write_file(&path.into(), text.into().as_bytes())
 }
 
@@ -25,22 +30,42 @@ pub fn compress<P: Into<String>>(path: P, exclude: Option<Vec<String>>) -> Resul
     let exclude = exclude.unwrap_or_default();
     let paths = expand_glob(&path.into(), &exclude)?;
     let mut entries = IndexMap::new();
-    for path in paths {
+    let cwd = get_cwd()?;
+    for path_str in paths.iter() {
+        let path = PathBuf::from(path_str)
+            .strip_prefix(cwd.clone()) // path in archives must be relative!
+            .unwrap_or(&PathBuf::from(path_str))
+            .display()
+            .to_string();
         entries.insert(path.clone(), read_file(&path.clone())?);
     }
     archive_entries_from_bytes(entries).map_err(|e| e.to_string())
 }
 
-pub fn compress_and_encode_base64<P: Into<String>>(path: P) -> Result<String, String> {
+pub fn unpack_base64<P: Into<String>>(tarb64: &str, dest: P) -> Result<(), String> {
+    let dest = PathBuf::from(dest.into());
+    let contents = tarb64_unpack_entries_as_map(Some(tarb64)).map_err(|e| e.to_string())?;
+
+    for (path, bytes) in contents {
+        let dest_file = dest.join(path).display().to_string();
+        write_file(&dest_file, &bytes)?;
+    }
+
+    Ok(())
+}
+
+pub fn compress_and_encode_base64(path: PathBuf) -> Result<String, String> {
     let exclude = vec!["node_modules/".to_string(), "\\.git/".to_string()];
-    let bytes = compress(path, Some(exclude))?;
+    let bytes = compress(path.display().to_string(), Some(exclude))?;
     encode_bytes_to_base_64(bytes).map_err(|e| e.to_string())
 }
 
+/// Returns `get_cwd()` by default, custom `dir` otherwise
 pub fn cwd() -> Result<PathBuf, String> {
-    // idea: make it configurable from the frontends?
-    let ret = PathBuf::from(get_cwd()?.to_owned());
-    Ok(ret)
+    match Store::get_deploy_cwd() {
+        Some(path) => Ok(path),
+        None => Ok(PathBuf::from(get_cwd()?.to_owned())),
+    }
 }
 
 pub fn make_relative(path: &Path) -> Result<PathBuf, String> {
diff --git a/typegraph/core/src/utils/mod.rs b/typegraph/core/src/utils/mod.rs
index 4e9861329d..3cf219450c 100644
--- a/typegraph/core/src/utils/mod.rs
+++ b/typegraph/core/src/utils/mod.rs
@@ -11,7 +11,7 @@ use crate::errors::Result;
 use crate::global_store::Store;
 use crate::types::TypeId;
 use crate::wit::core::{Guest, TypeBase, TypeId as CoreTypeId, TypeStruct};
-use crate::wit::utils::{Auth as WitAuth, QueryBodyParams};
+use crate::wit::utils::{Auth as WitAuth, QueryDeployParams};
 use crate::Lib;
 
 use self::oauth2::std::{named_provider, Oauth2Builder};
@@ -205,7 +205,7 @@ impl crate::wit::utils::Guest for crate::Lib {
             .build(named_provider(&service_name)?)
     }
 
-    fn gen_gqlquery(params: QueryBodyParams) -> Result<String> {
+    fn gql_deploy_query(params: QueryDeployParams) -> Result<String> {
         let query = r"
             mutation InsertTypegraph($tg: String!, $secrets: String!, $cliVersion: String!) {
                 addTypegraph(fromString: $tg, secrets: $secrets, cliVersion: $cliVersion) {
@@ -236,4 +236,23 @@ impl crate::wit::utils::Guest for crate::Lib {
 
         Ok(req_body.to_string())
     }
+
+    fn gql_remove_query(names: Vec<String>) -> Result<String> {
+        let query = r"
+            mutation($names: [String!]!) {
+                removeTypegraphs(names: $names)
+            }
+        ";
+        let req_body = json!({
+            "query": query,
+            "variables": json!({
+                "names":  names,
+              }),
+        });
+        Ok(req_body.to_string())
+    }
+
+    fn unpack_tarb64(tar_b64: String, dest: String) -> Result<()> {
+        fs_host::unpack_base64(&tar_b64, dest).map_err(|e| e.into())
+    }
 }
diff --git a/typegraph/core/src/utils/postprocess/mod.rs b/typegraph/core/src/utils/postprocess/mod.rs
index 1b9c2bbe13..c29ea0592e 100644
--- a/typegraph/core/src/utils/postprocess/mod.rs
+++ b/typegraph/core/src/utils/postprocess/mod.rs
@@ -5,6 +5,7 @@ use crate::utils::fs_host;
 use common::typegraph::Typegraph;
 use std::path::Path;
 pub mod deno_rt;
+pub mod prisma_rt;
 pub mod python_rt;
 pub mod wasmedge_rt;
 
@@ -13,7 +14,7 @@ pub fn compress_and_encode(main_path: &Path) -> Result<String, String> {
         return Err(format!("Unable to read {:?}: {}", main_path.display(), e));
     }
 
-    let enc_content = fs_host::compress_and_encode_base64(".")?;
+    let enc_content = fs_host::compress_and_encode_base64(fs_host::cwd()?)?;
     Ok(format!(
         "file:{};base64:{}",
         fs_host::make_relative(main_path)?.display(),
diff --git a/typegraph/core/src/utils/postprocess/prisma_rt.rs b/typegraph/core/src/utils/postprocess/prisma_rt.rs
new file mode 100644
index 0000000000..c7caf1fd78
--- /dev/null
+++ b/typegraph/core/src/utils/postprocess/prisma_rt.rs
@@ -0,0 +1,69 @@
+// Copyright Metatype OÜ, licensed under the Mozilla Public License Version 2.0.
+// SPDX-License-Identifier: MPL-2.0
+use std::path::PathBuf;
+
+use common::typegraph::runtimes::prisma::MigrationOptions;
+use common::typegraph::runtimes::{KnownRuntime::Prisma, TGRuntime};
+use common::typegraph::Typegraph;
+
+use crate::utils::fs_host;
+use crate::utils::postprocess::PostProcessor;
+use crate::wit::core::MigrationConfig;
+use crate::wit::metatype::typegraph::host::file_exists;
+
+pub struct PrismaProcessor {
+    config: MigrationConfig,
+}
+
+impl PrismaProcessor {
+    pub fn new(config: MigrationConfig) -> Self {
+        Self { config }
+    }
+}
+
+impl PostProcessor for PrismaProcessor {
+    fn postprocess(self, tg: &mut Typegraph) -> Result<(), String> {
+        self.embed_prisma_migrations(tg)?;
+        Ok(())
+    }
+}
+
+impl PrismaProcessor {
+    pub fn embed_prisma_migrations(&self, tg: &mut Typegraph) -> Result<(), String> {
+        let tg_name = tg.name().map_err(|e| e.to_string())?;
+        let base_migration_path = self.prisma_migrations_dir(&tg_name)?;
+
+        for rt in tg.runtimes.iter_mut() {
+            if let TGRuntime::Known(Prisma(rt_data)) = rt {
+                let rt_name = &rt_data.name;
+                let path = base_migration_path.join(rt_name);
+                rt_data.migration_options = Some(MigrationOptions {
+                    migration_files: {
+                        let path = fs_host::make_absolute(&path)?;
+                        match file_exists(&path.display().to_string())? {
+                            true => {
+                                let base64 = fs_host::compress_and_encode_base64(path)?;
+                                Some(base64)
+                            }
+                            false => None,
+                        }
+                    },
+                    create: self.config.action.create,
+                    reset: self.config.action.reset,
+                });
+            }
+        }
+        Ok(())
+    }
+
+    pub fn prisma_migrations_dir(&self, tg_name: &str) -> Result<PathBuf, String> {
+        let mut path = fs_host::cwd()?.join(PathBuf::from(
+            self.config
+                .migration_dir
+                .clone()
+                .unwrap_or("prisma-migrations".to_string()),
+        ));
+        path.push(tg_name);
+        Ok(path)
+    }
+}
diff --git a/typegraph/core/wit/typegraph.wit b/typegraph/core/wit/typegraph.wit
index b763e70c13..4cab2d0057 100644
--- a/typegraph/core/wit/typegraph.wit
+++ b/typegraph/core/wit/typegraph.wit
@@ -34,12 +34,28 @@ interface core {
         rate: option<rate>,
     }
 
-    enum typegraph-finalize-mode {
+    init-typegraph: func(params: typegraph-init-params) -> result<_, error>
+
+    record migration-action {
+        create: bool,
+        reset: bool
+    }
+
+    record migration-config {
+        migration-dir: option<string>,
+        action: migration-action
+    }
+
+    record artifact-resolution-config {
+        dir: option<string>, // cwd() if none
+        prisma-migration: migration-config
+    }
+
+    variant typegraph-finalize-mode {
         simple,
-        resolve-artifacts
+        resolve-artifacts(option<artifact-resolution-config>)
     }
 
-    init-typegraph: func(params: typegraph-init-params) -> result<_, error>
     finalize-typegraph: func(mode: typegraph-finalize-mode) -> result<string, error>
 
     type type-id = u32
@@ -498,13 +514,16 @@ interface utils {
     oauth2-with-extended-profiler: func(service-name: string, scopes: string, extension: string) -> result<string, error>
     oauth2-with-custom-profiler: func(service-name: string, scopes: string, profiler: type-id) -> result<string, error>
 
-    record query-body-params {
+    record query-deploy-params {
         tg: string,
         cli-version: string,
         secrets: option<list<tuple<string, string>>>,
     }
 
-    gen-gqlquery: func(params: query-body-params) -> result<string, error>
+    gql-deploy-query: func(params: query-deploy-params) -> result<string, error>
+    gql-remove-query: func(tg-name: list<string>) -> result<string, error>
+
+    unpack-tarb64: func(tar-b64: string, dest: string) -> result<_, error>
 }
 
 interface host {
diff --git a/typegraph/node/sdk/src/host/host.ts b/typegraph/node/sdk/src/host/host.ts
index c3bed43142..839bc4e53e 100644
--- a/typegraph/node/sdk/src/host/host.ts
+++ b/typegraph/node/sdk/src/host/host.ts
@@ -52,26 +52,30 @@ export function getCwd(): string {
   }
 }
 
-export function fileExists(path: string): boolean {
+export function fileExists(filePath: string): boolean {
   try {
-    return fs.existsSync(path);
+    return fs.existsSync(filePath);
   } catch (err) {
     throw (err instanceof Error ? err.message : err);
   }
 }
 
-export function readFile(path: string): Uint8Array {
+export function readFile(filePath: string): Uint8Array {
   try {
-    const buffer = fs.readFileSync(path, null);
+    const buffer = fs.readFileSync(filePath, null);
     return new Uint8Array(buffer);
   } catch (err) {
     throw (err instanceof Error ? err.message : err);
   }
 }
 
-export function writeFile(path: string, data: Uint8Array): void {
+export function writeFile(filePath: string, data: Uint8Array): void {
   try {
-    void fs.writeFileSync(path, data);
+    const dir = path.dirname(filePath);
+    if (!fs.existsSync(dir)) {
+      fs.mkdirSync(dir, { recursive: true });
+    }
+    void fs.writeFileSync(filePath, data, { flag: "w" });
   } catch (err) {
     throw (err instanceof Error ? err.message : err);
   }
diff --git a/typegraph/node/sdk/src/tg_deploy.ts b/typegraph/node/sdk/src/tg_deploy.ts
index 20f593b88a..f3b403d103 100644
--- a/typegraph/node/sdk/src/tg_deploy.ts
+++ b/typegraph/node/sdk/src/tg_deploy.ts
@@ -1,47 +1,88 @@
 // Copyright Metatype OÜ, licensed under the Mozilla Public License Version 2.0.
 // SPDX-License-Identifier: MPL-2.0
 
+import { ArtifactResolutionConfig } from "./gen/interfaces/metatype-typegraph-core.js";
 import { TypegraphOutput } from "./typegraph.js";
 import { wit_utils } from "./wit.js";
 
-export interface BasicAuth {
-  username: string;
-  password: string;
+export class BasicAuth {
+  constructor(public username: string, public password: string) {
+  }
+  asHeaderValue(): string {
+    return `Basic ${btoa(this.username + ":" + this.password)}`;
+  }
 }
 
 export interface TypegraphDeployParams {
   baseUrl: string;
   auth?: BasicAuth;
+  artifactsConfig?: ArtifactResolutionConfig;
   secrets: Record<string, string>;
   cliVersion: string;
 }
 
+export interface TypegraphRemoveParams {
+  baseUrl: string;
+  auth?: BasicAuth;
+}
+
+export interface DeployResult {
+  serialized: string;
+  typegate: Record<string, any> | string;
+}
+
+export interface RemoveResult {
+  typegate: Record<string, any> | string;
+}
+
 export async function tgDeploy(
   typegraph: TypegraphOutput,
   params: TypegraphDeployParams,
-) {
-  const { baseUrl, cliVersion, secrets, auth } = params;
-  const { serialized } = typegraph;
+): Promise<DeployResult> {
+  const { baseUrl, cliVersion, secrets, auth, artifactsConfig } = params;
+  const serialized = typegraph.serialize(artifactsConfig);
 
   const headers = new Headers();
   headers.append("Content-Type", "application/json");
   if (auth) {
-    headers.append(
-      "Authorization",
-      `Basic ${btoa(auth.username + ":" + auth.password)}`,
-    );
+    headers.append("Authorization", auth.asHeaderValue());
   }
 
   const response = await fetch(new URL("/typegate", baseUrl), {
     method: "POST",
     headers,
-    body: wit_utils.genGqlquery({
+    body: wit_utils.gqlDeployQuery({
       cliVersion,
       tg: serialized,
       secrets: Object.entries(secrets ?? {}),
     }),
   });
-  return handleResponse(response);
+  return {
+    serialized,
+    typegate: await handleResponse(response),
+  };
+}
+
+export async function tgRemove(
+  typegraph: TypegraphOutput,
+  params: TypegraphRemoveParams,
+): Promise<RemoveResult> {
+  const { baseUrl, auth } = params;
+
+  const headers = new Headers();
+  headers.append("Content-Type", "application/json");
+  if (auth) {
+    headers.append("Authorization", auth.asHeaderValue());
+  }
+
+  const response = await fetch(new URL("/typegate", baseUrl), {
+    method: "POST",
+    headers,
+    body: wit_utils.gqlRemoveQuery([typegraph.name]),
+  });
+  return {
+    typegate: await handleResponse(response),
+  };
 }
 
 async function handleResponse(
diff --git a/typegraph/node/sdk/src/typegraph.ts b/typegraph/node/sdk/src/typegraph.ts
index fd2d7b94c5..4e0eb2b4dd 100644
--- a/typegraph/node/sdk/src/typegraph.ts
+++ b/typegraph/node/sdk/src/typegraph.ts
@@ -13,6 +13,7 @@ import {
 import { Auth, Cors as CorsWit, Rate, wit_utils } from "./wit.js";
 import Policy from "./policy.js";
 import { getPolicyChain } from "./types.js";
+import { ArtifactResolutionConfig } from "./gen/interfaces/metatype-typegraph-core.js";
 
 type Exports = Record<string, t.Func>;
 
@@ -72,21 +73,21 @@ export class RawAuth {
 }
 
 export interface TypegraphOutput {
-  serialized: string;
-  args: Omit<TypegraphArgs, "builder">;
+  serialize: (config?: ArtifactResolutionConfig) => string;
+  name: string;
 }
 
 export function typegraph(
   name: string,
   builder: TypegraphBuilder,
-): void;
+): TypegraphOutput;
 export function typegraph(
   args: TypegraphArgs,
-): void;
+): TypegraphOutput;
 export function typegraph(
   args: Omit<TypegraphArgs, "builder">,
   builder: TypegraphBuilder,
-): void;
+): TypegraphOutput;
 export function typegraph(
   nameOrArgs: string | TypegraphArgs | Omit<TypegraphArgs, "builder">,
   maybeBuilder?: TypegraphBuilder,
@@ -168,21 +169,24 @@ export function typegraph(
 
   builder(g);
 
-  const tgJson = core.finalizeTypegraph(
-    disableAutoSerialization ? "resolve-artifacts" : "simple",
-  );
+  let serialize = () => "";
   if (!disableAutoSerialization) {
+    const tgJson = core.finalizeTypegraph({ tag: "simple" });
     console.log(tgJson);
+    serialize = () => tgJson;
+  } else {
+    // config is known at deploy time
+    serialize = (config?: ArtifactResolutionConfig) => {
+      const tgJson = core.finalizeTypegraph({
+        tag: "resolve-artifacts",
+        val: config,
+      });
+      return tgJson;
+    };
   }
   return {
-    serialized: tgJson,
-    args: {
-      name,
-      cors,
-      dynamic,
-      rate,
-      secrets,
-    },
+    serialize,
+    name,
   };
 }
 
diff --git a/typegraph/python/typegraph/graph/tg_deploy.py b/typegraph/python/typegraph/graph/tg_deploy.py
index 1b1a7fbc75..a33e61a4cb 100644
--- a/typegraph/python/typegraph/graph/tg_deploy.py
+++ b/typegraph/python/typegraph/graph/tg_deploy.py
@@ -2,14 +2,15 @@
 # SPDX-License-Identifier: MPL-2.0
 
 from dataclasses import dataclass
-from typing import Dict, Optional
+from typing import Dict, Optional, Union
 from urllib import request
 import json
 from base64 import b64encode
+from typegraph.gen.exports.core import ArtifactResolutionConfig
 from typegraph.gen.types import Err
 
 from typegraph.graph.typegraph import TypegraphOutput
-from typegraph.gen.exports.utils import QueryBodyParams
+from typegraph.gen.exports.utils import QueryDeployParams
 from typegraph.wit import store, wit_utils
 
 
@@ -18,32 +19,53 @@ class BasicAuth:
     username: str
     password: str
 
+    def as_header_value(self):
+        payload = b64encode(f"{self.username}:{self.password}".encode("utf-8")).decode(
+            "utf-8"
+        )
+        return f"Basic {payload}"
+
 
 @dataclass
 class TypegraphDeployParams:
     base_url: str
     cli_version: str
     auth: Optional[BasicAuth] = None
-    secrets: Optional[Dict[str, any]] = None
+    secrets: Optional[Dict[str, str]] = None
+    artifacts_config: Optional[ArtifactResolutionConfig] = None
+
+
+@dataclass
+class TypegraphRemoveParams:
+    base_url: str
+    auth: Optional[BasicAuth] = None
+
+
+@dataclass
+class DeployResult:
+    serialized: str
+    typegate: Union[Dict[str, any], str]
 
 
-def tg_deploy(tg: TypegraphOutput, params: TypegraphDeployParams):
+@dataclass
+class RemoveResult:
+    typegate: Union[Dict[str, any], str]
+
+
+def tg_deploy(tg: TypegraphOutput, params: TypegraphDeployParams) -> DeployResult:
     sep = "/" if not params.base_url.endswith("/") else ""
     url = params.base_url + sep + "typegate"
 
     headers = {"Content-Type": "application/json"}
     if params.auth is not None:
-        payload = b64encode(
-            f"{params.auth.username}:{params.auth.password}".encode("utf-8")
-        ).decode("utf-8")
-        headers["Authorization"] = f"Basic {payload}"
-
-    res = wit_utils.gen_gqlquery(
+        headers["Authorization"] = params.auth.as_header_value()
+    serialized = tg.serialize(params.artifacts_config)
+    res = wit_utils.gql_deploy_query(
         store,
-        params=QueryBodyParams(
-            tg=tg.serialized,
+        params=QueryDeployParams(
+            tg=serialized,
             cli_version=params.cli_version,
-            secrets=[(k, v) for k, v in (params.secrets or {})],
+            secrets=[(k, v) for k, v in (params.secrets or {}).items()],
         ),
     )
 
@@ -56,9 +78,36 @@ def tg_deploy(tg: TypegraphOutput, params: TypegraphDeployParams):
         headers=headers,
         data=res.value.encode(),
     )
+    return DeployResult(
+        serialized=serialized,
+        typegate=handle_response(request.urlopen(req).read().decode()),
+    )
+
+
+def tg_remove(tg: TypegraphOutput, params: TypegraphRemoveParams):
+    sep = "/" if not params.base_url.endswith("/") else ""
+    url = params.base_url + sep + "typegate"
+
+    headers = {"Content-Type": "application/json"}
+    if params.auth is not None:
+        headers["Authorization"] = params.auth.as_header_value()
+
+    res = wit_utils.gql_remove_query(store, [tg.name])
+
+    if isinstance(res, Err):
+        raise Exception(res.value)
+
+    req = request.Request(
+        url=url,
+        method="POST",
+        headers=headers,
+        data=res.value.encode(),
+    )
+    return RemoveResult(typegate=handle_response(request.urlopen(req).read().decode()))
+
 
-    body = request.urlopen(req).read().decode()
+def handle_response(res: any):
     try:
-        return json.loads(body)
+        return json.loads(res)
     except Exception as _:
-        return body
+        return res
diff --git a/typegraph/python/typegraph/graph/typegraph.py b/typegraph/python/typegraph/graph/typegraph.py
index 2b06340377..11f307566b 100644
--- a/typegraph/python/typegraph/graph/typegraph.py
+++ b/typegraph/python/typegraph/graph/typegraph.py
@@ -7,8 +7,10 @@
 from typing import TYPE_CHECKING, Callable, List, Optional, Union
 
 from typegraph.gen.exports.core import (
+    ArtifactResolutionConfig,
     Rate,
-    TypegraphFinalizeMode,
+    TypegraphFinalizeModeResolveArtifacts,
+    TypegraphFinalizeModeSimple,
     TypegraphInitParams,
 )
 from typegraph.gen.exports.core import (
@@ -122,8 +124,8 @@ def ref(self, name: str) -> "t.typedef":
 
 @dataclass
 class TypegraphOutput:
-    tg: Typegraph
-    serialized: str
+    name: str
+    serialize: Callable[[Optional[ArtifactResolutionConfig]], str]
 
 
 def typegraph(
@@ -170,20 +172,33 @@ def decorator(builder: Callable[[Graph], None]) -> TypegraphOutput:
         popped = Typegraph._context.pop()
         assert tg == popped
 
-        tg_json = core.finalize_typegraph(
-            store,
-            TypegraphFinalizeMode.RESOLVE_ARTIFACTS
-            if disable_auto_serialization
-            else TypegraphFinalizeMode.SIMPLE,
-        )
-
-        if isinstance(tg_json, Err):
-            raise Exception(tg_json.value)
+        serialize = None
 
         if not disable_auto_serialization:
+            tg_json = core.finalize_typegraph(store, TypegraphFinalizeModeSimple())
+            if isinstance(tg_json, Err):
+                raise Exception(tg_json.value)
+
             print(tg_json.value)
 
-        return lambda: TypegraphOutput(tg=tg, serialized=tg_json.value)
+            def no_conf():
+                return tg_json.value
+
+            serialize = no_conf
+        else:
+            # config is only known at deploy time
+            def serialize_with_artifacts(
+                config: Optional[ArtifactResolutionConfig] = None,
+            ):
+                mode = TypegraphFinalizeModeResolveArtifacts(config)
+                tg_json = core.finalize_typegraph(store, mode)
+                if isinstance(tg_json, Err):
+                    raise Exception(tg_json.value)
+                return tg_json.value
+
+            serialize = serialize_with_artifacts
+
+        return lambda: TypegraphOutput(name=tg.name, serialize=serialize)
 
     return decorator
 
diff --git a/typegraph/python/typegraph/host/host.py b/typegraph/python/typegraph/host/host.py
index a65cf1ecc6..05820bcca5 100644
--- a/typegraph/python/typegraph/host/host.py
+++ b/typegraph/python/typegraph/host/host.py
@@ -47,6 +47,8 @@ def read_file(self, path: str) -> Result[bytes, str]:
 
     def write_file(self, path: str, data: bytes) -> Result[None, str]:
         try:
+            dirname = os.path.dirname(path)
+            os.makedirs(dirname, exist_ok=True)
             file = open(path, "wb")
             file.write(data)
             return Ok(None)
diff --git a/typegraph/python/typegraph/utils.py b/typegraph/python/typegraph/utils.py
index 1232012352..f3b249eafe 100644
--- a/typegraph/python/typegraph/utils.py
+++ b/typegraph/python/typegraph/utils.py
@@ -7,6 +7,7 @@
 from typegraph.injection import InheritDef
 from typegraph.gen.exports.utils import ReducePath, ReduceValue
 from typegraph.injection import serialize_static_injection
+from typegraph.wit import store, wit_utils
 
 
 # def serialize_record_values(obj: Union[Dict[str, any], None]):
@@ -72,3 +73,7 @@ def build_reduce_data(node: any, paths: List[ReducePath], curr_path: List[str]):
         return paths
 
     raise Exception(f"unsupported type {type(node)} at {'.'.join(curr_path)}")
+
+
+def unpack_tarb64(tar_b64: str, dest: str):
+    return wit_utils.unpack_tarb64(store, tar_b64, dest)
diff --git a/typegraph/python/typegraph/wit.py b/typegraph/python/typegraph/wit.py
index 881ef20007..800af280ce 100644
--- a/typegraph/python/typegraph/wit.py
+++ b/typegraph/python/typegraph/wit.py
@@ -10,6 +10,13 @@
 from typegraph.gen.exports.utils import Utils
 from typegraph.host.host import HostImpl
 
+# Make sure the imports are similar to the node implementation
+from typegraph.gen.exports.core import (
+    ArtifactResolutionConfig,  # noqa
+    MigrationConfig,  # noqa
+    MigrationAction,  # noqa
+)
+
 store = Store()
 _typegraph_core = Root(store, RootImports(HostImpl()))