@prisma/composer-prisma-cloud 0.30.0-dev.3 → 0.30.0-dev.5

package/dist/local-target.mjs

@@ -1,5 +1,5 @@
 import { t as blindCast$1 } from "./casts-DpaahrlC-Ykus3kCE.mjs";
-import { E as isWithin, b as mintKeyPair, c as PrismaCloudContainer, d as collectPreflightNames, h as prismaCloudContainerOf, i as OrmMigrationProvider, n as GeneratedParamProvider, p as deserialize, s as PgWarmProvider, u as S3CredentialsProvider, v as serviceAppName, w as ServiceKeyProvider, x as Providers } from "./s3-credentials-resource-BZjtuopJ-azxxffwQ.mjs";
+import { C as Providers, E as ServiceKeyProvider, O as isWithin, S as mintKeyPair, b as serviceAppName, c as PgWarmProvider, d as S3CredentialsProvider, f as collectPreflightNames, g as prismaCloudContainerOf, l as PrismaCloudContainer, m as deserialize, n as GeneratedParamProvider, r as LocalOrmMigrationProvider, y as resourceName } from "./s3-credentials-resource-D4jcpAZp-DrGYkOaZ.mjs";
 import { createRequire } from "node:module";
 import { blindCast } from "@prisma/composer/casts";
 import * as Effect from "effect/Effect";
@@ -58,6 +58,21 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
+//#region ../../0-framework/0-foundation/foundation/dist/internal-error-Dfur7Zqt.mjs
+/**
+* A bug in Prisma ORM, not a user error. Never catch this except at the
+* outermost boundary for crash reporting — an InternalError means an invariant
+* broke and the process cannot reliably continue. User-facing failures use
+* `structuredError` with a dotted code instead.
+*/
+var InternalError = class extends Error {
+	isPrismaInternalError = true;
+	constructor(message, options) {
+		super(message, options?.cause !== void 0 ? { cause: options.cause } : void 0);
+		this.name = "InternalError";
+	}
+};
+//#endregion
 //#region ../../0-framework/0-foundation/foundation/dist/errors.mjs
 /**
 * Returns an object with the key/value if value is defined, otherwise an empty object.
@@ -1780,6 +1795,9 @@ function isPidAlive(pid) {
 		return false;
 	}
 }
+async function readRegistryEntry(registryRoot, name) {
+	return readJsonFile(registryFilePath(registryRoot, name), isRegistryEntry$1);
+}
 async function probeHealth(port, healthPath, timeoutMs) {
 	try {
 		const res = await fetch(`http://127.0.0.1:${port}${healthPath}`, { signal: AbortSignal.timeout(timeoutMs) });
@@ -2050,50 +2068,53 @@ async function ensureDaemon(name, entry, opts = {}) {
 		await release();
 	}
 }
-//#endregion
-//#region ../../1-prisma-cloud/0-lowering/dev-emulators/dist/segments-CA7TOJ1U.mjs
-/**
-* API hygiene shared by both daemons (local-dev spec § 2): every `<app>`,
-* `<id>`, and `<name>` path segment must match this shape or the request is
-* a 400 naming the segment.
-*/
-const SEGMENT_RE = /^[a-z0-9][a-z0-9-]*$/;
-function isValidSegment(segment) {
-	return segment.length <= 63 && SEGMENT_RE.test(segment);
-}
-//#endregion
-//#region ../../1-prisma-cloud/0-lowering/dev-emulators/dist/instance-name-BF6J_weL.mjs
-/**
-* `pcdev-<app>-<database-id>` instance-name derivation (local-dev spec § 2
-* `postgres-main.ts`): each half lowercased, every char outside `[a-z0-9]`
-* replaced by `-`, runs collapsed, the combined name trimmed to 63 chars.
-*
-* A separate, side-effect-free module (not defined inline in
-* `postgres-main.ts`) so it can be imported directly by tests without also
-* running that file's own `main()` — `postgres-main.ts` is a daemon
-* entrypoint script, always invoked as a subprocess, and calls `main()`
-* unconditionally at module load.
-*/
-/**
-* Deliberately linear, no ambiguous quantifiers: a per-character replace
-* (no `+`, so no run-length backtracking surface), a bounded-quantifier
-* collapse (`{2,}`, not alternation-with-quantifiers), and plain
-* index-walking for the leading/trailing trim instead of a regex — a
-* combined `+`-plus-alternation trim (`/^-+|-+$/g`) is exactly the shape
-* CodeQL's polynomial-ReDoS check flags, whether or not this particular
-* instance is provably safe.
-*/
-function slug(segment) {
-	const collapsed = segment.toLowerCase().replace(/[^a-z0-9]/g, "-").replace(/-{2,}/g, "-");
-	let start = 0;
-	let end = collapsed.length;
-	while (start < end && collapsed[start] === "-") start++;
-	while (end > start && collapsed[end - 1] === "-") end--;
-	return collapsed.slice(start, end);
-}
-function instanceNameFor(app, id) {
-	return `pcdev-${slug(app)}-${slug(id)}`.slice(0, 63);
-}
+(class ResultImpl {
+	ok;
+	_value;
+	_failure;
+	constructor(ok, valueOrFailure) {
+		this.ok = ok;
+		if (ok) this._value = blindCast$1(valueOrFailure);
+		else this._failure = blindCast$1(valueOrFailure);
+		Object.freeze(this);
+	}
+	get value() {
+		if (!this.ok) throw new InternalError("Cannot access value on NotOk result");
+		return this._value;
+	}
+	get failure() {
+		if (this.ok) throw new InternalError("Cannot access failure on Ok result");
+		return this._failure;
+	}
+	/**
+	* Creates a successful result.
+	*/
+	static ok(value) {
+		return blindCast$1(new ResultImpl(true, value));
+	}
+	/**
+	* Creates an unsuccessful result.
+	*/
+	static notOk(failure) {
+		return blindCast$1(new ResultImpl(false, failure));
+	}
+	/**
+	* Asserts that this result is Ok and returns the value.
+	* Throws if the result is NotOk.
+	*/
+	assertOk() {
+		if (!this.ok) throw new InternalError("Expected Ok result but got NotOk");
+		return this.value;
+	}
+	/**
+	* Asserts that this result is NotOk and returns the failure.
+	* Throws if the result is Ok.
+	*/
+	assertNotOk() {
+		if (this.ok) throw new InternalError("Expected NotOk result but got Ok");
+		return this.failure;
+	}
+}).ok(void 0);
 //#endregion
 //#region ../../1-prisma-cloud/0-lowering/dev-emulators/dist/index.mjs
 /**
@@ -2126,10 +2147,6 @@ function resolveBaseUrl(name, opts) {
 	if (!isRegistryEntry(parsed) || !isPidAlive(parsed.pid)) throw notRunningError(name);
 	return `http://127.0.0.1:${parsed.port}`;
 }
-function encodeSegment(segment) {
-	if (!isValidSegment(segment)) throw new Error(`invalid path segment "${segment}"`);
-	return encodeURIComponent(segment);
-}
 const ADMIN_FETCH_ATTEMPTS = 3;
 const ADMIN_FETCH_RETRY_DELAY_MS = 150;
 /**
@@ -2176,11 +2193,11 @@ const INSTANCE_STATUSES = /* @__PURE__ */ new Set([
 function isStringRecord$1(value) {
 	return typeof value === "object" && value !== null && Object.values(value).every((v) => typeof v === "string");
 }
-function isInstanceInfo(value) {
+function isServiceInstanceInfo(value) {
 	return typeof value === "object" && value !== null && "id" in value && typeof value.id === "string" && "labels" in value && isStringRecord$1(value.labels) && "port" in value && typeof value.port === "number" && "url" in value && typeof value.url === "string" && "status" in value && typeof value.status === "string" && INSTANCE_STATUSES.has(value.status) && "logPath" in value && typeof value.logPath === "string";
 }
-function isInstanceInfoArray(value) {
-	return Array.isArray(value) && value.every(isInstanceInfo);
+function isServiceInstanceInfoArray(value) {
+	return Array.isArray(value) && value.every(isServiceInstanceInfo);
 }
 function isHealthBody(value) {
 	return typeof value === "object" && value !== null && "version" in value && typeof value.version === "string";
@@ -2206,19 +2223,19 @@ function computeClient(opts = {}) {
 		},
 		async createInstance(request) {
 			const body = await (await expectOk(await adminFetch(`${baseUrl}/instances`, postJson(request), { retry: false }))).json();
-			if (!isInstanceInfo(body)) throw new Error("malformed instance-create response from the compute emulator");
+			if (!isServiceInstanceInfo(body)) throw new Error("malformed instance-create response from the compute emulator");
 			return body;
 		},
 		async listInstances() {
 			const body = await (await expectOk(await adminFetch(`${baseUrl}/instances`))).json();
-			if (!isInstanceInfoArray(body)) throw new Error("malformed instances listing from the compute emulator");
+			if (!isServiceInstanceInfoArray(body)) throw new Error("malformed instances listing from the compute emulator");
 			return body;
 		},
 		async getInstance(id) {
 			const res = await adminFetch(instancePath(baseUrl, id));
 			if (res.status === 404) return void 0;
 			const body = await (await expectOk(res)).json();
-			if (!isInstanceInfo(body)) throw new Error("malformed instance response from the compute emulator");
+			if (!isServiceInstanceInfo(body)) throw new Error("malformed instance response from the compute emulator");
 			return body;
 		},
 		async putDeployment(id, deployment) {
@@ -2255,8 +2272,15 @@ function computeClient(opts = {}) {
 		}
 	};
 }
+function isBucketInstanceInfo(value) {
+	return typeof value === "object" && value !== null && "id" in value && typeof value.id === "string" && "labels" in value && isStringRecord$1(value.labels) && "dir" in value && typeof value.dir === "string";
+}
+function isBucketInstanceInfoArray(value) {
+	return Array.isArray(value) && value.every(isBucketInstanceInfo);
+}
 function bucketsClient(opts = {}) {
 	const baseUrl = resolveBaseUrl("buckets", opts);
+	const adminUrl = `${baseUrl}/_pcdev/instances`;
 	return {
 		baseUrl,
 		async health() {
@@ -2264,15 +2288,25 @@ function bucketsClient(opts = {}) {
 			if (!isHealthBody(body)) throw new Error("malformed /_pcdev/health response from the buckets emulator");
 			return body;
 		},
-		async putBucket(app, name, dir) {
-			await expectOk(await adminFetch(`${baseUrl}/_pcdev/apps/${encodeSegment(app)}/buckets/${encodeSegment(name)}`, {
-				method: "PUT",
-				headers: { "content-type": "application/json" },
-				body: JSON.stringify({ dir })
-			}));
+		async createInstance(request) {
+			const body = await (await expectOk(await adminFetch(adminUrl, postJson(request), { retry: false }))).json();
+			if (!isBucketInstanceInfo(body)) throw new Error("malformed instance-create response from the buckets emulator");
+			return body;
+		},
+		async listInstances() {
+			const body = await (await expectOk(await adminFetch(adminUrl))).json();
+			if (!isBucketInstanceInfoArray(body)) throw new Error("malformed instances listing from the buckets emulator");
+			return body;
+		},
+		async getInstance(id) {
+			const res = await adminFetch(instancePath(`${baseUrl}/_pcdev`, id));
+			if (res.status === 404) return void 0;
+			const body = await (await expectOk(res)).json();
+			if (!isBucketInstanceInfo(body)) throw new Error("malformed instance response from the buckets emulator");
+			return body;
 		},
-		async putCredentials(app, accessKeyId, secretAccessKey) {
-			await expectOk(await adminFetch(`${baseUrl}/_pcdev/apps/${encodeSegment(app)}/credentials`, {
+		async putCredentials(id, accessKeyId, secretAccessKey) {
+			await expectOk(await adminFetch(`${instancePath(`${baseUrl}/_pcdev`, id)}/credentials`, {
 				method: "PUT",
 				headers: { "content-type": "application/json" },
 				body: JSON.stringify({
@@ -2281,19 +2315,16 @@ function bucketsClient(opts = {}) {
 				})
 			}));
 		},
-		async deleteApp(app) {
-			await expectOk(await adminFetch(`${baseUrl}/_pcdev/apps/${encodeSegment(app)}`, { method: "DELETE" }));
+		async deleteInstance(id) {
+			await expectOk(await adminFetch(instancePath(`${baseUrl}/_pcdev`, id), { method: "DELETE" }));
 		}
 	};
 }
-function isDatabaseInfo(value) {
-	return typeof value === "object" && value !== null && "id" in value && typeof value.id === "string" && "url" in value && typeof value.url === "string" && "instanceName" in value && typeof value.instanceName === "string" && "databasePort" in value && typeof value.databasePort === "number";
+function isDatabaseInstanceInfo(value) {
+	return typeof value === "object" && value !== null && "id" in value && typeof value.id === "string" && "labels" in value && isStringRecord$1(value.labels) && "port" in value && typeof value.port === "number" && "url" in value && typeof value.url === "string" && "status" in value && (value.status === "running" || value.status === "stopped");
 }
-function isDatabaseInfoArray(value) {
-	return Array.isArray(value) && value.every(isDatabaseInfo);
-}
-function isEnsuredDatabase(value) {
-	return typeof value === "object" && value !== null && "url" in value && typeof value.url === "string";
+function isDatabaseInstanceInfoArray(value) {
+	return Array.isArray(value) && value.every(isDatabaseInstanceInfo);
 }
 function postgresClient(opts = {}) {
 	const baseUrl = resolveBaseUrl("postgres", opts);
@@ -2304,25 +2335,53 @@ function postgresClient(opts = {}) {
 			if (!isHealthBody(body)) throw new Error("malformed /health response from the postgres emulator");
 			return body;
 		},
-		async ensureDatabase(app, id, prismaDevModulePath) {
-			const body = await (await expectOk(await adminFetch(`${baseUrl}/apps/${encodeSegment(app)}/databases/${encodeSegment(id)}`, {
-				method: "PUT",
-				headers: { "content-type": "application/json" },
-				body: JSON.stringify({ prismaDevModulePath })
-			}))).json();
-			if (!isEnsuredDatabase(body)) throw new Error("malformed database-ensure response from the postgres emulator");
+		async createInstance(request) {
+			const body = await (await expectOk(await adminFetch(`${baseUrl}/instances`, postJson(request), { retry: false }))).json();
+			if (!isDatabaseInstanceInfo(body)) throw new Error("malformed instance-create response from the postgres emulator");
+			return body;
+		},
+		async listInstances() {
+			const body = await (await expectOk(await adminFetch(`${baseUrl}/instances`))).json();
+			if (!isDatabaseInstanceInfoArray(body)) throw new Error("malformed instances listing from the postgres emulator");
 			return body;
 		},
-		async listDatabases(app) {
-			const body = await (await expectOk(await adminFetch(`${baseUrl}/apps/${encodeSegment(app)}/databases`))).json();
-			if (!isDatabaseInfoArray(body)) throw new Error("malformed databases listing from the postgres emulator");
+		async getInstance(id) {
+			const res = await adminFetch(instancePath(baseUrl, id));
+			if (res.status === 404) return void 0;
+			const body = await (await expectOk(res)).json();
+			if (!isDatabaseInstanceInfo(body)) throw new Error("malformed instance response from the postgres emulator");
 			return body;
 		},
-		async deleteApp(app) {
-			await expectOk(await adminFetch(`${baseUrl}/apps/${encodeSegment(app)}`, { method: "DELETE" }));
+		async startInstances(ids, prismaDevModulePath) {
+			await expectOk(await adminFetch(`${baseUrl}/instances/start`, postJson({
+				ids,
+				prismaDevModulePath
+			})));
+		},
+		async stopInstances(ids) {
+			await expectOk(await adminFetch(`${baseUrl}/instances/stop`, postJson({ ids })));
+		},
+		async deleteInstance(id, prismaDevModulePath) {
+			await expectOk(await adminFetch(instancePath(baseUrl, id), {
+				method: "DELETE",
+				...prismaDevModulePath !== void 0 ? {
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({ prismaDevModulePath })
+				} : {}
+			}));
 		}
 	};
 }
+const DAEMON_OF$1 = {
+	service: "compute",
+	database: "postgres",
+	bucket: "buckets"
+};
+/** Whether the emulator for `kind` is registered with a live process. */
+async function isEmulatorRunning(kind, opts = {}) {
+	const entry = await readRegistryEntry(opts.registryRoot ?? defaultRegistryRoot(), DAEMON_OF$1[kind]);
+	return entry !== void 0 && isPidAlive(entry.pid);
+}
 //#endregion
 //#region ../../../node_modules/tar/dist/esm/index.min.js
 var zr = Object.defineProperty;
@@ -5640,156 +5699,6 @@ function appNameOf(container) {
 	return container.input.appName;
 }
 /**
-* Shared helpers for the upstream-attribute records every local provider
-* emits — one implementation, so the compute and postgres families cannot
-* drift on the `'local'` project fallback or the timestamp.
-*/
-/** The fixed `createdAt`/`updatedAt` local providers stamp: local dev has no meaningful creation time. */
-const DEV_TIMESTAMP = "1970-01-01T00:00:00.000Z";
-/** Reads a project id from upstream's `project` input: a plain string or a resolved `Prisma.Project` attributes record. */
-function projectIdOfInput(value) {
-	if (typeof value === "string") return value;
-	if (Predicate.isObject(value) && typeof value["projectId"] === "string") return value["projectId"];
-	return "local";
-}
-/**
-* Local bucket-cluster providers (local-dev spec § 4): both `Bucket` and
-* `BucketAccessKey` are clients of the machine-global bucket emulator —
-* already up by the time these run, since the extension's
-* `localTarget.emulators` hook ensures it before converge.
-*/
-/** Upstream lets `name` default to the resource's logical ID; locally a bucket must have a concrete name to register under. */
-const bucketNameOf = (news, id) => news.name ?? id;
-/** Reads a bucket id from upstream's `bucket` input: a plain string or a resolved `Prisma.Bucket` attributes record. */
-function bucketIdOfInput(value) {
-	if (typeof value === "string") return value;
-	if (Predicate.isObject(value) && typeof value["bucketId"] === "string") return value["bucketId"];
-	return "local";
-}
-/** `Bucket` → registers `<app>--<name>` with the bucket emulator, backed by an in-project data root. */
-function LocalBucketProvider(input) {
-	return Provider.effect(Bucket, Effect.succeed({
-		list: () => Effect.succeed([]),
-		reconcile: ({ news, id }) => Effect.tryPromise({
-			try: async () => {
-				const app = appNameOf(input.container);
-				const name = bucketNameOf(news, id);
-				const dir = path$1.join(input.devDir, "buckets", name);
-				await bucketsClient().putBucket(app, name, dir);
-				return {
-					bucketId: name,
-					name,
-					projectId: projectIdOfInput(news.project),
-					createdAt: DEV_TIMESTAMP,
-					logicalId: null
-				};
-			},
-			catch: (cause) => cause
-		}),
-		delete: () => Effect.void,
-		read: ({ output }) => Effect.succeed(output)
-	}));
-}
-/**
-* `BucketAccessKey` → mint-once-stable (the same lifecycle as `ServiceKey`/
-* `S3Credentials`: reuse `output`'s pair when present, mint only on first
-* create) — but ALWAYS re-registers the (prior or fresh) pair with the
-* emulator, so a bucket emulator whose own state was wiped self-heals on the
-* next converge.
-*/
-function LocalBucketAccessKeyProvider(input) {
-	return Provider.effect(BucketAccessKey, Effect.succeed({
-		list: () => Effect.succeed([]),
-		reconcile: ({ news, output, id }) => Effect.tryPromise({
-			try: async () => {
-				const app = appNameOf(input.container);
-				const pair = output !== void 0 ? {
-					accessKeyId: output.accessKeyId,
-					secretAccessKey: Redacted.value(output.secretAccessKey)
-				} : mintKeyPair();
-				const client = bucketsClient();
-				await client.putCredentials(app, pair.accessKeyId, pair.secretAccessKey);
-				const bucketId = bucketIdOfInput(news.bucket);
-				return {
-					bucketAccessKeyId: news.name ?? id,
-					bucketId,
-					accessKeyId: pair.accessKeyId,
-					secretAccessKey: Redacted.make(pair.secretAccessKey),
-					endpoint: client.baseUrl,
-					bucketName: `${app}--${bucketId}`
-				};
-			},
-			catch: (cause) => cause
-		}),
-		delete: () => Effect.void,
-		read: ({ output }) => Effect.succeed(output)
-	}));
-}
-/**
-* Extracts the tar.gz `@internal/lowering`'s `packageComputeArtifact` writes
-* (local-dev spec § 4) — emulation-only code, so it lives here rather than
-* beside the writer (production source stays physically separated from
-* emulation). Reading tar is commodity even though the writer is a
-* deterministic subset we own (fixed mtimes, sorted entries): the maintained
-* `tar` package (dependency razor) does the parsing; this module keeps only
-* the pinned entry filtering (regular files plus safe relative symlinks,
-* reject devices/path escapes) and the directory-level temp-then-rename.
-*/
-function unsupportedEntryError(entryPath, type) {
-	return /* @__PURE__ */ new Error(`compute artifact entry "${entryPath}" has type "${type}" — only regular files and safe symlinks are supported; this artifact was not produced by packageComputeArtifact.`);
-}
-function pathEscapeError(entryPath) {
-	return /* @__PURE__ */ new Error(`compute artifact entry "${entryPath}" escapes the extraction directory — this artifact was not produced by packageComputeArtifact.`);
-}
-const REGULAR_FILE_TYPES = /* @__PURE__ */ new Set([
-	"File",
-	"OldFile",
-	"ContiguousFile"
-]);
-const SYMLINK_TYPE = "SymbolicLink";
-/**
-* Extracts `tarGzPath` (a `packageComputeArtifact` tar.gz) into `destDir`,
-* temp-then-rename at the directory level: entries are written into a
-* sibling temp directory first, then that directory is renamed onto
-* `destDir` — a concurrent unpack of the SAME hash races benignly (last
-* rename wins, both write identical bytes), and a reader of `destDir` never
-* sees a partial tree.
-*/
-function extractComputeArtifact(tarGzPath, destDir) {
-	const parentDir = path$1.dirname(destDir);
-	fs$2.mkdirSync(parentDir, { recursive: true });
-	const tmpDir = path$1.join(parentDir, `.${path$1.basename(destDir)}.${crypto$1.randomUUID()}.tmp`);
-	fs$2.mkdirSync(tmpDir, { recursive: true });
-	try {
-		So({
-			file: tarGzPath,
-			cwd: tmpDir,
-			sync: true,
-			onentry: (entry) => {
-				const resolved = path$1.resolve(tmpDir, entry.path);
-				if (!isWithin(tmpDir, resolved)) throw pathEscapeError(entry.path);
-				if (REGULAR_FILE_TYPES.has(entry.type)) return;
-				if (entry.type !== SYMLINK_TYPE) throw unsupportedEntryError(entry.path, entry.type);
-				if (entry.linkpath === void 0) throw unsupportedEntryError(entry.path, `${entry.type} without a target`);
-				if (path$1.isAbsolute(entry.linkpath)) throw pathEscapeError(`${entry.path} -> ${entry.linkpath}`);
-				const linkTarget = path$1.resolve(path$1.dirname(resolved), entry.linkpath);
-				if (!isWithin(tmpDir, linkTarget)) throw pathEscapeError(`${entry.path} -> ${entry.linkpath}`);
-			}
-		});
-		fs$2.rmSync(destDir, {
-			recursive: true,
-			force: true
-		});
-		fs$2.renameSync(tmpDir, destDir);
-	} catch (error) {
-		fs$2.rmSync(tmpDir, {
-			recursive: true,
-			force: true
-		});
-		throw error;
-	}
-}
-/**
 * The shared dev-instance store (local-dev spec § 4): the JSON files under
 * `<devDir>/` every local provider reads or writes. Every write is
 * temp-then-rename; reads and writes on the SAME file are additionally
@@ -5854,8 +5763,28 @@ function envStore(devDir) {
 function secretsStore(devDir) {
 	return createStore(path$1.join(devDir, "secrets.json"), isStringRecord, {}, 384);
 }
+/** Where local dev loads `@prisma/dev` from, for the Postgres emulator. */
+function noPrismaDevError(cause) {
+	return /* @__PURE__ */ new Error(`local dev needs @prisma/dev for its local Postgres emulator — @prisma/composer-prisma-cloud declares it as a dependency, but it did not resolve from Composer's own installation; reinstall your dependencies. (${cause instanceof Error ? cause.message : String(cause)})`);
+}
+/**
+* Composer owns the local Postgres emulator's version: `@prisma/dev` is a
+* dependency of `@prisma/composer-prisma-cloud` and is resolved from
+* Composer's own package, never from the app. The app's copy (if any) is
+* ignored on purpose — an old `@prisma/dev` pulled in transitively (alchemy
+* pins `^0.20.0`, whose pglite-socket crashes on any message over 64 KiB)
+* would otherwise silently replace the version Composer tested against.
+* The daemon imports the returned path dynamically.
+*/
+function resolvePrismaDevModulePath() {
+	try {
+		return createRequire(import.meta.url).resolve("@prisma/dev");
+	} catch (cause) {
+		throw noPrismaDevError(cause);
+	}
+}
 /**
-* Which emulator instance backs each node of the app run from a directory.
+* Which emulator instance backs each node of each app run from a directory.
 * `prisma dev` records it in `<directory>/.prisma-composer/dev/`, and every
 * Composer operation on an emulator instance goes through it. The emulators
 * know nothing about Composer: the labels written on create are for people
@@ -5863,128 +5792,293 @@ function secretsStore(devDir) {
 */
 const EMULATOR_INSTANCES_FILE = "emulator-instances.json";
 function isNodeInstance(value) {
-	return typeof value === "object" && value !== null && "kind" in value && value.kind === "compute" && "id" in value && typeof value.id === "string" && "port" in value && typeof value.port === "number";
+	if (typeof value !== "object" || value === null) return false;
+	if (!("id" in value) || typeof value.id !== "string" || !("kind" in value)) return false;
+	if (value.kind === "bucket") return true;
+	return (value.kind === "service" || value.kind === "database") && "port" in value && typeof value.port === "number";
+}
+function isNodes(value) {
+	return typeof value === "object" && value !== null && Object.values(value).every(isNodeInstance);
+}
+function isAppInstances(value) {
+	return typeof value === "object" && value !== null && "nodes" in value && isNodes(value.nodes);
 }
 function isEmulatorInstances(value) {
-	return typeof value === "object" && value !== null && "app" in value && typeof value.app === "string" && "nodes" in value && typeof value.nodes === "object" && value.nodes !== null && Object.values(value.nodes).every(isNodeInstance);
+	return typeof value === "object" && value !== null && "current" in value && typeof value.current === "string" && "apps" in value && typeof value.apps === "object" && value.apps !== null && Object.values(value.apps).every(isAppInstances);
+}
+function isEarlierServiceNode(value) {
+	return typeof value === "object" && value !== null && "kind" in value && value.kind === "compute" && "id" in value && typeof value.id === "string" && "port" in value && typeof value.port === "number";
+}
+function isSingleAppRecord(value) {
+	return typeof value === "object" && value !== null && "app" in value && typeof value.app === "string" && "nodes" in value && typeof value.nodes === "object" && value.nodes !== null && Object.values(value.nodes).every(isEarlierServiceNode);
+}
+function isStoredRecord(value) {
+	return isEmulatorInstances(value) || isSingleAppRecord(value);
 }
+/** A single-app record reads as a record holding that one app; the next write rewrites it. */
+function normalized(stored) {
+	if (stored === void 0 || isEmulatorInstances(stored)) return stored;
+	const nodes = Object.fromEntries(Object.entries(stored.nodes).map(([address, { id, port }]) => [address, {
+		kind: "service",
+		id,
+		port
+	}]));
+	return {
+		current: stored.app,
+		apps: { [stored.app]: { nodes } }
+	};
+}
+/**
+* A database's or bucket's key in the record: its resource `name`, which the
+* lowering sets from the same helper the emulators hook keys it by. A
+* resource without a name cannot be matched to the instance the hook
+* recorded, so it is refused rather than recorded under another key.
+*/
+function recordKeyOf(kind, resourceId, name) {
+	if (name === void 0) throw new Error(`local dev: the ${kind} resource "${resourceId}" has no name, so its emulator instance cannot be found in the directory's record.`);
+	return name;
+}
+/** The project directory that holds `devDir` (`<directory>/.prisma-composer/dev`). */
 function directoryOf(devDir) {
-	const normalized = path$1.normalize(devDir);
-	return normalized.endsWith(DEV_DIR) ? normalized.slice(0, -DEV_DIR.length - 1) : normalized;
+	const normalizedDir = path$1.normalize(devDir);
+	return normalizedDir.endsWith(DEV_DIR) ? normalizedDir.slice(0, -DEV_DIR.length - 1) : normalizedDir;
 }
 function store(devDir) {
-	return createStore(path$1.join(devDir, EMULATOR_INSTANCES_FILE), isEmulatorInstances, void 0);
+	return createStore(path$1.join(devDir, EMULATOR_INSTANCES_FILE), isStoredRecord, void 0);
+}
+async function readRecord(devDir) {
+	return normalized(await store(devDir).read());
+}
+async function updateRecord(devDir, mutate) {
+	await store(devDir).update((stored) => mutate(normalized(stored)));
 }
-/** This app's nodes. A record left by another app run from the same directory counts as empty. */
-async function appNodes(scope) {
-	const current = await store(scope.devDir).read();
-	return current?.app === scope.app ? current.nodes : {};
+/** The record `prisma dev` left in `directory`; undefined when it has not run there. */
+function readEmulatorInstances(directory) {
+	return readRecord(path$1.join(directory, DEV_DIR));
+}
+async function appNodes$1(scope) {
+	return (await readRecord(scope.devDir))?.apps[scope.app]?.nodes ?? {};
 }
 async function updateNodes(scope, mutate) {
-	await store(scope.devDir).update((current) => {
-		const nodes = { ...current?.app === scope.app ? current.nodes : {} };
+	await updateRecord(scope.devDir, (record) => {
+		const nodes = { ...record?.apps[scope.app]?.nodes ?? {} };
 		mutate(nodes);
 		return {
-			app: scope.app,
-			nodes
+			current: record?.current ?? scope.app,
+			apps: {
+				...record?.apps,
+				[scope.app]: { nodes }
+			}
 		};
 	});
 }
+function labelsFor(scope, address) {
+	return {
+		"composer.directory": directoryOf(scope.devDir),
+		"composer.app": scope.app,
+		"composer.address": address
+	};
+}
+function idsOf(nodes, kind) {
+	return Object.values(nodes).flatMap((node) => node.kind === kind ? [node.id] : []);
+}
 /**
-* A directory has one dev instance. When the record names another app, that
-* app's compute instances are deleted and the record starts over for this
-* one. Returns the previous app's name when it was retired.
+* Stops the service processes and database servers of `nodes`, keeping
+* their data and ports, and returns the nodes it stopped. A kind whose
+* emulator is not running has nothing running to stop.
 */
-async function retirePreviousApp(scope) {
-	const current = await store(scope.devDir).read();
-	if (current === void 0 || current.app === scope.app) return void 0;
-	const client = computeClient();
-	for (const instance of Object.values(current.nodes)) await client.deleteInstance(instance.id);
-	await store(scope.devDir).update(() => ({
-		app: scope.app,
-		nodes: {}
+async function stopNodes(nodes) {
+	const services = idsOf(nodes, "service");
+	const databases = idsOf(nodes, "database");
+	const results = await Promise.allSettled([services.length > 0 && whenRunning("service", () => computeClient().stopInstances(services)), databases.length > 0 && whenRunning("database", () => postgresClient().stopInstances(databases))]);
+	const failure = results.find((result) => result.status === "rejected");
+	if (failure) throw failure.reason;
+	const stoppedKinds = /* @__PURE__ */ new Set();
+	if (results[0].status === "fulfilled" && results[0].value === true) stoppedKinds.add("service");
+	if (results[1].status === "fulfilled" && results[1].value === true) stoppedKinds.add("database");
+	return Object.entries(nodes).flatMap(([address, node]) => node.kind !== "bucket" && stoppedKinds.has(node.kind) ? [{
+		address,
+		kind: node.kind
+	}] : []);
+}
+/** Runs `action` when the emulator for `kind` is running; returns whether it ran. */
+async function whenRunning(kind, action) {
+	if (!await isEmulatorRunning(kind)) return false;
+	await action();
+	return true;
+}
+/**
+* Makes `scope.app` the directory's current app. When another app ran here
+* last, its service processes and database servers are stopped and its
+* instances stay recorded, so running it again resumes them with their data
+* and ports. Returns the previous app's name when it changed.
+*/
+async function selectApp(scope) {
+	const record = await readRecord(scope.devDir);
+	const previous = record?.current;
+	if (previous !== void 0 && previous !== scope.app) await stopNodes(record?.apps[previous]?.nodes ?? {});
+	await updateRecord(scope.devDir, (latest) => ({
+		current: scope.app,
+		apps: {
+			...latest?.apps,
+			[scope.app]: latest?.apps[scope.app] ?? { nodes: {} }
+		}
 	}));
-	return current.app;
+	return previous !== void 0 && previous !== scope.app ? previous : void 0;
 }
-/** Each compute node of the app, with the instance that backs it. */
-async function computeNodeInstances(scope) {
-	return Object.entries(await appNodes(scope)).map(([address, instance]) => ({
+/** Each node of the app of `kind`, with the instance that backs it. */
+async function nodeInstancesOf(scope, kind) {
+	return Object.entries(await appNodes$1(scope)).flatMap(([address, instance]) => isOfKind(instance, kind) ? [{
 		address,
 		instance
-	}));
+	}] : []);
 }
-/** The compute instance recorded for `address`; undefined when there is none. */
-async function mappedComputeInstance(scope, address) {
-	return (await appNodes(scope))[address];
+function isOfKind(instance, kind) {
+	return instance.kind === kind;
+}
+/** The instance of `kind` recorded for `address`; undefined when there is none. */
+async function recordedInstance(scope, address, kind) {
+	const recorded = (await appNodes$1(scope))[address];
+	return recorded !== void 0 && isOfKind(recorded, kind) ? recorded : void 0;
 }
 /**
 * The instance that runs the service at `address`. The recorded instance is
 * reused while the Compute emulator still has it. Otherwise a new one is
 * created, requesting the recorded port, and recorded.
 */
-async function ensureComputeInstance(scope, address) {
+async function ensureServiceInstance(scope, address) {
 	const client = computeClient();
-	const recorded = await mappedComputeInstance(scope, address);
+	const recorded = await recordedInstance(scope, address, "service");
 	if (recorded && await client.getInstance(recorded.id)) return { instance: recorded };
 	const created = await client.createInstance({
-		labels: {
-			"composer.directory": directoryOf(scope.devDir),
-			"composer.app": scope.app,
-			"composer.address": address
-		},
+		labels: labelsFor(scope, address),
 		...recorded ? { port: recorded.port } : {}
 	});
 	const instance = {
-		kind: "compute",
+		kind: "service",
 		id: created.id,
 		port: created.port
 	};
 	await updateNodes(scope, (nodes) => {
 		nodes[address] = instance;
 	});
-	if (recorded && recorded.port !== created.port) return {
+	return {
 		instance,
-		portChange: {
-			address,
-			previous: recorded.port,
-			given: created.port
-		}
+		...portChangeOf("service", address, recorded?.port, created.port)
 	};
-	return { instance };
 }
-/** The emulator's view of the instance recorded for `address`; undefined when either is missing. */
-async function liveComputeInstance(scope, address) {
-	const recorded = await mappedComputeInstance(scope, address);
+function portChangeOf(kind, address, previous, given) {
+	return previous !== void 0 && previous !== given ? { portChange: {
+		kind,
+		address,
+		previous,
+		given
+	} } : {};
+}
+/**
+* The running database for `address`. A recorded database the Postgres
+* emulator still has is started if it is stopped. Otherwise a new one is
+* created, requesting the recorded port, and recorded; it starts empty.
+*/
+async function ensureDatabaseInstance(scope, address, prismaDevModulePath) {
+	const client = postgresClient();
+	const recorded = await recordedInstance(scope, address, "database");
+	const existing = recorded ? await client.getInstance(recorded.id) : void 0;
+	if (existing?.status === "running") return { instance: existing };
+	if (existing) {
+		await client.startInstances([existing.id], prismaDevModulePath);
+		return { instance: await client.getInstance(existing.id) ?? existing };
+	}
+	const created = await client.createInstance({
+		labels: labelsFor(scope, address),
+		...recorded ? { port: recorded.port } : {},
+		prismaDevModulePath
+	});
+	await updateNodes(scope, (nodes) => {
+		nodes[address] = {
+			kind: "database",
+			id: created.id,
+			port: created.port
+		};
+	});
+	return {
+		instance: created,
+		...portChangeOf("database", address, recorded?.port, created.port)
+	};
+}
+/**
+* The bucket for `address`. The recorded bucket is reused while the bucket
+* emulator still has it. Otherwise a new one is created over `dir` and
+* recorded; the objects already in `dir` are its objects.
+*/
+async function ensureBucketInstance(scope, address, dir) {
+	const client = bucketsClient();
+	const recorded = await recordedInstance(scope, address, "bucket");
+	const existing = recorded ? await client.getInstance(recorded.id) : void 0;
+	if (existing) return existing;
+	const created = await client.createInstance({
+		labels: labelsFor(scope, address),
+		dir
+	});
+	await updateNodes(scope, (nodes) => {
+		nodes[address] = {
+			kind: "bucket",
+			id: created.id
+		};
+	});
+	return created;
+}
+/** The Compute emulator's view of the instance recorded for `address`; undefined when either is missing. */
+async function liveServiceInstance(scope, address) {
+	const recorded = await recordedInstance(scope, address, "service");
 	return recorded ? computeClient().getInstance(recorded.id) : void 0;
 }
+/** The id recorded for `address`; undefined when there is none. */
+async function recordedInstanceId(scope, address) {
+	return (await appNodes$1(scope))[address]?.id;
+}
+async function deleteInstance(instance) {
+	if (instance.kind === "service") await computeClient().deleteInstance(instance.id);
+	else if (instance.kind === "database") await postgresClient().deleteInstance(instance.id, resolvePrismaDevModulePath());
+	else await bucketsClient().deleteInstance(instance.id);
+}
 /** Deletes the instance recorded for `address` and forgets it. */
-async function deleteComputeInstance(scope, address) {
-	const recorded = await mappedComputeInstance(scope, address);
+async function deleteNodeInstance(scope, address) {
+	const recorded = (await appNodes$1(scope))[address];
 	if (!recorded) return;
-	await computeClient().deleteInstance(recorded.id);
+	await deleteInstance(recorded);
 	await updateNodes(scope, (nodes) => {
 		delete nodes[address];
 	});
 }
+/** The kinds of instance recorded for the app, so a caller can start their emulators first. */
+async function recordedKinds(scope) {
+	return new Set(Object.values(await appNodes$1(scope)).map((node) => node.kind));
+}
 /**
-* `--fresh`: deletes every instance the directory's record names, whichever
-* app wrote it, then empties the record. Teardown runs before the emulators
-* hook, so the record may still name the app run here before.
+* `--fresh`: deletes the app's recorded instances of every kind and its
+* entry. Other apps' entries are left alone. A bucket's objects live in the
+* dev directory, which `--fresh` removes separately.
 */
-async function deleteRecordedInstances(devDir) {
-	const current = await store(devDir).read();
-	if (current === void 0) return;
-	const client = computeClient();
-	for (const instance of Object.values(current.nodes)) await client.deleteInstance(instance.id);
-	await store(devDir).update(() => ({
-		app: current.app,
-		nodes: {}
-	}));
+async function deleteAppInstances(scope) {
+	for (const instance of Object.values(await appNodes$1(scope))) await deleteInstance(instance);
+	await updateRecord(scope.devDir, (record) => {
+		const apps = { ...record?.apps };
+		delete apps[scope.app];
+		return {
+			current: record?.current ?? scope.app,
+			apps
+		};
+	});
+}
+/** When `prisma dev` ends: stops the app's service processes and database servers, keeping their data and ports. */
+async function stopAppInstances(scope) {
+	return stopNodes(await appNodes$1(scope));
 }
 /**
-* The Compute emulator's failure messages name instances by id; `prisma dev`
-* names services by address. Rewrites a plain `Error`'s message and leaves
-* any other error, such as a structured one, untouched.
+* The emulators' failure messages name instances by id; `prisma dev` names
+* services by address. Rewrites a plain `Error`'s message and leaves any
+* other error, such as a structured one, untouched.
 */
 function withServiceAddresses(error, nodes) {
 	if (!(error instanceof Error) || error.constructor !== Error) return error;
@@ -5993,6 +6087,204 @@ function withServiceAddresses(error, nodes) {
 	return message === error.message ? error : new Error(message, { cause: error });
 }
 /**
+* Shared helpers for the upstream-attribute records every local provider
+* emits — one implementation, so the compute and postgres families cannot
+* drift on the `'local'` project fallback or the timestamp.
+*/
+/** The fixed `createdAt`/`updatedAt` local providers stamp: local dev has no meaningful creation time. */
+const DEV_TIMESTAMP = "1970-01-01T00:00:00.000Z";
+/** Reads a project id from upstream's `project` input: a plain string or a resolved `Prisma.Project` attributes record. */
+function projectIdOfInput(value) {
+	if (typeof value === "string") return value;
+	if (Predicate.isObject(value) && typeof value["projectId"] === "string") return value["projectId"];
+	return "local";
+}
+/**
+* Local bucket-cluster providers (local-dev spec § 4): both `Bucket` and
+* `BucketAccessKey` are clients of the machine-global bucket emulator —
+* already up by the time these run, since the extension's
+* `localTarget.emulators` hook ensures it before converge.
+*/
+/** Reads a bucket id from upstream's `bucket` input: a plain string or a resolved `Prisma.Bucket` attributes record. */
+function bucketIdOfInput(value) {
+	if (typeof value === "string") return value;
+	if (Predicate.isObject(value) && typeof value["bucketId"] === "string") return value["bucketId"];
+	return "local";
+}
+const BUCKETS_DIR = "buckets";
+/** Where a bucket's objects live: in the project's dev directory, under its app, so `--fresh` removes them with the app. */
+function bucketDataDir(scope, name) {
+	return path$1.join(scope.devDir, BUCKETS_DIR, scope.app, name);
+}
+function appScopeOf$2(input) {
+	return {
+		devDir: input.devDir,
+		app: appNameOf(input.container)
+	};
+}
+/**
+* `Bucket` → the bucket instance the directory's record names for the
+* resource, created when there is none, over an in-project data root. Its
+* `bucketId` is the instance id, which is also its S3 bucket name. A Bucket
+* whose recorded instance changed is updated, so its access key is
+* registered on the new instance.
+*/
+function LocalBucketProvider(input) {
+	return Provider.effect(Bucket, Effect.succeed({
+		list: () => Effect.succeed([]),
+		reconcile: ({ news, id }) => Effect.tryPromise({
+			try: async () => {
+				const name = recordKeyOf("bucket", id, news.name);
+				return {
+					bucketId: (await ensureBucketInstance(appScopeOf$2(input), name, bucketDataDir(appScopeOf$2(input), name))).id,
+					name,
+					projectId: projectIdOfInput(news.project),
+					createdAt: DEV_TIMESTAMP,
+					logicalId: null
+				};
+			},
+			catch: (cause) => cause
+		}),
+		diff: ({ output }) => Effect.tryPromise({
+			try: async () => {
+				if (output === void 0) return void 0;
+				return await recordedInstanceId(appScopeOf$2(input), output.name) === output.bucketId ? void 0 : { action: "update" };
+			},
+			catch: (cause) => cause
+		}),
+		delete: () => Effect.void,
+		read: ({ output }) => Effect.succeed(output)
+	}));
+}
+/**
+* `BucketAccessKey` → mint-once-stable (the same lifecycle as `ServiceKey`/
+* `S3Credentials`: reuse `output`'s pair when present, mint only on first
+* create) — but ALWAYS re-registers the (prior or fresh) pair with the
+* emulator, so a bucket emulator whose own state was wiped self-heals on the
+* next converge.
+*/
+function LocalBucketAccessKeyProvider(_input) {
+	return Provider.effect(BucketAccessKey, Effect.succeed({
+		list: () => Effect.succeed([]),
+		reconcile: ({ news, output, id }) => Effect.tryPromise({
+			try: async () => {
+				const pair = output !== void 0 ? {
+					accessKeyId: output.accessKeyId,
+					secretAccessKey: Redacted.value(output.secretAccessKey)
+				} : mintKeyPair();
+				const client = bucketsClient();
+				const bucketId = bucketIdOfInput(news.bucket);
+				await client.putCredentials(bucketId, pair.accessKeyId, pair.secretAccessKey);
+				return {
+					bucketAccessKeyId: news.name ?? id,
+					bucketId,
+					accessKeyId: pair.accessKeyId,
+					secretAccessKey: Redacted.make(pair.secretAccessKey),
+					endpoint: client.baseUrl,
+					bucketName: bucketId
+				};
+			},
+			catch: (cause) => cause
+		}),
+		delete: () => Effect.void,
+		read: ({ output }) => Effect.succeed(output)
+	}));
+}
+/**
+* The emulators hook's half of the directory's record: before Alchemy runs,
+* every node of the app gets its emulator instance, one at a time in the
+* order given.
+*/
+/**
+* Ensures each node's instance, in the order given: a recorded instance is
+* reused (a stopped database is started), a missing one is created again on
+* its remembered port, and a new node gets a new instance. A new instance
+* gets the smallest free port, so on a fresh start the ports follow this
+* order. Returns the nodes whose re-created instance could not get its
+* remembered port back.
+*/
+async function ensureAppInstances(scope, nodes) {
+	const changes = [];
+	for (const { address, kind } of nodes) try {
+		const { portChange } = await ensureNodeInstance(scope, address, kind);
+		if (portChange) changes.push(portChange);
+	} catch (cause) {
+		const reason = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`ensuring the local instance for ${kind} "${address}" failed: ${reason}`, { cause });
+	}
+	return changes;
+}
+async function ensureNodeInstance(scope, address, kind) {
+	if (kind === "service") return ensureServiceInstance(scope, address);
+	if (kind === "database") return ensureDatabaseInstance(scope, address, resolvePrismaDevModulePath());
+	await ensureBucketInstance(scope, address, bucketDataDir(scope, address));
+	return {};
+}
+/**
+* Extracts the tar.gz `@internal/lowering`'s `packageComputeArtifact` writes
+* (local-dev spec § 4) — emulation-only code, so it lives here rather than
+* beside the writer (production source stays physically separated from
+* emulation). Reading tar is commodity even though the writer is a
+* deterministic subset we own (fixed mtimes, sorted entries): the maintained
+* `tar` package (dependency razor) does the parsing; this module keeps only
+* the pinned entry filtering (regular files plus safe relative symlinks,
+* reject devices/path escapes) and the directory-level temp-then-rename.
+*/
+function unsupportedEntryError(entryPath, type) {
+	return /* @__PURE__ */ new Error(`compute artifact entry "${entryPath}" has type "${type}" — only regular files and safe symlinks are supported; this artifact was not produced by packageComputeArtifact.`);
+}
+function pathEscapeError(entryPath) {
+	return /* @__PURE__ */ new Error(`compute artifact entry "${entryPath}" escapes the extraction directory — this artifact was not produced by packageComputeArtifact.`);
+}
+const REGULAR_FILE_TYPES = /* @__PURE__ */ new Set([
+	"File",
+	"OldFile",
+	"ContiguousFile"
+]);
+const SYMLINK_TYPE = "SymbolicLink";
+/**
+* Extracts `tarGzPath` (a `packageComputeArtifact` tar.gz) into `destDir`,
+* temp-then-rename at the directory level: entries are written into a
+* sibling temp directory first, then that directory is renamed onto
+* `destDir` — a concurrent unpack of the SAME hash races benignly (last
+* rename wins, both write identical bytes), and a reader of `destDir` never
+* sees a partial tree.
+*/
+function extractComputeArtifact(tarGzPath, destDir) {
+	const parentDir = path$1.dirname(destDir);
+	fs$2.mkdirSync(parentDir, { recursive: true });
+	const tmpDir = path$1.join(parentDir, `.${path$1.basename(destDir)}.${crypto$1.randomUUID()}.tmp`);
+	fs$2.mkdirSync(tmpDir, { recursive: true });
+	try {
+		So({
+			file: tarGzPath,
+			cwd: tmpDir,
+			sync: true,
+			onentry: (entry) => {
+				const resolved = path$1.resolve(tmpDir, entry.path);
+				if (!isWithin(tmpDir, resolved)) throw pathEscapeError(entry.path);
+				if (REGULAR_FILE_TYPES.has(entry.type)) return;
+				if (entry.type !== SYMLINK_TYPE) throw unsupportedEntryError(entry.path, entry.type);
+				if (entry.linkpath === void 0) throw unsupportedEntryError(entry.path, `${entry.type} without a target`);
+				if (path$1.isAbsolute(entry.linkpath)) throw pathEscapeError(`${entry.path} -> ${entry.linkpath}`);
+				const linkTarget = path$1.resolve(path$1.dirname(resolved), entry.linkpath);
+				if (!isWithin(tmpDir, linkTarget)) throw pathEscapeError(`${entry.path} -> ${entry.linkpath}`);
+			}
+		});
+		fs$2.rmSync(destDir, {
+			recursive: true,
+			force: true
+		});
+		fs$2.renameSync(tmpDir, destDir);
+	} catch (error) {
+		fs$2.rmSync(tmpDir, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
+}
+/**
 * Local compute-cluster providers: upstream alchemy's `Prisma.App` and
 * `Prisma.Deployment` become clients of the machine-scoped Compute emulator;
 * `Prisma.EnvironmentVariable` becomes a row in the dev env store;
@@ -6106,7 +6398,7 @@ async function materializeEnv(devDir, address, port) {
 	if (process.env["HOME"] !== void 0) env["HOME"] = process.env["HOME"];
 	return env;
 }
-function appScopeOf(input) {
+function appScopeOf$1(input) {
 	return {
 		devDir: input.devDir,
 		app: appNameOf(input.container)
@@ -6128,7 +6420,7 @@ function LocalAppProvider(input) {
 		reconcile: ({ id, news }) => Effect.tryPromise({
 			try: async () => {
 				const name = news.displayName ?? id;
-				const { instance } = await ensureComputeInstance(appScopeOf(input), name);
+				const { instance } = await ensureServiceInstance(appScopeOf$1(input), name);
 				const url = localUrl(instance.port);
 				return {
 					appId: name,
@@ -6147,41 +6439,18 @@ function LocalAppProvider(input) {
 		diff: ({ output }) => Effect.tryPromise({
 			try: async () => {
 				if (output === void 0) return void 0;
-				if ((await liveComputeInstance(appScopeOf(input), output.name))?.url === output.appEndpointDomain) return void 0;
+				if ((await liveServiceInstance(appScopeOf$1(input), output.name))?.url === output.appEndpointDomain) return void 0;
 				return { action: "update" };
 			},
 			catch: (cause) => cause
 		}),
 		delete: ({ output }) => Effect.tryPromise({
-			try: () => deleteComputeInstance(appScopeOf(input), output.name),
+			try: () => deleteNodeInstance(appScopeOf$1(input), output.name),
 			catch: (cause) => cause
 		}),
 		read: ({ output }) => Effect.succeed(output)
 	}));
 }
-/**
-* Ensures each service's emulator instance one at a time, in the order given,
-* before Alchemy applies the `App` resources concurrently. A new instance gets
-* the smallest free port, so on a fresh start the ports follow this order; a
-* service that already has an instance keeps its port. `serviceAppNames` are
-* the `App` resources' `displayName`s. Returns the services whose instance had
-* to be re-created and could not get its remembered port back.
-*/
-async function ensureServiceInstances(container, devDir, serviceAppNames) {
-	const scope = {
-		devDir,
-		app: appNameOf(container)
-	};
-	const changes = [];
-	for (const service of serviceAppNames) try {
-		const { portChange } = await ensureComputeInstance(scope, service);
-		if (portChange) changes.push(portChange);
-	} catch (cause) {
-		const reason = cause instanceof Error ? cause.message : String(cause);
-		throw new Error(`ensuring the local service for service "${service}" failed: ${reason}`, { cause });
-	}
-	return changes;
-}
 /** `Prisma.EnvironmentVariable` → a key/value row in `<devDir>/env.json`. Upstream's value is `Redacted`; env.json holds the plain string the child process is given. */
 function LocalEnvironmentVariableProvider(input) {
 	return Provider.effect(EnvironmentVariable, Effect.succeed({
@@ -6239,7 +6508,7 @@ function LocalDeploymentProvider(input) {
 				const artifactDir = path$1.join(input.devDir, "artifacts", artifactHash);
 				if (!fs$2.existsSync(artifactDir)) extractComputeArtifact(news.artifactPath, artifactDir);
 				const { address, listens } = readComputeManifest(artifactDir);
-				const { instance } = await ensureComputeInstance(appScopeOf(input), appId);
+				const { instance } = await ensureServiceInstance(appScopeOf$1(input), appId);
 				const env = await materializeEnv(input.devDir, address, instance.port);
 				try {
 					await computeClient().putDeployment(instance.id, {
@@ -6270,7 +6539,7 @@ function LocalDeploymentProvider(input) {
 		diff: ({ output }) => Effect.tryPromise({
 			try: async () => {
 				if (output === void 0) return void 0;
-				if ((await liveComputeInstance(appScopeOf(input), output.appId))?.artifactHash === output.artifactHash) return void 0;
+				if ((await liveServiceInstance(appScopeOf$1(input), output.appId))?.artifactHash === output.artifactHash) return void 0;
 				return { action: "update" };
 			},
 			catch: (cause) => cause
@@ -6304,57 +6573,106 @@ function LocalProjectProvider(_input) {
 		delete: () => Effect.void
 	}));
 }
-/**
-* Local postgres-cluster providers: upstream alchemy's `Prisma.Database` and
-* `Prisma.Connection` become clients of the `postgres-main` emulator daemon
-* (one named, persistent `@prisma/dev` server per `Database` resource).
-* `PgWarm`/`OrmMigration` are not here — the hosted ones run against whatever
-* URL they are handed. Attributes match upstream's shapes; the daemon's
-* DIRECT connection string maps to `directConnectionString` and
-* `databaseUrl`, everything else is left absent. Instance names come from
-* `@internal/dev-emulators`' own `instanceNameFor` — a locally re-derived
-* slug drifted from the daemon's and broke `Connection`'s lookup.
-*/
+const CONDITION_OF = {
+	running: "running",
+	stopped: "stopped",
+	backoff: "crashing",
+	held: "crashing"
+};
+/** A node whose emulator no longer has the instance the record names. */
+function missing(address, kind) {
+	return {
+		address,
+		kind,
+		emulator: "running",
+		state: "missing",
+		condition: "missing"
+	};
+}
+async function locate(address, node) {
+	const kind = node.kind;
+	if (!await isEmulatorRunning(kind)) return {
+		address,
+		kind,
+		emulator: "not-running"
+	};
+	if (node.kind === "service") {
+		const instance = await computeClient().getInstance(node.id);
+		if (instance === void 0) return missing(address, kind);
+		return {
+			address,
+			kind,
+			emulator: "running",
+			url: instance.url,
+			state: instance.status,
+			condition: CONDITION_OF[instance.status],
+			logPath: instance.logPath
+		};
+	}
+	if (node.kind === "database") {
+		const instance = await postgresClient().getInstance(node.id);
+		if (instance === void 0) return missing(address, kind);
+		return {
+			address,
+			kind,
+			emulator: "running",
+			url: instance.url,
+			state: instance.status,
+			condition: instance.status
+		};
+	}
+	const client = bucketsClient();
+	if (await client.getInstance(node.id) === void 0) return missing(address, kind);
+	return {
+		address,
+		kind,
+		emulator: "running",
+		url: `${client.baseUrl}/${node.id}`,
+		state: "running",
+		condition: "running"
+	};
+}
+/** The directory's current app; undefined when `prisma dev` never ran there. */
+async function currentApp(devDir) {
+	const record = await readEmulatorInstances(directoryOf(devDir));
+	if (record === void 0) return void 0;
+	const app = record.current;
+	const nodes = record.apps[app]?.nodes ?? {};
+	return {
+		app,
+		addresses: Object.keys(nodes),
+		locate: async (address) => {
+			const node = nodes[address];
+			return node === void 0 ? void 0 : locate(address, node);
+		},
+		stop: () => stopAppInstances({
+			devDir,
+			app
+		})
+	};
+}
 /** Reads a database id from upstream's `database` input: a plain string or a resolved `Prisma.Database` attributes record. */
 function databaseIdOfInput(value) {
 	if (typeof value === "string") return value;
 	if (Predicate.isObject(value) && typeof value["databaseId"] === "string") return value["databaseId"];
 }
-function noPrismaDevError(cause) {
-	return /* @__PURE__ */ new Error(`local dev needs @prisma/dev for its local Postgres emulator — @prisma/composer-prisma-cloud declares it as a dependency, but it did not resolve from Composer's own installation; reinstall your dependencies. (${cause instanceof Error ? cause.message : String(cause)})`);
-}
 /**
-* Composer owns the local Postgres emulator's version: `@prisma/dev` is a
-* dependency of `@prisma/composer-prisma-cloud` and is resolved from
-* Composer's own package, never from the app. The app's copy (if any) is
-* ignored on purpose — an old `@prisma/dev` pulled in transitively (alchemy
-* pins `^0.20.0`, whose pglite-socket crashes on any message over 64 KiB)
-* would otherwise silently replace the version Composer tested against.
-* The daemon imports the returned path dynamically.
-*/
-function resolvePrismaDevModulePath() {
-	try {
-		return createRequire(import.meta.url).resolve("@prisma/dev");
-	} catch (cause) {
-		throw noPrismaDevError(cause);
-	}
-}
-/**
-* `Prisma.Database` → an ensured `postgres-main` server, one per resource.
-* Stores the daemon's returned url as the `directConnectionString` attribute.
+* `Prisma.Database` → the database instance the directory's record names for
+* the resource, started if it is stopped and created when there is none.
+* Stores its url as the `directConnectionString` attribute. A Database whose
+* recorded instance changed (re-created after the emulator lost it) is
+* updated, so its Connection and dependents get the new instance's URL.
 */
 function LocalDatabaseProvider(input) {
 	return Provider.effect(Prisma.Database, Effect.succeed({
 		list: () => Effect.succeed([]),
 		reconcile: ({ id, news }) => Effect.tryPromise({
 			try: async () => {
-				const app = appNameOf(input.container);
-				const name = news.name ?? id;
-				const prismaDevModulePath = resolvePrismaDevModulePath();
-				const { url } = await postgresClient().ensureDatabase(app, slug(name), prismaDevModulePath);
-				const direct = Redacted.make(url);
+				const name = recordKeyOf("database", id, news.name);
+				const { instance } = await ensureDatabaseInstance(appScopeOf(input), name, resolvePrismaDevModulePath());
+				const direct = Redacted.make(instance.url);
 				return {
-					databaseId: instanceNameFor(app, name),
+					databaseId: instance.id,
 					databaseName: name,
 					projectId: projectIdOfInput(news.project),
 					status: "ready",
@@ -6374,28 +6692,40 @@ function LocalDatabaseProvider(input) {
 			},
 			catch: (cause) => cause
 		}),
+		diff: ({ output }) => Effect.tryPromise({
+			try: async () => {
+				if (output === void 0 || output.databaseName === void 0) return void 0;
+				return await recordedInstanceId(appScopeOf(input), output.databaseName) === output.databaseId ? void 0 : { action: "update" };
+			},
+			catch: (cause) => cause
+		}),
 		delete: () => Effect.void
 	}));
 }
+function appScopeOf(input) {
+	return {
+		devDir: input.devDir,
+		app: appNameOf(input.container)
+	};
+}
 function noRecordedInstanceError(databaseId) {
 	return /* @__PURE__ */ new Error(`no local Postgres instance recorded for databaseId "${databaseId}" — the Database provider did not run; converge is corrupt (try --fresh).`);
 }
-/** `Prisma.Connection` → the daemon's live listing, matched by instance name (the Database attributes' `databaseId` IS the instance name). */
-function LocalConnectionProvider(input) {
+/** `Prisma.Connection` → the database instance the Database attributes' `databaseId` names. */
+function LocalConnectionProvider(_input) {
 	return Provider.effect(Prisma.Connection, Effect.succeed({
 		list: () => Effect.succeed([]),
 		reconcile: ({ id, news }) => Effect.tryPromise({
 			try: async () => {
-				const app = appNameOf(input.container);
 				const databaseId = databaseIdOfInput(news.database);
 				if (databaseId === void 0) throw noRecordedInstanceError(String(news.database));
-				const found = (await postgresClient().listDatabases(app)).find((entry) => entry.instanceName === databaseId);
+				const found = await postgresClient().getInstance(databaseId);
 				if (found === void 0) throw noRecordedInstanceError(databaseId);
 				const direct = Redacted.make(found.url);
 				return {
-					connectionId: found.instanceName,
+					connectionId: found.id,
 					connectionName: news.name ?? id,
-					databaseId: found.instanceName,
+					databaseId: found.id,
 					kind: "postgres",
 					createdAt: DEV_TIMESTAMP,
 					directConnectionString: direct,
@@ -6441,10 +6771,8 @@ function resolvePackageEntry(specifier) {
 * ADR-0041 D12). The target extension's `dev/teardown.ts` orchestrates
 * (which app, which emulator clients); this module owns the actual
 * filesystem operations, so the extension's own source stays free of
-* `node:`/`bun:` imports (its invariant 5). Postgres instance removal is
-* NOT here (REVISED — operator review of #162): it is a
-* `postgresClient().deleteApp(app)` call, made directly alongside the
-* compute/buckets clients — no filesystem or child-process work of its own.
+* `node:`/`bun:` imports (its invariant 5). Emulator instances are not
+* removed here: the extension deletes them through the directory's record.
 */
 /** `fs.rm(..., { recursive: true, force: true })` for every given path — tolerates absence. */
 function removeLocalPaths(paths) {
@@ -6453,6 +6781,21 @@ function removeLocalPaths(paths) {
 		force: true
 	});
 }
+/**
+* Removes the dev state directory's contents for `--fresh`, except what
+* other apps run from the directory still use: the record of their emulator
+* instances and their buckets' objects. This app's objects go.
+*/
+function removeAppDevState(devDir, app) {
+	let entries;
+	try {
+		entries = fs$2.readdirSync(devDir);
+	} catch {
+		return;
+	}
+	const kept = /* @__PURE__ */ new Set([EMULATOR_INSTANCES_FILE, BUCKETS_DIR]);
+	removeLocalPaths([...entries.filter((entry) => !kept.has(entry)).map((entry) => path$1.join(devDir, entry)), path$1.join(devDir, BUCKETS_DIR, app)]);
+}
 //#endregion
 //#region ../../1-prisma-cloud/1-extensions/target/dist/local-target.mjs
 const RELIST_INTERVAL_MS = 2e3;
@@ -6500,7 +6843,7 @@ async function* mergedLogs(scope, signal, tail) {
 		})();
 	};
 	const relist = async () => {
-		for (const { address, instance } of await computeNodeInstances(scope)) follow(instance.id, address);
+		for (const { address, instance } of await nodeInstancesOf(scope, "service")) follow(instance.id, address);
 	};
 	await relist();
 	const timer = setInterval(() => void relist(), RELIST_INTERVAL_MS);
@@ -6532,7 +6875,7 @@ async function devAttach(input) {
 	const client = computeClient();
 	return {
 		startServices: async () => {
-			const nodes = await computeNodeInstances(scope);
+			const nodes = await nodeInstancesOf(scope, "service");
 			try {
 				await client.startInstances(nodes.map(({ instance }) => instance.id));
 			} catch (error) {
@@ -6540,15 +6883,14 @@ async function devAttach(input) {
 			}
 		},
 		endpoints: async () => {
-			return (await computeNodeInstances(scope)).map(({ address, instance }) => ({
+			return (await nodeInstancesOf(scope, "service")).map(({ address, instance }) => ({
 				address,
 				url: `http://localhost:${String(instance.port)}`
 			}));
 		},
 		logs: (signal, opts) => mergedLogs(scope, signal, opts?.tail ?? 0),
-		stopServices: async () => {
-			const nodes = await computeNodeInstances(scope);
-			await client.stopInstances(nodes.map(({ instance }) => instance.id));
+		stopApp: async () => {
+			await stopAppInstances(scope);
 		}
 	};
 }
@@ -6571,34 +6913,54 @@ function devContainerDescriptor() {
 function daemonEntry(name) {
 	return resolvePackageEntry(`@prisma/composer-prisma-cloud/local-target/${name}-main`);
 }
-function usesBuckets(input) {
-	return input.graph.nodes.some((n) => n.node.kind === "resource" && n.node.type === "s3");
-}
-function usesPostgres(input) {
-	return input.graph.nodes.some((n) => n.node.kind === "resource" && (n.node.type === "raw-postgres" || n.node.type === "postgres"));
-}
-/** The `App` name of each of this extension's services, in `graph.nodes` order: dependencies first, ties in declaration order. */
-function serviceAppNames(input) {
-	return input.graph.nodes.filter((n) => n.node.kind === "service" && n.node.extension === "@prisma/composer-prisma-cloud").map((n) => serviceAppName(n.id));
+const DATABASE_TYPES = /* @__PURE__ */ new Set(["raw-postgres", "postgres"]);
+const BUCKET_TYPE = "s3";
+/**
+* This extension's nodes that run on an emulator, in `graph.nodes` order —
+* dependencies first, ties in declaration order — keyed by the name their
+* resource is given: a service by its `App` name, a database and a bucket by
+* their resource name — the keys the local providers look them up by.
+*/
+function appNodes(input) {
+	return input.graph.nodes.flatMap((n) => {
+		if (n.node.kind === "service" && n.node.extension === "@prisma/composer-prisma-cloud") return [{
+			address: serviceAppName(n.id),
+			kind: "service"
+		}];
+		if (n.node.kind === "resource" && DATABASE_TYPES.has(n.node.type)) return [{
+			address: resourceName(n.id),
+			kind: "database"
+		}];
+		if (n.node.kind === "resource" && n.node.type === BUCKET_TYPE) return [{
+			address: resourceName(n.id),
+			kind: "bucket"
+		}];
+		return [];
+	});
 }
 async function runDevEmulators(input) {
+	const nodes = appNodes(input);
 	const { url: computeUrl } = await ensureDaemon("compute", daemonEntry("compute"));
 	console.log(`[dev] compute emulator ready at ${computeUrl}`);
-	const retired = await retirePreviousApp({
-		devDir: input.devDir,
-		app: appNameOf(input.container)
-	});
-	if (retired !== void 0) console.log(`[dev] removed the local services of "${retired}", the app run here before`);
-	const portChanges = await ensureServiceInstances(input.container, input.devDir, serviceAppNames(input));
-	for (const { address, previous, given } of portChanges) console.log(`[dev] service "${address}" now uses port ${String(given)}: its previous port ${String(previous)} is in use`);
-	if (usesBuckets(input)) {
+	if (nodes.some((node) => node.kind === "bucket")) {
 		const { url: bucketsUrl } = await ensureDaemon("buckets", daemonEntry("buckets"));
 		console.log(`[dev] buckets emulator ready at ${bucketsUrl}`);
 	}
-	if (usesPostgres(input)) {
+	if (nodes.some((node) => node.kind === "database")) {
 		const { url: postgresUrl } = await ensureDaemon("postgres", daemonEntry("postgres"));
 		console.log(`[dev] postgres emulator ready at ${postgresUrl}`);
 	}
+	const scope = {
+		devDir: input.devDir,
+		app: appNameOf(input.container)
+	};
+	const previous = await selectApp(scope);
+	if (previous !== void 0) console.log(`[dev] stopped the local services of "${previous}", the app run here before; its data is kept`);
+	const portChanges = await ensureAppInstances(scope, nodes).catch(async (error) => {
+		await stopAppInstances(scope).catch(() => void 0);
+		throw error;
+	});
+	for (const { kind, address, previous: before, given } of portChanges) console.log(`[dev] ${kind} "${address}" now uses port ${String(given)}: its previous port ${String(before)} is in use`);
 }
 /** `local-placeholder-<16 lowercase hex>` — Web Crypto only, matching the extension's other local mints (ServiceKey, S3Credentials). */
 function mintPlaceholder() {
@@ -6639,22 +7001,25 @@ async function runDevPreflight(input) {
 	}));
 	if (missing.length > 0) throw missingEnvParamsError(missing);
 }
-async function tolerateUnreachable(action) {
-	try {
-		await action();
-	} catch {}
-}
+const DAEMON_OF = {
+	service: "compute",
+	database: "postgres",
+	bucket: "buckets"
+};
 async function runDevTeardown(input) {
 	const app = prismaCloudContainerOf(input.container).input.appName;
 	const cwd = process.cwd();
 	const devDir = `${cwd}/${DEV_DIR}`;
-	await tolerateUnreachable(() => postgresClient().deleteApp(app));
+	const scope = {
+		devDir,
+		app
+	};
 	try {
-		await ensureDaemon("compute", daemonEntry("compute"));
-		await deleteRecordedInstances(devDir);
+		for (const kind of await recordedKinds(scope)) await ensureDaemon(DAEMON_OF[kind], daemonEntry(DAEMON_OF[kind]));
+		await deleteAppInstances(scope);
 	} finally {
-		await tolerateUnreachable(() => bucketsClient().deleteApp(app));
-		removeLocalPaths([devDir, `${cwd}/.alchemy/state/${app}/dev`]);
+		removeAppDevState(devDir, app);
+		removeLocalPaths([`${cwd}/.alchemy/state/${app}/dev`]);
 	}
 }
 /** `localTargetProviders()`'s `ProviderCollection` doesn't structurally unify with Alchemy's inferred providers Layer (a @internal/lowering typings gap); it satisfies it at runtime — mirrors `control/extension.ts`'s own `asProvidersLayer`, duplicated rather than shared so this module imports nothing from `./control`. */
@@ -6669,11 +7034,12 @@ function asProvidersLayer(layer) {
 function localTargetDescriptor() {
 	return {
 		container: devContainerDescriptor(),
-		providers: (input) => asProvidersLayer(Layer.mergeAll(localTargetProviders(input), PgWarmProvider(), OrmMigrationProvider(), S3CredentialsProvider(), GeneratedParamProvider(), ServiceKeyProvider())),
+		providers: (input) => asProvidersLayer(Layer.mergeAll(localTargetProviders(input), PgWarmProvider(), LocalOrmMigrationProvider(), S3CredentialsProvider(), GeneratedParamProvider(), ServiceKeyProvider())),
 		preflight: (input) => runDevPreflight(input),
 		emulators: (input) => runDevEmulators(input),
 		attach: (input) => devAttach(input),
-		teardown: (input) => runDevTeardown(input)
+		teardown: (input) => runDevTeardown(input),
+		current: (input) => currentApp(input.devDir)
 	};
 }
 //#endregion