alchemy 2.0.0-beta.10 → 2.0.0-beta.13

package/bin/alchemy.js

@@ -1,42 +1,47 @@
 import { createRequire } from "node:module";
-import * as Auth from "@distilled.cloud/aws/Auth";
-import { NodeRuntime, NodeServices } from "@effect/platform-node";
-import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
-import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-import * as Option from "effect/Option";
+import * as Command$1 from "effect/unstable/cli/Command";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Context from "effect/Context";
+import * as FileSystem from "effect/FileSystem";
 import * as Path$1 from "effect/Path";
 import { Path } from "effect/Path";
-import * as S from "effect/Schema";
-import * as Stream$1 from "effect/Stream";
-import { Argument, Command, Flag } from "effect/unstable/cli";
+import * as Cause from "effect/Cause";
+import * as Config from "effect/Config";
+import * as Console from "effect/Console";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Argument from "effect/unstable/cli/Argument";
 import * as CliError from "effect/unstable/cli/CliError";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as ChildProcess from "effect/unstable/process/ChildProcess";
-import * as Deferred from "effect/Deferred";
-import * as Context from "effect/Context";
+import * as Flag$1 from "effect/unstable/cli/Flag";
+import "@clack/prompts";
 import * as Data from "effect/Data";
+import "effect/unstable/process";
+import * as Auth from "@distilled.cloud/aws/Auth";
+import * as Logger from "effect/Logger";
+import * as Region$1 from "@distilled.cloud/aws/Region";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as s3 from "@distilled.cloud/aws/s3";
+import * as Schedule from "effect/Schedule";
+import { Credentials, fromAwsCredentialIdentity } from "@distilled.cloud/aws/Credentials";
+import * as Deferred from "effect/Deferred";
 import { pipe } from "effect/Function";
 import { SingleShotGen } from "effect/Utils";
 import { pipeArguments } from "effect/Pipeable";
-import * as FileSystem from "effect/FileSystem";
-import "@distilled.cloud/aws/sts";
-import { Region, Region as Region$1 } from "@distilled.cloud/aws/Region";
-import * as s3 from "@distilled.cloud/aws/s3";
-import * as Schedule from "effect/Schedule";
-import { Credentials } from "@distilled.cloud/aws/Credentials";
+import * as Redacted from "effect/Redacted";
+import os from "node:os";
 import { PassThrough, Stream } from "node:stream";
 import process$1, { cwd, env } from "node:process";
-import os from "node:os";
 import { execFileSync } from "node:child_process";
 import * as fs$1 from "node:fs";
 import fs from "node:fs";
 import tty from "node:tty";
 import { EventEmitter } from "node:events";
 import { Buffer as Buffer$1 } from "node:buffer";
+import { Command, Flag } from "effect/unstable/cli";
+import * as Stream$1 from "effect/Stream";
 
 //#region rolldown:runtime
 var __create = Object.create;
@@ -69,7 +74,410 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "2.0.0-beta.10";
+var version = "2.0.0-beta.13";
+
+//#endregion
+//#region src/Config.ts
+var DotAlchemy = class extends Context.Service()(".alchemy") {};
+const dotAlchemy = Layer.effect(DotAlchemy, Effect.gen(function* () {
+	const fs$2 = yield* FileSystem.FileSystem;
+	const dir = (yield* Path$1.Path).join(process.cwd(), ".alchemy");
+	yield* fs$2.makeDirectory(dir, { recursive: true });
+	return dir;
+}));
+
+//#endregion
+//#region src/Util/PlatformServices.ts
+const isBun$1 = typeof Bun !== "undefined";
+const PlatformServices = Effect.promise(async () => {
+	if (isBun$1) {
+		const [BunServices, BunSocket] = await Promise.all([import("@effect/platform-bun/BunServices"), import("@effect/platform-bun/BunSocket")]);
+		return Layer.merge(BunServices.layer, BunSocket.layerWebSocketConstructor);
+	} else {
+		const [NodeServices, NodeSocket] = await Promise.all([import("@effect/platform-node/NodeServices"), import("@effect/platform-node/NodeSocket")]);
+		return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
+	}
+}).pipe(Layer.unwrap);
+const runMain = (effect, options) => {
+	if (isBun$1) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options));
+	else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options));
+};
+
+//#endregion
+//#region src/Auth/AuthProvider.ts
+var AuthError = class extends Schema.TaggedErrorClass()("AuthError", {
+	message: Schema.String,
+	cause: Schema.optional(Schema.Defect)
+}) {};
+var AuthProviders = class extends Context.Service()("AuthProviders") {};
+
+//#endregion
+//#region src/Util/Clank.ts
+var PromptCancelled = class extends Data.TaggedError("PromptCancelled") {};
+const retryIfCancelled = Effect.retry({ while: (e) => e instanceof PromptCancelled });
+
+//#endregion
+//#region bin/commands/_shared.ts
+const USER = Config.string("USER").pipe(Config.orElse(() => Config.string("USERNAME")), Config.withDefault("unknown"));
+const STAGE = Config.string("stage").pipe(Config.option, (a) => a.asEffect(), Effect.map(Option.getOrUndefined));
+/**
+* `true` if `e` is a {@link PromptCancelled}, or an {@link AuthError} whose
+* `cause` chain bottoms out in one. Schema-tagged errors don't always
+* survive `instanceof` across module boundaries, so we also accept any
+* object whose `_tag` matches.
+*/
+const isPromptCancellation = (e) => {
+	for (let cur = e, i = 0; cur != null && i < 16; i++) {
+		if (cur instanceof PromptCancelled) return true;
+		if (typeof cur === "object" && cur._tag === "PromptCancelled") return true;
+		if (cur instanceof AuthError || typeof cur === "object" && cur._tag === "AuthError") {
+			cur = cur.cause;
+			continue;
+		}
+		return false;
+	}
+	return false;
+};
+/**
+* Catches user cancellations (Ctrl+C inside a prompt, surfaced as
+* {@link PromptCancelled} or wrapped in an {@link AuthError}) and exits
+* the CLI cleanly with a friendly message instead of dumping a stack
+* trace.
+*/
+const handleCancellation = (self$1) => self$1.pipe(Effect.catchCause((cause) => {
+	return cause.reasons.some((r) => {
+		if (Cause.isFailReason(r)) return isPromptCancellation(r.error);
+		if (Cause.isDieReason(r)) return isPromptCancellation(r.defect);
+		return false;
+	}) ? Console.log("\nCancelled.") : Effect.failCause(cause);
+}), Effect.onInterrupt(() => Console.log("\nInterrupted.")));
+const stage = Flag$1.string("stage").pipe(Flag$1.withSchema(Schema.String.check(Schema.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))), Flag$1.withDescription("Stage to deploy to, defaults to dev_${USER}"), Flag$1.optional, Flag$1.map(Option.getOrUndefined), Flag$1.mapEffect(Effect.fn(function* (stage$1) {
+	if (stage$1) return stage$1;
+	return yield* STAGE.pipe(Effect.catch(() => Effect.fail(new CliError.MissingOption({ option: "stage" }))), Effect.flatMap((s) => s === void 0 ? USER.asEffect().pipe(Effect.map((user) => `dev_${user}`), Effect.catch(() => Effect.succeed("unknown"))) : Effect.succeed(s)));
+})));
+const envFile = Flag$1.file("env-file").pipe(Flag$1.optional, Flag$1.withDescription("File to load environment variables from, defaults to .env"));
+const dryRun = Flag$1.boolean("dry-run").pipe(Flag$1.withDescription("Dry run the deployment, do not actually deploy"), Flag$1.withDefault(false));
+const yes = Flag$1.boolean("yes").pipe(Flag$1.withDescription("Yes to all prompts"), Flag$1.withDefault(false));
+const force = Flag$1.boolean("force").pipe(Flag$1.withDescription("Force updates for resources that would otherwise no-op"), Flag$1.withDefault(false));
+const main = Argument.file("main", { mustExist: true }).pipe(Argument.withDescription("Main file to deploy, defaults to alchemy.run.ts"), Argument.withDefault("alchemy.run.ts"));
+const profile = Flag$1.string("profile").pipe(Flag$1.withDescription("Auth profile to use (~/.alchemy/profiles.json). Defaults to 'default' or $ALCHEMY_PROFILE."), Flag$1.optional, Flag$1.map(Option.getOrElse(() => "default")));
+const resourceFilter = Flag$1.string("filter").pipe(Flag$1.withDescription("Comma-separated logical resource IDs (e.g. Api,Sandbox). Only those resources are included."), Flag$1.optional, Flag$1.map(Option.getOrUndefined));
+const TAIL_COLORS = [
+	"\x1B[36m",
+	"\x1B[35m",
+	"\x1B[33m",
+	"\x1B[32m",
+	"\x1B[34m",
+	"\x1B[91m",
+	"\x1B[96m",
+	"\x1B[95m",
+	"\x1B[93m",
+	"\x1B[92m"
+];
+const TAIL_RESET = "\x1B[0m";
+const formatLocalTimestamp = (date) => {
+	return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}-${String(date.getDate()).padStart(2, "0")} ${String(date.getHours()).padStart(2, "0")}:${String(date.getMinutes()).padStart(2, "0")}:${String(date.getSeconds()).padStart(2, "0")}.${String(date.getMilliseconds()).padStart(3, "0")} ${new Intl.DateTimeFormat("en-US", { timeZoneName: "short" }).formatToParts(date).find((p) => p.type === "timeZoneName")?.value ?? ""}`;
+};
+const parseResourceFilter = (filter) => {
+	if (filter === void 0) return void 0;
+	const ids = filter.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+	if (ids.length === 0) return void 0;
+	return new Set(ids);
+};
+const parseSince = (value) => {
+	const match = value.match(/^(\d+)([smhd])$/);
+	if (match) {
+		const num = parseInt(match[1], 10);
+		const unit = match[2];
+		const ms = unit === "s" ? num * 1e3 : unit === "m" ? num * 6e4 : unit === "h" ? num * 36e5 : num * 864e5;
+		return new Date(Date.now() - ms);
+	}
+	const parsed = new Date(value);
+	if (isNaN(parsed.getTime())) throw new Error(`Invalid --since value: '${value}'. Use a duration (e.g. '1h', '30m') or ISO date.`);
+	return parsed;
+};
+const importStack = Effect.fn(function* (main$1) {
+	const path = yield* Path$1.Path;
+	const stackEffect = (yield* Effect.promise(() => import(path.resolve(process.cwd(), main$1)))).default;
+	if (!Effect.isEffect(stackEffect)) return yield* Effect.die(/* @__PURE__ */ new Error(`Main file '${main$1}' must export a default stack definition (export default Alchemy.Stack({...}))`));
+	return stackEffect;
+});
+
+//#endregion
+//#region src/AWS/Environment.ts
+const AWS_PROFILE = Config.string("AWS_PROFILE").pipe(Config.withDefault("default"));
+const AWS_REGION = Config.string("AWS_REGION");
+var AWSEnvironment = class extends Context.Service()("AWS::Environment") {};
+/**
+* Build an `AWSEnvironment` from an SSO profile (`AWS_PROFILE` env var,
+* defaults to `"default"`). Uses the profile's `sso_account_id` and `region`,
+* and resolves credentials lazily via `aws sso login`.
+*/
+const Default = Layer.effect(AWSEnvironment, Effect.suspend(() => loadDefault())).pipe(Layer.orDie);
+const loadDefault = () => Effect.gen(function* () {
+	const profileName = yield* AWS_PROFILE;
+	const auth = yield* Auth.Default;
+	const profile$1 = yield* auth.loadProfile(profileName);
+	if (!profile$1.sso_account_id) return yield* Effect.die(`AWS SSO profile '${profileName}' is missing sso_account_id`);
+	const region = profile$1.region ?? (yield* AWS_REGION.pipe(Config.option, Config.map(Option.getOrElse(() => "us-east-1"))));
+	return {
+		profile: profileName,
+		accountId: profile$1.sso_account_id,
+		region,
+		credentials: auth.loadProfileCredentials(profileName)
+	};
+});
+const isStatic = (shape) => shape.credentials != null && typeof shape.credentials.accessKeyId === "string";
+/**
+* Build an `AWSEnvironment` Layer directly from values — useful for
+* static credentials in CI or tests.
+*
+* Named `makeEnvironment` rather than `of` because `Context.Service.of`
+* already exists with different semantics (builds the service value, not
+* a Layer); putting both on `AWSEnvironment` would be confusing.
+*/
+const makeEnvironment = (shape) => Layer.succeed(AWSEnvironment, isStatic(shape) ? {
+	...shape,
+	credentials: Effect.succeed(fromAwsCredentialIdentity(shape.credentials))
+} : shape);
+
+//#endregion
+//#region src/AWS/Bootstrap.ts
+/**
+* Tag key used to identify the alchemy assets bucket.
+*/
+const ASSETS_BUCKET_TAG = "alchemy::assets-bucket";
+/**
+* Tag key used to scope the alchemy assets bucket to an AWS region.
+*/
+const ASSETS_BUCKET_REGION_TAG = "alchemy::assets-bucket-region";
+/**
+* Build an account-regional namespace bucket name.
+*
+* Account-regional buckets must follow the naming convention:
+*   `<prefix>-<accountId>-<region>-an`
+*
+* @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/gpbucketnamespaces.html#account-regional-gp-buckets
+*/
+const createAssetsBucketName = (accountId, region) => `alchemy-assets-${accountId}-${region}-an`.toLowerCase();
+const createAssetsBucketTags = (region) => [{
+	Key: ASSETS_BUCKET_TAG,
+	Value: "true"
+}, {
+	Key: ASSETS_BUCKET_REGION_TAG,
+	Value: region
+}];
+const getBucketTags = (bucketName) => s3.getBucketTagging({ Bucket: bucketName }).pipe(Effect.map((response) => response.TagSet ?? []), Effect.catchTag("NoSuchTagSet", () => Effect.succeed([])));
+const hasAssetsBucketTag = (tags) => tags.some((tag) => tag.Key === ASSETS_BUCKET_TAG && tag.Value === "true");
+const normalizeBucketRegion = (location) => {
+	if (!location) return "us-east-1";
+	if (location === "EU") return "eu-west-1";
+	return location;
+};
+const bucketMatchesRegion = (tags, region) => {
+	const taggedRegion = tags.find((tag) => tag.Key === ASSETS_BUCKET_REGION_TAG)?.Value;
+	return taggedRegion === void 0 ? void 0 : taggedRegion === region;
+};
+const lookupAssetsBuckets = Effect.gen(function* () {
+	const region = yield* Region;
+	const buckets = (yield* s3.listBuckets({})).Buckets ?? [];
+	const matchingBuckets = [];
+	for (const bucket of buckets) {
+		const bucketName = bucket.Name;
+		if (!bucketName) continue;
+		const tags = yield* getBucketTags(bucketName).pipe(Effect.catch(() => Effect.succeed([])));
+		if (!hasAssetsBucketTag(tags)) continue;
+		const taggedRegionMatch = bucketMatchesRegion(tags, region);
+		if (taggedRegionMatch === true) {
+			matchingBuckets.push(bucketName);
+			continue;
+		}
+		if (taggedRegionMatch === false) continue;
+		if ((yield* s3.getBucketLocation({ Bucket: bucketName }).pipe(Effect.map((response) => normalizeBucketRegion(response.LocationConstraint)), Effect.catch(() => Effect.succeed(void 0)))) === region) matchingBuckets.push(bucketName);
+	}
+	return matchingBuckets;
+});
+const lookupAssetsBucket = Effect.gen(function* () {
+	const matchingBuckets = yield* lookupAssetsBuckets;
+	for (const bucketName of matchingBuckets) return Option.some(bucketName);
+	return Option.none();
+});
+const ensureAssetsBucketTags = Effect.fn(function* (bucketName, region) {
+	const tagSet = [...(yield* getBucketTags(bucketName)).filter((tag) => tag.Key !== ASSETS_BUCKET_TAG && tag.Key !== ASSETS_BUCKET_REGION_TAG), ...createAssetsBucketTags(region)];
+	yield* s3.putBucketTagging({
+		Bucket: bucketName,
+		Tagging: { TagSet: tagSet.map((tag) => ({
+			Key: tag.Key,
+			Value: tag.Value
+		})) }
+	});
+});
+const deleteAllObjects = Effect.fn(function* (bucketName) {
+	let continuationToken;
+	do {
+		const listResponse = yield* s3.listObjectsV2({
+			Bucket: bucketName,
+			ContinuationToken: continuationToken
+		});
+		if (listResponse.Contents && listResponse.Contents.length > 0) yield* s3.deleteObjects({
+			Bucket: bucketName,
+			Delete: {
+				Objects: listResponse.Contents.map((obj) => ({ Key: obj.Key })),
+				Quiet: true
+			}
+		});
+		continuationToken = listResponse.NextContinuationToken;
+	} while (continuationToken);
+	let keyMarker;
+	let versionIdMarker;
+	do {
+		const listVersionsResponse = yield* s3.listObjectVersions({
+			Bucket: bucketName,
+			KeyMarker: keyMarker,
+			VersionIdMarker: versionIdMarker
+		});
+		const objectsToDelete = [...(listVersionsResponse.Versions ?? []).map((v) => ({
+			Key: v.Key,
+			VersionId: v.VersionId
+		})), ...(listVersionsResponse.DeleteMarkers ?? []).map((dm) => ({
+			Key: dm.Key,
+			VersionId: dm.VersionId
+		}))];
+		if (objectsToDelete.length > 0) yield* s3.deleteObjects({
+			Bucket: bucketName,
+			Delete: {
+				Objects: objectsToDelete,
+				Quiet: true
+			}
+		});
+		keyMarker = listVersionsResponse.NextKeyMarker;
+		versionIdMarker = listVersionsResponse.NextVersionIdMarker;
+	} while (keyMarker);
+});
+/**
+* Bootstrap the AWS environment by creating the assets bucket.
+*
+* This is idempotent - running it multiple times is safe.
+* The bucket is tagged and later discovered by tag lookup instead of by name.
+*/
+const bootstrap = Effect.fn(function* () {
+	const region = yield* Region;
+	const existingBucket = yield* lookupAssetsBucket;
+	if (Option.isSome(existingBucket)) {
+		yield* ensureAssetsBucketTags(existingBucket.value, region);
+		yield* Effect.logInfo(`Assets bucket already exists: ${existingBucket.value}`);
+		return {
+			bucketName: existingBucket.value,
+			created: false
+		};
+	}
+	const { accountId } = yield* AWSEnvironment;
+	const bucketName = createAssetsBucketName(accountId, region);
+	yield* s3.createBucket({
+		Bucket: bucketName,
+		BucketNamespace: "account-regional",
+		CreateBucketConfiguration: {
+			Tags: createAssetsBucketTags(region),
+			...region === "us-east-1" ? {} : { LocationConstraint: region }
+		}
+	}).pipe(Effect.catchTag("BucketAlreadyOwnedByYou", () => Effect.void), Effect.retry({
+		while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
+		schedule: Schedule.exponential(100)
+	}));
+	yield* s3.headBucket({ Bucket: bucketName }).pipe(Effect.retry({ schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10))) }));
+	yield* Effect.logInfo(`Created assets bucket: ${bucketName}`);
+	return {
+		bucketName,
+		created: true
+	};
+});
+const destroyBootstrap = Effect.fn(function* () {
+	const bucketNames = yield* lookupAssetsBuckets;
+	for (const bucketName of bucketNames) {
+		yield* Effect.logInfo(`Destroying assets bucket: ${bucketName}`);
+		yield* deleteAllObjects(bucketName);
+		yield* s3.deleteBucket({ Bucket: bucketName }).pipe(Effect.retry({
+			while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
+			schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10)))
+		}));
+	}
+	return {
+		bucketNames,
+		destroyed: bucketNames.length
+	};
+});
+
+//#endregion
+//#region src/AWS/Credentials.ts
+/**
+* Lazy `Credentials` layer derived from the surrounding {@link AWSEnvironment}.
+* Credentials are resolved on first access (not during layer construction),
+* matching the existing @distilled.cloud/aws semantics.
+*/
+const fromEnvironment$1 = Layer.effect(Credentials, Effect.map(AWSEnvironment.asEffect(), (env$2) => env$2.credentials));
+
+//#endregion
+//#region src/AWS/Region.ts
+/**
+* Derive the AWS region from the surrounding {@link AWSEnvironment}.
+*/
+const fromEnvironment = Layer.effect(Region$1.Region, Effect.map(AWSEnvironment.asEffect(), (env$2) => env$2.region));
+
+//#endregion
+//#region src/Util/ConfigProvider.ts
+const loadConfigProvider = (envFile$1) => {
+	if (Option.isSome(envFile$1)) return ConfigProvider.fromDotEnv({ path: envFile$1.value }).pipe(Effect.map((dotEnv) => ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv())));
+	return Effect.gen(function* () {
+		if (!(yield* (yield* FileSystem.FileSystem).exists(".env"))) return ConfigProvider.fromEnv();
+		return ConfigProvider.orElse(yield* ConfigProvider.fromDotEnv({ path: ".env" }), ConfigProvider.fromEnv());
+	});
+};
+
+//#endregion
+//#region src/Util/FileLogger.ts
+const fileLogger = Effect.fnUntraced(function* (...segments) {
+	const dotAlchemy$1 = yield* DotAlchemy;
+	const fs$2 = yield* FileSystem.FileSystem;
+	const path = yield* Path;
+	const logFile = path.join(dotAlchemy$1, "log", ...segments);
+	yield* fs$2.makeDirectory(path.dirname(logFile), { recursive: true });
+	return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
+});
+
+//#endregion
+//#region bin/commands/bootstrap.ts
+const awsProfile = Flag$1.string("profile").pipe(Flag$1.withDescription("AWS profile to use for credentials"), Flag$1.optional, Flag$1.map(Option.getOrElse(() => "default")));
+const awsRegion = Flag$1.string("region").pipe(Flag$1.withDescription("AWS region to bootstrap (defaults to AWS_REGION env var)"), Flag$1.optional, Flag$1.map(Option.getOrUndefined));
+const bootstrapDestroy = Flag$1.boolean("destroy").pipe(Flag$1.withDescription("Destroy all bootstrap buckets in the selected region"), Flag$1.withDefault(false));
+const bootstrapCommand = Command$1.make("bootstrap", {
+	envFile,
+	profile: awsProfile,
+	region: awsRegion,
+	destroy: bootstrapDestroy
+}, Effect.fnUntraced(function* ({ envFile: envFile$1, profile: profile$1, region, destroy }) {
+	const logger = Logger.layer([fileLogger("bootstrap.txt")]);
+	return yield* Effect.gen(function* () {
+		const ssoProfile = yield* Auth.loadProfile(profile$1);
+		if (!ssoProfile.sso_account_id) return yield* Effect.die(`AWS SSO profile '${profile$1}' is missing sso_account_id`);
+		const ambient = yield* Effect.context();
+		const environment = makeEnvironment({
+			accountId: ssoProfile.sso_account_id,
+			region: region ?? ssoProfile.region ?? "us-east-1",
+			credentials: Auth.loadProfileCredentials(profile$1).pipe(Effect.provide(ambient)),
+			profile: profile$1
+		});
+		const awsLayers = Layer.provideMerge(Layer.mergeAll(fromEnvironment, fromEnvironment$1), environment);
+		return yield* Effect.gen(function* () {
+			const provider = yield* loadConfigProvider(envFile$1);
+			const bootstrapLayer = Layer.provide(awsLayers, Layer.succeed(ConfigProvider.ConfigProvider, provider));
+			if (destroy) {
+				yield* destroyBootstrap().pipe(Effect.tap((result) => result.destroyed === 0 ? Console.log("✓ No bootstrap buckets found to destroy") : Console.log(`✓ Destroyed ${result.destroyed} bootstrap bucket(s): ${result.bucketNames.join(", ")}`)), Effect.provide(bootstrapLayer));
+				return;
+			}
+			yield* bootstrap().pipe(Effect.tap(({ bucketName, created }) => created ? Console.log(`✓ Created assets bucket: ${bucketName}`) : Console.log(`✓ Assets bucket already exists: ${bucketName}`)), Effect.provide(bootstrapLayer));
+		});
+	}).pipe(Effect.provide(logger));
+}));
 
 //#endregion
 //#region src/Artifacts.ts
@@ -126,11 +534,6 @@ const makeScopedArtifacts = (store, fqn) => {
 	};
 };
 /**
-* Run an effect with a fresh artifact root, replacing any existing store.
-* Use this at top-level entrypoints that intentionally define a new deploy run.
-*/
-const provideFreshArtifactStore = (effect) => effect.pipe(Effect.provideServiceEffect(ArtifactStore, Effect.sync(createArtifactStore)));
-/**
 * Ensure an artifact root exists, reusing the ambient store when one is already
 * present. This lets nested helpers participate in the same run-scoped cache.
 */
@@ -287,20 +690,23 @@ const Stack = Object.assign(taggedFunction(Context.Service()("Stack"), (stackNam
 	id: stackName
 }) }) }))));
 const StackName = Stack.use((stack) => Effect.succeed(stack.name));
-const make$1 = (name, providers, stack) => (effect) => Effect.all([
+const make$1 = (name, providers, stack) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
+	const stackLayer = Layer.effect(Stack, Stage.asEffect().pipe(Effect.map((stage$1) => stack ?? {
+		name,
+		stage: stage$1,
+		resources: {},
+		bindings: {}
+	}), Effect.tap(Effect.logInfo)));
+	return providers.pipe(Layer.provideMerge(stackLayer), Layer.buildWithScope(scope));
+}), Effect.flatMap((context) => Effect.all([
 	effect,
 	Stack.asEffect(),
 	Effect.context()
-]).pipe(Effect.map(([output, stack$1, services]) => ({
+]).pipe(Effect.map(([output, stack$1, services$1]) => ({
 	...stack$1,
 	output,
-	services
-})), Effect.provide(providers), Effect.provideServiceEffect(Stack, Stage.asEffect().pipe(Effect.map((stage$1) => stack ?? {
-	name,
-	stage: stage$1,
-	resources: {},
-	bindings: {}
-}), Effect.tap(Effect.logInfo))));
+	services: services$1
+})), Effect.provideContext(context))));
 const CurrentStack = Effect.serviceOption(Stack).asEffect().pipe(Effect.map(Option.getOrUndefined));
 
 //#endregion
@@ -576,6 +982,28 @@ const generateInstanceId = () => Effect.sync(() => {
 
 //#endregion
 //#region src/State/LocalState.ts
+const REDACTED_MARKER = "__redacted__";
+const encodeState = (value) => {
+	if (value === null || value === void 0) return value;
+	if (Redacted.isRedacted(value)) return { [REDACTED_MARKER]: encodeState(Redacted.value(value)) };
+	if (isResource(value)) return {
+		id: value.LogicalId,
+		type: value.Type,
+		props: encodeState(value.Props),
+		attr: encodeState(value.Attributes)
+	};
+	if (Array.isArray(value)) return value.map(encodeState);
+	if (typeof value === "object") {
+		const result = {};
+		for (const [k, v] of Object.entries(value)) result[k] = encodeState(v);
+		return result;
+	}
+	return value;
+};
+const reviveState = (_key, value) => {
+	if (value !== null && typeof value === "object" && !Array.isArray(value) && REDACTED_MARKER in value) return Redacted.make(value[REDACTED_MARKER]);
+	return value;
+};
 const LocalState = Layer.effect(State, Effect.gen(function* () {
 	const fs$2 = yield* FileSystem.FileSystem;
 	const path = yield* Path$1.Path;
@@ -593,7 +1021,7 @@ const LocalState = Layer.effect(State, Effect.gen(function* () {
 	const state = {
 		listStacks: () => fs$2.readDirectory(stateDir).pipe(recover, Effect.map((files) => files ?? [])),
 		listStages: (stack) => fs$2.readDirectory(path.join(stateDir, stack)).pipe(recover, Effect.map((files) => files ?? [])),
-		get: (request) => fs$2.readFile(resource(request)).pipe(Effect.map((file) => JSON.parse(file.toString())), recover),
+		get: (request) => fs$2.readFile(resource(request)).pipe(Effect.map((file) => JSON.parse(file.toString(), reviveState)), recover),
 		getReplacedResources: Effect.fnUntraced(function* (request) {
 			return (yield* Effect.all((yield* state.list(request)).map((fqn) => state.get({
 				stack: request.stack,
@@ -601,15 +1029,7 @@ const LocalState = Layer.effect(State, Effect.gen(function* () {
 				fqn
 			})))).filter((r) => r?.status === "replaced");
 		}),
-		set: (request) => ensure(stageDir(request)).pipe(Effect.flatMap(() => fs$2.writeFileString(resource(request), JSON.stringify(request.value, (k, v) => {
-			if (isResource(v)) return {
-				id: v.LogicalId,
-				type: v.Type,
-				props: v.Props,
-				attr: v.Attributes
-			};
-			return v;
-		}, 2))), recover, Effect.map(() => request.value)),
+		set: (request) => ensure(stageDir(request)).pipe(Effect.flatMap(() => fs$2.writeFileString(resource(request), JSON.stringify(encodeState(request.value), null, 2))), recover, Effect.map(() => request.value)),
 		delete: (request) => fs$2.remove(resource(request)).pipe(recover),
 		list: (request) => fs$2.readDirectory(stageDir(request)).pipe(recover, Effect.map((files) => files?.map((file) => decodeFqn(file.replace(/\.json$/, ""))) ?? []))
 	};
@@ -619,7 +1039,7 @@ const LocalState = Layer.effect(State, Effect.gen(function* () {
 //#endregion
 //#region src/Apply.ts
 const provideLifecycleScope = (fqn, instanceId) => (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrElse(createArtifactStore)), Effect.flatMap((store) => effect.pipe(Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)), Effect.provideService(InstanceId, instanceId))));
-const apply = (plan) => ensureArtifactStore(Effect.gen(function* () {
+const apply = (plan) => Effect.gen(function* () {
 	const session = yield* (yield* Cli).startApplySession(plan);
 	const state = yield* State;
 	const stack = yield* Stack;
@@ -640,7 +1060,7 @@ const apply = (plan) => ensureArtifactStore(Effect.gen(function* () {
 	if (!plan.output) return;
 	const outputs = Object.fromEntries(Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]));
 	return yield* evaluate(plan.output, outputs);
-}));
+}).pipe(ensureArtifactStore);
 const executePlan = Effect.fnUntraced(function* (plan, tracker, terminalStatuses, session, state, stackName, stage$1) {
 	const ready = Object.fromEntries(yield* Effect.all(Object.keys(plan.resources).map((fqn) => Effect.map(Deferred.make(), (d) => [fqn, d]))));
 	const getOutputs = () => Object.fromEntries(Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]));
@@ -1217,170 +1637,494 @@ const excludeDeletedBindings = (bindings) => bindings.flatMap(({ action, sid, da
 }]);
 
 //#endregion
-//#region src/AWS/Region.ts
-const AWS_REGION = Config.string("AWS_REGION");
+//#region ../../node_modules/.bun/pathe@2.0.3/node_modules/pathe/dist/shared/pathe.M-eThtNZ.mjs
+let _lazyMatch = () => {
+	var __lib__ = (() => {
+		var m = Object.defineProperty, V = Object.getOwnPropertyDescriptor, G = Object.getOwnPropertyNames, T = Object.prototype.hasOwnProperty, q = (r, e) => {
+			for (var n in e) m(r, n, {
+				get: e[n],
+				enumerable: true
+			});
+		}, H = (r, e, n, a) => {
+			if (e && typeof e == "object" || typeof e == "function") for (let t of G(e)) !T.call(r, t) && t !== n && m(r, t, {
+				get: () => e[t],
+				enumerable: !(a = V(e, t)) || a.enumerable
+			});
+			return r;
+		}, J = (r) => H(m({}, "__esModule", { value: true }), r), w = {};
+		q(w, { default: () => re$1 });
+		var A = (r) => Array.isArray(r), d = (r) => typeof r == "function", Q = (r) => r.length === 0, W = (r) => typeof r == "number", K = (r) => typeof r == "object" && r !== null, X = (r) => r instanceof RegExp, b = (r) => typeof r == "string", h = (r) => r === void 0, Y = (r) => {
+			const e = /* @__PURE__ */ new Map();
+			return (n) => {
+				const a = e.get(n);
+				if (a) return a;
+				const t = r(n);
+				return e.set(n, t), t;
+			};
+		}, rr = (r, e, n = {}) => {
+			const a = {
+				cache: {},
+				input: r,
+				index: 0,
+				indexMax: 0,
+				options: n,
+				output: []
+			};
+			if (v(e)(a) && a.index === r.length) return a.output;
+			throw new Error(`Failed to parse at index ${a.indexMax}`);
+		}, i = (r, e) => A(r) ? er(r, e) : b(r) ? ar(r, e) : nr(r, e), er = (r, e) => {
+			const n = {};
+			for (const a of r) {
+				if (a.length !== 1) throw new Error(`Invalid character: "${a}"`);
+				const t = a.charCodeAt(0);
+				n[t] = true;
+			}
+			return (a) => {
+				const t = a.index, o = a.input;
+				for (; a.index < o.length && o.charCodeAt(a.index) in n;) a.index += 1;
+				const u = a.index;
+				if (u > t) {
+					if (!h(e) && !a.options.silent) {
+						const s = a.input.slice(t, u), c = d(e) ? e(s, o, String(t)) : e;
+						h(c) || a.output.push(c);
+					}
+					a.indexMax = Math.max(a.indexMax, a.index);
+				}
+				return true;
+			};
+		}, nr = (r, e) => {
+			const n = r.source, a = r.flags.replace(/y|$/, "y"), t = new RegExp(n, a);
+			return g((o) => {
+				t.lastIndex = o.index;
+				const u = t.exec(o.input);
+				if (u) {
+					if (!h(e) && !o.options.silent) {
+						const s = d(e) ? e(...u, o.input, String(o.index)) : e;
+						h(s) || o.output.push(s);
+					}
+					return o.index += u[0].length, o.indexMax = Math.max(o.indexMax, o.index), true;
+				} else return false;
+			});
+		}, ar = (r, e) => (n) => {
+			if (n.input.startsWith(r, n.index)) {
+				if (!h(e) && !n.options.silent) {
+					const t = d(e) ? e(r, n.input, String(n.index)) : e;
+					h(t) || n.output.push(t);
+				}
+				return n.index += r.length, n.indexMax = Math.max(n.indexMax, n.index), true;
+			} else return false;
+		}, C = (r, e, n, a) => {
+			const t = v(r);
+			return g(_(M((o) => {
+				let u = 0;
+				for (; u < n;) {
+					const s = o.index;
+					if (!t(o) || (u += 1, o.index === s)) break;
+				}
+				return u >= e;
+			})));
+		}, tr = (r, e) => C(r, 0, 1), f = (r, e) => C(r, 0, Infinity), x = (r, e) => {
+			const n = r.map(v);
+			return g(_(M((a) => {
+				for (let t = 0, o = n.length; t < o; t++) if (!n[t](a)) return false;
+				return true;
+			})));
+		}, l = (r, e) => {
+			const n = r.map(v);
+			return g(_((a) => {
+				for (let t = 0, o = n.length; t < o; t++) if (n[t](a)) return true;
+				return false;
+			}));
+		}, M = (r, e = false) => {
+			const n = v(r);
+			return (a) => {
+				const t = a.index, o = a.output.length, u = n(a);
+				return (!u || e) && (a.index = t, a.output.length !== o && (a.output.length = o)), u;
+			};
+		}, _ = (r, e) => {
+			return v(r);
+		}, g = (() => {
+			let r = 0;
+			return (e) => {
+				const n = v(e), a = r += 1;
+				return (t) => {
+					var o;
+					if (t.options.memoization === false) return n(t);
+					const u = t.index, s = (o = t.cache)[a] || (o[a] = /* @__PURE__ */ new Map()), c = s.get(u);
+					if (c === false) return false;
+					if (W(c)) return t.index = c, true;
+					if (c) return t.index = c.index, c.output?.length && t.output.push(...c.output), true;
+					{
+						const Z = t.output.length;
+						if (n(t)) {
+							const D = t.index, U = t.output.length;
+							if (U > Z) {
+								const ee = t.output.slice(Z, U);
+								s.set(u, {
+									index: D,
+									output: ee
+								});
+							} else s.set(u, D);
+							return true;
+						} else return s.set(u, false), false;
+					}
+				};
+			};
+		})(), E = (r) => {
+			let e;
+			return (n) => (e || (e = v(r())), e(n));
+		}, v = Y((r) => {
+			if (d(r)) return Q(r) ? E(r) : r;
+			if (b(r) || X(r)) return i(r);
+			if (A(r)) return x(r);
+			if (K(r)) return l(Object.values(r));
+			throw new Error("Invalid rule");
+		}), P = "abcdefghijklmnopqrstuvwxyz", ir = (r) => {
+			let e = "";
+			for (; r > 0;) e = P[(r - 1) % 26] + e, r = Math.floor((r - 1) / 26);
+			return e;
+		}, O = (r) => {
+			let e = 0;
+			for (let n = 0, a = r.length; n < a; n++) e = e * 26 + P.indexOf(r[n]) + 1;
+			return e;
+		}, S = (r, e) => {
+			if (e < r) return S(e, r);
+			const n = [];
+			for (; r <= e;) n.push(r++);
+			return n;
+		}, or = (r, e, n) => S(r, e).map((a) => String(a).padStart(n, "0")), R = (r, e) => S(O(r), O(e)).map(ir), p = (r) => r, z = (r) => ur((e) => rr(e, r, { memoization: false }).join("")), ur = (r) => {
+			const e = {};
+			return (n) => e[n] ?? (e[n] = r(n));
+		}, sr = i(/^\*\*\/\*$/, ".*"), cr = i(/^\*\*\/(\*)?([ a-zA-Z0-9._-]+)$/, (r, e, n) => `.*${e ? "" : "(?:^|/)"}${n.replaceAll(".", "\\.")}`), lr = i(/^\*\*\/(\*)?([ a-zA-Z0-9._-]*)\{([ a-zA-Z0-9._-]+(?:,[ a-zA-Z0-9._-]+)*)\}$/, (r, e, n, a) => `.*${e ? "" : "(?:^|/)"}${n.replaceAll(".", "\\.")}(?:${a.replaceAll(",", "|").replaceAll(".", "\\.")})`), y = i(/\\./, p), pr = i(/[$.*+?^(){}[\]\|]/, (r) => `\\${r}`), vr = i(/./, p), fr = l([i(/^(?:!!)*!(.*)$/, (r, e) => `(?!^${L(e)}$).*?`), i(/^(!!)+/, "")]), j = l([
+			i(/\/(\*\*\/)+/, "(?:/.+/|/)"),
+			i(/^(\*\*\/)+/, "(?:^|.*/)"),
+			i(/\/(\*\*)$/, "(?:/.*|$)"),
+			i(/\*\*/, ".*")
+		]), N = l([i(/\*\/(?!\*\*\/)/, "[^/]*/"), i(/\*/, "[^/]*")]), k = i("?", "[^/]"), $r = i("[", p), wr = i("]", p), Ar = i(/[!^]/, "^/"), br = i(/[a-z]-[a-z]|[0-9]-[0-9]/i, p), Er = l([
+			y,
+			i(/[$.*+?^(){}[\|]/, (r) => `\\${r}`),
+			br,
+			i(/[^\]]/, p)
+		]), B = x([
+			$r,
+			tr(Ar),
+			f(Er),
+			wr
+		]), Pr = i("{", "(?:"), Or = i("}", ")"), I = x([
+			Pr,
+			l([
+				i(/(\d+)\.\.(\d+)/, (r, e, n) => or(+e, +n, Math.min(e.length, n.length)).join("|")),
+				i(/([a-z]+)\.\.([a-z]+)/, (r, e, n) => R(e, n).join("|")),
+				i(/([A-Z]+)\.\.([A-Z]+)/, (r, e, n) => R(e.toLowerCase(), n.toLowerCase()).join("|").toUpperCase())
+			]),
+			Or
+		]), kr = i("{", "(?:"), Br = i("}", ")"), Ir = i(",", "|"), Fr = i(/[$.*+?^(){[\]\|]/, (r) => `\\${r}`), Lr = i(/[^}]/, p), F = x([
+			kr,
+			f(l([
+				j,
+				N,
+				k,
+				B,
+				I,
+				E(() => F),
+				y,
+				Fr,
+				Ir,
+				Lr
+			])),
+			Br
+		]), L = z(f(l([
+			sr,
+			cr,
+			lr,
+			fr,
+			j,
+			N,
+			k,
+			B,
+			I,
+			F,
+			y,
+			pr,
+			vr
+		]))), Tr = i(/\\./, p), qr = i(/./, p), Yr = z(f(l([
+			Tr,
+			i(/\*\*\*+/, "*"),
+			i(/([^/{[(!])\*\*/, (r, e) => `${e}*`),
+			i(/(^|.)\*\*(?=[^*/)\]}])/, (r, e) => `${e}*`),
+			qr
+		]))), $ = (r, e) => {
+			const n = Array.isArray(r) ? r : [r];
+			if (!n.length) return false;
+			const a = n.map($.compile), t = n.every((s) => /(\/(?:\*\*)?|\[\/\])$/.test(s)), o = e.replace(/[\\\/]+/g, "/").replace(/\/$/, t ? "/" : "");
+			return a.some((s) => s.test(o));
+		};
+		$.compile = (r) => new RegExp(`^${L(Yr(r))}$`, "s");
+		var re$1 = $;
+		return J(w);
+	})();
+	return __lib__.default || __lib__;
+};
+let _match;
+const zeptomatch = (path, pattern) => {
+	if (!_match) {
+		_match = _lazyMatch();
+		_lazyMatch = null;
+	}
+	return _match(path, pattern);
+};
+const _DRIVE_LETTER_START_RE = /^[A-Za-z]:\//;
+function normalizeWindowsPath(input = "") {
+	if (!input) return input;
+	return input.replace(/\\/g, "/").replace(_DRIVE_LETTER_START_RE, (r) => r.toUpperCase());
+}
+const _UNC_REGEX = /^[/\\]{2}/;
+const _IS_ABSOLUTE_RE = /^[/\\](?![/\\])|^[/\\]{2}(?!\.)|^[A-Za-z]:[/\\]/;
+const _DRIVE_LETTER_RE = /^[A-Za-z]:$/;
+const _ROOT_FOLDER_RE = /^\/([A-Za-z]:)?$/;
+const _EXTNAME_RE = /.(\.[^./]+|\.)$/;
+const _PATH_ROOT_RE = /^[/\\]|^[a-zA-Z]:[/\\]/;
+const sep = "/";
+const normalize = function(path) {
+	if (path.length === 0) return ".";
+	path = normalizeWindowsPath(path);
+	const isUNCPath = path.match(_UNC_REGEX);
+	const isPathAbsolute = isAbsolute(path);
+	const trailingSeparator = path[path.length - 1] === "/";
+	path = normalizeString(path, !isPathAbsolute);
+	if (path.length === 0) {
+		if (isPathAbsolute) return "/";
+		return trailingSeparator ? "./" : ".";
+	}
+	if (trailingSeparator) path += "/";
+	if (_DRIVE_LETTER_RE.test(path)) path += "/";
+	if (isUNCPath) {
+		if (!isPathAbsolute) return `//./${path}`;
+		return `//${path}`;
+	}
+	return isPathAbsolute && !isAbsolute(path) ? `/${path}` : path;
+};
+const join = function(...segments) {
+	let path = "";
+	for (const seg of segments) {
+		if (!seg) continue;
+		if (path.length > 0) {
+			const pathTrailing = path[path.length - 1] === "/";
+			const segLeading = seg[0] === "/";
+			if (pathTrailing && segLeading) path += seg.slice(1);
+			else path += pathTrailing || segLeading ? seg : `/${seg}`;
+		} else path += seg;
+	}
+	return normalize(path);
+};
+function cwd$2() {
+	if (typeof process !== "undefined" && typeof process.cwd === "function") return process.cwd().replace(/\\/g, "/");
+	return "/";
+}
+const resolve = function(...arguments_) {
+	arguments_ = arguments_.map((argument) => normalizeWindowsPath(argument));
+	let resolvedPath = "";
+	let resolvedAbsolute = false;
+	for (let index = arguments_.length - 1; index >= -1 && !resolvedAbsolute; index--) {
+		const path = index >= 0 ? arguments_[index] : cwd$2();
+		if (!path || path.length === 0) continue;
+		resolvedPath = `${path}/${resolvedPath}`;
+		resolvedAbsolute = isAbsolute(path);
+	}
+	resolvedPath = normalizeString(resolvedPath, !resolvedAbsolute);
+	if (resolvedAbsolute && !isAbsolute(resolvedPath)) return `/${resolvedPath}`;
+	return resolvedPath.length > 0 ? resolvedPath : ".";
+};
+function normalizeString(path, allowAboveRoot) {
+	let res = "";
+	let lastSegmentLength = 0;
+	let lastSlash = -1;
+	let dots = 0;
+	let char = null;
+	for (let index = 0; index <= path.length; ++index) {
+		if (index < path.length) char = path[index];
+		else if (char === "/") break;
+		else char = "/";
+		if (char === "/") {
+			if (lastSlash === index - 1 || dots === 1);
+			else if (dots === 2) {
+				if (res.length < 2 || lastSegmentLength !== 2 || res[res.length - 1] !== "." || res[res.length - 2] !== ".") {
+					if (res.length > 2) {
+						const lastSlashIndex = res.lastIndexOf("/");
+						if (lastSlashIndex === -1) {
+							res = "";
+							lastSegmentLength = 0;
+						} else {
+							res = res.slice(0, lastSlashIndex);
+							lastSegmentLength = res.length - 1 - res.lastIndexOf("/");
+						}
+						lastSlash = index;
+						dots = 0;
+						continue;
+					} else if (res.length > 0) {
+						res = "";
+						lastSegmentLength = 0;
+						lastSlash = index;
+						dots = 0;
+						continue;
+					}
+				}
+				if (allowAboveRoot) {
+					res += res.length > 0 ? "/.." : "..";
+					lastSegmentLength = 2;
+				}
+			} else {
+				if (res.length > 0) res += `/${path.slice(lastSlash + 1, index)}`;
+				else res = path.slice(lastSlash + 1, index);
+				lastSegmentLength = index - lastSlash - 1;
+			}
+			lastSlash = index;
+			dots = 0;
+		} else if (char === "." && dots !== -1) ++dots;
+		else dots = -1;
+	}
+	return res;
+}
+const isAbsolute = function(p) {
+	return _IS_ABSOLUTE_RE.test(p);
+};
+const toNamespacedPath = function(p) {
+	return normalizeWindowsPath(p);
+};
+const extname = function(p) {
+	if (p === "..") return "";
+	const match = _EXTNAME_RE.exec(normalizeWindowsPath(p));
+	return match && match[1] || "";
+};
+const relative = function(from, to) {
+	const _from = resolve(from).replace(_ROOT_FOLDER_RE, "$1").split("/");
+	const _to = resolve(to).replace(_ROOT_FOLDER_RE, "$1").split("/");
+	if (_to[0][1] === ":" && _from[0][1] === ":" && _from[0] !== _to[0]) return _to.join("/");
+	const _fromCopy = [..._from];
+	for (const segment of _fromCopy) {
+		if (_to[0] !== segment) break;
+		_from.shift();
+		_to.shift();
+	}
+	return [..._from.map(() => ".."), ..._to].join("/");
+};
+const dirname = function(p) {
+	const segments = normalizeWindowsPath(p).replace(/\/$/, "").split("/").slice(0, -1);
+	if (segments.length === 1 && _DRIVE_LETTER_RE.test(segments[0])) segments[0] += "/";
+	return segments.join("/") || (isAbsolute(p) ? "/" : ".");
+};
+const format$2 = function(p) {
+	const ext = p.ext ? p.ext.startsWith(".") ? p.ext : `.${p.ext}` : "";
+	const segments = [
+		p.root,
+		p.dir,
+		p.base ?? (p.name ?? "") + ext
+	].filter(Boolean);
+	return normalizeWindowsPath(p.root ? resolve(...segments) : segments.join("/"));
+};
+const basename = function(p, extension$2) {
+	const segments = normalizeWindowsPath(p).split("/");
+	let lastSegment = "";
+	for (let i = segments.length - 1; i >= 0; i--) {
+		const val = segments[i];
+		if (val) {
+			lastSegment = val;
+			break;
+		}
+	}
+	return extension$2 && lastSegment.endsWith(extension$2) ? lastSegment.slice(0, -extension$2.length) : lastSegment;
+};
+const parse$3 = function(p) {
+	const root$1 = _PATH_ROOT_RE.exec(p)?.[0]?.replace(/\\/g, "/") || "";
+	const base = basename(p);
+	const extension$2 = extname(base);
+	return {
+		root: root$1,
+		dir: dirname(p),
+		base,
+		ext: extension$2,
+		name: base.slice(0, base.length - extension$2.length)
+	};
+};
+const matchesGlob = (path, pattern) => {
+	return zeptomatch(pattern, normalize(path));
+};
+const _path = {
+	__proto__: null,
+	basename,
+	dirname,
+	extname,
+	format: format$2,
+	isAbsolute,
+	join,
+	matchesGlob,
+	normalize,
+	normalizeString,
+	parse: parse$3,
+	relative,
+	resolve,
+	sep,
+	toNamespacedPath
+};
 
 //#endregion
-//#region src/AWS/Account.ts
-var Account = class extends Context.Service()("AWS::AccountID") {};
+//#region ../../node_modules/.bun/pathe@2.0.3/node_modules/pathe/dist/index.mjs
+const delimiter = /* @__PURE__ */ (() => globalThis.process?.platform === "win32" ? ";" : ":")();
+const _platforms = {
+	posix: void 0,
+	win32: void 0
+};
+const mix = (del = delimiter) => {
+	return new Proxy(_path, { get(_, prop) {
+		if (prop === "delimiter") return del;
+		if (prop === "posix") return posix;
+		if (prop === "win32") return win32;
+		return _platforms[prop] || _path[prop];
+	} });
+};
+const posix = /* @__PURE__ */ mix(":");
+const win32 = /* @__PURE__ */ mix(";");
 
 //#endregion
-//#region src/AWS/Bootstrap.ts
-/**
-* Tag key used to identify the alchemy assets bucket.
-*/
-const ASSETS_BUCKET_TAG = "alchemy::assets-bucket";
+//#region src/Auth/Profile.ts
+const rootDir = posix.join(os.homedir(), ".alchemy");
+const configFilePath = posix.join(rootDir, "profiles.json");
 /**
-* Tag key used to scope the alchemy assets bucket to an AWS region.
+* Config key consulted by the various `fromAuthProvider` /
+* `fromEnvironment` layers to pick which named profile in
+* `~/.alchemy/profiles.json` to use. Defaults to `"default"`.
 */
-const ASSETS_BUCKET_REGION_TAG = "alchemy::assets-bucket-region";
-const createAssetsBucketName = (region) => `alchemy-assets-${region}-${crypto.randomUUID().replaceAll("-", "").slice(0, 16)}`.toLowerCase();
-const createAssetsBucketTags = (region) => [{
-	Key: ASSETS_BUCKET_TAG,
-	Value: "true"
-}, {
-	Key: ASSETS_BUCKET_REGION_TAG,
-	Value: region
-}];
-const getBucketTags = (bucketName) => s3.getBucketTagging({ Bucket: bucketName }).pipe(Effect.map((response) => response.TagSet ?? []), Effect.catchTag("NoSuchTagSet", () => Effect.succeed([])));
-const hasAssetsBucketTag = (tags) => tags.some((tag) => tag.Key === ASSETS_BUCKET_TAG && tag.Value === "true");
-const normalizeBucketRegion = (location) => {
-	if (!location) return "us-east-1";
-	if (location === "EU") return "eu-west-1";
-	return location;
-};
-const bucketMatchesRegion = (tags, region) => {
-	const taggedRegion = tags.find((tag) => tag.Key === ASSETS_BUCKET_REGION_TAG)?.Value;
-	return taggedRegion === void 0 ? void 0 : taggedRegion === region;
-};
-const lookupAssetsBuckets = Effect.gen(function* () {
-	const region = yield* Region;
-	const buckets = (yield* s3.listBuckets({})).Buckets ?? [];
-	const matchingBuckets = [];
-	for (const bucket of buckets) {
-		const bucketName = bucket.Name;
-		if (!bucketName) continue;
-		const tags = yield* getBucketTags(bucketName).pipe(Effect.catch(() => Effect.succeed([])));
-		if (!hasAssetsBucketTag(tags)) continue;
-		const taggedRegionMatch = bucketMatchesRegion(tags, region);
-		if (taggedRegionMatch === true) {
-			matchingBuckets.push(bucketName);
-			continue;
-		}
-		if (taggedRegionMatch === false) continue;
-		if ((yield* s3.getBucketLocation({ Bucket: bucketName }).pipe(Effect.map((response) => normalizeBucketRegion(response.LocationConstraint)), Effect.catch(() => Effect.succeed(void 0)))) === region) matchingBuckets.push(bucketName);
-	}
-	return matchingBuckets;
-});
-const lookupAssetsBucket = Effect.gen(function* () {
-	const matchingBuckets = yield* lookupAssetsBuckets;
-	for (const bucketName of matchingBuckets) return Option.some(bucketName);
-	return Option.none();
-});
-const ensureAssetsBucketTags = Effect.fn(function* (bucketName, region) {
-	const tagSet = [...(yield* getBucketTags(bucketName)).filter((tag) => tag.Key !== ASSETS_BUCKET_TAG && tag.Key !== ASSETS_BUCKET_REGION_TAG), ...createAssetsBucketTags(region)];
-	yield* s3.putBucketTagging({
-		Bucket: bucketName,
-		Tagging: { TagSet: tagSet.map((tag) => ({
-			Key: tag.Key,
-			Value: tag.Value
-		})) }
-	});
-});
-const deleteAllObjects = Effect.fn(function* (bucketName) {
-	let continuationToken;
-	do {
-		const listResponse = yield* s3.listObjectsV2({
-			Bucket: bucketName,
-			ContinuationToken: continuationToken
-		});
-		if (listResponse.Contents && listResponse.Contents.length > 0) yield* s3.deleteObjects({
-			Bucket: bucketName,
-			Delete: {
-				Objects: listResponse.Contents.map((obj) => ({ Key: obj.Key })),
-				Quiet: true
-			}
-		});
-		continuationToken = listResponse.NextContinuationToken;
-	} while (continuationToken);
-	let keyMarker;
-	let versionIdMarker;
-	do {
-		const listVersionsResponse = yield* s3.listObjectVersions({
-			Bucket: bucketName,
-			KeyMarker: keyMarker,
-			VersionIdMarker: versionIdMarker
-		});
-		const objectsToDelete = [...(listVersionsResponse.Versions ?? []).map((v) => ({
-			Key: v.Key,
-			VersionId: v.VersionId
-		})), ...(listVersionsResponse.DeleteMarkers ?? []).map((dm) => ({
-			Key: dm.Key,
-			VersionId: dm.VersionId
-		}))];
-		if (objectsToDelete.length > 0) yield* s3.deleteObjects({
-			Bucket: bucketName,
-			Delete: {
-				Objects: objectsToDelete,
-				Quiet: true
-			}
-		});
-		keyMarker = listVersionsResponse.NextKeyMarker;
-		versionIdMarker = listVersionsResponse.NextVersionIdMarker;
-	} while (keyMarker);
+const ALCHEMY_PROFILE = Config.string("ALCHEMY_PROFILE").pipe(Config.withDefault("default"));
+const CONFIG_VERSION = 0;
+const emptyConfig = () => ({
+	version: CONFIG_VERSION,
+	profiles: {}
 });
+const readConfig = FileSystem.FileSystem.asEffect().pipe(Effect.flatMap((fs$2) => fs$2.readFileString(configFilePath)), Effect.flatMap((data) => Effect.try({
+	try: () => {
+		const parsed = JSON.parse(data);
+		if (parsed?.version !== CONFIG_VERSION) return emptyConfig();
+		return parsed;
+	},
+	catch: emptyConfig
+})), Effect.orElseSucceed(emptyConfig));
+const writeConfig = (config) => FileSystem.FileSystem.asEffect().pipe(Effect.tap((fs$2) => fs$2.makeDirectory(posix.dirname(configFilePath), { recursive: true })), Effect.flatMap((fs$2) => fs$2.writeFileString(configFilePath, JSON.stringify(config, null, 2))));
+const getProfile = (name) => readConfig.pipe(Effect.map((config) => config.profiles[name]));
+const setProfile = (name, profile$1) => readConfig.pipe(Effect.tap((config) => Effect.sync(() => config.profiles[name] = profile$1)), Effect.flatMap(writeConfig));
 /**
-* Bootstrap the AWS environment by creating the assets bucket.
+* Returns a `ConfigProvider` that overrides `ALCHEMY_PROFILE` with the
+* given `profile` (when explicitly passed via the CLI `--profile` flag),
+* falling through to `base` for everything else.
 *
-* This is idempotent - running it multiple times is safe.
-* The bucket is tagged and later discovered by tag lookup instead of by name.
+* Use this to let the CLI's `--profile <name>` win over `$ALCHEMY_PROFILE`
+* without disturbing other config lookups.
 */
-const bootstrap = Effect.fn(function* () {
-	const region = yield* Region;
-	const existingBucket = yield* lookupAssetsBucket;
-	if (Option.isSome(existingBucket)) {
-		yield* ensureAssetsBucketTags(existingBucket.value, region);
-		yield* Effect.logInfo(`Assets bucket already exists: ${existingBucket.value}`);
-		return {
-			bucketName: existingBucket.value,
-			created: false
-		};
-	}
-	const bucketName = createAssetsBucketName(region);
-	if (region === "us-east-1") yield* s3.createBucket({ Bucket: bucketName }).pipe(Effect.retry({
-		while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
-		schedule: Schedule.exponential(100)
-	}));
-	else yield* s3.createBucket({
-		Bucket: bucketName,
-		CreateBucketConfiguration: { LocationConstraint: region }
-	}).pipe(Effect.catchTag("BucketAlreadyOwnedByYou", () => Effect.void), Effect.retry({
-		while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
-		schedule: Schedule.exponential(100)
-	}));
-	yield* s3.headBucket({ Bucket: bucketName }).pipe(Effect.retry({ schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10))) }));
-	yield* ensureAssetsBucketTags(bucketName, region);
-	yield* Effect.logInfo(`Created assets bucket: ${bucketName}`);
-	return {
-		bucketName,
-		created: true
-	};
-});
-const destroyBootstrap = Effect.fn(function* () {
-	const bucketNames = yield* lookupAssetsBuckets;
-	for (const bucketName of bucketNames) {
-		yield* Effect.logInfo(`Destroying assets bucket: ${bucketName}`);
-		yield* deleteAllObjects(bucketName);
-		yield* s3.deleteBucket({ Bucket: bucketName }).pipe(Effect.retry({
-			while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
-			schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10)))
-		}));
-	}
-	return {
-		bucketNames,
-		destroyed: bucketNames.length
-	};
-});
+const withProfileOverride = (base, profile$1) => {
+	if (profile$1 === void 0) return base;
+	const overrides = { ALCHEMY_PROFILE: profile$1 };
+	const overrideProvider = ConfigProvider.make((path) => Effect.succeed(path.length === 1 && typeof path[0] === "string" && path[0] in overrides ? ConfigProvider.makeValue(overrides[path[0]]) : void 0));
+	return ConfigProvider.orElse(base)(overrideProvider);
+};
 
 //#endregion
 //#region ../../node_modules/.bun/react@19.2.5/node_modules/react/cjs/react.production.js
@@ -2048,19 +2792,19 @@ var require_react_development = /* @__PURE__ */ __commonJS({ "../../node_modules
 			prevActScopeDepth !== actScopeDepth - 1 && console.error("You seem to have overlapping act() calls, this is not supported. Be sure to await previous act() calls before making a new one. ");
 			actScopeDepth = prevActScopeDepth;
 		}
-		function recursivelyFlushAsyncActWork(returnValue, resolve, reject) {
+		function recursivelyFlushAsyncActWork(returnValue, resolve$1, reject) {
 			var queue = ReactSharedInternals$1.actQueue;
 			if (null !== queue) if (0 !== queue.length) try {
 				flushActQueue(queue);
 				enqueueTask(function() {
-					return recursivelyFlushAsyncActWork(returnValue, resolve, reject);
+					return recursivelyFlushAsyncActWork(returnValue, resolve$1, reject);
 				});
 				return;
 			} catch (error) {
 				ReactSharedInternals$1.thrownErrors.push(error);
 			}
 			else ReactSharedInternals$1.actQueue = null;
-			0 < ReactSharedInternals$1.thrownErrors.length ? (queue = aggregateErrors(ReactSharedInternals$1.thrownErrors), ReactSharedInternals$1.thrownErrors.length = 0, reject(queue)) : resolve(returnValue);
+			0 < ReactSharedInternals$1.thrownErrors.length ? (queue = aggregateErrors(ReactSharedInternals$1.thrownErrors), ReactSharedInternals$1.thrownErrors.length = 0, reject(queue)) : resolve$1(returnValue);
 		}
 		function flushActQueue(queue) {
 			if (!isFlushing) {
@@ -2221,14 +2965,14 @@ var require_react_development = /* @__PURE__ */ __commonJS({ "../../node_modules
 				queueSeveralMicrotasks(function() {
 					didAwaitActCall || didWarnNoAwaitAct || (didWarnNoAwaitAct = !0, console.error("You called act(async () => ...) without await. This could lead to unexpected testing behaviour, interleaving multiple act calls and mixing their scopes. You should - await act(async () => ...);"));
 				});
-				return { then: function(resolve, reject) {
+				return { then: function(resolve$1, reject) {
 					didAwaitActCall = !0;
 					thenable.then(function(returnValue) {
 						popActScope(prevActQueue, prevActScopeDepth);
 						if (0 === prevActScopeDepth) {
 							try {
 								flushActQueue(queue), enqueueTask(function() {
-									return recursivelyFlushAsyncActWork(returnValue, resolve, reject);
+									return recursivelyFlushAsyncActWork(returnValue, resolve$1, reject);
 								});
 							} catch (error$0) {
 								ReactSharedInternals$1.thrownErrors.push(error$0);
@@ -2238,7 +2982,7 @@ var require_react_development = /* @__PURE__ */ __commonJS({ "../../node_modules
 								ReactSharedInternals$1.thrownErrors.length = 0;
 								reject(_thrownError);
 							}
-						} else resolve(returnValue);
+						} else resolve$1(returnValue);
 					}, function(error) {
 						popActScope(prevActQueue, prevActScopeDepth);
 						0 < ReactSharedInternals$1.thrownErrors.length ? (error = aggregateErrors(ReactSharedInternals$1.thrownErrors), ReactSharedInternals$1.thrownErrors.length = 0, reject(error)) : reject(error);
@@ -2251,11 +2995,11 @@ var require_react_development = /* @__PURE__ */ __commonJS({ "../../node_modules
 				didAwaitActCall || didWarnNoAwaitAct || (didWarnNoAwaitAct = !0, console.error("A component suspended inside an `act` scope, but the `act` call was not awaited. When testing React components that depend on asynchronous data, you must await the result:\n\nawait act(() => ...)"));
 			}), ReactSharedInternals$1.actQueue = null);
 			if (0 < ReactSharedInternals$1.thrownErrors.length) throw callback = aggregateErrors(ReactSharedInternals$1.thrownErrors), ReactSharedInternals$1.thrownErrors.length = 0, callback;
-			return { then: function(resolve, reject) {
+			return { then: function(resolve$1, reject) {
 				didAwaitActCall = !0;
 				0 === prevActScopeDepth ? (ReactSharedInternals$1.actQueue = queue, enqueueTask(function() {
-					return recursivelyFlushAsyncActWork(returnValue$jscomp$0, resolve, reject);
-				})) : resolve(returnValue$jscomp$0);
+					return recursivelyFlushAsyncActWork(returnValue$jscomp$0, resolve$1, reject);
+				})) : resolve$1(returnValue$jscomp$0);
 			} };
 		};
 		exports.cache = function(fn) {
@@ -3092,7 +3836,7 @@ var loadYoga = (() => {
 		function Ja(a) {
 			a = Ka(a);
 			var b = N(a);
-			S$1(a);
+			S(a);
 			return b;
 		}
 		function La(a, b) {
@@ -3910,7 +4654,7 @@ var loadYoga = (() => {
 							for (k = 0; k < e; ++k) l[k] = String.fromCharCode(A[f + k]);
 							l = l.join("");
 						}
-						S$1(d);
+						S(d);
 						return l;
 					},
 					toWireType: function(d, e) {
@@ -3960,15 +4704,15 @@ var loadYoga = (() => {
 								}
 								f[g] = 0;
 							}
-						} else if (g) for (g = 0; g < f; ++g) l = e.charCodeAt(g), 255 < l && (S$1(m), L("String has UTF-16 code units that do not fit in 8 bits")), A[m + g] = l;
+						} else if (g) for (g = 0; g < f; ++g) l = e.charCodeAt(g), 255 < l && (S(m), L("String has UTF-16 code units that do not fit in 8 bits")), A[m + g] = l;
 						else for (g = 0; g < f; ++g) A[m + g] = e[g];
-						null !== d && d.push(S$1, k);
+						null !== d && d.push(S, k);
 						return k;
 					},
 					argPackAdvance: 8,
 					readValueFromPointer: Xa,
 					V: function(d) {
-						S$1(d);
+						S(d);
 					}
 				});
 			},
@@ -3988,7 +4732,7 @@ var loadYoga = (() => {
 							var t = m + 4 + u * b;
 							if (u == l || 0 == n[t >> k]) r = d(r, t - r), void 0 === p ? p = r : (p += String.fromCharCode(0), p += r), r = t + b;
 						}
-						S$1(m);
+						S(m);
 						return p;
 					},
 					toWireType: function(m, l) {
@@ -3996,13 +4740,13 @@ var loadYoga = (() => {
 						var n = f(l), p = Ib(4 + n + b);
 						E[p >> 2] = n >> k;
 						e(l, p + 4, n + b);
-						null !== m && m.push(S$1, p);
+						null !== m && m.push(S, p);
 						return p;
 					},
 					argPackAdvance: 8,
 					readValueFromPointer: Xa,
 					V: function(m) {
-						S$1(m);
+						S(m);
 					}
 				});
 			},
@@ -4176,8 +4920,8 @@ var loadYoga = (() => {
 		};
 		var Ib = h._malloc = function() {
 			return (Ib = h._malloc = h.asm.I).apply(null, arguments);
-		}, S$1 = h._free = function() {
-			return (S$1 = h._free = h.asm.K).apply(null, arguments);
+		}, S = h._free = function() {
+			return (S = h._free = h.asm.K).apply(null, arguments);
 		};
 		h.dynCall_jiji = function() {
 			return (h.dynCall_jiji = h.asm.L).apply(null, arguments);
@@ -7024,8 +7768,8 @@ var require_react_reconciler_production = /* @__PURE__ */ __commonJS({ "../../no
 				currentEntangledActionThenable = {
 					status: "pending",
 					value: void 0,
-					then: function(resolve) {
-						entangledListeners.push(resolve);
+					then: function(resolve$1) {
+						entangledListeners.push(resolve$1);
 					}
 				};
 			}
@@ -7048,8 +7792,8 @@ var require_react_reconciler_production = /* @__PURE__ */ __commonJS({ "../../no
 				status: "pending",
 				value: null,
 				reason: null,
-				then: function(resolve) {
-					listeners.push(resolve);
+				then: function(resolve$1) {
+					listeners.push(resolve$1);
 				}
 			};
 			thenable.then(function() {
@@ -14131,8 +14875,8 @@ var require_react_reconciler_development = /* @__PURE__ */ __commonJS({ "../../n
 				currentEntangledActionThenable = {
 					status: "pending",
 					value: void 0,
-					then: function(resolve) {
-						entangledListeners.push(resolve);
+					then: function(resolve$1) {
+						entangledListeners.push(resolve$1);
 					}
 				};
 			}
@@ -14155,8 +14899,8 @@ var require_react_reconciler_development = /* @__PURE__ */ __commonJS({ "../../n
 				status: "pending",
 				value: null,
 				reason: null,
-				then: function(resolve) {
-					listeners.push(resolve);
+				then: function(resolve$1) {
+					listeners.push(resolve$1);
 				}
 			};
 			thenable.then(function() {
@@ -32682,11 +33426,11 @@ var require_backend = /* @__PURE__ */ __commonJS({ "../../node_modules/.bun/reac
 						var componentInfo = getCurrentComponentInfo();
 						if (componentInfo === null) return;
 						if (args.length > 3 && typeof args[0] === "string" && args[0].startsWith("%c%s%c ") && typeof args[1] === "string" && typeof args[2] === "string" && typeof args[3] === "string") {
-							var format$2 = args[0].slice(7);
+							var format$3 = args[0].slice(7);
 							var env$2 = args[2].trim();
 							args = args.slice(4);
-							if (env$2 !== componentInfo.env) args.unshift("[" + env$2 + "] " + format$2);
-							else args.unshift(format$2);
+							if (env$2 !== componentInfo.env) args.unshift("[" + env$2 + "] " + format$3);
+							else args.unshift(format$3);
 						}
 						var message = formatConsoleArgumentsToSingleString.apply(void 0, renderer_toConsumableArray(args));
 						var componentLogsEntry = componentInfoToComponentLogsMap.get(componentInfo);
@@ -42130,10 +42874,10 @@ var require_stack_utils = /* @__PURE__ */ __commonJS({ "../../node_modules/.bun/
 			return res;
 		}
 	};
-	function setFile(result, filename, cwd$2) {
+	function setFile(result, filename, cwd$3) {
 		if (filename) {
 			filename = filename.replace(/\\/g, "/");
-			if (filename.startsWith(`${cwd$2}/`)) filename = filename.slice(cwd$2.length + 1);
+			if (filename.startsWith(`${cwd$3}/`)) filename = filename.slice(cwd$3.length + 1);
 			result.file = filename;
 		}
 	}
@@ -42976,8 +43720,8 @@ var Ink = class {
 		else setImmediate(resolveOrReject);
 	}
 	async waitUntilExit() {
-		this.exitPromise ||= new Promise((resolve, reject) => {
-			this.resolveExitPromise = resolve;
+		this.exitPromise ||= new Promise((resolve$1, reject) => {
+			this.resolveExitPromise = resolve$1;
 			this.rejectExitPromise = reject;
 		});
 		if (!this.beforeExitHandler) {
@@ -44362,16 +45106,6 @@ const startApplySession = Effect.fn(function* (plan) {
 	};
 });
 
-//#endregion
-//#region src/Config.ts
-var DotAlchemy = class extends Context.Service()(".alchemy") {};
-const dotAlchemy = Layer.effect(DotAlchemy, Effect.gen(function* () {
-	const fs$2 = yield* FileSystem.FileSystem;
-	const dir = (yield* Path$1.Path).join(process.cwd(), ".alchemy");
-	yield* fs$2.makeDirectory(dir, { recursive: true });
-	return dir;
-}));
-
 //#endregion
 //#region src/Util/types.ts
 const asEffect = (effect) => Effect.isEffect(effect) ? effect : Effect.succeed(effect);
@@ -44703,224 +45437,114 @@ var DeleteResourceHasDownstreamDependencies = class extends Data.TaggedError("De
 var UnsatisfiedResourceCycle = class extends Data.TaggedError("UnsatisfiedResourceCycle") {};
 
 //#endregion
-//#region src/Util/ConfigProvider.ts
-const loadConfigProvider = (envFile$1) => {
-	if (Option.isSome(envFile$1)) return ConfigProvider.fromDotEnv({ path: envFile$1.value }).pipe(Effect.map((dotEnv) => ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv())));
-	return Effect.gen(function* () {
-		if (!(yield* (yield* FileSystem.FileSystem).exists(".env"))) return ConfigProvider.fromEnv();
-		return ConfigProvider.orElse(yield* ConfigProvider.fromDotEnv({ path: ".env" }), ConfigProvider.fromEnv());
-	});
-};
-
-//#endregion
-//#region src/Util/FileLogger.ts
-const fileLogger = Effect.fnUntraced(function* (...segments) {
-	const dotAlchemy$1 = yield* DotAlchemy;
-	const fs$2 = yield* FileSystem.FileSystem;
-	const path = yield* Path;
-	const logFile = path.join(dotAlchemy$1, "log", ...segments);
-	yield* fs$2.makeDirectory(path.dirname(logFile), { recursive: true });
-	return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
+//#region bin/commands/deploy.ts
+const execStack = Effect.fn(function* ({ main: main$1, stage: stage$1, envFile: envFile$1, profile: profile$1, dryRun: dryRun$1 = false, force: force$1 = false, yes: yes$1 = false, destroy = false }) {
+	const stackEffect = yield* importStack(main$1);
+	const services$1 = Layer.mergeAll(Layer.succeed(ArtifactStore, createArtifactStore()), Layer.succeed(AuthProviders, {}), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(envFile$1), profile$1)), inkCLI(), Logger.layer([fileLogger("out")]), Layer.succeed(Stage, stage$1), LocalState);
+	yield* Effect.gen(function* () {
+		const cli$1 = yield* Cli;
+		const stack = yield* stackEffect;
+		yield* Effect.gen(function* () {
+			const updatePlan = yield* make(destroy ? {
+				...stack,
+				resources: {},
+				bindings: {},
+				output: {}
+			} : stack, { force: force$1 });
+			if (dryRun$1) yield* cli$1.displayPlan(updatePlan);
+			else {
+				if (!yes$1) {
+					if (!(yield* cli$1.approvePlan(updatePlan))) return;
+				}
+				const outputs = yield* apply(updatePlan);
+				yield* Console.log(outputs);
+			}
+		}).pipe(Effect.provide(stack.services));
+	}).pipe(Effect.provide(services$1));
 });
-
-//#endregion
-//#region bin/alchemy.ts
-const USER = Config.string("USER").pipe(Config.orElse(() => Config.string("USERNAME")), Config.withDefault("unknown"));
-const STAGE = Config.string("stage").pipe(Config.option, (a) => a.asEffect(), Effect.map(Option.getOrUndefined));
-const stage = Flag.string("stage").pipe(Flag.withSchema(S.String.check(S.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))), Flag.withDescription("Stage to deploy to, defaults to dev_${USER}"), Flag.optional, Flag.map(Option.getOrUndefined), Flag.mapEffect(Effect.fn(function* (stage$1) {
-	if (stage$1) return stage$1;
-	return yield* STAGE.pipe(Effect.catch(() => Effect.fail(new CliError.MissingOption({ option: "stage" }))), Effect.flatMap((s) => s === void 0 ? USER.asEffect().pipe(Effect.map((user) => `dev_${user}`), Effect.catch(() => Effect.succeed("unknown"))) : Effect.succeed(s)));
-})));
-const envFile = Flag.file("env-file").pipe(Flag.optional, Flag.withDescription("File to load environment variables from, defaults to .env"));
-const dryRun = Flag.boolean("dry-run").pipe(Flag.withDescription("Dry run the deployment, do not actually deploy"), Flag.withDefault(false));
-const yes = Flag.boolean("yes").pipe(Flag.withDescription("Yes to all prompts"), Flag.withDefault(false));
-const force = Flag.boolean("force").pipe(Flag.withDescription("Force updates for resources that would otherwise no-op"), Flag.withDefault(false));
-const main = Argument.file("main", { mustExist: true }).pipe(Argument.withDescription("Main file to deploy, defaults to alchemy.run.ts"), Argument.withDefault("alchemy.run.ts"));
-const deployCommand = Command.make("deploy", {
+const deployCommand = Command$1.make("deploy", {
 	dryRun,
 	force,
 	main,
 	envFile,
 	stage,
-	yes
-}, (args) => execStack(args));
-const destroyCommand = Command.make("destroy", {
+	yes,
+	profile
+}, execStack);
+const destroyCommand = Command$1.make("destroy", {
 	dryRun,
 	main,
 	envFile,
 	stage,
-	yes
+	yes,
+	profile
 }, (args) => execStack({
 	...args,
 	destroy: true
 }));
-const planCommand = Command.make("plan", {
+const planCommand = Command$1.make("plan", {
 	main,
 	envFile,
-	stage
+	stage,
+	profile
 }, (args) => execStack({
 	...args,
 	dryRun: true
 }));
-const execStack = Effect.fn(function* ({ main: main$1, stage: stage$1, envFile: envFile$1, dryRun: dryRun$1 = false, force: force$1 = false, yes: yes$1 = false, destroy = false }) {
-	const path = yield* Path;
-	const stackEffect = (yield* Effect.promise(() => import(path.resolve(process.cwd(), main$1)))).default;
-	if (!stackEffect) return yield* Effect.die(/* @__PURE__ */ new Error(`Main file '${main$1}' must export a default stack definition (export default defineStack({...}))`));
-	const configProvider = yield* loadConfigProvider(envFile$1);
-	const platform$1 = Layer.mergeAll(NodeServices.layer, FetchHttpClient.layer);
-	const rootLogger = Logger.layer([fileLogger("out")]);
-	const alchemy = Layer.mergeAll(LocalState, inkCLI(), Layer.provideMerge(rootLogger, dotAlchemy));
-	yield* Effect.gen(function* () {
-		const cli = yield* Cli;
-		const stack = yield* stackEffect;
-		yield* Effect.gen(function* () {
-			const updatePlan = yield* make(destroy ? {
-				...stack,
-				resources: {},
-				bindings: {},
-				output: {}
-			} : stack, { force: force$1 });
-			if (dryRun$1) yield* cli.displayPlan(updatePlan);
-			else {
-				if (!yes$1) {
-					if (!(yield* cli.approvePlan(updatePlan))) return;
-				}
-				const outputs = yield* apply(updatePlan);
-				yield* Console.log(outputs);
-			}
-		}).pipe(Effect.provide(stack.services), provideFreshArtifactStore);
-	}).pipe(Effect.provide(Layer.provideMerge(alchemy, Layer.mergeAll(platform$1, Layer.succeed(Stage, stage$1)))), Effect.provideService(ConfigProvider.ConfigProvider, configProvider));
-});
-const resourceFilter = Flag.string("filter").pipe(Flag.withDescription("Comma-separated logical resource IDs (e.g. Api,Sandbox). Only those resources are included."), Flag.optional, Flag.map(Option.getOrUndefined));
-const tailCommand = Command.make("tail", {
+
+//#endregion
+//#region bin/commands/login.ts
+const loginConfigure = Flag.boolean("configure").pipe(Flag.withDescription("Run the provider's interactive configure step before logging in"), Flag.withDefault(false));
+const loginCommand = Command.make("login", {
 	main,
 	envFile,
 	stage,
-	filter: resourceFilter
-}, Effect.fnUntraced(function* ({ main: main$1, stage: stage$1, envFile: envFile$1, filter }) {
-	const path = yield* Path;
-	const stackEffect = (yield* Effect.promise(() => import(path.resolve(process.cwd(), main$1)))).default;
-	if (!stackEffect) return yield* Effect.die(/* @__PURE__ */ new Error(`Main file '${main$1}' must export a default stack definition (export default defineStack({...}))`));
-	const configProvider = yield* loadConfigProvider(envFile$1);
-	const platform$1 = Layer.mergeAll(NodeServices.layer, FetchHttpClient.layer);
-	const rootLogger = Logger.layer([fileLogger("out")]);
-	const alchemy = Layer.mergeAll(LocalState, Layer.provideMerge(rootLogger, dotAlchemy));
+	profile,
+	configure: loginConfigure
+}, Effect.fnUntraced(function* ({ main: main$1, stage: stage$1, envFile: envFile$1, profile: profile$1, configure }) {
+	const stackEffect = yield* importStack(main$1);
+	const authProviders = {};
+	const services$1 = Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(envFile$1), profile$1)), Logger.layer([fileLogger("out")]), Layer.succeed(Stage, stage$1), LocalState);
 	yield* Effect.gen(function* () {
-		const state = yield* State;
-		const stack = yield* stackEffect;
-		yield* Effect.gen(function* () {
-			const filterSet = parseResourceFilter(filter);
-			const availableIds = [...new Set(Object.values(stack.resources).map((r) => r.LogicalId))].sort();
-			if (filterSet) {
-				for (const id of filterSet) if (!availableIds.includes(id)) return yield* Effect.die(/* @__PURE__ */ new Error(`Unknown resource '${id}' in --filter. Available: ${availableIds.join(", ") || "(none)"}`));
-			}
-			const fqns = Object.keys(stack.resources);
-			const tailable = [];
-			for (const fqn of fqns) {
-				const resource = stack.resources[fqn];
-				if (filterSet && !filterSet.has(resource.LogicalId)) continue;
-				const resourceState = yield* state.get({
-					stack: stack.name,
-					stage: stack.stage,
-					fqn
-				});
-				if (!resourceState?.attr) continue;
-				const provider = yield* findProviderByType(resource.Type);
-				if (!provider.tail) continue;
-				tailable.push({
-					logicalId: resource.LogicalId,
-					stream: provider.tail({
-						id: resource.LogicalId,
-						instanceId: resourceState.instanceId,
-						props: resourceState.props,
-						output: resourceState.attr
-					})
+		yield* stackEffect;
+		const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+		const providers = Object.values(authProviders);
+		if (providers.length === 0) {
+			yield* Console.log("No AuthProviders registered. Make sure the stack's providers() layer includes AuthProviderLayer entries.");
+			return;
+		}
+		yield* Effect.forEach(providers, (provider) => Effect.gen(function* () {
+			const existing = yield* getProfile(profile$1);
+			const stored = existing?.[provider.name];
+			let cfg;
+			if (configure || stored == null) {
+				cfg = yield* provider.configure(profile$1, { ci });
+				yield* setProfile(profile$1, {
+					...existing,
+					[provider.name]: cfg
 				});
-			}
-			if (tailable.length === 0) {
-				if (filterSet) yield* Console.log("No tailable resources match --filter (deploy first, or selected resources may not support tail).");
-				else yield* Console.log("No tailable resources found. Deploy first, then run tail.");
-				return;
-			}
-			yield* Console.log(`Tailing: ${tailable.map((t) => t.logicalId).join(", ")}`);
-			const taggedStreams = tailable.map(({ logicalId, stream }, i) => {
-				const color = TAIL_COLORS[i % TAIL_COLORS.length];
-				return stream.pipe(Stream$1.map(({ timestamp, message }) => {
-					return `${color}${formatLocalTimestamp(timestamp)} [${logicalId}]${TAIL_RESET} ${message}`;
-				}));
-			});
-			yield* Stream$1.mergeAll(taggedStreams, { concurrency: "unbounded" }).pipe(Stream$1.runForEach((line) => Console.log(line)));
-		}).pipe(Effect.provide(stack.services));
-	}).pipe(Effect.provide(Layer.provideMerge(alchemy, Layer.mergeAll(platform$1, Layer.succeed(Stage, stage$1)))), Effect.provideService(ConfigProvider.ConfigProvider, configProvider), Effect.scoped);
+			} else cfg = stored;
+			yield* provider.login(profile$1, cfg);
+			yield* provider.prettyPrint(profile$1, cfg);
+		}), { discard: true });
+	}).pipe(Effect.provide(services$1));
 }));
-const awsProfile = Flag.string("profile").pipe(Flag.withDescription("AWS profile to use for credentials"), Flag.optional, Flag.map(Option.getOrElse(() => "default")));
-const awsRegion = Flag.string("region").pipe(Flag.withDescription("AWS region to bootstrap (defaults to AWS_REGION env var)"), Flag.optional, Flag.map(Option.getOrUndefined));
-const bootstrapDestroy = Flag.boolean("destroy").pipe(Flag.withDescription("Destroy all bootstrap buckets in the selected region"), Flag.withDefault(false));
-const bootstrapCommand = Command.make("bootstrap", {
-	envFile,
-	profile: awsProfile,
-	region: awsRegion,
-	destroy: bootstrapDestroy
-}, Effect.fnUntraced(function* ({ envFile: envFile$1, profile, region, destroy }) {
-	const platform$1 = Layer.mergeAll(NodeServices.layer, FetchHttpClient.layer, Layer.provideMerge(Logger.layer([fileLogger("bootstrap.txt")]), dotAlchemy));
-	return yield* Effect.gen(function* () {
-		const ssoProfile = yield* Auth.loadProfile(profile);
-		const credentials = yield* Auth.loadProfileCredentials(profile);
-		const awsLayers = Layer.mergeAll(Layer.succeed(Account, profile), Layer.succeed(Region$1, region ?? ssoProfile.region ?? "us-east-1"), Layer.succeed(Credentials, Effect.succeed(credentials)));
-		return yield* Effect.gen(function* () {
-			const provider = yield* loadConfigProvider(envFile$1);
-			const bootstrapLayer = Layer.provide(awsLayers, Layer.succeed(ConfigProvider.ConfigProvider, provider));
-			if (destroy) {
-				yield* destroyBootstrap().pipe(Effect.tap((result) => result.destroyed === 0 ? Console.log("✓ No bootstrap buckets found to destroy") : Console.log(`✓ Destroyed ${result.destroyed} bootstrap bucket(s): ${result.bucketNames.join(", ")}`)), Effect.provide(bootstrapLayer));
-				return;
-			}
-			yield* bootstrap().pipe(Effect.tap(({ bucketName, created }) => created ? Console.log(`✓ Created assets bucket: ${bucketName}`) : Console.log(`✓ Assets bucket already exists: ${bucketName}`)), Effect.provide(bootstrapLayer));
-		});
-	}).pipe(Effect.provide(platform$1));
-}));
-Command.make("dev", {
-	main,
-	envFile,
-	stage
-}, ({ envFile: envFile$1, main: main$1, stage: stage$1 }) => Effect.gen(function* () {
-	const proc = yield* ChildProcess.make("bun", ["--hot", main$1], { env: { ALCHEMY_PHASE: "dev" } });
-	proc.stdout;
-	proc.stderr;
-	proc.all;
-}));
-const TAIL_COLORS = [
-	"\x1B[36m",
-	"\x1B[35m",
-	"\x1B[33m",
-	"\x1B[32m",
-	"\x1B[34m",
-	"\x1B[91m",
-	"\x1B[96m",
-	"\x1B[95m",
-	"\x1B[93m",
-	"\x1B[92m"
-];
-const TAIL_RESET = "\x1B[0m";
-const formatLocalTimestamp = (date) => {
-	return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}-${String(date.getDate()).padStart(2, "0")} ${String(date.getHours()).padStart(2, "0")}:${String(date.getMinutes()).padStart(2, "0")}:${String(date.getSeconds()).padStart(2, "0")}.${String(date.getMilliseconds()).padStart(3, "0")} ${new Intl.DateTimeFormat("en-US", { timeZoneName: "short" }).formatToParts(date).find((p) => p.type === "timeZoneName")?.value ?? ""}`;
-};
+
+//#endregion
+//#region bin/commands/logs.ts
 const logsLimit = Flag.integer("limit").pipe(Flag.withDescription("Number of log entries to fetch"), Flag.withDefault(100));
 const logsSince = Flag.string("since").pipe(Flag.withDescription("Fetch logs since this time (e.g. '1h', '30m', '2024-01-01T00:00:00Z')"), Flag.optional, Flag.map(Option.getOrUndefined));
 const logsCommand = Command.make("logs", {
 	main,
 	envFile,
 	stage,
+	profile,
 	filter: resourceFilter,
 	limit: logsLimit,
 	since: logsSince
-}, Effect.fnUntraced(function* ({ main: main$1, stage: stage$1, envFile: envFile$1, filter, limit, since }) {
-	const path = yield* Path;
-	const stackEffect = (yield* Effect.promise(() => import(path.resolve(process.cwd(), main$1)))).default;
-	if (!stackEffect) return yield* Effect.die(/* @__PURE__ */ new Error(`Main file '${main$1}' must export a default stack definition (export default defineStack({...}))`));
-	const configProvider = yield* loadConfigProvider(envFile$1);
-	const platform$1 = Layer.mergeAll(NodeServices.layer, FetchHttpClient.layer);
-	const rootLogger = Logger.layer([fileLogger("out")]);
-	const alchemy = Layer.mergeAll(LocalState, Layer.provideMerge(rootLogger, dotAlchemy));
+}, Effect.fnUntraced(function* ({ main: main$1, stage: stage$1, envFile: envFile$1, profile: profile$1, filter, limit, since }) {
+	const stackEffect = yield* importStack(main$1);
+	const services$1 = Layer.mergeAll(ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(envFile$1), profile$1)), Layer.succeed(AuthProviders, {}), Layer.succeed(Stage, stage$1), Logger.layer([fileLogger("out")]), LocalState);
 	const sinceDate = since ? parseSince(since) : void 0;
 	yield* Effect.gen(function* () {
 		const state = yield* State;
@@ -44973,35 +45597,83 @@ const logsCommand = Command.make("logs", {
 			}).sort((a, b) => a.timestamp.getTime() - b.timestamp.getTime());
 			for (const entry of merged) yield* Console.log(entry.formatted);
 		}).pipe(Effect.provide(stack.services));
-	}).pipe(Effect.provide(Layer.provideMerge(alchemy, Layer.mergeAll(platform$1, Layer.succeed(Stage, stage$1)))), Effect.provideService(ConfigProvider.ConfigProvider, configProvider), Effect.scoped);
+	}).pipe(Effect.provide(services$1));
 }));
-const parseResourceFilter = (filter) => {
-	if (filter === void 0) return void 0;
-	const ids = filter.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-	if (ids.length === 0) return void 0;
-	return new Set(ids);
-};
-const parseSince = (value) => {
-	const match = value.match(/^(\d+)([smhd])$/);
-	if (match) {
-		const num = parseInt(match[1], 10);
-		const unit = match[2];
-		const ms = unit === "s" ? num * 1e3 : unit === "m" ? num * 6e4 : unit === "h" ? num * 36e5 : num * 864e5;
-		return new Date(Date.now() - ms);
-	}
-	const parsed = new Date(value);
-	if (isNaN(parsed.getTime())) throw new Error(`Invalid --since value: '${value}'. Use a duration (e.g. '1h', '30m') or ISO date.`);
-	return parsed;
-};
-const root = Command.make("alchemy", {}).pipe(Command.withSubcommands([
+
+//#endregion
+//#region bin/commands/tail.ts
+const tailCommand = Command$1.make("tail", {
+	main,
+	envFile,
+	stage,
+	profile,
+	filter: resourceFilter
+}, Effect.fnUntraced(function* ({ main: main$1, stage: stage$1, envFile: envFile$1, profile: profile$1, filter }) {
+	const stackEffect = yield* importStack(main$1);
+	const services$1 = Layer.mergeAll(ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(envFile$1), profile$1)), Layer.succeed(AuthProviders, {}), Layer.succeed(Stage, stage$1), Logger.layer([fileLogger("out")]), LocalState);
+	yield* Effect.gen(function* () {
+		const state = yield* State;
+		const stack = yield* stackEffect;
+		yield* Effect.gen(function* () {
+			const filterSet = parseResourceFilter(filter);
+			const availableIds = [...new Set(Object.values(stack.resources).map((r) => r.LogicalId))].sort();
+			if (filterSet) {
+				for (const id of filterSet) if (!availableIds.includes(id)) return yield* Effect.die(/* @__PURE__ */ new Error(`Unknown resource '${id}' in --filter. Available: ${availableIds.join(", ") || "(none)"}`));
+			}
+			const fqns = Object.keys(stack.resources);
+			const tailable = [];
+			for (const fqn of fqns) {
+				const resource = stack.resources[fqn];
+				if (filterSet && !filterSet.has(resource.LogicalId)) continue;
+				const resourceState = yield* state.get({
+					stack: stack.name,
+					stage: stack.stage,
+					fqn
+				});
+				if (!resourceState?.attr) continue;
+				const provider = yield* findProviderByType(resource.Type);
+				if (!provider.tail) continue;
+				tailable.push({
+					logicalId: resource.LogicalId,
+					stream: provider.tail({
+						id: resource.LogicalId,
+						instanceId: resourceState.instanceId,
+						props: resourceState.props,
+						output: resourceState.attr
+					})
+				});
+			}
+			if (tailable.length === 0) {
+				if (filterSet) yield* Console.log("No tailable resources match --filter (deploy first, or selected resources may not support tail).");
+				else yield* Console.log("No tailable resources found. Deploy first, then run tail.");
+				return;
+			}
+			yield* Console.log(`Tailing: ${tailable.map((t) => t.logicalId).join(", ")}`);
+			const taggedStreams = tailable.map(({ logicalId, stream }, i) => {
+				const color = TAIL_COLORS[i % TAIL_COLORS.length];
+				return stream.pipe(Stream$1.map(({ timestamp, message }) => {
+					return `${color}${formatLocalTimestamp(timestamp)} [${logicalId}]${TAIL_RESET} ${message}`;
+				}));
+			});
+			yield* Stream$1.mergeAll(taggedStreams, { concurrency: "unbounded" }).pipe(Stream$1.runForEach((line) => Console.log(line)));
+		}).pipe(Effect.provide(stack.services));
+	}).pipe(Effect.provide(services$1));
+}));
+
+//#endregion
+//#region bin/alchemy.ts
+const root = Command$1.make("alchemy", {}).pipe(Command$1.withSubcommands([
 	bootstrapCommand,
 	deployCommand,
 	destroyCommand,
 	planCommand,
 	tailCommand,
-	logsCommand
+	logsCommand,
+	loginCommand
 ]));
-Command.run(root, { version }).pipe(Effect.provideService(ConfigProvider.ConfigProvider, ConfigProvider.fromEnv()), Effect.provide(NodeServices.layer), Effect.scoped, NodeRuntime.runMain);
+const cli = Command$1.run(root, { version });
+const services = Layer.mergeAll(Layer.provideMerge(dotAlchemy, PlatformServices), FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()));
+cli.pipe(Effect.provide(services), Effect.scoped, handleCancellation, runMain);
 
 //#endregion
 export {  };