alchemy 2.0.0-beta.14 → 2.0.0-beta.15

package/bin/alchemy.js

@@ -8,6 +8,15 @@ import * as EffectContext from "effect/Context";
 import * as FileSystem from "effect/FileSystem";
 import * as Path$1 from "effect/Path";
 import { Path } from "effect/Path";
+import { PassThrough, Stream } from "node:stream";
+import process$1, { cwd, env } from "node:process";
+import os from "node:os";
+import { execFileSync } from "node:child_process";
+import * as fs$1 from "node:fs";
+import fs from "node:fs";
+import tty from "node:tty";
+import { EventEmitter } from "node:events";
+import { Buffer as Buffer$1 } from "node:buffer";
 import * as Cause from "effect/Cause";
 import * as Config from "effect/Config";
 import * as Console from "effect/Console";
@@ -28,18 +37,9 @@ import * as Schedule from "effect/Schedule";
 import { Credentials, fromAwsCredentialIdentity } from "@distilled.cloud/aws/Credentials";
 import * as Deferred from "effect/Deferred";
 import { pipe } from "effect/Function";
+import * as Redacted from "effect/Redacted";
 import { SingleShotGen } from "effect/Utils";
 import { pipeArguments } from "effect/Pipeable";
-import { PassThrough, Stream } from "node:stream";
-import process$1, { cwd, env } from "node:process";
-import os from "node:os";
-import { execFileSync } from "node:child_process";
-import * as fs$1 from "node:fs";
-import fs from "node:fs";
-import tty from "node:tty";
-import { EventEmitter } from "node:events";
-import { Buffer as Buffer$1 } from "node:buffer";
-import * as Redacted from "effect/Redacted";
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import * as Stream$1 from "effect/Stream";
 
@@ -74,7 +74,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "2.0.0-beta.14";
+var version = "2.0.0-beta.15";
 
 //#endregion
 //#region src/AlchemyContext.ts
@@ -89,582 +89,6 @@ const AlchemyContextLive = Layer.effect(AlchemyContext, Effect.gen(function* ()
 	};
 }));
 
-//#endregion
-//#region src/Util/PlatformServices.ts
-const isBun$1 = typeof Bun !== "undefined";
-const PlatformServices = Effect.promise(async () => {
-	if (isBun$1) {
-		const [BunServices, BunSocket] = await Promise.all([import("@effect/platform-bun/BunServices"), import("@effect/platform-bun/BunSocket")]);
-		return Layer.merge(BunServices.layer, BunSocket.layerWebSocketConstructor);
-	} else {
-		const [NodeServices, NodeSocket] = await Promise.all([import("@effect/platform-node/NodeServices"), import("@effect/platform-node/NodeSocket")]);
-		return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
-	}
-}).pipe(Layer.unwrap);
-const runMain = (effect, options) => {
-	if (isBun$1) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options));
-	else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options));
-};
-
-//#endregion
-//#region src/Auth/AuthProvider.ts
-var AuthError = class extends Schema.TaggedErrorClass()("AuthError", {
-	message: Schema.String,
-	cause: Schema.optional(Schema.Defect)
-}) {};
-var AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
-
-//#endregion
-//#region src/Util/Clank.ts
-var PromptCancelled = class extends Data.TaggedError("PromptCancelled") {};
-const retryIfCancelled = Effect.retry({ while: (e) => e instanceof PromptCancelled });
-
-//#endregion
-//#region bin/commands/_shared.ts
-const USER = Config.string("USER").pipe(Config.orElse(() => Config.string("USERNAME")), Config.withDefault("unknown"));
-const STAGE = Config.string("stage").pipe(Config.option, (a) => a.asEffect(), Effect.map(Option.getOrUndefined));
-/**
-* `true` if `e` is a {@link PromptCancelled}, or an {@link AuthError} whose
-* `cause` chain bottoms out in one. Schema-tagged errors don't always
-* survive `instanceof` across module boundaries, so we also accept any
-* object whose `_tag` matches.
-*/
-const isPromptCancellation = (e) => {
-	for (let cur = e, i = 0; cur != null && i < 16; i++) {
-		if (cur instanceof PromptCancelled) return true;
-		if (typeof cur === "object" && cur._tag === "PromptCancelled") return true;
-		if (cur instanceof AuthError || typeof cur === "object" && cur._tag === "AuthError") {
-			cur = cur.cause;
-			continue;
-		}
-		return false;
-	}
-	return false;
-};
-/**
-* Catches user cancellations (Ctrl+C inside a prompt, surfaced as
-* {@link PromptCancelled} or wrapped in an {@link AuthError}) and exits
-* the CLI cleanly with a friendly message instead of dumping a stack
-* trace.
-*/
-const handleCancellation = (self$1) => self$1.pipe(Effect.catchCause((cause) => {
-	return cause.reasons.some((r) => {
-		if (Cause.isFailReason(r)) return isPromptCancellation(r.error);
-		if (Cause.isDieReason(r)) return isPromptCancellation(r.defect);
-		return false;
-	}) ? Console.log("\nCancelled.") : Effect.failCause(cause);
-}), Effect.onInterrupt(() => Console.log("\nInterrupted.")));
-const stage = Flag$1.string("stage").pipe(Flag$1.withSchema(Schema.String.check(Schema.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))), Flag$1.withDescription("Stage to deploy to, defaults to dev_${USER}"), Flag$1.optional, Flag$1.map(Option.getOrUndefined), Flag$1.mapEffect(Effect.fn(function* (stage$1) {
-	if (stage$1) return stage$1;
-	return yield* STAGE.pipe(Effect.catch(() => Effect.fail(new CliError.MissingOption({ option: "stage" }))), Effect.flatMap((s) => s === void 0 ? USER.asEffect().pipe(Effect.map((user) => `dev_${user}`), Effect.catch(() => Effect.succeed("unknown"))) : Effect.succeed(s)));
-})));
-const envFile = Flag$1.file("env-file").pipe(Flag$1.optional, Flag$1.withDescription("File to load environment variables from, defaults to .env"));
-const dryRun = Flag$1.boolean("dry-run").pipe(Flag$1.withDescription("Dry run the deployment, do not actually deploy"), Flag$1.withDefault(false));
-const yes = Flag$1.boolean("yes").pipe(Flag$1.withDescription("Yes to all prompts"), Flag$1.withDefault(false));
-const force = Flag$1.boolean("force").pipe(Flag$1.withDescription("Force updates for resources that would otherwise no-op"), Flag$1.withDefault(false));
-const main = Argument$1.file("main", { mustExist: true }).pipe(Argument$1.withDescription("Main file to deploy, defaults to alchemy.run.ts"), Argument$1.withDefault("alchemy.run.ts"));
-const profile = Flag$1.string("profile").pipe(Flag$1.withDescription("Auth profile to use (~/.alchemy/profiles.json). Defaults to 'default' or $ALCHEMY_PROFILE."), Flag$1.optional, Flag$1.map(Option.getOrElse(() => "default")));
-const resourceFilter = Flag$1.string("filter").pipe(Flag$1.withDescription("Comma-separated logical resource IDs (e.g. Api,Sandbox). Only those resources are included."), Flag$1.optional, Flag$1.map(Option.getOrUndefined));
-const TAIL_COLORS = [
-	"\x1B[36m",
-	"\x1B[35m",
-	"\x1B[33m",
-	"\x1B[32m",
-	"\x1B[34m",
-	"\x1B[91m",
-	"\x1B[96m",
-	"\x1B[95m",
-	"\x1B[93m",
-	"\x1B[92m"
-];
-const TAIL_RESET = "\x1B[0m";
-const formatLocalTimestamp = (date) => {
-	return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}-${String(date.getDate()).padStart(2, "0")} ${String(date.getHours()).padStart(2, "0")}:${String(date.getMinutes()).padStart(2, "0")}:${String(date.getSeconds()).padStart(2, "0")}.${String(date.getMilliseconds()).padStart(3, "0")} ${new Intl.DateTimeFormat("en-US", { timeZoneName: "short" }).formatToParts(date).find((p) => p.type === "timeZoneName")?.value ?? ""}`;
-};
-const parseResourceFilter = (filter) => {
-	if (filter === void 0) return void 0;
-	const ids = filter.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-	if (ids.length === 0) return void 0;
-	return new Set(ids);
-};
-const parseSince = (value) => {
-	const match = value.match(/^(\d+)([smhd])$/);
-	if (match) {
-		const num = parseInt(match[1], 10);
-		const unit = match[2];
-		const ms = unit === "s" ? num * 1e3 : unit === "m" ? num * 6e4 : unit === "h" ? num * 36e5 : num * 864e5;
-		return new Date(Date.now() - ms);
-	}
-	const parsed = new Date(value);
-	if (isNaN(parsed.getTime())) throw new Error(`Invalid --since value: '${value}'. Use a duration (e.g. '1h', '30m') or ISO date.`);
-	return parsed;
-};
-const importStack = Effect.fn(function* (main$1) {
-	const path = yield* Path$1.Path;
-	const stackEffect = (yield* Effect.promise(() => import(path.resolve(process.cwd(), main$1)))).default;
-	if (!Effect.isEffect(stackEffect)) return yield* Effect.die(/* @__PURE__ */ new Error(`Main file '${main$1}' must export a default stack definition (export default Alchemy.Stack({...}))`));
-	return stackEffect;
-});
-
-//#endregion
-//#region src/AWS/Environment.ts
-const AWS_PROFILE = Config.string("AWS_PROFILE").pipe(Config.withDefault("default"));
-const AWS_REGION = Config.string("AWS_REGION");
-var AWSEnvironment = class extends EffectContext.Service()("AWS::Environment") {};
-/**
-* Build an `AWSEnvironment` from an SSO profile (`AWS_PROFILE` env var,
-* defaults to `"default"`). Uses the profile's `sso_account_id` and `region`,
-* and resolves credentials lazily via `aws sso login`.
-*/
-const Default = Layer.effect(AWSEnvironment, Effect.suspend(() => loadDefault())).pipe(Layer.orDie);
-const loadDefault = () => Effect.gen(function* () {
-	const profileName = yield* AWS_PROFILE;
-	const auth = yield* Auth.Default;
-	const profile$1 = yield* auth.loadProfile(profileName);
-	if (!profile$1.sso_account_id) return yield* Effect.die(`AWS SSO profile '${profileName}' is missing sso_account_id`);
-	const region = profile$1.region ?? (yield* AWS_REGION.pipe(Config.option, Config.map(Option.getOrElse(() => "us-east-1"))));
-	return {
-		profile: profileName,
-		accountId: profile$1.sso_account_id,
-		region,
-		credentials: auth.loadProfileCredentials(profileName)
-	};
-});
-const isStatic = (shape) => shape.credentials != null && typeof shape.credentials.accessKeyId === "string";
-/**
-* Build an `AWSEnvironment` Layer directly from values — useful for
-* static credentials in CI or tests.
-*
-* Named `makeEnvironment` rather than `of` because `Context.Service.of`
-* already exists with different semantics (builds the service value, not
-* a Layer); putting both on `AWSEnvironment` would be confusing.
-*/
-const makeEnvironment = (shape) => Layer.succeed(AWSEnvironment, isStatic(shape) ? {
-	...shape,
-	credentials: Effect.succeed(fromAwsCredentialIdentity(shape.credentials))
-} : shape);
-
-//#endregion
-//#region src/AWS/Bootstrap.ts
-/**
-* Tag key used to identify the alchemy assets bucket.
-*/
-const ASSETS_BUCKET_TAG = "alchemy::assets-bucket";
-/**
-* Tag key used to scope the alchemy assets bucket to an AWS region.
-*/
-const ASSETS_BUCKET_REGION_TAG = "alchemy::assets-bucket-region";
-/**
-* Build an account-regional namespace bucket name.
-*
-* Account-regional buckets must follow the naming convention:
-*   `<prefix>-<accountId>-<region>-an`
-*
-* @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/gpbucketnamespaces.html#account-regional-gp-buckets
-*/
-const createAssetsBucketName = (accountId, region) => `alchemy-assets-${accountId}-${region}-an`.toLowerCase();
-const createAssetsBucketTags = (region) => [{
-	Key: ASSETS_BUCKET_TAG,
-	Value: "true"
-}, {
-	Key: ASSETS_BUCKET_REGION_TAG,
-	Value: region
-}];
-const getBucketTags = (bucketName) => s3.getBucketTagging({ Bucket: bucketName }).pipe(Effect.map((response) => response.TagSet ?? []), Effect.catchTag("NoSuchTagSet", () => Effect.succeed([])));
-const hasAssetsBucketTag = (tags) => tags.some((tag) => tag.Key === ASSETS_BUCKET_TAG && tag.Value === "true");
-const normalizeBucketRegion = (location) => {
-	if (!location) return "us-east-1";
-	if (location === "EU") return "eu-west-1";
-	return location;
-};
-const bucketMatchesRegion = (tags, region) => {
-	const taggedRegion = tags.find((tag) => tag.Key === ASSETS_BUCKET_REGION_TAG)?.Value;
-	return taggedRegion === void 0 ? void 0 : taggedRegion === region;
-};
-const lookupAssetsBuckets = Effect.gen(function* () {
-	const region = yield* Region;
-	const buckets = (yield* s3.listBuckets({})).Buckets ?? [];
-	const matchingBuckets = [];
-	for (const bucket of buckets) {
-		const bucketName = bucket.Name;
-		if (!bucketName) continue;
-		const tags = yield* getBucketTags(bucketName).pipe(Effect.catch(() => Effect.succeed([])));
-		if (!hasAssetsBucketTag(tags)) continue;
-		const taggedRegionMatch = bucketMatchesRegion(tags, region);
-		if (taggedRegionMatch === true) {
-			matchingBuckets.push(bucketName);
-			continue;
-		}
-		if (taggedRegionMatch === false) continue;
-		if ((yield* s3.getBucketLocation({ Bucket: bucketName }).pipe(Effect.map((response) => normalizeBucketRegion(response.LocationConstraint)), Effect.catch(() => Effect.succeed(void 0)))) === region) matchingBuckets.push(bucketName);
-	}
-	return matchingBuckets;
-});
-const lookupAssetsBucket = Effect.gen(function* () {
-	const matchingBuckets = yield* lookupAssetsBuckets;
-	for (const bucketName of matchingBuckets) return Option.some(bucketName);
-	return Option.none();
-});
-const ensureAssetsBucketTags = Effect.fn(function* (bucketName, region) {
-	const tagSet = [...(yield* getBucketTags(bucketName)).filter((tag) => tag.Key !== ASSETS_BUCKET_TAG && tag.Key !== ASSETS_BUCKET_REGION_TAG), ...createAssetsBucketTags(region)];
-	yield* s3.putBucketTagging({
-		Bucket: bucketName,
-		Tagging: { TagSet: tagSet.map((tag) => ({
-			Key: tag.Key,
-			Value: tag.Value
-		})) }
-	});
-});
-const deleteAllObjects = Effect.fn(function* (bucketName) {
-	let continuationToken;
-	do {
-		const listResponse = yield* s3.listObjectsV2({
-			Bucket: bucketName,
-			ContinuationToken: continuationToken
-		});
-		if (listResponse.Contents && listResponse.Contents.length > 0) yield* s3.deleteObjects({
-			Bucket: bucketName,
-			Delete: {
-				Objects: listResponse.Contents.map((obj) => ({ Key: obj.Key })),
-				Quiet: true
-			}
-		});
-		continuationToken = listResponse.NextContinuationToken;
-	} while (continuationToken);
-	let keyMarker;
-	let versionIdMarker;
-	do {
-		const listVersionsResponse = yield* s3.listObjectVersions({
-			Bucket: bucketName,
-			KeyMarker: keyMarker,
-			VersionIdMarker: versionIdMarker
-		});
-		const objectsToDelete = [...(listVersionsResponse.Versions ?? []).map((v) => ({
-			Key: v.Key,
-			VersionId: v.VersionId
-		})), ...(listVersionsResponse.DeleteMarkers ?? []).map((dm) => ({
-			Key: dm.Key,
-			VersionId: dm.VersionId
-		}))];
-		if (objectsToDelete.length > 0) yield* s3.deleteObjects({
-			Bucket: bucketName,
-			Delete: {
-				Objects: objectsToDelete,
-				Quiet: true
-			}
-		});
-		keyMarker = listVersionsResponse.NextKeyMarker;
-		versionIdMarker = listVersionsResponse.NextVersionIdMarker;
-	} while (keyMarker);
-});
-/**
-* Bootstrap the AWS environment by creating the assets bucket.
-*
-* This is idempotent - running it multiple times is safe.
-* The bucket is tagged and later discovered by tag lookup instead of by name.
-*/
-const bootstrap = Effect.fn(function* () {
-	const region = yield* Region;
-	const existingBucket = yield* lookupAssetsBucket;
-	if (Option.isSome(existingBucket)) {
-		yield* ensureAssetsBucketTags(existingBucket.value, region);
-		yield* Effect.logInfo(`Assets bucket already exists: ${existingBucket.value}`);
-		return {
-			bucketName: existingBucket.value,
-			created: false
-		};
-	}
-	const { accountId } = yield* AWSEnvironment;
-	const bucketName = createAssetsBucketName(accountId, region);
-	yield* s3.createBucket({
-		Bucket: bucketName,
-		BucketNamespace: "account-regional",
-		CreateBucketConfiguration: {
-			Tags: createAssetsBucketTags(region),
-			...region === "us-east-1" ? {} : { LocationConstraint: region }
-		}
-	}).pipe(Effect.catchTag("BucketAlreadyOwnedByYou", () => Effect.void), Effect.retry({
-		while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
-		schedule: Schedule.exponential(100)
-	}));
-	yield* s3.headBucket({ Bucket: bucketName }).pipe(Effect.retry({ schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10))) }));
-	yield* Effect.logInfo(`Created assets bucket: ${bucketName}`);
-	return {
-		bucketName,
-		created: true
-	};
-});
-const destroyBootstrap = Effect.fn(function* () {
-	const bucketNames = yield* lookupAssetsBuckets;
-	for (const bucketName of bucketNames) {
-		yield* Effect.logInfo(`Destroying assets bucket: ${bucketName}`);
-		yield* deleteAllObjects(bucketName);
-		yield* s3.deleteBucket({ Bucket: bucketName }).pipe(Effect.retry({
-			while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
-			schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10)))
-		}));
-	}
-	return {
-		bucketNames,
-		destroyed: bucketNames.length
-	};
-});
-
-//#endregion
-//#region src/AWS/Credentials.ts
-/**
-* Lazy `Credentials` layer derived from the surrounding {@link AWSEnvironment}.
-* Credentials are resolved on first access (not during layer construction),
-* matching the existing @distilled.cloud/aws semantics.
-*/
-const fromEnvironment$1 = Layer.effect(Credentials, Effect.map(AWSEnvironment.asEffect(), (env$2) => env$2.credentials));
-
-//#endregion
-//#region src/AWS/Region.ts
-/**
-* Derive the AWS region from the surrounding {@link AWSEnvironment}.
-*/
-const fromEnvironment = Layer.effect(Region$1.Region, Effect.map(AWSEnvironment.asEffect(), (env$2) => env$2.region));
-
-//#endregion
-//#region src/Util/ConfigProvider.ts
-const loadConfigProvider = (envFile$1) => {
-	if (Option.isSome(envFile$1)) return ConfigProvider.fromDotEnv({ path: envFile$1.value }).pipe(Effect.map((dotEnv) => ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv())));
-	return Effect.gen(function* () {
-		if (!(yield* (yield* FileSystem.FileSystem).exists(".env"))) return ConfigProvider.fromEnv();
-		return ConfigProvider.orElse(yield* ConfigProvider.fromDotEnv({ path: ".env" }), ConfigProvider.fromEnv());
-	});
-};
-
-//#endregion
-//#region src/Util/FileLogger.ts
-const fileLogger = Effect.fnUntraced(function* (...segments) {
-	const { dotAlchemy } = yield* AlchemyContext;
-	const fs$2 = yield* FileSystem.FileSystem;
-	const path = yield* Path;
-	const logFile = path.join(dotAlchemy, "log", ...segments);
-	yield* fs$2.makeDirectory(path.dirname(logFile), { recursive: true });
-	return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
-});
-
-//#endregion
-//#region bin/commands/bootstrap.ts
-const awsProfile = Flag$1.string("profile").pipe(Flag$1.withDescription("AWS profile to use for credentials"), Flag$1.optional, Flag$1.map(Option.getOrElse(() => "default")));
-const awsRegion = Flag$1.string("region").pipe(Flag$1.withDescription("AWS region to bootstrap (defaults to AWS_REGION env var)"), Flag$1.optional, Flag$1.map(Option.getOrUndefined));
-const bootstrapDestroy = Flag$1.boolean("destroy").pipe(Flag$1.withDescription("Destroy all bootstrap buckets in the selected region"), Flag$1.withDefault(false));
-const bootstrapCommand = Command$1.make("bootstrap", {
-	envFile,
-	profile: awsProfile,
-	region: awsRegion,
-	destroy: bootstrapDestroy
-}, Effect.fnUntraced(function* ({ envFile: envFile$1, profile: profile$1, region, destroy }) {
-	const logger = Logger.layer([fileLogger("bootstrap.txt")]);
-	return yield* Effect.gen(function* () {
-		const ssoProfile = yield* Auth.loadProfile(profile$1);
-		if (!ssoProfile.sso_account_id) return yield* Effect.die(`AWS SSO profile '${profile$1}' is missing sso_account_id`);
-		const ambient = yield* Effect.context();
-		const environment = makeEnvironment({
-			accountId: ssoProfile.sso_account_id,
-			region: region ?? ssoProfile.region ?? "us-east-1",
-			credentials: Auth.loadProfileCredentials(profile$1).pipe(Effect.provide(ambient)),
-			profile: profile$1
-		});
-		const awsLayers = Layer.provideMerge(Layer.mergeAll(fromEnvironment, fromEnvironment$1), environment);
-		return yield* Effect.gen(function* () {
-			const provider = yield* loadConfigProvider(envFile$1);
-			const bootstrapLayer = Layer.provide(awsLayers, Layer.succeed(ConfigProvider.ConfigProvider, provider));
-			if (destroy) {
-				yield* destroyBootstrap().pipe(Effect.tap((result) => result.destroyed === 0 ? Console.log("✓ No bootstrap buckets found to destroy") : Console.log(`✓ Destroyed ${result.destroyed} bootstrap bucket(s): ${result.bucketNames.join(", ")}`)), Effect.provide(bootstrapLayer));
-				return;
-			}
-			yield* bootstrap().pipe(Effect.tap(({ bucketName, created }) => created ? Console.log(`✓ Created assets bucket: ${bucketName}`) : Console.log(`✓ Assets bucket already exists: ${bucketName}`)), Effect.provide(bootstrapLayer));
-		});
-	}).pipe(Effect.provide(logger));
-}));
-
-//#endregion
-//#region src/Artifacts.ts
-/**
-* Per-resource in-memory artifacts shared across a single `Plan.make -> apply`
-* execution.
-*
-* The engine scopes this service by resource `FQN` before invoking lifecycle
-* handlers, so providers should treat it as a resource-local bag for expensive,
-* deterministic intermediate results that can be reused across phases.
-*
-* Expected usage:
-*
-* - `diff` computes an expensive artifact once and stores it
-* - `create` / `update` reads the same artifact and skips recomputing it
-* - artifacts are ephemeral and must never be required for correctness on a
-*   later deploy because the bag is reset between runs
-*
-* Example:
-*
-* ```ts
-* const artifacts = yield* Artifacts;
-* const cached = yield* artifacts.get<PreparedBundle>("bundle");
-* if (cached) return cached;
-*
-* const bundle = yield* prepareBundle();
-* yield* artifacts.set("bundle", bundle);
-* return bundle;
-* ```
-*/
-var Artifacts = class extends EffectContext.Service()("Artifacts") {};
-var ArtifactStore = class extends EffectContext.Service()("Artifacts/Store") {};
-/**
-* Create a fresh root store for one deploy/test run.
-*/
-const createArtifactStore = () => /* @__PURE__ */ new Map();
-const getOrCreateBag = (store, fqn) => {
-	const existing = store.get(fqn);
-	if (existing) return existing;
-	const bag = /* @__PURE__ */ new Map();
-	store.set(fqn, bag);
-	return bag;
-};
-const makeScopedArtifacts = (store, fqn) => {
-	const bag = getOrCreateBag(store, fqn);
-	return {
-		get: (key) => Effect.sync(() => bag.get(key)),
-		set: (key, value) => Effect.sync(() => {
-			bag.set(key, value);
-		}),
-		delete: (key) => Effect.sync(() => {
-			bag.delete(key);
-		})
-	};
-};
-/**
-* Ensure an artifact root exists, reusing the ambient store when one is already
-* present. This lets nested helpers participate in the same run-scoped cache.
-*/
-const ensureArtifactStore = (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrUndefined), Effect.flatMap((existing) => effect.pipe(Effect.provideService(ArtifactStore, existing ?? createArtifactStore()))));
-
-//#endregion
-//#region src/Cli/Cli.ts
-var Cli = class extends EffectContext.Service()("CLI") {};
-
-//#endregion
-//#region src/Util/service.ts
-const GenericService = () => (Kind) => {
-	const service = EffectContext.Service(Kind);
-	const make$2 = (Type) => EffectContext.Service(`${Kind}<${Type}>`);
-	return Object.assign(Object.setPrototypeOf(make$2, service), service);
-};
-
-//#endregion
-//#region src/ExecutionContext.ts
-const ExecutionContext = GenericService()("Alchemy::ExecutionContext");
-const CurrentExecutionContext = Effect.serviceOption(ExecutionContext).pipe(Effect.map(Option.getOrUndefined));
-
-//#endregion
-//#region src/Ref.ts
-const RefMetadata = Symbol.for("alchemy/RefMetadata");
-const isRef = (s) => s && s[RefMetadata] !== void 0;
-const getRefMetadata = (ref$1) => ref$1[RefMetadata];
-const ref = ({ stack, id, stage: stage$1 }) => {
-	const ref$1 = new Proxy({}, { get: (_, prop) => {
-		if (prop === RefMetadata) return {
-			stack,
-			stage: stage$1,
-			id
-		};
-		return of(ref$1)[prop];
-	} });
-	return ref$1;
-};
-
-//#endregion
-//#region src/FQN.ts
-/**
-* Separator used in FQN strings.
-*/
-const FQN_SEPARATOR = "/";
-/**
-* Encode an FQN for safe filesystem storage.
-* Replaces `/` (FQN separator) with `__` to avoid subdirectory creation.
-*/
-const encodeFqn = (fqn) => fqn.replaceAll(FQN_SEPARATOR, "__");
-/**
-* Decode a filename back to FQN.
-*/
-const decodeFqn = (filename) => filename.replaceAll("__", FQN_SEPARATOR);
-/**
-* Convert a NamespaceNode chain to an array of namespace IDs, from root to leaf.
-*
-* @example
-* ```ts
-* const ns = { Id: "Child", Parent: { Id: "Parent", Parent: { Id: "Root" } } };
-* toPath(ns); // ["Root", "Parent", "Child"]
-* ```
-*/
-const toPath = (ns) => {
-	if (!ns) return [];
-	const path = [];
-	let current = ns;
-	while (current) {
-		path.unshift(current.Id);
-		current = current.Parent;
-	}
-	return path;
-};
-/**
-* Create a fully-qualified name (FQN) from a namespace and logical ID.
-* The FQN is a flat key suitable for state storage.
-*
-* @example
-* ```ts
-* const ns = { Id: "Child", Parent: { Id: "Parent" } };
-* toFqn(ns, "MyResource"); // "Parent/Child/MyResource"
-* toFqn(undefined, "MyResource"); // "MyResource"
-* ```
-*/
-const toFqn = (ns, logicalId) => {
-	const path = toPath(ns);
-	path.push(logicalId);
-	return path.join(FQN_SEPARATOR);
-};
-/**
-* Parse an FQN back into namespace path segments and the logical ID.
-*
-* @example
-* ```ts
-* parseFqn("Parent/Child/MyResource"); // { path: ["Parent", "Child"], logicalId: "MyResource" }
-* parseFqn("MyResource"); // { path: [], logicalId: "MyResource" }
-* ```
-*/
-const parseFqn = (fqn) => {
-	const parts = fqn.split(FQN_SEPARATOR);
-	return {
-		path: parts,
-		logicalId: parts.pop()
-	};
-};
-
-//#endregion
-//#region src/Provider.ts
-const Provider = (type) => EffectContext.Service()(type);
-const isProviderCollectionService = (value) => {
-	return typeof value === "object" && value !== null && "kind" in value && value.kind === "ProviderCollection";
-};
-const findProviderByType = (type) => tryFindProviderByType(type).pipe(Effect.flatMap(Option.match({
-	onNone: () => Effect.die(`Provider not found for ${type}`),
-	onSome: (provider) => Effect.succeed(provider)
-})));
-const tryFindProviderByType = Effect.fnUntraced(function* (resourceType) {
-	const Tag = Provider(resourceType);
-	const direct = yield* Effect.serviceOption(Tag);
-	if (Option.isSome(direct)) return direct;
-	const context = yield* Effect.context();
-	for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
-		const provider = value.get(resourceType);
-		if (provider) return Option.some(provider);
-	}
-	return Option.none();
-});
-
 //#endregion
 //#region ../../node_modules/.bun/react@19.2.5/node_modules/react/cjs/react.production.js
 var require_react_production = /* @__PURE__ */ __commonJS({ "../../node_modules/.bun/react@19.2.5/node_modules/react/cjs/react.production.js": ((exports) => {
@@ -1882,7 +1306,7 @@ function throttle(func, throttleMs = 0, options = {}) {
 //#region ../../node_modules/.bun/environment@1.1.0/node_modules/environment/index.js
 const isBrowser = globalThis.window?.document !== void 0;
 const isNode = globalThis.process?.versions?.node !== void 0;
-const isBun = globalThis.process?.versions?.bun !== void 0;
+const isBun$1 = globalThis.process?.versions?.bun !== void 0;
 const isDeno = globalThis.Deno?.version?.deno !== void 0;
 const isElectron = globalThis.process?.versions?.electron !== void 0;
 const isJsDom = globalThis.navigator?.userAgent?.includes("jsdom") === true;
@@ -42877,6 +42301,77 @@ var use_input_default = useInput;
 const useApp = () => (0, import_react.useContext)(AppContext_default);
 var use_app_default = useApp;
 
+//#endregion
+//#region src/Cli/Cli.ts
+var Cli = class extends EffectContext.Service()("CLI") {};
+
+//#endregion
+//#region src/FQN.ts
+/**
+* Separator used in FQN strings.
+*/
+const FQN_SEPARATOR = "/";
+/**
+* Encode an FQN for safe filesystem storage.
+* Replaces `/` (FQN separator) with `__` to avoid subdirectory creation.
+*/
+const encodeFqn = (fqn) => fqn.replaceAll(FQN_SEPARATOR, "__");
+/**
+* Decode a filename back to FQN.
+*/
+const decodeFqn = (filename) => filename.replaceAll("__", FQN_SEPARATOR);
+/**
+* Convert a NamespaceNode chain to an array of namespace IDs, from root to leaf.
+*
+* @example
+* ```ts
+* const ns = { Id: "Child", Parent: { Id: "Parent", Parent: { Id: "Root" } } };
+* toPath(ns); // ["Root", "Parent", "Child"]
+* ```
+*/
+const toPath = (ns) => {
+	if (!ns) return [];
+	const path = [];
+	let current = ns;
+	while (current) {
+		path.unshift(current.Id);
+		current = current.Parent;
+	}
+	return path;
+};
+/**
+* Create a fully-qualified name (FQN) from a namespace and logical ID.
+* The FQN is a flat key suitable for state storage.
+*
+* @example
+* ```ts
+* const ns = { Id: "Child", Parent: { Id: "Parent" } };
+* toFqn(ns, "MyResource"); // "Parent/Child/MyResource"
+* toFqn(undefined, "MyResource"); // "MyResource"
+* ```
+*/
+const toFqn = (ns, logicalId) => {
+	const path = toPath(ns);
+	path.push(logicalId);
+	return path.join(FQN_SEPARATOR);
+};
+/**
+* Parse an FQN back into namespace path segments and the logical ID.
+*
+* @example
+* ```ts
+* parseFqn("Parent/Child/MyResource"); // { path: ["Parent", "Child"], logicalId: "MyResource" }
+* parseFqn("MyResource"); // { path: [], logicalId: "MyResource" }
+* ```
+*/
+const parseFqn = (fqn) => {
+	const parts = fqn.split(FQN_SEPARATOR);
+	return {
+		path: parts,
+		logicalId: parts.pop()
+	};
+};
+
 //#endregion
 //#region src/Cli/NamespaceTree.ts
 function buildNamespaceTree(items) {
@@ -43645,6 +43140,511 @@ const startApplySession = Effect.fn(function* (plan) {
 	};
 });
 
+//#endregion
+//#region src/Util/PlatformServices.ts
+const isBun = typeof Bun !== "undefined";
+const PlatformServices = Effect.promise(async () => {
+	if (isBun) {
+		const [BunServices, BunSocket] = await Promise.all([import("@effect/platform-bun/BunServices"), import("@effect/platform-bun/BunSocket")]);
+		return Layer.merge(BunServices.layer, BunSocket.layerWebSocketConstructor);
+	} else {
+		const [NodeServices, NodeSocket] = await Promise.all([import("@effect/platform-node/NodeServices"), import("@effect/platform-node/NodeSocket")]);
+		return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
+	}
+}).pipe(Layer.unwrap);
+const runMain = (effect, options) => {
+	if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options));
+	else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options));
+};
+
+//#endregion
+//#region src/Auth/AuthProvider.ts
+var AuthError = class extends Schema.TaggedErrorClass()("AuthError", {
+	message: Schema.String,
+	cause: Schema.optional(Schema.Defect)
+}) {};
+var AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
+
+//#endregion
+//#region src/Util/Clank.ts
+var PromptCancelled = class extends Data.TaggedError("PromptCancelled") {};
+const retryIfCancelled = Effect.retry({ while: (e) => e instanceof PromptCancelled });
+
+//#endregion
+//#region bin/commands/_shared.ts
+const USER = Config.string("USER").pipe(Config.orElse(() => Config.string("USERNAME")), Config.withDefault("unknown"));
+const STAGE = Config.string("stage").pipe(Config.option, (a) => a.asEffect(), Effect.map(Option.getOrUndefined));
+/**
+* `true` if `e` is a {@link PromptCancelled}, or an {@link AuthError} whose
+* `cause` chain bottoms out in one. Schema-tagged errors don't always
+* survive `instanceof` across module boundaries, so we also accept any
+* object whose `_tag` matches.
+*/
+const isPromptCancellation = (e) => {
+	for (let cur = e, i = 0; cur != null && i < 16; i++) {
+		if (cur instanceof PromptCancelled) return true;
+		if (typeof cur === "object" && cur._tag === "PromptCancelled") return true;
+		if (cur instanceof AuthError || typeof cur === "object" && cur._tag === "AuthError") {
+			cur = cur.cause;
+			continue;
+		}
+		return false;
+	}
+	return false;
+};
+/**
+* Catches user cancellations (Ctrl+C inside a prompt, surfaced as
+* {@link PromptCancelled} or wrapped in an {@link AuthError}) and exits
+* the CLI cleanly with a friendly message instead of dumping a stack
+* trace.
+*/
+const handleCancellation = (self$1) => self$1.pipe(Effect.catchCause((cause) => {
+	return cause.reasons.some((r) => {
+		if (Cause.isFailReason(r)) return isPromptCancellation(r.error);
+		if (Cause.isDieReason(r)) return isPromptCancellation(r.defect);
+		return false;
+	}) ? Console.log("\nCancelled.") : Effect.failCause(cause);
+}), Effect.onInterrupt(() => Console.log("\nInterrupted.")));
+const stage = Flag$1.string("stage").pipe(Flag$1.withSchema(Schema.String.check(Schema.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))), Flag$1.withDescription("Stage to deploy to, defaults to dev_${USER}"), Flag$1.optional, Flag$1.map(Option.getOrUndefined), Flag$1.mapEffect(Effect.fn(function* (stage$1) {
+	if (stage$1) return stage$1;
+	return yield* STAGE.pipe(Effect.catch(() => Effect.fail(new CliError.MissingOption({ option: "stage" }))), Effect.flatMap((s) => s === void 0 ? USER.asEffect().pipe(Effect.map((user) => `dev_${user}`), Effect.catch(() => Effect.succeed("unknown"))) : Effect.succeed(s)));
+})));
+const envFile = Flag$1.file("env-file").pipe(Flag$1.optional, Flag$1.withDescription("File to load environment variables from, defaults to .env"));
+const dryRun = Flag$1.boolean("dry-run").pipe(Flag$1.withDescription("Dry run the deployment, do not actually deploy"), Flag$1.withDefault(false));
+const yes = Flag$1.boolean("yes").pipe(Flag$1.withDescription("Yes to all prompts"), Flag$1.withDefault(false));
+const force = Flag$1.boolean("force").pipe(Flag$1.withDescription("Force updates for resources that would otherwise no-op"), Flag$1.withDefault(false));
+const main = Argument$1.file("main", { mustExist: true }).pipe(Argument$1.withDescription("Main file to deploy, defaults to alchemy.run.ts"), Argument$1.withDefault("alchemy.run.ts"));
+const profile = Flag$1.string("profile").pipe(Flag$1.withDescription("Auth profile to use (~/.alchemy/profiles.json). Defaults to 'default' or $ALCHEMY_PROFILE."), Flag$1.optional, Flag$1.map(Option.getOrElse(() => "default")));
+const resourceFilter = Flag$1.string("filter").pipe(Flag$1.withDescription("Comma-separated logical resource IDs (e.g. Api,Sandbox). Only those resources are included."), Flag$1.optional, Flag$1.map(Option.getOrUndefined));
+const TAIL_COLORS = [
+	"\x1B[36m",
+	"\x1B[35m",
+	"\x1B[33m",
+	"\x1B[32m",
+	"\x1B[34m",
+	"\x1B[91m",
+	"\x1B[96m",
+	"\x1B[95m",
+	"\x1B[93m",
+	"\x1B[92m"
+];
+const TAIL_RESET = "\x1B[0m";
+const formatLocalTimestamp = (date) => {
+	return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}-${String(date.getDate()).padStart(2, "0")} ${String(date.getHours()).padStart(2, "0")}:${String(date.getMinutes()).padStart(2, "0")}:${String(date.getSeconds()).padStart(2, "0")}.${String(date.getMilliseconds()).padStart(3, "0")} ${new Intl.DateTimeFormat("en-US", { timeZoneName: "short" }).formatToParts(date).find((p) => p.type === "timeZoneName")?.value ?? ""}`;
+};
+const parseResourceFilter = (filter) => {
+	if (filter === void 0) return void 0;
+	const ids = filter.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+	if (ids.length === 0) return void 0;
+	return new Set(ids);
+};
+const parseSince = (value) => {
+	const match = value.match(/^(\d+)([smhd])$/);
+	if (match) {
+		const num = parseInt(match[1], 10);
+		const unit = match[2];
+		const ms = unit === "s" ? num * 1e3 : unit === "m" ? num * 6e4 : unit === "h" ? num * 36e5 : num * 864e5;
+		return new Date(Date.now() - ms);
+	}
+	const parsed = new Date(value);
+	if (isNaN(parsed.getTime())) throw new Error(`Invalid --since value: '${value}'. Use a duration (e.g. '1h', '30m') or ISO date.`);
+	return parsed;
+};
+const importStack = Effect.fn(function* (main$1) {
+	const path = yield* Path$1.Path;
+	const stackEffect = (yield* Effect.promise(() => import(path.resolve(process.cwd(), main$1)))).default;
+	if (!Effect.isEffect(stackEffect)) return yield* Effect.die(/* @__PURE__ */ new Error(`Main file '${main$1}' must export a default stack definition (export default Alchemy.Stack({...}))`));
+	return stackEffect;
+});
+
+//#endregion
+//#region src/AWS/Environment.ts
+const AWS_PROFILE = Config.string("AWS_PROFILE").pipe(Config.withDefault("default"));
+const AWS_REGION = Config.string("AWS_REGION");
+var AWSEnvironment = class extends EffectContext.Service()("AWS::Environment") {};
+/**
+* Build an `AWSEnvironment` from an SSO profile (`AWS_PROFILE` env var,
+* defaults to `"default"`). Uses the profile's `sso_account_id` and `region`,
+* and resolves credentials lazily via `aws sso login`.
+*/
+const Default = Layer.effect(AWSEnvironment, Effect.suspend(() => loadDefault())).pipe(Layer.orDie);
+const loadDefault = () => Effect.gen(function* () {
+	const profileName = yield* AWS_PROFILE;
+	const auth = yield* Auth.Default;
+	const profile$1 = yield* auth.loadProfile(profileName);
+	if (!profile$1.sso_account_id) return yield* Effect.die(`AWS SSO profile '${profileName}' is missing sso_account_id`);
+	const region = profile$1.region ?? (yield* AWS_REGION.pipe(Config.option, Config.map(Option.getOrElse(() => "us-east-1"))));
+	return {
+		profile: profileName,
+		accountId: profile$1.sso_account_id,
+		region,
+		credentials: auth.loadProfileCredentials(profileName)
+	};
+});
+const isStatic = (shape) => shape.credentials != null && typeof shape.credentials.accessKeyId === "string";
+/**
+* Build an `AWSEnvironment` Layer directly from values — useful for
+* static credentials in CI or tests.
+*
+* Named `makeEnvironment` rather than `of` because `Context.Service.of`
+* already exists with different semantics (builds the service value, not
+* a Layer); putting both on `AWSEnvironment` would be confusing.
+*/
+const makeEnvironment = (shape) => Layer.succeed(AWSEnvironment, isStatic(shape) ? {
+	...shape,
+	credentials: Effect.succeed(fromAwsCredentialIdentity(shape.credentials))
+} : shape);
+
+//#endregion
+//#region src/AWS/Bootstrap.ts
+/**
+* Tag key used to identify the alchemy assets bucket.
+*/
+const ASSETS_BUCKET_TAG = "alchemy::assets-bucket";
+/**
+* Tag key used to scope the alchemy assets bucket to an AWS region.
+*/
+const ASSETS_BUCKET_REGION_TAG = "alchemy::assets-bucket-region";
+/**
+* Build an account-regional namespace bucket name.
+*
+* Account-regional buckets must follow the naming convention:
+*   `<prefix>-<accountId>-<region>-an`
+*
+* @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/gpbucketnamespaces.html#account-regional-gp-buckets
+*/
+const createAssetsBucketName = (accountId, region) => `alchemy-assets-${accountId}-${region}-an`.toLowerCase();
+const createAssetsBucketTags = (region) => [{
+	Key: ASSETS_BUCKET_TAG,
+	Value: "true"
+}, {
+	Key: ASSETS_BUCKET_REGION_TAG,
+	Value: region
+}];
+const getBucketTags = (bucketName) => s3.getBucketTagging({ Bucket: bucketName }).pipe(Effect.map((response) => response.TagSet ?? []), Effect.catchTag("NoSuchTagSet", () => Effect.succeed([])));
+const hasAssetsBucketTag = (tags) => tags.some((tag) => tag.Key === ASSETS_BUCKET_TAG && tag.Value === "true");
+const normalizeBucketRegion = (location) => {
+	if (!location) return "us-east-1";
+	if (location === "EU") return "eu-west-1";
+	return location;
+};
+const bucketMatchesRegion = (tags, region) => {
+	const taggedRegion = tags.find((tag) => tag.Key === ASSETS_BUCKET_REGION_TAG)?.Value;
+	return taggedRegion === void 0 ? void 0 : taggedRegion === region;
+};
+const lookupAssetsBuckets = Effect.gen(function* () {
+	const region = yield* Region;
+	const buckets = (yield* s3.listBuckets({})).Buckets ?? [];
+	const matchingBuckets = [];
+	for (const bucket of buckets) {
+		const bucketName = bucket.Name;
+		if (!bucketName) continue;
+		const tags = yield* getBucketTags(bucketName).pipe(Effect.catch(() => Effect.succeed([])));
+		if (!hasAssetsBucketTag(tags)) continue;
+		const taggedRegionMatch = bucketMatchesRegion(tags, region);
+		if (taggedRegionMatch === true) {
+			matchingBuckets.push(bucketName);
+			continue;
+		}
+		if (taggedRegionMatch === false) continue;
+		if ((yield* s3.getBucketLocation({ Bucket: bucketName }).pipe(Effect.map((response) => normalizeBucketRegion(response.LocationConstraint)), Effect.catch(() => Effect.succeed(void 0)))) === region) matchingBuckets.push(bucketName);
+	}
+	return matchingBuckets;
+});
+const lookupAssetsBucket = Effect.gen(function* () {
+	const matchingBuckets = yield* lookupAssetsBuckets;
+	for (const bucketName of matchingBuckets) return Option.some(bucketName);
+	return Option.none();
+});
+const ensureAssetsBucketTags = Effect.fn(function* (bucketName, region) {
+	const tagSet = [...(yield* getBucketTags(bucketName)).filter((tag) => tag.Key !== ASSETS_BUCKET_TAG && tag.Key !== ASSETS_BUCKET_REGION_TAG), ...createAssetsBucketTags(region)];
+	yield* s3.putBucketTagging({
+		Bucket: bucketName,
+		Tagging: { TagSet: tagSet.map((tag) => ({
+			Key: tag.Key,
+			Value: tag.Value
+		})) }
+	});
+});
+const deleteAllObjects = Effect.fn(function* (bucketName) {
+	let continuationToken;
+	do {
+		const listResponse = yield* s3.listObjectsV2({
+			Bucket: bucketName,
+			ContinuationToken: continuationToken
+		});
+		if (listResponse.Contents && listResponse.Contents.length > 0) yield* s3.deleteObjects({
+			Bucket: bucketName,
+			Delete: {
+				Objects: listResponse.Contents.map((obj) => ({ Key: obj.Key })),
+				Quiet: true
+			}
+		});
+		continuationToken = listResponse.NextContinuationToken;
+	} while (continuationToken);
+	let keyMarker;
+	let versionIdMarker;
+	do {
+		const listVersionsResponse = yield* s3.listObjectVersions({
+			Bucket: bucketName,
+			KeyMarker: keyMarker,
+			VersionIdMarker: versionIdMarker
+		});
+		const objectsToDelete = [...(listVersionsResponse.Versions ?? []).map((v) => ({
+			Key: v.Key,
+			VersionId: v.VersionId
+		})), ...(listVersionsResponse.DeleteMarkers ?? []).map((dm) => ({
+			Key: dm.Key,
+			VersionId: dm.VersionId
+		}))];
+		if (objectsToDelete.length > 0) yield* s3.deleteObjects({
+			Bucket: bucketName,
+			Delete: {
+				Objects: objectsToDelete,
+				Quiet: true
+			}
+		});
+		keyMarker = listVersionsResponse.NextKeyMarker;
+		versionIdMarker = listVersionsResponse.NextVersionIdMarker;
+	} while (keyMarker);
+});
+/**
+* Bootstrap the AWS environment by creating the assets bucket.
+*
+* This is idempotent - running it multiple times is safe.
+* The bucket is tagged and later discovered by tag lookup instead of by name.
+*/
+const bootstrap = Effect.fn(function* () {
+	const region = yield* Region;
+	const existingBucket = yield* lookupAssetsBucket;
+	if (Option.isSome(existingBucket)) {
+		yield* ensureAssetsBucketTags(existingBucket.value, region);
+		yield* Effect.logInfo(`Assets bucket already exists: ${existingBucket.value}`);
+		return {
+			bucketName: existingBucket.value,
+			created: false
+		};
+	}
+	const { accountId } = yield* AWSEnvironment;
+	const bucketName = createAssetsBucketName(accountId, region);
+	yield* s3.createBucket({
+		Bucket: bucketName,
+		BucketNamespace: "account-regional",
+		CreateBucketConfiguration: {
+			Tags: createAssetsBucketTags(region),
+			...region === "us-east-1" ? {} : { LocationConstraint: region }
+		}
+	}).pipe(Effect.catchTag("BucketAlreadyOwnedByYou", () => Effect.void), Effect.retry({
+		while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
+		schedule: Schedule.exponential(100)
+	}));
+	yield* s3.headBucket({ Bucket: bucketName }).pipe(Effect.retry({ schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10))) }));
+	yield* Effect.logInfo(`Created assets bucket: ${bucketName}`);
+	return {
+		bucketName,
+		created: true
+	};
+});
+const destroyBootstrap = Effect.fn(function* () {
+	const bucketNames = yield* lookupAssetsBuckets;
+	for (const bucketName of bucketNames) {
+		yield* Effect.logInfo(`Destroying assets bucket: ${bucketName}`);
+		yield* deleteAllObjects(bucketName);
+		yield* s3.deleteBucket({ Bucket: bucketName }).pipe(Effect.retry({
+			while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
+			schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10)))
+		}));
+	}
+	return {
+		bucketNames,
+		destroyed: bucketNames.length
+	};
+});
+
+//#endregion
+//#region src/AWS/Credentials.ts
+/**
+* Lazy `Credentials` layer derived from the surrounding {@link AWSEnvironment}.
+* Credentials are resolved on first access (not during layer construction),
+* matching the existing @distilled.cloud/aws semantics.
+*/
+const fromEnvironment$1 = Layer.effect(Credentials, Effect.map(AWSEnvironment.asEffect(), (env$2) => env$2.credentials));
+
+//#endregion
+//#region src/AWS/Region.ts
+/**
+* Derive the AWS region from the surrounding {@link AWSEnvironment}.
+*/
+const fromEnvironment = Layer.effect(Region$1.Region, Effect.map(AWSEnvironment.asEffect(), (env$2) => env$2.region));
+
+//#endregion
+//#region src/Util/ConfigProvider.ts
+const loadConfigProvider = (envFile$1) => {
+	if (Option.isSome(envFile$1)) return ConfigProvider.fromDotEnv({ path: envFile$1.value }).pipe(Effect.map((dotEnv) => ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv())));
+	return Effect.gen(function* () {
+		if (!(yield* (yield* FileSystem.FileSystem).exists(".env"))) return ConfigProvider.fromEnv();
+		return ConfigProvider.orElse(yield* ConfigProvider.fromDotEnv({ path: ".env" }), ConfigProvider.fromEnv());
+	});
+};
+
+//#endregion
+//#region src/Util/FileLogger.ts
+const fileLogger = Effect.fnUntraced(function* (...segments) {
+	const { dotAlchemy } = yield* AlchemyContext;
+	const fs$2 = yield* FileSystem.FileSystem;
+	const path = yield* Path;
+	const logFile = path.join(dotAlchemy, "log", ...segments);
+	yield* fs$2.makeDirectory(path.dirname(logFile), { recursive: true });
+	return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
+});
+
+//#endregion
+//#region bin/commands/bootstrap.ts
+const awsProfile = Flag$1.string("profile").pipe(Flag$1.withDescription("AWS profile to use for credentials"), Flag$1.optional, Flag$1.map(Option.getOrElse(() => "default")));
+const awsRegion = Flag$1.string("region").pipe(Flag$1.withDescription("AWS region to bootstrap (defaults to AWS_REGION env var)"), Flag$1.optional, Flag$1.map(Option.getOrUndefined));
+const bootstrapDestroy = Flag$1.boolean("destroy").pipe(Flag$1.withDescription("Destroy all bootstrap buckets in the selected region"), Flag$1.withDefault(false));
+const bootstrapCommand = Command$1.make("bootstrap", {
+	envFile,
+	profile: awsProfile,
+	region: awsRegion,
+	destroy: bootstrapDestroy
+}, Effect.fnUntraced(function* ({ envFile: envFile$1, profile: profile$1, region, destroy }) {
+	const logger = Logger.layer([fileLogger("bootstrap.txt")]);
+	return yield* Effect.gen(function* () {
+		const ssoProfile = yield* Auth.loadProfile(profile$1);
+		if (!ssoProfile.sso_account_id) return yield* Effect.die(`AWS SSO profile '${profile$1}' is missing sso_account_id`);
+		const ambient = yield* Effect.context();
+		const environment = makeEnvironment({
+			accountId: ssoProfile.sso_account_id,
+			region: region ?? ssoProfile.region ?? "us-east-1",
+			credentials: Auth.loadProfileCredentials(profile$1).pipe(Effect.provide(ambient)),
+			profile: profile$1
+		});
+		const awsLayers = Layer.provideMerge(Layer.mergeAll(fromEnvironment, fromEnvironment$1), environment);
+		return yield* Effect.gen(function* () {
+			const provider = yield* loadConfigProvider(envFile$1);
+			const bootstrapLayer = Layer.provide(awsLayers, Layer.succeed(ConfigProvider.ConfigProvider, provider));
+			if (destroy) {
+				yield* destroyBootstrap().pipe(Effect.tap((result) => result.destroyed === 0 ? Console.log("✓ No bootstrap buckets found to destroy") : Console.log(`✓ Destroyed ${result.destroyed} bootstrap bucket(s): ${result.bucketNames.join(", ")}`)), Effect.provide(bootstrapLayer));
+				return;
+			}
+			yield* bootstrap().pipe(Effect.tap(({ bucketName, created }) => created ? Console.log(`✓ Created assets bucket: ${bucketName}`) : Console.log(`✓ Assets bucket already exists: ${bucketName}`)), Effect.provide(bootstrapLayer));
+		});
+	}).pipe(Effect.provide(logger));
+}));
+
+//#endregion
+//#region src/Artifacts.ts
+/**
+* Per-resource in-memory artifacts shared across a single `Plan.make -> apply`
+* execution.
+*
+* The engine scopes this service by resource `FQN` before invoking lifecycle
+* handlers, so providers should treat it as a resource-local bag for expensive,
+* deterministic intermediate results that can be reused across phases.
+*
+* Expected usage:
+*
+* - `diff` computes an expensive artifact once and stores it
+* - `create` / `update` reads the same artifact and skips recomputing it
+* - artifacts are ephemeral and must never be required for correctness on a
+*   later deploy because the bag is reset between runs
+*
+* Example:
+*
+* ```ts
+* const artifacts = yield* Artifacts;
+* const cached = yield* artifacts.get<PreparedBundle>("bundle");
+* if (cached) return cached;
+*
+* const bundle = yield* prepareBundle();
+* yield* artifacts.set("bundle", bundle);
+* return bundle;
+* ```
+*/
+var Artifacts = class extends EffectContext.Service()("Artifacts") {};
+var ArtifactStore = class extends EffectContext.Service()("Artifacts/Store") {};
+/**
+* Create a fresh root store for one deploy/test run.
+*/
+const createArtifactStore = () => /* @__PURE__ */ new Map();
+const getOrCreateBag = (store, fqn) => {
+	const existing = store.get(fqn);
+	if (existing) return existing;
+	const bag = /* @__PURE__ */ new Map();
+	store.set(fqn, bag);
+	return bag;
+};
+const makeScopedArtifacts = (store, fqn) => {
+	const bag = getOrCreateBag(store, fqn);
+	return {
+		get: (key) => Effect.sync(() => bag.get(key)),
+		set: (key, value) => Effect.sync(() => {
+			bag.set(key, value);
+		}),
+		delete: (key) => Effect.sync(() => {
+			bag.delete(key);
+		})
+	};
+};
+/**
+* Ensure an artifact root exists, reusing the ambient store when one is already
+* present. This lets nested helpers participate in the same run-scoped cache.
+*/
+const ensureArtifactStore = (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrUndefined), Effect.flatMap((existing) => effect.pipe(Effect.provideService(ArtifactStore, existing ?? createArtifactStore()))));
+
+//#endregion
+//#region src/Util/service.ts
+const GenericService = () => (Kind) => {
+	const service = EffectContext.Service(Kind);
+	const make$2 = (Type) => EffectContext.Service(`${Kind}<${Type}>`);
+	return Object.assign(Object.setPrototypeOf(make$2, service), service);
+};
+
+//#endregion
+//#region src/ExecutionContext.ts
+const ExecutionContext = GenericService()("Alchemy::ExecutionContext");
+const CurrentExecutionContext = Effect.serviceOption(ExecutionContext).pipe(Effect.map(Option.getOrUndefined));
+
+//#endregion
+//#region src/Ref.ts
+const RefMetadata = Symbol.for("alchemy/RefMetadata");
+const isRef = (s) => s && s[RefMetadata] !== void 0;
+const getRefMetadata = (ref$1) => ref$1[RefMetadata];
+const ref = ({ stack, id, stage: stage$1 }) => {
+	const ref$1 = new Proxy({}, { get: (_, prop) => {
+		if (prop === RefMetadata) return {
+			stack,
+			stage: stage$1,
+			id
+		};
+		return of(ref$1)[prop];
+	} });
+	return ref$1;
+};
+
+//#endregion
+//#region src/Provider.ts
+const Provider = (type) => EffectContext.Service()(type);
+const isProviderCollectionService = (value) => {
+	return typeof value === "object" && value !== null && "kind" in value && value.kind === "ProviderCollection";
+};
+const findProviderByType = (type) => tryFindProviderByType(type).pipe(Effect.flatMap(Option.match({
+	onNone: () => Effect.die(`Provider not found for ${type}`),
+	onSome: (provider) => Effect.succeed(provider)
+})));
+const tryFindProviderByType = Effect.fnUntraced(function* (resourceType) {
+	const Tag = Provider(resourceType);
+	const direct = yield* Effect.serviceOption(Tag);
+	if (Option.isSome(direct)) return direct;
+	const context = yield* Effect.context();
+	for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
+		const provider = value.get(resourceType);
+		if (provider) return Option.some(provider);
+	}
+	return Option.none();
+});
+
 //#endregion
 //#region src/Stage.ts
 var Stage = class extends EffectContext.Service()("Stage") {};
@@ -43675,12 +43675,16 @@ const Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (st
 	id: stackName
 }) }) }))));
 const StackName = Stack.use((stack) => Effect.succeed(stack.name));
-const make$1 = (options) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => options.providers.pipe(Layer.provideMerge(options.state), Layer.provideMerge(Layer.effect(Stack, Stage.asEffect().pipe(Effect.map((stage$1) => options.stack ?? {
-	name: options.name,
-	stage: stage$1,
-	resources: {},
-	bindings: {}
-})))), Layer.buildWithScope(scope))), Effect.flatMap((context) => Effect.all([
+const make$1 = (options) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
+	if (options.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://alchemy.run/concepts/state-store for available state stores.`));
+	if (options.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
+	return options.providers.pipe(Layer.provideMerge(options.state), Layer.provideMerge(Layer.effect(Stack, Stage.asEffect().pipe(Effect.map((stage$1) => options.stack ?? {
+		name: options.name,
+		stage: stage$1,
+		resources: {},
+		bindings: {}
+	})))), Layer.buildWithScope(scope));
+}), Effect.flatMap((context) => Effect.all([
 	effect,
 	Stack.asEffect(),
 	Effect.context()
@@ -43895,6 +43899,7 @@ const evaluate = (expr, upstream$1) => Effect.gen(function* () {
 		}
 	}
 	if (Array.isArray(expr)) return yield* Effect.all(expr.map((item) => evaluate(item, upstream$1)));
+	else if (Redacted.isRedacted(expr)) return expr;
 	else if (typeof expr === "object" && expr !== null) return Object.fromEntries(yield* Effect.all(Object.entries(expr).map(([key, value]) => evaluate(value, upstream$1).pipe(Effect.map((value$1) => [key, value$1])))));
 	return expr;
 });
@@ -45194,6 +45199,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 	const resolveInput = (input) => Effect.gen(function* () {
 		if (!input) return input;
 		else if (isExpr(input)) return yield* resolveOutput(input);
+		else if (Redacted.isRedacted(input)) return input;
 		else if (Array.isArray(input)) return yield* Effect.all(input.map(resolveInput), { concurrency: "unbounded" });
 		else if (isResource(input)) return yield* resolveInput(yield* resolveOutput(of(input)));
 		else if (typeof input === "object") return Object.fromEntries(yield* Effect.all(Object.entries(input).map(([key, value]) => resolveInput(value).pipe(Effect.map((value$1) => [key, value$1]))), { concurrency: "unbounded" }));
@@ -45471,7 +45477,7 @@ var UnsatisfiedResourceCycle = class extends Data.TaggedError("UnsatisfiedResour
 //#region bin/commands/deploy.ts
 const execStack = Effect.fn(function* ({ main: main$1, stage: stage$1, envFile: envFile$1, profile: profile$1, dryRun: dryRun$1 = false, force: force$1 = false, yes: yes$1 = false, destroy = false }) {
 	const stackEffect = yield* importStack(main$1);
-	const services$1 = Layer.mergeAll(Layer.succeed(ArtifactStore, createArtifactStore()), Layer.succeed(AuthProviders, yield* Effect.serviceOption(AuthProviders).pipe(Effect.map(Option.getOrElse(() => ({}))))), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(envFile$1), profile$1)), inkCLI(), Logger.layer([fileLogger("out")]), Layer.succeed(Stage, stage$1));
+	const services$1 = Layer.mergeAll(Layer.succeed(ArtifactStore, createArtifactStore()), Layer.succeed(AuthProviders, yield* Effect.serviceOption(AuthProviders).pipe(Effect.map(Option.getOrElse(() => ({}))))), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(envFile$1), profile$1)), Logger.layer([fileLogger("out")]), Layer.succeed(Stage, stage$1));
 	yield* Effect.gen(function* () {
 		const cli$1 = yield* Cli;
 		const stack = yield* stackEffect;
@@ -45853,7 +45859,7 @@ const root = Command$1.make("alchemy", {}).pipe(Command$1.withSubcommands([
 	stateCommand
 ]));
 const cli = Command$1.run(root, { version });
-const services = Layer.mergeAll(Layer.provideMerge(AlchemyContextLive, PlatformServices), FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()));
+const services = Layer.mergeAll(Layer.provideMerge(AlchemyContextLive, PlatformServices), FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()), inkCLI());
 cli.pipe(Effect.provide(services), Effect.scoped, handleCancellation, runMain);
 
 //#endregion