alchemy 2.0.0-beta.42 → 2.0.0-beta.44

package/bin/exec.js

@@ -1,7 +1,7 @@
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as S from "effect/Schema";
+import * as Schema from "effect/Schema";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as EffectContext from "effect/Context";
 import * as FileSystem from "effect/FileSystem";
@@ -11,20 +11,28 @@ import * as Redacted from "effect/Redacted";
 import path from "pathe";
 import * as Config from "effect/Config";
 import os from "node:os";
-import * as Console from "effect/Console";
+import { newWebSocketRpcSession } from "capnweb";
+import * as Cache from "effect/Cache";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
 import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
-import * as Command from "effect/unstable/cli/Command";
-import * as Flag from "effect/unstable/cli/Flag";
-import * as Data from "effect/Data";
-import * as Cause from "effect/Cause";
+import "effect/Scope";
 import * as Deferred from "effect/Deferred";
-import { pipe } from "effect/Function";
+import * as Data from "effect/Data";
+import { flow, pipe } from "effect/Function";
 import { SingleShotGen } from "effect/Utils";
 import { pipeArguments } from "effect/Pipeable";
-import "effect/Scope";
-import * as Duration from "effect/Duration";
+import "effect/Predicate";
+import "effect/Record";
+import * as Cause from "effect/Cause";
 import * as Exit from "effect/Exit";
+import * as Stream from "effect/Stream";
+import * as NodeUtil from "node:util";
+import * as Console from "effect/Console";
+import * as Command from "effect/unstable/cli/Command";
+import * as Flag from "effect/unstable/cli/Flag";
+import * as Duration from "effect/Duration";
 import * as Metric from "effect/Metric";
 import { createHash } from "node:crypto";
 import * as Argument from "effect/unstable/cli/Argument";
@@ -146,125 +154,6 @@ const CredentialsStoreLive = Layer.effect(CredentialsStore, Effect.gen(function*
 	};
 }));
 
-//#endregion
-//#region lib/Util/PlatformServices.js
-const isBun = typeof Bun !== "undefined";
-const PlatformServices = Effect.promise(async () => {
-	if (isBun) {
-		const [BunServices, BunSocket] = await Promise.all([import("@effect/platform-bun/BunServices"), import("@effect/platform-bun/BunSocket")]);
-		return Layer.merge(BunServices.layer, BunSocket.layerWebSocketConstructor);
-	} else {
-		const [NodeServices, NodeSocket] = await Promise.all([import("@effect/platform-node/NodeServices"), import("@effect/platform-node/NodeSocket")]);
-		return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
-	}
-}).pipe(Layer.unwrap);
-const runMain = (effect, options) => {
-	if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options));
-	else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options));
-};
-
-//#endregion
-//#region lib/AdoptPolicy.js
-/**
-* AdoptPolicy controls whether the engine should "adopt" pre-existing cloud
-* resources that conflict with this stack instead of failing.
-*
-* The engine always calls a provider's `read` lifecycle operation when there
-* is no prior state and `read` is implemented. The provider's job is to
-* report two things:
-*
-*   1. Whether the resource exists (returns attributes vs. `undefined`).
-*   2. Whether *we* own it (plain attributes vs. {@link Unowned}-branded).
-*
-* The engine then routes:
-*
-*   | `read` outcome      | `adopt: false` | `adopt: true`     |
-*   | ------------------- | -------------- | ----------------- |
-*   | undefined           | create         | create            |
-*   | owned (plain attrs) | silent adopt   | silent adopt      |
-*   | {@link Unowned}     | fail           | takeover (adopt)  |
-*
-* "Owned" means a provider has affirmatively determined the resource was
-* created by this stack/stage/logical-id (typically by inspecting tags or
-* naming conventions). Resources without ownership semantics simply always
-* return plain attrs — they are treated as owned by default, so silent
-* adoption is the norm and `--adopt` is unnecessary.
-*
-* The policy can be overridden per-effect via {@link adopt} — most commonly
-* applied at the resource or stack scope.
-*/
-var AdoptPolicy = class extends EffectContext.Service()("AdoptPolicy") {};
-/**
-* Engine-raised failure produced when `read` reports an existing resource
-* marked as {@link Unowned} and `adopt` is `false`. Surface this to the user
-* to indicate they should either re-tag the cloud resource, pick a different
-* physical name, or re-run with `--adopt` (or `adopt(true)`) to force a
-* takeover.
-*/
-var OwnedBySomeoneElse = class extends Data.TaggedError("OwnedBySomeoneElse") {};
-/**
-* Private symbol used to brand attribute objects returned by `read` as
-* "exists in cloud, but not owned by this stack/stage/logical-id".
-*
-* Deliberately *not* registered via `Symbol.for` — the brand is an
-* engine-internal routing hint and must not be observable or
-* forgeable from outside this module. The engine strips it before any
-* state persistence (see {@link stripUnowned}) so it never leaks into
-* the state store, JSON serialization, or downstream `Output`s.
-*/
-const UnownedTag = Symbol("alchemy/Unowned");
-/**
-* Brand a `read` return value as belonging to a different owner.
-*
-* Use this in a provider's `read` implementation when the resource exists in
-* the cloud but a positive ownership check (e.g. tag inspection) shows it
-* was *not* created by this stack/stage/logical-id:
-*
-* ```ts
-* read: Effect.fnUntraced(function* ({ id, output, olds }) {
-*   const settings = yield* getScriptSettings({ ... }).pipe(
-*     Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
-*   );
-*   if (!settings) return undefined;
-*
-*   const attrs = { workerName, ...buildAttrs(settings) };
-*   return hasAlchemyWorkerTags(id, settings.tags) ? attrs : Unowned(attrs);
-* }),
-* ```
-*
-* The returned value is structurally still `T` — there is no wrapper to
-* unwrap. The brand is a non-enumerable symbol that the engine inspects
-* during planning to decide whether to take over (`adopt: true`) or fail
-* loudly (`adopt: false`).
-*
-* Resources without ownership semantics should simply return plain attrs —
-* the engine treats them as owned and silent adoption is the default.
-*/
-const Unowned = Object.assign((attrs) => {
-	const cloned = { ...attrs };
-	Object.defineProperty(cloned, UnownedTag, {
-		value: true,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-	return cloned;
-}, { is: (value) => typeof value === "object" && value !== null && value[UnownedTag] === true });
-/**
-* Strip the {@link Unowned} brand from an attributes object before persisting
-* it — state should not carry per-deploy ownership-routing metadata.
-*
-* The brand is intentionally non-enumerable, so a plain spread already
-* drops it; the additional `delete` is defense-in-depth in case a future
-* change makes the descriptor enumerable. Always returns a fresh object
-* (never mutates the input).
-*/
-const stripUnowned = (attrs) => {
-	const out = { ...attrs };
-	if (UnownedTag in out) delete out[UnownedTag];
-	return out;
-};
-
 //#endregion
 //#region lib/Artifacts.js
 /**
@@ -325,6 +214,10 @@ const makeScopedArtifacts = (store, fqn) => {
 */
 const ensureArtifactStore = (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrUndefined), Effect.flatMap((existing) => effect.pipe(Effect.provideService(ArtifactStore, existing ?? createArtifactStore()))));
 
+//#endregion
+//#region lib/Auth/AuthProvider.js
+var AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
+
 //#endregion
 //#region lib/Cli/Cli.js
 var Cli = class extends EffectContext.Service()("CLI") {};
@@ -415,105 +308,6 @@ const tryFindProviderByType = Effect.fnUntraced(function* (resourceType) {
 	return Option.none();
 });
 
-//#endregion
-//#region lib/Util/service.js
-const GenericService = () => (Kind) => {
-	const service = EffectContext.Service(Kind);
-	const make$2 = (Type) => EffectContext.Service(`${Kind}<${Type}>`);
-	return Object.assign(Object.setPrototypeOf(make$2, service), service);
-};
-
-//#endregion
-//#region lib/Auth/AuthProvider.js
-var AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
-
-//#endregion
-//#region lib/Stage.js
-var Stage = class extends EffectContext.Service()("Stage") {};
-
-//#endregion
-//#region lib/Util/ConfigProvider.js
-const loadConfigProvider = (envFile$1) => {
-	if (Option.isSome(envFile$1)) return ConfigProvider.fromDotEnv({ path: envFile$1.value }).pipe(Effect.map((dotEnv) => ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv())));
-	return Effect.gen(function* () {
-		if (!(yield* (yield* FileSystem.FileSystem).exists(".env"))) return ConfigProvider.fromEnv();
-		return ConfigProvider.orElse(yield* ConfigProvider.fromDotEnv({ path: ".env" }), ConfigProvider.fromEnv());
-	});
-};
-
-//#endregion
-//#region lib/Util/effect.js
-const effectClass = ((impl) => impl === void 0 ? (innerImpl) => effectClass(innerImpl) : Object.assign(class {
-	static asEffect() {
-		return impl;
-	}
-	static [Symbol.iterator]() {
-		return new SingleShotGen(this.asEffect());
-	}
-	static pipe(...fns) {
-		return pipeArguments(this, fns);
-	}
-}, impl));
-const taggedFunction = (tag$1, fn) => {
-	const overrides = {
-		asEffect: () => tag$1,
-		[Symbol.iterator]: () => tag$1[Symbol.iterator](),
-		pipe: (...fns) => pipeArguments(tag$1, fns),
-		toString: () => `${tag$1.toString()}.${fn.name}`
-	};
-	return new Proxy(fn, {
-		get: (target, prop, receiver) => Reflect.has(overrides, prop) ? Reflect.get(overrides, prop, receiver) : Reflect.has(target, prop) ? Reflect.get(target, prop, receiver) : Reflect.get(tag$1, prop, tag$1),
-		has: (target, prop) => Reflect.has(overrides, prop) || Reflect.has(target, prop) || Reflect.has(tag$1, prop)
-	});
-};
-
-//#endregion
-//#region lib/Util/FileLogger.js
-const fileLogger = Effect.fnUntraced(function* (...segments) {
-	const { dotAlchemy } = yield* AlchemyContext;
-	const fs = yield* FileSystem.FileSystem;
-	const path$1 = yield* Path;
-	const logFile = path$1.join(dotAlchemy, "log", ...segments);
-	yield* fs.makeDirectory(path$1.dirname(logFile), { recursive: true });
-	return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
-});
-
-//#endregion
-//#region lib/Stack.js
-const Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (stackName, options, eff) => {
-	if (!stackName) return (stackName$1) => Object.assign(stackRef(stackName$1).pipe(effectClass), {
-		stage: createStageProxy(stackName$1),
-		make: (options$1, eff$1) => Stack(stackName$1, options$1, eff$1)
-	});
-	return eff.pipe(make$1({
-		name: stackName,
-		...options
-	}), (eff$1) => Object.assign(eff$1, { stage: createStageProxy(stackName) }));
-}));
-const createStageProxy = (stackName) => new Proxy({}, { get: (_, stage$1) => stackRef(stackName, { stage: stage$1 }) });
-const StackName = Stack.use((stack) => Effect.succeed(stack.name));
-const make$1 = (options) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
-	if (options.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://v2.alchemy.run/concepts/state-store for available state stores.`));
-	if (options.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
-	return options.providers.pipe(Layer.provideMerge(options.state), Layer.provideMerge(Layer.effect(Stack, Stage.pipe(Effect.map((stage$1) => options.stack ?? {
-		name: options.name,
-		stage: stage$1,
-		resources: {},
-		bindings: {},
-		actions: {}
-	})))), Layer.buildWithScope(scope));
-}), Effect.flatMap((context) => Effect.all([
-	effect,
-	Stack,
-	Effect.context()
-]).pipe(Effect.map(([output, stack, services$1]) => ({
-	...stack,
-	output,
-	services: EffectContext.merge(services$1, context)
-})), Effect.provideContext(context))));
-const CurrentStack = Effect.serviceOption(Stack).pipe(Effect.map(Option.getOrUndefined));
-const platform = Layer.mergeAll(PlatformServices, FetchHttpClient.layer, Logger.layer([fileLogger("out")], { mergeWithExisting: true }), Layer.provide(ProfileLive, PlatformServices), Layer.provide(CredentialsStoreLive, PlatformServices));
-
 //#endregion
 //#region lib/Resource.js
 const isResource = (value) => {
@@ -527,9 +321,13 @@ const isResource = (value) => {
 *
 * E.g. the context of a running Worker, Task, Process, Function
 */
-const RuntimeContext = GenericService()("Alchemy::RuntimeContext");
+var RuntimeContext = class extends EffectContext.Service()("RuntimeContext") {};
 const CurrentRuntimeContext = Effect.serviceOption(RuntimeContext).pipe(Effect.map(Option.getOrUndefined));
 
+//#endregion
+//#region lib/Stage.js
+var Stage = class extends EffectContext.Service()("Stage") {};
+
 //#endregion
 //#region lib/State/State.js
 const isActionState = (s) => !!s && s.kind === "action";
@@ -847,6 +645,282 @@ const toObject = (acc, v) => ({
 	...v
 });
 
+//#endregion
+//#region lib/Util/ConfigProvider.js
+const loadConfigProvider = (envFile$1) => {
+	if (Option.isSome(envFile$1)) return ConfigProvider.fromDotEnv({ path: envFile$1.value }).pipe(Effect.map((dotEnv) => ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv())));
+	return Effect.gen(function* () {
+		if (!(yield* (yield* FileSystem.FileSystem).exists(".env"))) return ConfigProvider.fromEnv();
+		return ConfigProvider.orElse(yield* ConfigProvider.fromDotEnv({ path: ".env" }), ConfigProvider.fromEnv());
+	});
+};
+
+//#endregion
+//#region lib/Util/effect.js
+const effectClass = ((impl) => impl === void 0 ? (innerImpl) => effectClass(innerImpl) : Object.assign(class {
+	static asEffect() {
+		return impl;
+	}
+	static [Symbol.iterator]() {
+		return new SingleShotGen(this.asEffect());
+	}
+	static pipe(...fns) {
+		return pipeArguments(this, fns);
+	}
+}, impl));
+const taggedFunction = (tag$1, fn) => {
+	const overrides = {
+		asEffect: () => tag$1,
+		[Symbol.iterator]: () => tag$1[Symbol.iterator](),
+		pipe: (...fns) => pipeArguments(tag$1, fns),
+		toString: () => `${tag$1.toString()}.${fn.name}`
+	};
+	return new Proxy(fn, {
+		get: (target, prop, receiver) => Reflect.has(overrides, prop) ? Reflect.get(overrides, prop, receiver) : Reflect.has(target, prop) ? Reflect.get(target, prop, receiver) : Reflect.get(tag$1, prop, tag$1),
+		has: (target, prop) => Reflect.has(overrides, prop) || Reflect.has(target, prop) || Reflect.has(tag$1, prop)
+	});
+};
+
+//#endregion
+//#region lib/Util/FileLogger.js
+const fileLogger = Effect.fnUntraced(function* (...segments) {
+	const { dotAlchemy } = yield* AlchemyContext;
+	const fs = yield* FileSystem.FileSystem;
+	const path$1 = yield* Path;
+	const logFile = path$1.join(dotAlchemy, "log", ...segments);
+	yield* fs.makeDirectory(path$1.dirname(logFile), { recursive: true });
+	return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
+});
+
+//#endregion
+//#region lib/Util/PlatformServices.js
+const isBun = typeof Bun !== "undefined";
+/**
+* Constructs a layer with different implementations for Bun and Node.
+*/
+const platformLayer = (constructors) => Layer.unwrap(Effect.promise(async () => {
+	if (isBun) return await constructors.bun();
+	else return await constructors.node();
+}));
+const PlatformServices = platformLayer({
+	bun: async () => {
+		const [BunServices, BunSocket] = await Promise.all([import("@effect/platform-bun/BunServices"), import("@effect/platform-bun/BunSocket")]);
+		return Layer.merge(BunServices.layer, BunSocket.layerWebSocketConstructor);
+	},
+	node: async () => {
+		const [NodeServices, NodeSocket] = await Promise.all([import("@effect/platform-node/NodeServices"), import("@effect/platform-node/NodeSocket")]);
+		return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
+	}
+});
+const runMain = (effect, options) => {
+	if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options));
+	else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options));
+};
+
+//#endregion
+//#region lib/Stack.js
+const Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (stackName, options, eff) => {
+	if (!stackName) return (stackName$1) => Object.assign(stackRef(stackName$1).pipe(effectClass), {
+		stage: createStageProxy(stackName$1),
+		make: (options$1, eff$1) => Stack(stackName$1, options$1, eff$1)
+	});
+	return eff.pipe(make$2({
+		name: stackName,
+		...options
+	}), (eff$1) => Object.assign(eff$1, { stage: createStageProxy(stackName) }));
+}));
+const createStageProxy = (stackName) => new Proxy({}, { get: (_, stage$1) => stackRef(stackName, { stage: stage$1 }) });
+const StackName = Stack.use((stack) => Effect.succeed(stack.name));
+const make$2 = (options) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
+	if (options.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://v2.alchemy.run/concepts/state-store for available state stores.`));
+	if (options.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
+	return options.providers.pipe(Layer.provideMerge(options.state), Layer.provideMerge(Layer.effect(Stack, Stage.pipe(Effect.map((stage$1) => options.stack ?? {
+		name: options.name,
+		stage: stage$1,
+		resources: {},
+		bindings: {},
+		actions: {}
+	})))), Layer.buildWithScope(scope));
+}), Effect.flatMap((context) => Effect.all([
+	effect,
+	Stack,
+	Effect.context()
+]).pipe(Effect.map(([output, stack, services$1]) => ({
+	...stack,
+	output,
+	services: EffectContext.merge(services$1, context)
+})), Effect.provideContext(context))));
+const CurrentStack = Effect.serviceOption(Stack).pipe(Effect.map(Option.getOrUndefined));
+const platform = Layer.mergeAll(PlatformServices, FetchHttpClient.layer, Logger.layer([fileLogger("out")], { mergeWithExisting: true }), Layer.provide(ProfileLive, PlatformServices), Layer.provide(CredentialsStoreLive, PlatformServices));
+
+//#endregion
+//#region lib/Local/RpcSerialization.js
+const unwrapRpcHandlers = (handlers, streamKeys) => {
+	return Object.fromEntries(Object.entries(handlers).map(([key, value]) => [key, typeof value === "function" ? streamKeys?.includes(key) ? unwrapRpcStreamHandler(value) : unwrapRpcEffectHandler(value) : typeof value === "object" && value !== null ? unwrapRpcHandlers(value) : value]));
+};
+const serializeError = Schema.encodeSync(Schema.Defect);
+const unwrapRpcEffectHandler = (handler) => flow((...args) => serializeRpcArgs(args), (args) => Effect.promise(() => handler(args)), Effect.flatMap((exit) => {
+	if (exit._tag === "Success") return Exit.succeed(exit.value);
+	return Exit.failCause(Cause.fromReasons(exit.cause.map((reason) => {
+		switch (reason._tag) {
+			case "Fail": return Cause.makeFailReason(reason.error);
+			case "Die": return Cause.makeDieReason(reason.defect);
+			case "Interrupt": return Cause.makeInterruptReason(reason.fiberId);
+		}
+	})));
+}));
+const unwrapRpcStreamHandler = (handler) => flow((...args) => serializeRpcArgs(args), (args) => handler(args), (stream) => Stream.fromReadableStream({
+	evaluate: () => stream,
+	onError: (error) => error
+}));
+const serializeRpcArgs = (value) => {
+	if (Redacted.isRedacted(value)) return {
+		_tag: "Redacted",
+		value: Redacted.value(value)
+	};
+	if (isOutput(value)) return {
+		_tag: "Output",
+		description: NodeUtil.inspect(value)
+	};
+	if (typeof value === "function") return null;
+	if (Array.isArray(value)) return value.map(serializeRpcArgs);
+	if (value && typeof value === "object" && !("toJSON" in value)) return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, serializeRpcArgs(child)]));
+	return value;
+};
+
+//#endregion
+//#region lib/Local/RpcProviderProxy.js
+var RpcProviderProxy = class extends EffectContext.Service()("alchemy/Local/RpcProviderProxy") {};
+const SPAWNER_URL_ENV_KEY = "ALCHEMY_RPC_SPAWNER_URL";
+const make$1 = Effect.fnUntraced(function* (spawnerUrl) {
+	const client = yield* HttpClient.HttpClient;
+	const getSession = Effect.fnUntraced(function* (serverEntryUrl) {
+		const alchemyContext = yield* AlchemyContext;
+		const stack = yield* Stack;
+		const payload = {
+			serverEntryUrl,
+			alchemyContext,
+			stack: {
+				name: stack.name,
+				stage: stack.stage
+			}
+		};
+		return newWebSocketRpcSession(yield* (yield* client.post(spawnerUrl, { body: yield* HttpBody.json(payload) })).text);
+	}, (effect, serverEntryUrl) => Effect.catch(effect, (error) => Effect.die(new Error(`Failed to create provider RPC session for "${serverEntryUrl}"`, { cause: error }))));
+	const cache = yield* Cache.make({
+		lookup: getSession,
+		capacity: Infinity,
+		requireServicesAt: "lookup"
+	});
+	return RpcProviderProxy.of({ get: Effect.fnUntraced(function* (mainUrl, providerName) {
+		const session = yield* cache.lookup(mainUrl);
+		return unwrapRpcHandlers(yield* Effect.promise(() => session.getProvider(providerName)), ["tail"]);
+	}) });
+});
+const fromEnv = () => Layer.effect(RpcProviderProxy, Config.string(SPAWNER_URL_ENV_KEY).pipe(Effect.flatMap(make$1)));
+
+//#endregion
+//#region lib/AdoptPolicy.js
+/**
+* AdoptPolicy controls whether the engine should "adopt" pre-existing cloud
+* resources that conflict with this stack instead of failing.
+*
+* The engine always calls a provider's `read` lifecycle operation when there
+* is no prior state and `read` is implemented. The provider's job is to
+* report two things:
+*
+*   1. Whether the resource exists (returns attributes vs. `undefined`).
+*   2. Whether *we* own it (plain attributes vs. {@link Unowned}-branded).
+*
+* The engine then routes:
+*
+*   | `read` outcome      | `adopt: false` | `adopt: true`     |
+*   | ------------------- | -------------- | ----------------- |
+*   | undefined           | create         | create            |
+*   | owned (plain attrs) | silent adopt   | silent adopt      |
+*   | {@link Unowned}     | fail           | takeover (adopt)  |
+*
+* "Owned" means a provider has affirmatively determined the resource was
+* created by this stack/stage/logical-id (typically by inspecting tags or
+* naming conventions). Resources without ownership semantics simply always
+* return plain attrs — they are treated as owned by default, so silent
+* adoption is the norm and `--adopt` is unnecessary.
+*
+* The policy can be overridden per-effect via {@link adopt} — most commonly
+* applied at the resource or stack scope.
+*/
+var AdoptPolicy = class extends EffectContext.Service()("AdoptPolicy") {};
+/**
+* Engine-raised failure produced when `read` reports an existing resource
+* marked as {@link Unowned} and `adopt` is `false`. Surface this to the user
+* to indicate they should either re-tag the cloud resource, pick a different
+* physical name, or re-run with `--adopt` (or `adopt(true)`) to force a
+* takeover.
+*/
+var OwnedBySomeoneElse = class extends Data.TaggedError("OwnedBySomeoneElse") {};
+/**
+* Private symbol used to brand attribute objects returned by `read` as
+* "exists in cloud, but not owned by this stack/stage/logical-id".
+*
+* Deliberately *not* registered via `Symbol.for` — the brand is an
+* engine-internal routing hint and must not be observable or
+* forgeable from outside this module. The engine strips it before any
+* state persistence (see {@link stripUnowned}) so it never leaks into
+* the state store, JSON serialization, or downstream `Output`s.
+*/
+const UnownedTag = Symbol("alchemy/Unowned");
+/**
+* Brand a `read` return value as belonging to a different owner.
+*
+* Use this in a provider's `read` implementation when the resource exists in
+* the cloud but a positive ownership check (e.g. tag inspection) shows it
+* was *not* created by this stack/stage/logical-id:
+*
+* ```ts
+* read: Effect.fnUntraced(function* ({ id, output, olds }) {
+*   const settings = yield* getScriptSettings({ ... }).pipe(
+*     Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
+*   );
+*   if (!settings) return undefined;
+*
+*   const attrs = { workerName, ...buildAttrs(settings) };
+*   return hasAlchemyWorkerTags(id, settings.tags) ? attrs : Unowned(attrs);
+* }),
+* ```
+*
+* The returned value is structurally still `T` — there is no wrapper to
+* unwrap. The brand is a non-enumerable symbol that the engine inspects
+* during planning to decide whether to take over (`adopt: true`) or fail
+* loudly (`adopt: false`).
+*
+* Resources without ownership semantics should simply return plain attrs —
+* the engine treats them as owned and silent adoption is the default.
+*/
+const Unowned = Object.assign((attrs) => {
+	const cloned = { ...attrs };
+	Object.defineProperty(cloned, UnownedTag, {
+		value: true,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return cloned;
+}, { is: (value) => typeof value === "object" && value !== null && value[UnownedTag] === true });
+/**
+* Strip the {@link Unowned} brand from an attributes object before persisting
+* it — state should not carry per-deploy ownership-routing metadata.
+*
+* The brand is intentionally non-enumerable, so a plain spread already
+* drops it; the additional `delete` is defense-in-depth in case a future
+* change makes the descriptor enumerable. Always returns a fresh object
+* (never mutates the input).
+*/
+const stripUnowned = (attrs) => {
+	const out = { ...attrs };
+	if (UnownedTag in out) delete out[UnownedTag];
+	return out;
+};
+
 //#endregion
 //#region lib/Diff.js
 const isResolved = (value) => !_hasUnresolved(value);
@@ -2428,7 +2502,7 @@ var __rewriteRelativeImportExtension = void 0 && (void 0).__rewriteRelativeImpor
 };
 const USER = Config.string("USER").pipe(Config.orElse(() => Config.string("USERNAME")), Config.withDefault("unknown"));
 const STAGE = Config.string("stage").pipe(Config.option, (a) => a, Effect.map(Option.getOrUndefined));
-const stage = Flag.string("stage").pipe(Flag.withSchema(S.String.check(S.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))), Flag.withDescription("Stage to deploy to, defaults to dev_${USER}"), Flag.optional, Flag.map(Option.getOrUndefined), Flag.mapEffect(Effect.fn(function* (stage$1) {
+const stage = Flag.string("stage").pipe(Flag.withSchema(Schema.String.check(Schema.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))), Flag.withDescription("Stage to deploy to, defaults to dev_${USER}"), Flag.optional, Flag.map(Option.getOrUndefined), Flag.mapEffect(Effect.fn(function* (stage$1) {
 	if (stage$1) return stage$1;
 	return yield* STAGE.pipe(Effect.catch(() => Effect.fail(new CliError.MissingOption({ option: "stage" }))), Effect.flatMap((s) => s === void 0 ? USER.pipe(Effect.map((user) => `dev_${user}`), Effect.catch(() => Effect.succeed("unknown"))) : Effect.succeed(s)));
 })));
@@ -2468,17 +2542,17 @@ const importStack = Effect.fn(function* (main) {
 
 //#endregion
 //#region lib/Cli/commands/deploy.js
-const ExecStackOptions = S.Struct({
-	main: S.String,
-	stage: S.String,
-	envFile: S.OptionFromOptional(S.String),
-	profile: S.optional(S.String),
-	dryRun: S.optional(S.Boolean),
-	force: S.optional(S.Boolean),
-	yes: S.optional(S.Boolean),
-	destroy: S.optional(S.Boolean),
-	dev: S.optional(S.Boolean),
-	adopt: S.optional(S.Boolean)
+const ExecStackOptions = Schema.Struct({
+	main: Schema.String,
+	stage: Schema.String,
+	envFile: Schema.OptionFromOptional(Schema.String),
+	profile: Schema.optional(Schema.String),
+	dryRun: Schema.optional(Schema.Boolean),
+	force: Schema.optional(Schema.Boolean),
+	yes: Schema.optional(Schema.Boolean),
+	destroy: Schema.optional(Schema.Boolean),
+	dev: Schema.optional(Schema.Boolean),
+	adopt: Schema.optional(Schema.Boolean)
 });
 const stackSpanAttrs = (args) => ({
 	"alchemy.stage": args.stage,
@@ -2506,6 +2580,7 @@ const execStack = Effect.fn(function* ({ main, stage: stage$1, envFile: envFile$
 				...stack,
 				resources: {},
 				bindings: {},
+				actions: {},
 				output: {}
 			} : stack, { force: force$1 });
 			if (dryRun$1) yield* cli.displayPlan(updatePlan);
@@ -3348,8 +3423,8 @@ const selectCli = () => isNonInteractive() ? LoggingCli : inkCLI();
 
 //#endregion
 //#region lib/Cli/exec.js
-const services = Layer.mergeAll(Layer.provideMerge(AlchemyContextLive, PlatformServices), Layer.provide(ProfileLive, PlatformServices), Layer.provide(CredentialsStoreLive, PlatformServices), FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()), selectCli());
-const exec = () => execStack(S.decodeSync(ExecStackOptions)(JSON.parse(process.env.ALCHEMY_EXEC_OPTIONS))).pipe(Effect.provide(services), Effect.scoped);
+const services = Layer.merge(selectCli(), fromEnv()).pipe(Layer.provideMerge(Layer.mergeAll(AlchemyContextLive, ProfileLive, CredentialsStoreLive)), Layer.provideMerge(Layer.mergeAll(PlatformServices, FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()))));
+const exec = () => execStack(Schema.decodeSync(ExecStackOptions)(JSON.parse(process.env.ALCHEMY_EXEC_OPTIONS))).pipe(Effect.provide(services), Effect.scoped);
 
 //#endregion
 //#region bin/exec.ts