alchemy 2.0.0-beta.43 → 2.0.0-beta.45

package/bin/exec.js

@@ -1,7 +1,7 @@
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as S from "effect/Schema";
+import * as Schema from "effect/Schema";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as EffectContext from "effect/Context";
 import * as FileSystem from "effect/FileSystem";
@@ -11,20 +11,29 @@ import * as Redacted from "effect/Redacted";
 import path from "pathe";
 import * as Config from "effect/Config";
 import os from "node:os";
-import * as Console from "effect/Console";
+import { newWebSocketRpcSession } from "capnweb";
+import * as Cache from "effect/Cache";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
 import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
-import * as Command from "effect/unstable/cli/Command";
-import * as Flag from "effect/unstable/cli/Flag";
-import * as Data from "effect/Data";
-import * as Cause from "effect/Cause";
+import "effect/Scope";
 import * as Deferred from "effect/Deferred";
-import { pipe } from "effect/Function";
+import * as Semaphore from "effect/Semaphore";
+import * as Data from "effect/Data";
+import * as Duration from "effect/Duration";
+import { flow, pipe } from "effect/Function";
 import { SingleShotGen } from "effect/Utils";
 import { pipeArguments } from "effect/Pipeable";
-import "effect/Scope";
-import * as Duration from "effect/Duration";
+import "effect/Predicate";
+import "effect/Record";
+import * as Cause from "effect/Cause";
 import * as Exit from "effect/Exit";
+import * as Stream from "effect/Stream";
+import * as NodeUtil from "node:util";
+import * as Console from "effect/Console";
+import * as Command from "effect/unstable/cli/Command";
+import * as Flag from "effect/unstable/cli/Flag";
 import * as Metric from "effect/Metric";
 import { createHash } from "node:crypto";
 import * as Argument from "effect/unstable/cli/Argument";
@@ -134,7 +143,9 @@ const CredentialsStoreLive = Layer.effect(CredentialsStore, Effect.gen(function*
 	}));
 	const write = (profile$1, provider, credentials) => {
 		const filePath = credentialsFilePath(profile$1, provider);
-		return fs.makeDirectory(path.dirname(filePath), { recursive: true }).pipe(Effect.flatMap(() => fs.writeFileString(filePath, JSON.stringify(credentials, null, 2))));
+		return fs.makeDirectory(path.dirname(filePath), { recursive: true }).pipe(Effect.flatMap(() => {
+			return fs.writeFileString(filePath, JSON.stringify(credentials, null, 2));
+		}));
 	};
 	const remove_ = (profile$1, provider) => fs.remove(credentialsFilePath(profile$1, provider)).pipe(Effect.catch(() => Effect.void));
 	const deleteProfile = (profile$1) => fs.remove(profileCredentialsDirPath(profile$1), { recursive: true }).pipe(Effect.catch(() => Effect.void));
@@ -146,125 +157,6 @@ const CredentialsStoreLive = Layer.effect(CredentialsStore, Effect.gen(function*
 	};
 }));
 
-//#endregion
-//#region lib/Util/PlatformServices.js
-const isBun = typeof Bun !== "undefined";
-const PlatformServices = Effect.promise(async () => {
-	if (isBun) {
-		const [BunServices, BunSocket] = await Promise.all([import("@effect/platform-bun/BunServices"), import("@effect/platform-bun/BunSocket")]);
-		return Layer.merge(BunServices.layer, BunSocket.layerWebSocketConstructor);
-	} else {
-		const [NodeServices, NodeSocket] = await Promise.all([import("@effect/platform-node/NodeServices"), import("@effect/platform-node/NodeSocket")]);
-		return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
-	}
-}).pipe(Layer.unwrap);
-const runMain = (effect, options) => {
-	if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options));
-	else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options));
-};
-
-//#endregion
-//#region lib/AdoptPolicy.js
-/**
-* AdoptPolicy controls whether the engine should "adopt" pre-existing cloud
-* resources that conflict with this stack instead of failing.
-*
-* The engine always calls a provider's `read` lifecycle operation when there
-* is no prior state and `read` is implemented. The provider's job is to
-* report two things:
-*
-*   1. Whether the resource exists (returns attributes vs. `undefined`).
-*   2. Whether *we* own it (plain attributes vs. {@link Unowned}-branded).
-*
-* The engine then routes:
-*
-*   | `read` outcome      | `adopt: false` | `adopt: true`     |
-*   | ------------------- | -------------- | ----------------- |
-*   | undefined           | create         | create            |
-*   | owned (plain attrs) | silent adopt   | silent adopt      |
-*   | {@link Unowned}     | fail           | takeover (adopt)  |
-*
-* "Owned" means a provider has affirmatively determined the resource was
-* created by this stack/stage/logical-id (typically by inspecting tags or
-* naming conventions). Resources without ownership semantics simply always
-* return plain attrs — they are treated as owned by default, so silent
-* adoption is the norm and `--adopt` is unnecessary.
-*
-* The policy can be overridden per-effect via {@link adopt} — most commonly
-* applied at the resource or stack scope.
-*/
-var AdoptPolicy = class extends EffectContext.Service()("AdoptPolicy") {};
-/**
-* Engine-raised failure produced when `read` reports an existing resource
-* marked as {@link Unowned} and `adopt` is `false`. Surface this to the user
-* to indicate they should either re-tag the cloud resource, pick a different
-* physical name, or re-run with `--adopt` (or `adopt(true)`) to force a
-* takeover.
-*/
-var OwnedBySomeoneElse = class extends Data.TaggedError("OwnedBySomeoneElse") {};
-/**
-* Private symbol used to brand attribute objects returned by `read` as
-* "exists in cloud, but not owned by this stack/stage/logical-id".
-*
-* Deliberately *not* registered via `Symbol.for` — the brand is an
-* engine-internal routing hint and must not be observable or
-* forgeable from outside this module. The engine strips it before any
-* state persistence (see {@link stripUnowned}) so it never leaks into
-* the state store, JSON serialization, or downstream `Output`s.
-*/
-const UnownedTag = Symbol("alchemy/Unowned");
-/**
-* Brand a `read` return value as belonging to a different owner.
-*
-* Use this in a provider's `read` implementation when the resource exists in
-* the cloud but a positive ownership check (e.g. tag inspection) shows it
-* was *not* created by this stack/stage/logical-id:
-*
-* ```ts
-* read: Effect.fnUntraced(function* ({ id, output, olds }) {
-*   const settings = yield* getScriptSettings({ ... }).pipe(
-*     Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
-*   );
-*   if (!settings) return undefined;
-*
-*   const attrs = { workerName, ...buildAttrs(settings) };
-*   return hasAlchemyWorkerTags(id, settings.tags) ? attrs : Unowned(attrs);
-* }),
-* ```
-*
-* The returned value is structurally still `T` — there is no wrapper to
-* unwrap. The brand is a non-enumerable symbol that the engine inspects
-* during planning to decide whether to take over (`adopt: true`) or fail
-* loudly (`adopt: false`).
-*
-* Resources without ownership semantics should simply return plain attrs —
-* the engine treats them as owned and silent adoption is the default.
-*/
-const Unowned = Object.assign((attrs) => {
-	const cloned = { ...attrs };
-	Object.defineProperty(cloned, UnownedTag, {
-		value: true,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-	return cloned;
-}, { is: (value) => typeof value === "object" && value !== null && value[UnownedTag] === true });
-/**
-* Strip the {@link Unowned} brand from an attributes object before persisting
-* it — state should not carry per-deploy ownership-routing metadata.
-*
-* The brand is intentionally non-enumerable, so a plain spread already
-* drops it; the additional `delete` is defense-in-depth in case a future
-* change makes the descriptor enumerable. Always returns a fresh object
-* (never mutates the input).
-*/
-const stripUnowned = (attrs) => {
-	const out = { ...attrs };
-	if (UnownedTag in out) delete out[UnownedTag];
-	return out;
-};
-
 //#endregion
 //#region lib/Artifacts.js
 /**
@@ -325,6 +217,11 @@ const makeScopedArtifacts = (store, fqn) => {
 */
 const ensureArtifactStore = (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrUndefined), Effect.flatMap((existing) => effect.pipe(Effect.provideService(ArtifactStore, existing ?? createArtifactStore()))));
 
+//#endregion
+//#region lib/Auth/AuthProvider.js
+const interactiveMutex = Semaphore.makeUnsafe(1);
+var AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
+
 //#endregion
 //#region lib/Cli/Cli.js
 var Cli = class extends EffectContext.Service()("CLI") {};
@@ -415,97 +312,6 @@ const tryFindProviderByType = Effect.fnUntraced(function* (resourceType) {
 	return Option.none();
 });
 
-//#endregion
-//#region lib/Auth/AuthProvider.js
-var AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
-
-//#endregion
-//#region lib/Stage.js
-var Stage = class extends EffectContext.Service()("Stage") {};
-
-//#endregion
-//#region lib/Util/ConfigProvider.js
-const loadConfigProvider = (envFile$1) => {
-	if (Option.isSome(envFile$1)) return ConfigProvider.fromDotEnv({ path: envFile$1.value }).pipe(Effect.map((dotEnv) => ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv())));
-	return Effect.gen(function* () {
-		if (!(yield* (yield* FileSystem.FileSystem).exists(".env"))) return ConfigProvider.fromEnv();
-		return ConfigProvider.orElse(yield* ConfigProvider.fromDotEnv({ path: ".env" }), ConfigProvider.fromEnv());
-	});
-};
-
-//#endregion
-//#region lib/Util/effect.js
-const effectClass = ((impl) => impl === void 0 ? (innerImpl) => effectClass(innerImpl) : Object.assign(class {
-	static asEffect() {
-		return impl;
-	}
-	static [Symbol.iterator]() {
-		return new SingleShotGen(this.asEffect());
-	}
-	static pipe(...fns) {
-		return pipeArguments(this, fns);
-	}
-}, impl));
-const taggedFunction = (tag$1, fn) => {
-	const overrides = {
-		asEffect: () => tag$1,
-		[Symbol.iterator]: () => tag$1[Symbol.iterator](),
-		pipe: (...fns) => pipeArguments(tag$1, fns),
-		toString: () => `${tag$1.toString()}.${fn.name}`
-	};
-	return new Proxy(fn, {
-		get: (target, prop, receiver) => Reflect.has(overrides, prop) ? Reflect.get(overrides, prop, receiver) : Reflect.has(target, prop) ? Reflect.get(target, prop, receiver) : Reflect.get(tag$1, prop, tag$1),
-		has: (target, prop) => Reflect.has(overrides, prop) || Reflect.has(target, prop) || Reflect.has(tag$1, prop)
-	});
-};
-
-//#endregion
-//#region lib/Util/FileLogger.js
-const fileLogger = Effect.fnUntraced(function* (...segments) {
-	const { dotAlchemy } = yield* AlchemyContext;
-	const fs = yield* FileSystem.FileSystem;
-	const path$1 = yield* Path;
-	const logFile = path$1.join(dotAlchemy, "log", ...segments);
-	yield* fs.makeDirectory(path$1.dirname(logFile), { recursive: true });
-	return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
-});
-
-//#endregion
-//#region lib/Stack.js
-const Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (stackName, options, eff) => {
-	if (!stackName) return (stackName$1) => Object.assign(stackRef(stackName$1).pipe(effectClass), {
-		stage: createStageProxy(stackName$1),
-		make: (options$1, eff$1) => Stack(stackName$1, options$1, eff$1)
-	});
-	return eff.pipe(make$1({
-		name: stackName,
-		...options
-	}), (eff$1) => Object.assign(eff$1, { stage: createStageProxy(stackName) }));
-}));
-const createStageProxy = (stackName) => new Proxy({}, { get: (_, stage$1) => stackRef(stackName, { stage: stage$1 }) });
-const StackName = Stack.use((stack) => Effect.succeed(stack.name));
-const make$1 = (options) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
-	if (options.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://v2.alchemy.run/concepts/state-store for available state stores.`));
-	if (options.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
-	return options.providers.pipe(Layer.provideMerge(options.state), Layer.provideMerge(Layer.effect(Stack, Stage.pipe(Effect.map((stage$1) => options.stack ?? {
-		name: options.name,
-		stage: stage$1,
-		resources: {},
-		bindings: {},
-		actions: {}
-	})))), Layer.buildWithScope(scope));
-}), Effect.flatMap((context) => Effect.all([
-	effect,
-	Stack,
-	Effect.context()
-]).pipe(Effect.map(([output, stack, services$1]) => ({
-	...stack,
-	output,
-	services: EffectContext.merge(services$1, context)
-})), Effect.provideContext(context))));
-const CurrentStack = Effect.serviceOption(Stack).pipe(Effect.map(Option.getOrUndefined));
-const platform = Layer.mergeAll(PlatformServices, FetchHttpClient.layer, Logger.layer([fileLogger("out")], { mergeWithExisting: true }), Layer.provide(ProfileLive, PlatformServices), Layer.provide(CredentialsStoreLive, PlatformServices));
-
 //#endregion
 //#region lib/Resource.js
 const isResource = (value) => {
@@ -515,6 +321,18 @@ const isResource = (value) => {
 //#endregion
 //#region lib/RuntimeContext.js
 /**
+* Canonicalize a logical key into a key that is safe to use as the name of an
+* environment variable / binding (`[a-zA-Z][a-zA-Z0-9_]*`).
+*
+* `RuntimeContext.set`/`get` are dumb key/value stores: they read and write the
+* key **verbatim**. It is the *caller's* responsibility to hand them a
+* canonical key, since the caller is the one that knows the logical key may
+* contain `.`/`-` (e.g. a dotted config name from `Platform`, or an
+* `Output.toString()` like `"QueueSinkQueue.queueUrl"`). Callers run the key
+* through this before calling `set`/`get` so both sides agree.
+*/
+const sanitizeKey = (key) => key.replaceAll(/[^a-zA-Z0-9]/g, "_");
+/**
 * Context of the runtime environment.
 *
 * E.g. the context of a running Worker, Task, Process, Function
@@ -522,6 +340,10 @@ const isResource = (value) => {
 var RuntimeContext = class extends EffectContext.Service()("RuntimeContext") {};
 const CurrentRuntimeContext = Effect.serviceOption(RuntimeContext).pipe(Effect.map(Option.getOrUndefined));
 
+//#endregion
+//#region lib/Stage.js
+var Stage = class extends EffectContext.Service()("Stage") {};
+
 //#endregion
 //#region lib/State/State.js
 const isActionState = (s) => !!s && s.kind === "action";
@@ -556,7 +378,8 @@ var BaseExpr = class {
 		return this.bind(this.toString());
 	}
 	bind(id) {
-		return RuntimeContext.pipe(Effect.flatMap((ctx) => Effect.map(ctx.set(id, this), (key) => ctx.get(key))));
+		const key = sanitizeKey(id);
+		return RuntimeContext.pipe(Effect.flatMap((ctx) => Effect.map(ctx.set(key, this), (k) => ctx.get(k))));
 	}
 	pipe(...fns) {
 		return pipe(this, ...fns);
@@ -805,6 +628,7 @@ const evaluate = (expr, upstream$1) => Effect.gen(function* () {
 	}
 	if (Array.isArray(expr)) return yield* Effect.all(expr.map((item) => evaluate(item, upstream$1)));
 	else if (Redacted.isRedacted(expr)) return expr;
+	else if (Duration.isDuration(expr)) return expr;
 	else if (typeof expr === "object" && expr !== null) return Object.fromEntries(yield* Effect.all(Object.entries(expr).map(([key, value]) => evaluate(value, upstream$1).pipe(Effect.map((value$1) => [key, value$1])))));
 	return expr;
 });
@@ -839,6 +663,282 @@ const toObject = (acc, v) => ({
 	...v
 });
 
+//#endregion
+//#region lib/Util/ConfigProvider.js
+const loadConfigProvider = (envFile$1) => {
+	if (Option.isSome(envFile$1)) return ConfigProvider.fromDotEnv({ path: envFile$1.value }).pipe(Effect.map((dotEnv) => ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv())));
+	return Effect.gen(function* () {
+		if (!(yield* (yield* FileSystem.FileSystem).exists(".env"))) return ConfigProvider.fromEnv();
+		return ConfigProvider.orElse(yield* ConfigProvider.fromDotEnv({ path: ".env" }), ConfigProvider.fromEnv());
+	});
+};
+
+//#endregion
+//#region lib/Util/effect.js
+const effectClass = ((impl) => impl === void 0 ? (innerImpl) => effectClass(innerImpl) : Object.assign(class {
+	static asEffect() {
+		return impl;
+	}
+	static [Symbol.iterator]() {
+		return new SingleShotGen(this.asEffect());
+	}
+	static pipe(...fns) {
+		return pipeArguments(this, fns);
+	}
+}, impl));
+const taggedFunction = (tag$1, fn) => {
+	const overrides = {
+		asEffect: () => tag$1,
+		[Symbol.iterator]: () => tag$1[Symbol.iterator](),
+		pipe: (...fns) => pipeArguments(tag$1, fns),
+		toString: () => `${tag$1.toString()}.${fn.name}`
+	};
+	return new Proxy(fn, {
+		get: (target, prop, receiver) => Reflect.has(overrides, prop) ? Reflect.get(overrides, prop, receiver) : Reflect.has(target, prop) ? Reflect.get(target, prop, receiver) : Reflect.get(tag$1, prop, tag$1),
+		has: (target, prop) => Reflect.has(overrides, prop) || Reflect.has(target, prop) || Reflect.has(tag$1, prop)
+	});
+};
+
+//#endregion
+//#region lib/Util/FileLogger.js
+const fileLogger = Effect.fnUntraced(function* (...segments) {
+	const { dotAlchemy } = yield* AlchemyContext;
+	const fs = yield* FileSystem.FileSystem;
+	const path$1 = yield* Path;
+	const logFile = path$1.join(dotAlchemy, "log", ...segments);
+	yield* fs.makeDirectory(path$1.dirname(logFile), { recursive: true });
+	return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
+});
+
+//#endregion
+//#region lib/Util/PlatformServices.js
+const isBun = typeof Bun !== "undefined";
+/**
+* Constructs a layer with different implementations for Bun and Node.
+*/
+const platformLayer = (constructors) => Layer.unwrap(Effect.promise(async () => {
+	if (isBun) return await constructors.bun();
+	else return await constructors.node();
+}));
+const PlatformServices = platformLayer({
+	bun: async () => {
+		const [BunServices, BunSocket] = await Promise.all([import("@effect/platform-bun/BunServices"), import("@effect/platform-bun/BunSocket")]);
+		return Layer.merge(BunServices.layer, BunSocket.layerWebSocketConstructor);
+	},
+	node: async () => {
+		const [NodeServices, NodeSocket] = await Promise.all([import("@effect/platform-node/NodeServices"), import("@effect/platform-node/NodeSocket")]);
+		return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
+	}
+});
+const runMain = (effect, options) => {
+	if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options));
+	else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options));
+};
+
+//#endregion
+//#region lib/Stack.js
+const Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (stackName, options, eff) => {
+	if (!stackName) return (stackName$1) => Object.assign(stackRef(stackName$1).pipe(effectClass), {
+		stage: createStageProxy(stackName$1),
+		make: (options$1, eff$1) => Stack(stackName$1, options$1, eff$1)
+	});
+	return eff.pipe(make$2({
+		name: stackName,
+		...options
+	}), (eff$1) => Object.assign(eff$1, { stage: createStageProxy(stackName) }));
+}));
+const createStageProxy = (stackName) => new Proxy({}, { get: (_, stage$1) => stackRef(stackName, { stage: stage$1 }) });
+const StackName = Stack.use((stack) => Effect.succeed(stack.name));
+const make$2 = (options) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
+	if (options.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://v2.alchemy.run/concepts/state-store for available state stores.`));
+	if (options.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
+	return options.providers.pipe(Layer.provideMerge(options.state), Layer.provideMerge(Layer.effect(Stack, Stage.pipe(Effect.map((stage$1) => options.stack ?? {
+		name: options.name,
+		stage: stage$1,
+		resources: {},
+		bindings: {},
+		actions: {}
+	})))), Layer.buildWithScope(scope));
+}), Effect.flatMap((context) => Effect.all([
+	effect,
+	Stack,
+	Effect.context()
+]).pipe(Effect.map(([output, stack, services$1]) => ({
+	...stack,
+	output,
+	services: EffectContext.merge(services$1, context)
+})), Effect.provideContext(context))));
+const CurrentStack = Effect.serviceOption(Stack).pipe(Effect.map(Option.getOrUndefined));
+const platform = Layer.mergeAll(PlatformServices, FetchHttpClient.layer, Logger.layer([fileLogger("out")], { mergeWithExisting: true }), Layer.provide(ProfileLive, PlatformServices), Layer.provide(CredentialsStoreLive, PlatformServices));
+
+//#endregion
+//#region lib/Local/RpcSerialization.js
+const unwrapRpcHandlers = (handlers, streamKeys) => {
+	return Object.fromEntries(Object.entries(handlers).map(([key, value]) => [key, typeof value === "function" ? streamKeys?.includes(key) ? unwrapRpcStreamHandler(value) : unwrapRpcEffectHandler(value) : typeof value === "object" && value !== null ? unwrapRpcHandlers(value) : value]));
+};
+const serializeError = Schema.encodeSync(Schema.Defect);
+const unwrapRpcEffectHandler = (handler) => flow((...args) => serializeRpcArgs(args), (args) => Effect.promise(() => handler(args)), Effect.flatMap((exit) => {
+	if (exit._tag === "Success") return Exit.succeed(exit.value);
+	return Exit.failCause(Cause.fromReasons(exit.cause.map((reason) => {
+		switch (reason._tag) {
+			case "Fail": return Cause.makeFailReason(reason.error);
+			case "Die": return Cause.makeDieReason(reason.defect);
+			case "Interrupt": return Cause.makeInterruptReason(reason.fiberId);
+		}
+	})));
+}));
+const unwrapRpcStreamHandler = (handler) => flow((...args) => serializeRpcArgs(args), (args) => handler(args), (stream) => Stream.fromReadableStream({
+	evaluate: () => stream,
+	onError: (error) => error
+}));
+const serializeRpcArgs = (value) => {
+	if (Redacted.isRedacted(value)) return {
+		_tag: "Redacted",
+		value: Redacted.value(value)
+	};
+	if (isOutput(value)) return {
+		_tag: "Output",
+		description: NodeUtil.inspect(value)
+	};
+	if (typeof value === "function") return null;
+	if (Array.isArray(value)) return value.map(serializeRpcArgs);
+	if (value && typeof value === "object" && !("toJSON" in value)) return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, serializeRpcArgs(child)]));
+	return value;
+};
+
+//#endregion
+//#region lib/Local/RpcProviderProxy.js
+var RpcProviderProxy = class extends EffectContext.Service()("alchemy/Local/RpcProviderProxy") {};
+const SPAWNER_URL_ENV_KEY = "ALCHEMY_RPC_SPAWNER_URL";
+const make$1 = Effect.fnUntraced(function* (spawnerUrl) {
+	const client = yield* HttpClient.HttpClient;
+	const getSession = Effect.fnUntraced(function* (serverEntryUrl) {
+		const alchemyContext = yield* AlchemyContext;
+		const stack = yield* Stack;
+		const payload = {
+			serverEntryUrl,
+			alchemyContext,
+			stack: {
+				name: stack.name,
+				stage: stack.stage
+			}
+		};
+		return newWebSocketRpcSession(yield* (yield* client.post(spawnerUrl, { body: yield* HttpBody.json(payload) })).text);
+	}, (effect, serverEntryUrl) => Effect.catch(effect, (error) => Effect.die(new Error(`Failed to create provider RPC session for "${serverEntryUrl}"`, { cause: error }))));
+	const cache = yield* Cache.make({
+		lookup: getSession,
+		capacity: Infinity,
+		requireServicesAt: "lookup"
+	});
+	return RpcProviderProxy.of({ get: Effect.fnUntraced(function* (mainUrl, providerName) {
+		const session = yield* cache.lookup(mainUrl);
+		return unwrapRpcHandlers(yield* Effect.promise(() => session.getProvider(providerName)), ["tail"]);
+	}) });
+});
+const fromEnv = () => Layer.effect(RpcProviderProxy, Config.string(SPAWNER_URL_ENV_KEY).pipe(Effect.flatMap(make$1)));
+
+//#endregion
+//#region lib/AdoptPolicy.js
+/**
+* AdoptPolicy controls whether the engine should "adopt" pre-existing cloud
+* resources that conflict with this stack instead of failing.
+*
+* The engine always calls a provider's `read` lifecycle operation when there
+* is no prior state and `read` is implemented. The provider's job is to
+* report two things:
+*
+*   1. Whether the resource exists (returns attributes vs. `undefined`).
+*   2. Whether *we* own it (plain attributes vs. {@link Unowned}-branded).
+*
+* The engine then routes:
+*
+*   | `read` outcome      | `adopt: false` | `adopt: true`     |
+*   | ------------------- | -------------- | ----------------- |
+*   | undefined           | create         | create            |
+*   | owned (plain attrs) | silent adopt   | silent adopt      |
+*   | {@link Unowned}     | fail           | takeover (adopt)  |
+*
+* "Owned" means a provider has affirmatively determined the resource was
+* created by this stack/stage/logical-id (typically by inspecting tags or
+* naming conventions). Resources without ownership semantics simply always
+* return plain attrs — they are treated as owned by default, so silent
+* adoption is the norm and `--adopt` is unnecessary.
+*
+* The policy can be overridden per-effect via {@link adopt} — most commonly
+* applied at the resource or stack scope.
+*/
+var AdoptPolicy = class extends EffectContext.Service()("AdoptPolicy") {};
+/**
+* Engine-raised failure produced when `read` reports an existing resource
+* marked as {@link Unowned} and `adopt` is `false`. Surface this to the user
+* to indicate they should either re-tag the cloud resource, pick a different
+* physical name, or re-run with `--adopt` (or `adopt(true)`) to force a
+* takeover.
+*/
+var OwnedBySomeoneElse = class extends Data.TaggedError("OwnedBySomeoneElse") {};
+/**
+* Private symbol used to brand attribute objects returned by `read` as
+* "exists in cloud, but not owned by this stack/stage/logical-id".
+*
+* Deliberately *not* registered via `Symbol.for` — the brand is an
+* engine-internal routing hint and must not be observable or
+* forgeable from outside this module. The engine strips it before any
+* state persistence (see {@link stripUnowned}) so it never leaks into
+* the state store, JSON serialization, or downstream `Output`s.
+*/
+const UnownedTag = Symbol("alchemy/Unowned");
+/**
+* Brand a `read` return value as belonging to a different owner.
+*
+* Use this in a provider's `read` implementation when the resource exists in
+* the cloud but a positive ownership check (e.g. tag inspection) shows it
+* was *not* created by this stack/stage/logical-id:
+*
+* ```ts
+* read: Effect.fnUntraced(function* ({ id, output, olds }) {
+*   const settings = yield* getScriptSettings({ ... }).pipe(
+*     Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
+*   );
+*   if (!settings) return undefined;
+*
+*   const attrs = { workerName, ...buildAttrs(settings) };
+*   return hasAlchemyWorkerTags(id, settings.tags) ? attrs : Unowned(attrs);
+* }),
+* ```
+*
+* The returned value is structurally still `T` — there is no wrapper to
+* unwrap. The brand is a non-enumerable symbol that the engine inspects
+* during planning to decide whether to take over (`adopt: true`) or fail
+* loudly (`adopt: false`).
+*
+* Resources without ownership semantics should simply return plain attrs —
+* the engine treats them as owned and silent adoption is the default.
+*/
+const Unowned = Object.assign((attrs) => {
+	const cloned = { ...attrs };
+	Object.defineProperty(cloned, UnownedTag, {
+		value: true,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return cloned;
+}, { is: (value) => typeof value === "object" && value !== null && value[UnownedTag] === true });
+/**
+* Strip the {@link Unowned} brand from an attributes object before persisting
+* it — state should not carry per-deploy ownership-routing metadata.
+*
+* The brand is intentionally non-enumerable, so a plain spread already
+* drops it; the additional `delete` is defense-in-depth in case a future
+* change makes the descriptor enumerable. Always returns a fresh object
+* (never mutates the input).
+*/
+const stripUnowned = (attrs) => {
+	const out = { ...attrs };
+	if (UnownedTag in out) delete out[UnownedTag];
+	return out;
+};
+
 //#endregion
 //#region lib/Diff.js
 const isResolved = (value) => !_hasUnresolved(value);
@@ -856,6 +956,17 @@ const canonicalize = (value, stripNullish) => {
 	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).filter(([, nested]) => !stripNullish || nested != null).sort(([a], [b]) => a.localeCompare(b)).map(([key, nested]) => [key, canonicalize(nested, stripNullish)]));
 	return value;
 };
+/**
+* Collapse bindings that share the same `sid`, keeping the last occurrence.
+*
+* The same binding can be recorded more than once on a target resource — e.g.
+* a KV namespace bound to both a Worker and a Workflow ends up pushed twice to
+* `stack.bindings[fqn]`. `diffBindings` already collapses these implicitly via
+* its `Map` keyed by `sid`, so the `reconcile` path never observes duplicates.
+* Use this helper to give a provider's `diff` handler the same de-duplicated
+* binding set, keeping plan-time hashing consistent with deploy-time.
+*/
+const dedupeBindings = (bindings) => Array.from(new Map(bindings.map((b) => [b.sid, b])).values());
 const diffBindings = (oldBindings, newBindings) => {
 	const oldMap = new Map(oldBindings.map((b) => [b.sid, b]));
 	const newMap = new Map(newBindings.map((b) => [b.sid, b]));
@@ -888,7 +999,7 @@ const generateInstanceId = () => Effect.sync(() => {
 
 //#endregion
 //#region lib/Util/types.js
-const asEffect = (effect) => Effect.isEffect(effect) ? effect : Effect.succeed(effect);
+const asEffect = (effect) => typeof effect?.asEffect === "function" ? effect.asEffect() : Effect.isEffect(effect) ? effect : Effect.succeed(effect);
 
 //#endregion
 //#region lib/Telemetry/Metrics.js
@@ -1096,7 +1207,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 			if (!oldState || oldState.status === "creating") return resourceExpr;
 			const oldProps = oldState.status === "updating" ? oldState.old.props : oldState.props;
 			const oldBindings = oldState.bindings ?? [];
-			const newBindings = stack.bindings[resource.FQN] ?? [];
+			const newBindings = dedupeBindings(stack.bindings[resource.FQN] ?? []);
 			const diff = yield* provider.diff ? provider.diff({
 				id: resource.LogicalId,
 				olds: oldProps,
@@ -1120,6 +1231,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 		if (!input) return input;
 		else if (isExpr(input)) return yield* resolveOutput(input);
 		else if (Redacted.isRedacted(input)) return input;
+		else if (Duration.isDuration(input)) return input;
 		else if (Array.isArray(input)) return yield* Effect.all(input.map(resolveInput), { concurrency: "unbounded" });
 		else if (isResource(input)) return yield* resolveInput(yield* resolveOutput(of(input)));
 		else if (typeof input === "object") return Object.fromEntries(yield* Effect.all(Object.entries(input).map(([key, value]) => resolveInput(value).pipe(Effect.map((value$1) => [key, value$1]))), { concurrency: "unbounded" }));
@@ -1212,7 +1324,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 		const fqn = resource.FQN;
 		const news = yield* resolveInput(resource.Props);
 		const downstream = newDownstreamDependencies[fqn] ?? [];
-		const newBindings = yield* resolveInput(stack.bindings[fqn] ?? []);
+		const newBindings = dedupeBindings(yield* resolveInput(stack.bindings[fqn] ?? []));
 		const persisted = yield* state.get({
 			stack: stackName,
 			stage: stage$1,
@@ -1621,7 +1733,7 @@ const executePlan = Effect.fnUntraced(function* (plan, tracker, terminalStatuses
 	const ready = Object.fromEntries(yield* Effect.all(Object.keys(allNodes).map((fqn) => Effect.map(Deferred.make(), (d) => [fqn, d]))));
 	const readyStable = Object.fromEntries(yield* Effect.all(Object.keys(allNodes).map((fqn) => Effect.map(Deferred.make(), (d) => [fqn, d]))));
 	const getOutputs = () => Object.fromEntries(Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]));
-	const waitForDeps = (fqns) => Effect.all(fqns.filter((fqn) => fqn in ready).map((fqn) => Deferred.await(ready[fqn])), { concurrency: "unbounded" });
+	const waitForDeps = (fqns) => Effect.all(fqns.filter((fqn) => fqn in ready).map((fqn) => plan.cycleMembers.has(fqn) ? Deferred.await(ready[fqn]) : Deferred.await(readyStable[fqn])), { concurrency: "unbounded" });
 	const waitForStableDeps = (fqns) => Effect.all(fqns.filter((fqn) => fqn in readyStable).map((fqn) => Deferred.await(readyStable[fqn])), { concurrency: "unbounded" });
 	const failures = [];
 	yield* Effect.all(Object.entries(allNodes).map(([fqn, node]) => node.kind === "action" ? executeActionNode(fqn, node, tracker, ready, readyStable, terminalStatuses, session, state, stackName, stage$1, getOutputs, waitForStableDeps, failures) : executeNode(fqn, node, tracker, ready, readyStable, terminalStatuses, session, state, stackName, stage$1, getOutputs, waitForDeps, failures, plan.cycleMembers.has(fqn))), { concurrency: "unbounded" });
@@ -2420,7 +2532,7 @@ var __rewriteRelativeImportExtension = void 0 && (void 0).__rewriteRelativeImpor
 };
 const USER = Config.string("USER").pipe(Config.orElse(() => Config.string("USERNAME")), Config.withDefault("unknown"));
 const STAGE = Config.string("stage").pipe(Config.option, (a) => a, Effect.map(Option.getOrUndefined));
-const stage = Flag.string("stage").pipe(Flag.withSchema(S.String.check(S.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))), Flag.withDescription("Stage to deploy to, defaults to dev_${USER}"), Flag.optional, Flag.map(Option.getOrUndefined), Flag.mapEffect(Effect.fn(function* (stage$1) {
+const stage = Flag.string("stage").pipe(Flag.withSchema(Schema.String.check(Schema.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))), Flag.withDescription("Stage to deploy to, defaults to dev_${USER}"), Flag.optional, Flag.map(Option.getOrUndefined), Flag.mapEffect(Effect.fn(function* (stage$1) {
 	if (stage$1) return stage$1;
 	return yield* STAGE.pipe(Effect.catch(() => Effect.fail(new CliError.MissingOption({ option: "stage" }))), Effect.flatMap((s) => s === void 0 ? USER.pipe(Effect.map((user) => `dev_${user}`), Effect.catch(() => Effect.succeed("unknown"))) : Effect.succeed(s)));
 })));
@@ -2451,26 +2563,55 @@ const resourceFilter = Flag.string("filter").pipe(Flag.withDescription("Comma-se
 * ```
 */
 const instrumentCommand = (command, attrs) => (handler) => (args) => handler(args).pipe(Effect.withSpan(`cli.${command}`, { attributes: attrs ? attrs(args) : {} }), recordCli(command));
+/**
+* Render a profile's stored credential entries the same way across
+* `alchemy login` and `alchemy profile show`: one `── Provider ──`
+* header per entry, then either the provider's own `prettyPrint` block
+* (preferred) or a JSON-style fallback when the provider isn't
+* registered in the supplied {@link AuthProviders} registry.
+*/
+const printProfile = Effect.fn(function* (profile$1, stored, registry) {
+	yield* Console.log(`Profile: ${profile$1}`);
+	const names = Object.keys(stored).sort();
+	if (names.length === 0) {
+		yield* Console.log("(no providers configured)");
+		return;
+	}
+	for (const name of names) {
+		const cfg = stored[name];
+		yield* Console.log("");
+		yield* Console.log(`── ${name} ──`);
+		const provider = registry[name];
+		if (provider == null) {
+			yield* Console.log(`  method: ${cfg.method}`);
+			const { method: _method,...rest } = cfg;
+			for (const [k, v] of Object.entries(rest)) yield* Console.log(`  ${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`);
+			continue;
+		}
+		yield* provider.prettyPrint(profile$1, cfg);
+	}
+});
 const importStack = Effect.fn(function* (main) {
 	const path$1 = yield* Path$1.Path;
-	const stackEffect = (yield* Effect.promise(() => import(__rewriteRelativeImportExtension(path$1.resolve(process.cwd(), main))))).default;
+	const url = import.meta.resolve(path$1.resolve(main));
+	const stackEffect = (yield* Effect.promise(() => import(__rewriteRelativeImportExtension(url)))).default;
 	if (!Effect.isEffect(stackEffect)) return yield* Effect.die(/* @__PURE__ */ new Error(`Main file '${main}' must export a default stack definition (export default Alchemy.Stack({...}))`));
 	return stackEffect;
 });
 
 //#endregion
 //#region lib/Cli/commands/deploy.js
-const ExecStackOptions = S.Struct({
-	main: S.String,
-	stage: S.String,
-	envFile: S.OptionFromOptional(S.String),
-	profile: S.optional(S.String),
-	dryRun: S.optional(S.Boolean),
-	force: S.optional(S.Boolean),
-	yes: S.optional(S.Boolean),
-	destroy: S.optional(S.Boolean),
-	dev: S.optional(S.Boolean),
-	adopt: S.optional(S.Boolean)
+const ExecStackOptions = Schema.Struct({
+	main: Schema.String,
+	stage: Schema.String,
+	envFile: Schema.OptionFromOptional(Schema.String),
+	profile: Schema.optional(Schema.String),
+	dryRun: Schema.optional(Schema.Boolean),
+	force: Schema.optional(Schema.Boolean),
+	yes: Schema.optional(Schema.Boolean),
+	destroy: Schema.optional(Schema.Boolean),
+	dev: Schema.optional(Schema.Boolean),
+	adopt: Schema.optional(Schema.Boolean)
 });
 const stackSpanAttrs = (args) => ({
 	"alchemy.stage": args.stage,
@@ -3341,8 +3482,8 @@ const selectCli = () => isNonInteractive() ? LoggingCli : inkCLI();
 
 //#endregion
 //#region lib/Cli/exec.js
-const services = Layer.mergeAll(Layer.provideMerge(AlchemyContextLive, PlatformServices), Layer.provide(ProfileLive, PlatformServices), Layer.provide(CredentialsStoreLive, PlatformServices), FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()), selectCli());
-const exec = () => execStack(S.decodeSync(ExecStackOptions)(JSON.parse(process.env.ALCHEMY_EXEC_OPTIONS))).pipe(Effect.provide(services), Effect.scoped);
+const services = Layer.merge(selectCli(), fromEnv()).pipe(Layer.provideMerge(Layer.mergeAll(AlchemyContextLive, ProfileLive, CredentialsStoreLive)), Layer.provideMerge(Layer.mergeAll(PlatformServices, FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()))));
+const exec = () => execStack(Schema.decodeSync(ExecStackOptions)(JSON.parse(process.env.ALCHEMY_EXEC_OPTIONS))).pipe(Effect.provide(services), Effect.scoped);
 
 //#endregion
 //#region bin/exec.ts