alchemy 2.0.0-beta.61 → 2.0.0-beta.63

package/bin/exec.js

@@ -8,10 +8,14 @@ import * as FileSystem from "effect/FileSystem";
 import * as Path$1 from "effect/Path";
 import { Path } from "effect/Path";
 import * as Redacted from "effect/Redacted";
+import * as path$1 from "pathe";
 import path from "pathe";
 import * as Config from "effect/Config";
+import * as NodeOs from "node:os";
 import os from "node:os";
 import * as Semaphore from "effect/Semaphore";
+import { lock } from "@alchemy.run/node-utils/lockfile";
+import * as fs from "node:fs/promises";
 import { newWebSocketRpcSession } from "capnweb";
 import * as Cache from "effect/Cache";
 import * as HttpBody from "effect/unstable/http/HttpBody";
@@ -27,6 +31,7 @@ import { SingleShotGen } from "effect/Utils";
 import * as Effectable from "effect/Effectable";
 import "effect/Predicate";
 import "effect/Record";
+import http from "node:http";
 import * as Cause from "effect/Cause";
 import * as Exit from "effect/Exit";
 import * as Stream from "effect/Stream";
@@ -38,6 +43,22 @@ import * as Metric from "effect/Metric";
 import * as Argument from "effect/unstable/cli/Argument";
 import * as CliError from "effect/unstable/cli/CliError";
 import { pathToFileURL } from "node:url";
+import * as DistilledAuth from "@distilled.cloud/aws/Auth";
+import { Credentials } from "@distilled.cloud/aws/Credentials";
+import * as STS from "@distilled.cloud/aws/sts";
+import * as Match from "effect/Match";
+import { ChildProcess } from "effect/unstable/process";
+import * as NodeCrypto from "node:crypto";
+import crypto$1 from "node:crypto";
+import * as p from "@clack/prompts";
+import * as Region from "@distilled.cloud/aws/Region";
+import { DEFAULT_API_BASE_URL } from "@distilled.cloud/axiom/Credentials";
+import * as cfAccounts from "@distilled.cloud/cloudflare/accounts";
+import * as CfCredentialsModule from "@distilled.cloud/cloudflare/Credentials";
+import * as ChildProcess$1 from "effect/unstable/process/ChildProcess";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import * as PsCredentialsModule from "@distilled.cloud/planetscale/Credentials";
+import { listOrganizations } from "@distilled.cloud/planetscale/Operations";
 import { jsx, jsxs } from "react/jsx-runtime";
 import { Box, Text, render, useApp, useInput } from "ink";
 import { useEffect, useMemo, useRef, useState } from "react";
@@ -63,9 +84,9 @@ var AlchemyContext, AlchemyContextLive;
 var init_AlchemyContext = __esm({ "lib/AlchemyContext.js": (() => {
 	AlchemyContext = class extends EffectContext.Service()("alchemy/Context") {};
 	AlchemyContextLive = Layer.effect(AlchemyContext, Effect.gen(function* () {
-		const fs = yield* FileSystem.FileSystem;
+		const fs$1 = yield* FileSystem.FileSystem;
 		const dir = (yield* Path$1.Path).join(process.cwd(), ".alchemy");
-		yield* fs.makeDirectory(dir, { recursive: true });
+		yield* fs$1.makeDirectory(dir, { recursive: true });
 		return {
 			dotAlchemy: dir,
 			updateStateStore: false,
@@ -90,16 +111,90 @@ var init_interactive = __esm({ "lib/Util/interactive.js": (() => {
 	};
 }) });
 
+//#endregion
+//#region lib/Auth/Lock.js
+var sanitizeLockKey, UNLOCKABLE_FS_CODES, withLock;
+var init_Lock = __esm({ "lib/Auth/Lock.js": (() => {
+	init_Profile();
+	sanitizeLockKey = (key) => key.replace(/[^A-Za-z0-9._-]/g, "_");
+	UNLOCKABLE_FS_CODES = new Set([
+		"EROFS",
+		"EACCES",
+		"EPERM",
+		"ENOSPC"
+	]);
+	withLock = (key, effect) => {
+		const lockDir = path$1.join(rootDir, "lock");
+		const lockPath = path$1.join(lockDir, `${sanitizeLockKey(key)}.lock`);
+		return Effect.acquireUseRelease(Effect.promise(async () => {
+			try {
+				await fs.mkdir(lockDir, { recursive: true });
+				return await lock(lockPath, {
+					retries: {
+						retries: 2400,
+						minTimeout: 50,
+						maxTimeout: 50
+					},
+					stale: 3e4,
+					realpath: false,
+					onCompromised: (err) => {
+						console.warn(`auth lock compromised (continuing): ${err.message}`);
+					}
+				});
+			} catch (err) {
+				const code = err.code;
+				if (code !== void 0 && UNLOCKABLE_FS_CODES.has(code)) {
+					console.warn(`auth lock unavailable (${code} at '${lockPath}') — continuing without cross-process locking`);
+					return async () => {};
+				}
+				if (err instanceof Error && err.message.includes("already being held")) throw new Error(`Timed out waiting for the alchemy auth lock '${lockPath}' — another alchemy process has held it for over 120s. If no other alchemy process is running, delete the lock file and retry.`, { cause: err });
+				throw err;
+			}
+		}), () => effect, (release) => Effect.promise(() => release().catch(() => {})));
+	};
+}) });
+
 //#endregion
 //#region lib/Auth/AuthProvider.js
-var interactiveMutex, AuthError, AuthProviders;
+var AUTH_LANDING_HOST, AUTH_SUCCESS_URL, AUTH_ERROR_URL, LOCKED_METHODS, INTERACTIVE_METHODS, interactiveMutex, AuthError, AuthProviders, AuthProvider, AuthProviderLayer, getAuthProvider;
 var init_AuthProvider = __esm({ "lib/Auth/AuthProvider.js": (() => {
+	init_Lock();
+	AUTH_LANDING_HOST = "https://alchemy.run";
+	AUTH_SUCCESS_URL = `${AUTH_LANDING_HOST}/auth/success`;
+	AUTH_ERROR_URL = `${AUTH_LANDING_HOST}/auth/error`;
+	LOCKED_METHODS = new Set([
+		"read",
+		"login",
+		"logout",
+		"configure"
+	]);
+	INTERACTIVE_METHODS = new Set(["login", "configure"]);
 	interactiveMutex = Semaphore.makeUnsafe(1);
 	AuthError = class extends Schema.TaggedErrorClass()("AuthError", {
 		message: Schema.String,
 		cause: Schema.optional(Schema.Defect())
 	}) {};
 	AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
+	AuthProvider = () => (name, impl) => Effect.gen(function* () {
+		const ctx = yield* Effect.context();
+		const providers = yield* AuthProviders;
+		const service = yield* Effect.isEffect(impl) ? impl : Effect.succeed(impl);
+		return yield* Effect.sync(() => providers[name] = {
+			kind: "AuthProvider",
+			name,
+			...Object.fromEntries(Object.entries(service).map(([methodName, fn]) => [methodName, (...args) => {
+				let eff = fn(...args).pipe(Effect.provideContext(ctx));
+				if (LOCKED_METHODS.has(methodName)) {
+					const profileName = args[0];
+					eff = withLock(`${profileName}-${name}`, eff);
+				}
+				if (INTERACTIVE_METHODS.has(methodName)) eff = Semaphore.withPermits(interactiveMutex, 1)(eff);
+				return eff;
+			}]))
+		});
+	});
+	AuthProviderLayer = () => (name, impl) => Layer.effectDiscard(AuthProvider()(name, impl));
+	getAuthProvider = (name) => AuthProviders.use((registry) => registry[name] == null ? Effect.fail(new AuthError({ message: `AuthProvider '${name}' is not registered. Make sure its layer has been provided.` })) : Effect.succeed(registry[name]));
 }) });
 
 //#endregion
@@ -118,8 +213,8 @@ var init_Profile = __esm({ "lib/Auth/Profile.js": (() => {
 	});
 	AlchemyProfile = class extends EffectContext.Service()("Alchemy::Profile") {};
 	ProfileLive = Layer.effect(AlchemyProfile, Effect.gen(function* () {
-		const fs = yield* FileSystem.FileSystem;
-		const readConfig = fs.readFileString(configFilePath).pipe(Effect.flatMap((data) => Effect.try({
+		const fs$1 = yield* FileSystem.FileSystem;
+		const readConfig = fs$1.readFileString(configFilePath).pipe(Effect.flatMap((data) => Effect.try({
 			try: () => {
 				const parsed = JSON.parse(data);
 				if (parsed?.version !== CONFIG_VERSION) return emptyConfig();
@@ -127,7 +222,7 @@ var init_Profile = __esm({ "lib/Auth/Profile.js": (() => {
 			},
 			catch: emptyConfig
 		})), Effect.orElseSucceed(emptyConfig));
-		const writeConfig = (config) => fs.makeDirectory(path.dirname(configFilePath), { recursive: true }).pipe(Effect.flatMap(() => fs.writeFileString(configFilePath, JSON.stringify(config, null, 2))));
+		const writeConfig = (config) => fs$1.makeDirectory(path.dirname(configFilePath), { recursive: true }).pipe(Effect.flatMap(() => fs$1.writeFileString(configFilePath, JSON.stringify(config, null, 2))));
 		const getProfile = (name) => readConfig.pipe(Effect.map((config) => config.profiles[name]));
 		const setProfile = (name, profile$1) => readConfig.pipe(Effect.tap((config) => Effect.sync(() => config.profiles[name] = profile$1)), Effect.flatMap(writeConfig));
 		const deleteProfile = (name) => readConfig.pipe(Effect.flatMap((config) => {
@@ -153,16 +248,21 @@ var init_Profile = __esm({ "lib/Auth/Profile.js": (() => {
 			loadOrConfigure
 		};
 	}));
-	withProfileOverride = (base, profile$1) => {
-		if (profile$1 === void 0) return base;
+	withProfileOverride = (base$1, profile$1) => {
+		if (profile$1 === void 0) return base$1;
 		const overrides = { ALCHEMY_PROFILE: profile$1 };
-		const overrideProvider = ConfigProvider.make((path$1) => Effect.succeed(path$1.length === 1 && typeof path$1[0] === "string" && path$1[0] in overrides ? ConfigProvider.makeValue(overrides[path$1[0]]) : void 0));
-		return ConfigProvider.orElse(base)(overrideProvider);
+		const overrideProvider = ConfigProvider.make((path$2) => Effect.succeed(path$2.length === 1 && typeof path$2[0] === "string" && path$2[0] in overrides ? ConfigProvider.makeValue(overrides[path$2[0]]) : void 0));
+		return ConfigProvider.orElse(base$1)(overrideProvider);
 	};
 }) });
 
 //#endregion
 //#region lib/Auth/Credentials.js
+function displayRedacted(r, visibleChars = 4) {
+	const raw = Redacted.value(r);
+	if (raw.length <= visibleChars) return "****";
+	return `${raw.slice(0, visibleChars)}****`;
+}
 var credentialsDirPath, profileCredentialsDirPath, credentialsFilePath, CredentialsStore, CredentialsStoreLive;
 var init_Credentials = __esm({ "lib/Auth/Credentials.js": (() => {
 	init_Profile();
@@ -171,8 +271,8 @@ var init_Credentials = __esm({ "lib/Auth/Credentials.js": (() => {
 	credentialsFilePath = (profile$1, provider) => path.join(profileCredentialsDirPath(profile$1), `${provider}.json`);
 	CredentialsStore = class extends EffectContext.Service()("Alchemy::CredentialsStore") {};
 	CredentialsStoreLive = Layer.effect(CredentialsStore, Effect.gen(function* () {
-		const fs = yield* FileSystem.FileSystem;
-		const read = (profile$1, provider) => fs.readFileString(credentialsFilePath(profile$1, provider)).pipe(Effect.catch(() => Effect.succeed(void 0)), Effect.map((data) => {
+		const fs$1 = yield* FileSystem.FileSystem;
+		const read = (profile$1, provider) => fs$1.readFileString(credentialsFilePath(profile$1, provider)).pipe(Effect.catch(() => Effect.succeed(void 0)), Effect.map((data) => {
 			if (data === void 0) return void 0;
 			try {
 				return JSON.parse(data);
@@ -182,12 +282,12 @@ var init_Credentials = __esm({ "lib/Auth/Credentials.js": (() => {
 		}));
 		const write = (profile$1, provider, credentials) => {
 			const filePath = credentialsFilePath(profile$1, provider);
-			return fs.makeDirectory(path.dirname(filePath), { recursive: true }).pipe(Effect.flatMap(() => {
-				return fs.writeFileString(filePath, JSON.stringify(credentials, null, 2));
+			return fs$1.makeDirectory(path.dirname(filePath), { recursive: true }).pipe(Effect.flatMap(() => {
+				return fs$1.writeFileString(filePath, JSON.stringify(credentials, null, 2));
 			}));
 		};
-		const remove_ = (profile$1, provider) => fs.remove(credentialsFilePath(profile$1, provider)).pipe(Effect.catch(() => Effect.void));
-		const deleteProfile = (profile$1) => fs.remove(profileCredentialsDirPath(profile$1), { recursive: true }).pipe(Effect.catch(() => Effect.void));
+		const remove_ = (profile$1, provider) => fs$1.remove(credentialsFilePath(profile$1, provider)).pipe(Effect.catch(() => Effect.void));
+		const deleteProfile = (profile$1) => fs$1.remove(profileCredentialsDirPath(profile$1), { recursive: true }).pipe(Effect.catch(() => Effect.void));
 		return {
 			read,
 			write,
@@ -273,13 +373,13 @@ var init_FQN = __esm({ "lib/FQN.js": (() => {
 	FQN_SEPARATOR = "/";
 	toPath = (ns) => {
 		if (!ns) return [];
-		const path$1 = [];
+		const path$2 = [];
 		let current = ns;
 		while (current) {
-			path$1.unshift(current.Id);
+			path$2.unshift(current.Id);
 			current = current.Parent;
 		}
-		return path$1;
+		return path$2;
 	};
 	parseFqn = (fqn) => {
 		const parts = fqn.split(FQN_SEPARATOR);
@@ -384,7 +484,7 @@ function proxy(self) {
 	});
 	return proxy$1;
 }
-var inspect, of, asOutput, isOutput, ExprSymbol, exprKind, isExpr, BaseExpr, isResourceExpr, ResourceExpr, isPropExpr, PropExpr, isLiteralExpr, LiteralExpr, VoidExpr, isApplyExpr, ApplyExpr, isFlatMapExpr, FlatMapExpr, isEffectExpr, EffectExpr, isNamedExpr, NamedExpr, isAllExpr, AllExpr, isRefExpr, RefExpr, isStackRefExpr, StackRefExpr, stackRef, MissingSourceError, InvalidReferenceError, evaluate, hasOutputs, upstreamAny, upstream, resolveUpstream, toObject;
+var inspect, of$1, asOutput, isOutput, ExprSymbol, exprKind, isExpr, BaseExpr, isResourceExpr, ResourceExpr, isPropExpr, PropExpr, isLiteralExpr, LiteralExpr, VoidExpr, isApplyExpr, ApplyExpr, isFlatMapExpr, FlatMapExpr, isEffectExpr, EffectExpr, isNamedExpr, NamedExpr, isAllExpr, AllExpr, isRefExpr, RefExpr, isStackRefExpr, StackRefExpr, stackRef, MissingSourceError, InvalidReferenceError, evaluate, hasOutputs, upstreamAny, upstream, resolveUpstream, toObject;
 var init_Output = __esm({ "lib/Output.js": (() => {
 	init_Ref();
 	init_Resource();
@@ -394,7 +494,7 @@ var init_Output = __esm({ "lib/Output.js": (() => {
 	init_State();
 	init_data();
 	inspect = Symbol.for("nodejs.util.inspect.custom");
-	of = (resource) => {
+	of$1 = (resource) => {
 		if (isRef(resource)) {
 			const metadata = getRefMetadata(resource);
 			return new RefExpr(metadata.stack, metadata.stage, metadata.id, metadata.type !== void 0 ? { Type: metadata.type } : void 0);
@@ -579,7 +679,7 @@ var init_Output = __esm({ "lib/Output.js": (() => {
 			return `stackRef(${this.stack}${this.stage ? `, { stage: ${this.stage} }` : ""})`;
 		}
 	};
-	stackRef = (stack, options = {}) => Effect.succeed(new StackRefExpr(stack, options.stage));
+	stackRef = (stack, options$6 = {}) => Effect.succeed(new StackRefExpr(stack, options$6.stage));
 	MissingSourceError = class extends Data.TaggedError("MissingSourceError") {};
 	InvalidReferenceError = class extends Data.TaggedError("InvalidReferenceError") {};
 	evaluate = (expr, upstream$1) => Effect.gen(function* () {
@@ -717,10 +817,10 @@ var init_FileLogger = __esm({ "lib/Util/FileLogger.js": (() => {
 	init_AlchemyContext();
 	fileLogger = Effect.fn(function* (...segments) {
 		const { dotAlchemy } = yield* AlchemyContext;
-		const fs = yield* FileSystem.FileSystem;
-		const path$1 = yield* Path;
-		const logFile = path$1.join(dotAlchemy, "log", ...segments);
-		yield* fs.makeDirectory(path$1.dirname(logFile), { recursive: true });
+		const fs$1 = yield* FileSystem.FileSystem;
+		const path$2 = yield* Path;
+		const logFile = path$2.join(dotAlchemy, "log", ...segments);
+		yield* fs$1.makeDirectory(path$2.dirname(logFile), { recursive: true });
 		return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
 	});
 }) });
@@ -744,9 +844,9 @@ var init_PlatformServices = __esm({ "lib/Util/PlatformServices.js": (() => {
 			return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
 		}
 	});
-	runMain = (effect, options) => {
-		if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options));
-		else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options));
+	runMain = (effect, options$6) => {
+		if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options$6));
+		else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options$6));
 	};
 }) });
 
@@ -761,31 +861,31 @@ var init_Stack = __esm({ "lib/Stack.js": (() => {
 	init_effect();
 	init_FileLogger();
 	init_PlatformServices();
-	Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (stackName, options, eff) => {
+	Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (stackName, options$6, eff) => {
 		if (!stackName) return (stackName$1) => Object.assign(stackRef(stackName$1).pipe(effectClass), {
 			stackName: stackName$1,
 			stage: createStageProxy(stackName$1),
-			state: options?.state,
-			providers: options?.providers,
-			make: (options$1, eff$1) => Stack(stackName$1, options$1, eff$1)
+			state: options$6?.state,
+			providers: options$6?.providers,
+			make: (options$7, eff$1) => Stack(stackName$1, options$7, eff$1)
 		});
 		return eff.pipe(make$2({
 			name: stackName,
-			...options
+			...options$6
 		}), (eff$1) => Object.assign(eff$1, {
 			stackName,
 			stage: createStageProxy(stackName),
-			state: options?.state,
-			providers: options?.providers
+			state: options$6?.state,
+			providers: options$6?.providers
 		}));
 	}));
 	createStageProxy = (stackName) => new Proxy({}, { get: (_, stage$1) => stackRef(stackName, { stage: stage$1 }) });
 	StackName = Stack.use((stack) => Effect.succeed(stack.name));
-	make$2 = (options) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
-		if (options.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://v2.alchemy.run/state-store for available state stores.`));
-		if (options.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
-		return options.providers.pipe(Layer.provideMerge(options.state), Layer.provideMerge(Layer.effect(Stack, Stage.pipe(Effect.map((stage$1) => options.stack ?? {
-			name: options.name,
+	make$2 = (options$6) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
+		if (options$6.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options$6.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options$6.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://alchemy.run/state-store for available state stores.`));
+		if (options$6.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options$6.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options$6.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
+		return options$6.providers.pipe(Layer.provideMerge(options$6.state), Layer.provideMerge(Layer.effect(Stack, Stage.pipe(Effect.map((stage$1) => options$6.stack ?? {
+			name: options$6.name,
 			stage: stage$1,
 			resources: {},
 			bindings: {},
@@ -867,12 +967,50 @@ const make$1 = Effect.fn(function* (spawnerUrl) {
 		requireServicesAt: "lookup"
 	});
 	return RpcProviderProxy.of({ get: Effect.fn(function* (mainUrl, providerName) {
-		const session = yield* cache.lookup(mainUrl);
+		const session = yield* Cache.get(cache, mainUrl);
 		return unwrapRpcHandlers(yield* Effect.promise(() => session.getProvider(providerName)), ["tail"]);
 	}) });
 });
 const fromEnv = () => Layer.effect(RpcProviderProxy, Config.string(SPAWNER_URL_ENV_KEY).pipe(Effect.flatMap(make$1)));
 
+//#endregion
+//#region lib/ActionRuntimeContext.js
+/**
+* Runtime context bridge that lets an {@link Action} read Resource Outputs.
+*
+* Actions are peculiar: their init Effect runs at plan/stack-eval time (before
+* any resource exists) while their body runs at apply time (after upstreams are
+* materialized). To make `yield* db.databaseId` work inside an Action we split
+* the {@link RuntimeContext} into two cooperating halves that share nothing but
+* a sanitized key:
+*
+*  - {@link makeCaptureContext} is provided while the init Effect runs. Its
+*    `set(key, output)` records the referenced {@link Output} (so the engine can
+*    add a dependency edge and later resolve it) and its `get(key)` hands back a
+*    *deferred* accessor — an Effect that re-reads whatever `RuntimeContext` is
+*    ambient when it actually runs.
+*  - {@link makeResolveContext} is provided around the Action body at apply
+*    time. Its `get(key)` returns the already-resolved value for that key.
+*
+* Because the accessor produced at init re-reads `RuntimeContext`, yielding it
+* inside the body resolves against the apply-time context — no shared mutable
+* state, no infinite recursion (the resolve context's `get` is terminal).
+*/
+const base = (id) => ({
+	Type: "Action",
+	id,
+	env: {}
+});
+/**
+* Resolve context — provided around an Action body at apply time. `resolved`
+* maps each captured key to its value (already evaluated against the tracker).
+*/
+const makeResolveContext = (resolved) => ({
+	...base("resolve"),
+	set: (key) => Effect.succeed(key),
+	get: (key) => Effect.succeed(resolved[key])
+});
+
 //#endregion
 //#region lib/Diff.js
 init_Output();
@@ -885,6 +1023,30 @@ const _hasUnresolved = (value) => {
 	if (typeof value === "object") return Object.values(value).some(_hasUnresolved);
 	return false;
 };
+/**
+* Deeply replace every unresolved plan-time expression (an `Output`/`Expr`
+* or an un-evaluated `Effect`) with `undefined`, leaving resolved values
+* (including opaque `Redacted`/`Duration` instances) intact.
+*
+* Persisted resource state must only ever hold plain data. Durable (JSON)
+* state stores already enforce this implicitly — Output proxies are
+* function-typed, so `JSON.stringify` silently drops them — but the
+* in-memory store used by tests retains live proxies, which would later be
+* fed back into provider lifecycle operations as `olds` after an
+* interrupted apply (e.g. `read` during a destroy plan) and blow up on
+* first string coercion. Sanitizing at the commit boundary keeps both
+* store kinds consistent with the provider contract that `olds` is
+* resolved `Props`.
+*/
+const stripUnresolved = (value) => _stripUnresolved(value);
+const _stripUnresolved = (value) => {
+	if (value == null || isPrimitive(value)) return value;
+	if (isExpr(value) || Effect.isEffect(value)) return void 0;
+	if (Redacted.isRedacted(value) || Duration.isDuration(value)) return value;
+	if (Array.isArray(value)) return value.map(_stripUnresolved);
+	if (typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, _stripUnresolved(item)]));
+	return value;
+};
 const havePropsChanged = (oldProps, newProps) => hasOutputs(newProps) || JSON.stringify(canonicalize(oldProps ?? {}, false)) !== JSON.stringify(canonicalize(newProps ?? {}, false));
 const canonicalize = (value, stripNullish) => {
 	if (stripNullish && value == null) return void 0;
@@ -1130,7 +1292,7 @@ init_Output();
 init_Provider();
 init_Resource();
 init_sha256();
-const make = (stack, options = {}) => Effect.gen(function* () {
+const make = (stack, options$6 = {}) => Effect.gen(function* () {
 	const state = yield* yield* State;
 	const resources = Object.values(stack.resources);
 	const actions = Object.values(stack.actions ?? {});
@@ -1173,6 +1335,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 			const newBindings = dedupeBindings(stack.bindings[resource.FQN] ?? []);
 			const diff = yield* provider.diff ? provider.diff({
 				id: resource.LogicalId,
+				fqn: resource.FQN,
 				olds: oldProps,
 				instanceId: oldState.instanceId,
 				news: props,
@@ -1197,7 +1360,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 		else if (Duration.isDuration(input) || Redacted.isRedacted(input)) return input;
 		else if (Array.isArray(input)) return yield* Effect.all(input.map(resolveInput), { concurrency: "unbounded" });
 		else if (isResource(input)) {
-			const resolved = yield* resolveOutput(of(input));
+			const resolved = yield* resolveOutput(of$1(input));
 			if (isResourceExpr(resolved) && resolved.stables) return yield* resolveInput(resolved.stables);
 			return yield* resolveInput(resolved);
 		} else if (typeof input === "object") return Object.fromEntries(yield* Effect.all(Object.entries(input).map(([key, value]) => resolveInput(value).pipe(Effect.map((value$1) => [key, value$1]))), { concurrency: "unbounded" }));
@@ -1253,7 +1416,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 	const newResourceFqns = new Set(resources.map((r) => r.FQN));
 	const newActionFqns = new Set(actions.map((t) => t.FQN));
 	const newNodeFqns = new Set([...newResourceFqns, ...newActionFqns]);
-	const newUpstreamDependencies = Object.fromEntries([...resources.map((resource) => [resource.FQN, Object.values(upstreamAny(resource.Props)).map((r) => r.FQN)]), ...actions.map((action) => [action.FQN, Object.values(upstreamAny(action.Input)).map((r) => r.FQN)])]);
+	const newUpstreamDependencies = Object.fromEntries([...resources.map((resource) => [resource.FQN, Object.values(upstreamAny(resource.Props)).map((r) => r.FQN)]), ...actions.map((action) => [action.FQN, Array.from(new Set([...Object.values(upstreamAny(action.Input)).map((r) => r.FQN), ...Object.values(upstreamAny(action.Captures)).map((r) => r.FQN)]))])]);
 	const bindingUpstreamDependencies = Object.fromEntries(resources.map((resource) => [resource.FQN, Object.values(upstreamAny(stack.bindings[resource.FQN] ?? [])).map((r) => r.FQN)]));
 	const rawUpstreamDependencies = Object.fromEntries([...resources.map((resource) => {
 		const fqn = resource.FQN;
@@ -1305,6 +1468,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 			const adoptInstanceId = yield* generateInstanceId();
 			const readResult = yield* provider.read({
 				id,
+				fqn,
 				instanceId: adoptInstanceId,
 				olds: news,
 				output: void 0
@@ -1317,7 +1481,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 					resourceType: resource.Type,
 					logicalId: id
 				});
-				const adoptedState = {
+				oldState = {
 					status: "created",
 					fqn,
 					logicalId: id,
@@ -1331,13 +1495,6 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 					downstream,
 					removalPolicy: resource.RemovalPolicy
 				};
-				yield* state.set({
-					stack: stackName,
-					stage: stage$1,
-					fqn,
-					value: adoptedState
-				});
-				oldState = adoptedState;
 				forceUpdateAfterAdoption = true;
 			}
 		}
@@ -1359,6 +1516,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 			if (provider.read) {
 				const attr = yield* provider.read({
 					id,
+					fqn,
 					instanceId: oldState.instanceId,
 					olds: oldState.props,
 					output: oldState.attr
@@ -1376,13 +1534,14 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 		const oldProps = oldState.props;
 		const diff = yield* asEffect(provider?.diff?.({
 			id,
+			fqn,
 			olds: oldProps,
 			instanceId: oldState.instanceId,
 			output: oldState.attr,
 			news,
 			oldBindings,
 			newBindings
-		}).pipe(providePlanScope(fqn, oldState.instanceId))).pipe(Effect.map((diff$1) => diff$1 ?? { action: havePropsChanged(oldProps, news) || bindingDiffs.some((b) => b.action !== "noop") ? "update" : "noop" }), Effect.map((diff$1) => options.force && diff$1.action === "noop" ? { action: "update" } : diff$1), Effect.map((diff$1) => forceUpdateAfterAdoption && diff$1.action === "noop" ? { action: "update" } : diff$1));
+		}).pipe(providePlanScope(fqn, oldState.instanceId))).pipe(Effect.map((diff$1) => diff$1 ?? { action: havePropsChanged(oldProps, news) || bindingDiffs.some((b) => b.action !== "noop") ? "update" : "noop" }), Effect.map((diff$1) => options$6.force && diff$1.action === "noop" ? { action: "update" } : diff$1), Effect.map((diff$1) => forceUpdateAfterAdoption && diff$1.action === "noop" ? { action: "update" } : diff$1));
 		if (oldState.status === "creating") if (diff.action === "noop") return Node({
 			action: "create",
 			props: news,
@@ -1491,7 +1650,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 			forced: false
 		}];
 		const prior = oldState;
-		if (prior?.status === "ran" && prior.inputHash === inputHash && !options.force) return [fqn, {
+		if (prior?.status === "ran" && prior.inputHash === inputHash && !options$6.force) return [fqn, {
 			kind: "action",
 			action: "noop",
 			def: action,
@@ -1505,7 +1664,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 			input: action.Input,
 			state: prior,
 			downstream,
-			forced: !!options.force
+			forced: !!options$6.force
 		}];
 	})), { concurrency: "unbounded" }));
 	const cycleMembers = combinedCycleMembers;
@@ -1560,6 +1719,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 				LogicalId: logicalId,
 				Type: persisted.actionType,
 				Input: persisted.input,
+				Captures: {},
 				Run: () => void 0,
 				Output: void 0
 			}
@@ -1585,6 +1745,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 			if (oldState.attr === void 0) {
 				if (provider.read) attr = yield* provider.read({
 					id: logicalId,
+					fqn,
 					instanceId: oldState.instanceId,
 					olds: oldState.props,
 					output: oldState.attr
@@ -1640,7 +1801,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 	"alchemy.stack": stack.name,
 	"alchemy.stage": stack.stage,
 	"alchemy.resources.count": Object.keys(stack.resources).length,
-	"alchemy.force": !!options.force
+	"alchemy.force": !!options$6.force
 } }));
 const providePlanScope = (fqn, instanceId) => (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrElse(createArtifactStore)), Effect.flatMap((store) => effect.pipe(Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)), Effect.provideService(InstanceId, instanceId))));
 var DeleteResourceHasDownstreamDependencies = class extends Data.TaggedError("DeleteResourceHasDownstreamDependencies") {};
@@ -1648,6 +1809,7 @@ var UnsatisfiedResourceCycle = class extends Data.TaggedError("UnsatisfiedResour
 
 //#endregion
 //#region lib/Apply.js
+init_RuntimeContext();
 init_Artifacts();
 init_Cli();
 init_Output();
@@ -1727,6 +1889,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 		fqn,
 		value: {
 			...value,
+			props: stripUnresolved(value.props),
 			namespace
 		}
 	});
@@ -1846,6 +2009,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				yield* report("pre-creating");
 				attr = yield* node.provider.precreate({
 					id: logicalId,
+					fqn,
 					news: node.props,
 					session: scopedSession,
 					instanceId,
@@ -1879,6 +2043,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 			const bindingOutputs = excludeDeletedBindings(yield* evaluate(node.bindings, outputs));
 			attr = yield* node.provider.reconcile({
 				id: logicalId,
+				fqn,
 				news,
 				instanceId,
 				bindings: bindingOutputs,
@@ -1944,6 +2109,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 			const bindingOutputs = excludeDeletedBindings(yield* evaluate(node.bindings, outputs));
 			const attr = yield* node.provider.reconcile({
 				id: logicalId,
+				fqn,
 				news,
 				instanceId,
 				bindings: bindingOutputs,
@@ -2014,6 +2180,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				const retain = node.resource.RemovalPolicy === "retain";
 				if (old.attr !== void 0 && !retain) yield* node.provider.delete({
 					id: logicalId,
+					fqn,
 					instanceId: old.instanceId,
 					olds: old.props,
 					output: old.attr,
@@ -2037,6 +2204,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				yield* report("pre-creating");
 				attr = yield* node.provider.precreate({
 					id: logicalId,
+					fqn,
 					news: node.props,
 					session: scopedSession,
 					instanceId,
@@ -2072,6 +2240,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 			const bindingOutputs = excludeDeletedBindings(yield* evaluate(node.bindings, outputs));
 			attr = yield* node.provider.reconcile({
 				id: logicalId,
+				fqn,
 				news,
 				instanceId,
 				bindings: bindingOutputs,
@@ -2141,6 +2310,16 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 	"alchemy.resource.logical_id": node.resource.LogicalId,
 	"alchemy.resource.action": node.action
 } }));
+/**
+* Run an Action body, resolving any Outputs it captured via `yield* output`
+* during init against the current tracker and exposing them to the body through
+* the resolve {@link RuntimeContext}. See {@link makeCaptureContext}.
+*/
+const runAction = Effect.fn("apply.runAction")(function* (task, input, outputs) {
+	const resolved = {};
+	for (const [key, output] of Object.entries(task.Captures)) resolved[key] = yield* evaluate(output, outputs);
+	return yield* task.Run(input).pipe(Effect.provideService(RuntimeContext, makeResolveContext(resolved)));
+});
 const executeActionNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, session, state, stackName, stage$1, getOutputs, waitForDeps, failures) => Effect.gen(function* () {
 	const task = node.def;
 	const logicalId = task.LogicalId;
@@ -2180,7 +2359,7 @@ const executeActionNode = (fqn, node, tracker, ready, readyStable, terminalStatu
 		return;
 	}
 	yield* report("pending");
-	yield* waitForDeps(Object.keys(resolveUpstream(node.input)).filter((f) => f in readyStable));
+	yield* waitForDeps([...new Set([...Object.keys(resolveUpstream(node.input)), ...Object.keys(upstreamAny(task.Captures))])].filter((f) => f in readyStable));
 	const outputs = getOutputs();
 	const resolvedInput = yield* evaluate(node.input, outputs);
 	const inputHashValue = yield* hashInput(resolvedInput);
@@ -2195,7 +2374,7 @@ const executeActionNode = (fqn, node, tracker, ready, readyStable, terminalStatu
 		downstream: node.downstream
 	});
 	yield* report("running");
-	const result = yield* task.Run(resolvedInput);
+	const result = yield* runAction(task, resolvedInput, outputs);
 	yield* commit({
 		kind: "action",
 		status: "ran",
@@ -2270,6 +2449,7 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
 			};
 			const attr = yield* node.provider.reconcile({
 				id: logicalId,
+				fqn,
 				news: newProps,
 				instanceId,
 				bindings: newBindings,
@@ -2333,7 +2513,7 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
 					downstream: node.downstream
 				}
 			});
-			const result = yield* node.def.Run(newInput);
+			const result = yield* runAction(node.def, newInput, outputs);
 			yield* state.set({
 				stack: stackName,
 				stage: stage$1,
@@ -2421,6 +2601,7 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 				fqn,
 				value: {
 					...value,
+					props: stripUnresolved(value.props),
 					namespace
 				}
 			});
@@ -2469,6 +2650,7 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 				if (retainOldGeneration) yield* scopedSession.note("Retaining replaced resource (removal policy: retain)...");
 				if (attr !== void 0 && !retainOldGeneration) yield* provider.delete({
 					id: logicalId,
+					fqn,
 					instanceId,
 					olds: props,
 					output: attr,
@@ -2537,13 +2719,1722 @@ const excludeDeletedBindings = (bindings) => bindings.flatMap(({ action, sid, da
 	data
 }]);
 
+//#endregion
+//#region lib/Util/Clank.js
+var PromptCancelled = class extends Data.TaggedError("PromptCancelled") {};
+const retryIfCancelled = Effect.retry({ while: (e) => e instanceof PromptCancelled });
+/**
+* Wraps a clack prompt (which returns a `Promise<T | symbol>` where the
+* symbol indicates user cancellation) in an Effect.
+*
+* Returns `undefined` if the user cancels (Ctrl+C / Escape).
+*
+* Uses `Effect.callback` so fiber interruption propagates via the abort
+* signal to any async resources we own; the clack prompt itself is left
+* to resolve — its result is ignored after interruption.
+*/
+const prompt = (fn) => Effect.callback((resume, signal) => {
+	let settled = false;
+	fn().then((result) => {
+		if (settled || signal.aborted) return;
+		settled = true;
+		if (p.isCancel(result)) resume(Effect.fail(new PromptCancelled()));
+		else resume(Effect.succeed(result));
+	}, (err) => {
+		if (settled || signal.aborted) return;
+		settled = true;
+		resume(Effect.die(err));
+	});
+});
+const success = (str) => Effect.sync(() => p.log.success(str));
+const warn = (str) => Effect.sync(() => p.log.warn(str));
+const info = (str) => Effect.sync(() => p.log.info(str));
+const text = (opts) => prompt(() => p.text(opts));
+const password = (opts) => prompt(() => p.password(opts));
+const select = (opts) => prompt(() => p.select(opts));
+const confirm = (opts) => prompt(() => p.confirm(opts));
+const multiselect = (opts) => prompt(() => p.multiselect(opts));
+/**
+* Open a URL in the user's default browser.
+*
+* On Windows, uses rundll32's FileProtocolHandler — a built-in shim that
+* opens URLs in the default browser. It accepts the URL as a direct
+* argument (no shell, no quoting of `&`). cmd.exe `start` would treat
+* `&` in OAuth URLs as a command separator, and `explorer.exe` treats
+* its arg as a path.
+*/
+const openUrl = (url) => Effect.gen(function* () {
+	const [cmd, args] = process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+	yield* (yield* ChildProcess.make(cmd, [...args], { shell: false })).exitCode;
+}).pipe(Effect.scoped);
+
+//#endregion
+//#region lib/Auth/Env.js
+init_AuthProvider();
+const getEnv = (key) => Config.string(key).pipe(Effect.orElseSucceed(() => void 0));
+const getEnvRequired = (key) => Config.string(key).pipe(Effect.catch(() => Effect.fail(new AuthError({ message: `Missing required env: ${key}` }))));
+const getEnvRedacted = (key) => Config.redacted(key).pipe(Effect.orElseSucceed(() => void 0));
+const getEnvRedactedRequired = (key) => Config.redacted(key).pipe(Effect.catch(() => Effect.fail(new AuthError({ message: `Missing required env: ${key}` }))));
+const retryOnce = (self) => self.pipe(Effect.retry({
+	times: 1,
+	while: (e) => e instanceof PromptCancelled
+}), Effect.mapError((e) => new AuthError({
+	message: "User cancelled prompt",
+	cause: e
+})));
+
+//#endregion
+//#region lib/AWS/Environment.js
+init_AuthProvider();
+init_Profile();
+const AWS_PROFILE = Config.string("AWS_PROFILE").pipe(Config.withDefault("default"));
+const AWS_REGION = Config.string("AWS_REGION");
+const AWS_ACCOUNT_ID = Config.string("AWS_ACCOUNT_ID");
+const AWS_ACCESS_KEY_ID = Config.string("AWS_ACCESS_KEY_ID");
+const AWS_SECRET_ACCESS_KEY = Config.redacted("AWS_SECRET_ACCESS_KEY");
+const AWS_SESSION_TOKEN = Config.redacted("AWS_SESSION_TOKEN");
+var AWSEnvironment = class AWSEnvironment extends EffectContext.Service()("AWS::Environment") {
+	static current = AWSEnvironment.use((env) => env);
+	kind = "Environment";
+};
+const Default = Layer.effect(AWSEnvironment, Effect.gen(function* () {
+	const profile$1 = yield* AlchemyProfile;
+	const auth = yield* getAuthProvider(AWS_AUTH_PROVIDER_NAME);
+	const profileName = yield* ALCHEMY_PROFILE;
+	const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+	return yield* profile$1.loadOrConfigure(auth, profileName, { ci }).pipe(Effect.flatMap((config) => auth.read(profileName, config)), Effect.orDie, Effect.cached);
+})).pipe(Layer.orDie);
+
+//#endregion
+//#region lib/AWS/Region.js
+const of = (region) => Layer.succeed(Region.Region, Effect.succeed(region));
+const CurrentRegion = Effect.suspend(() => AWSEnvironment.use((env) => Effect.flatMap(env, ({ region }) => Effect.succeed(region))));
+/**
+* Derive the AWS region from the surrounding {@link AWSEnvironment}.
+*/
+const fromEnvironment = Layer.effect(Region.Region, Effect.gen(function* () {
+	const env = yield* AWSEnvironment;
+	return Effect.map(env, (env$1) => env$1.region);
+}));
+
+//#endregion
+//#region lib/AWS/AuthProvider.js
+init_AuthProvider();
+init_Credentials();
+const AWS_AUTH_PROVIDER_NAME = "AWS";
+const options$5 = [
+	{
+		value: "sso",
+		label: "SSO",
+		hint: "aws sso login — credentials loaded from AWS SSO cache"
+	},
+	{
+		value: "env",
+		label: "Environment Variables",
+		hint: "AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY"
+	},
+	{
+		value: "stored",
+		label: "Stored",
+		hint: "stored in ~/.alchemy/credentials"
+	}
+];
+/**
+* Layer that registers the AWS {@link AuthProvider} into the
+* {@link AuthProviders} registry when built. Include this in the AWS
+* `providers()` layer so `alchemy login` can discover it.
+*/
+const AwsAuth = AuthProviderLayer()(AWS_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+	const store = yield* CredentialsStore;
+	const getAccountId = ({ accessKeyId, secretAccessKey, sessionToken, region }) => STS.getCallerIdentity({}).pipe(Effect.provide(Layer.mergeAll(Layer.succeed(Credentials, Effect.succeed({
+		accessKeyId,
+		secretAccessKey,
+		sessionToken
+	})), of(region))), Effect.flatMap((self) => self.Account ? Effect.succeed(self.Account) : Effect.die(/* @__PURE__ */ new Error("No account ID found"))));
+	const loginStored = Effect.fn(function* (profileName) {
+		const accessKeyId = yield* text({
+			message: "AWS Access Key ID",
+			validate: (v) => v.length === 0 ? "Required" : void 0
+		}).pipe(retryOnce);
+		const secretAccessKey = yield* password({
+			message: "AWS Secret Access Key",
+			validate: (v) => v.length === 0 ? "Required" : void 0
+		}).pipe(retryOnce);
+		const sessionToken = yield* text({
+			message: "AWS Session Token (optional — press Enter or Esc to skip)",
+			placeholder: "(none)"
+		}).pipe(Effect.catch(() => Effect.succeed("")));
+		const region = yield* text({
+			message: "AWS Region",
+			placeholder: "us-east-1",
+			defaultValue: "us-east-1"
+		}).pipe(retryOnce);
+		const accountId = yield* getAccountId({
+			accessKeyId: Redacted.make(accessKeyId),
+			secretAccessKey: Redacted.make(secretAccessKey),
+			sessionToken: sessionToken ? Redacted.make(sessionToken) : void 0,
+			region
+		});
+		yield* store.write(profileName, "aws", {
+			accountId,
+			accessKeyId,
+			secretAccessKey,
+			sessionToken,
+			region
+		});
+		yield* success("AWS credentials saved.");
+		return { method: "stored" };
+	});
+	const configureInteractive = (profileName) => select({
+		message: "AWS authentication method",
+		options: options$5
+	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("sso", () => Effect.gen(function* () {
+		const config = {
+			method: "sso",
+			ssoProfile: (yield* text({
+				message: "AWS profile name (from ~/.aws/config)",
+				placeholder: "default",
+				defaultValue: "default"
+			})) ?? "default"
+		};
+		yield* loginSSO(config);
+		return config;
+	})), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
+		if (ctx.ci) return { method: "env" };
+		return yield* configureInteractive(profileName);
+	}).pipe(Effect.mapError((e) => new AuthError({
+		message: "failed to configure credentials",
+		cause: e
+	})));
+	const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fn(function* () {
+		const accessKeyId = yield* getEnvRedactedRequired("AWS_ACCESS_KEY_ID");
+		const secretAccessKey = yield* getEnvRedactedRequired("AWS_SECRET_ACCESS_KEY");
+		const sessionToken = yield* getEnvRedacted("AWS_SESSION_TOKEN");
+		const region = yield* getEnv("AWS_REGION").pipe(Effect.flatMap((region$1) => region$1 ? Effect.succeed(region$1) : getEnv("AWS_DEFAULT_REGION")));
+		if (!region) return yield* Effect.fail(new AuthError({ message: "AWS region not found. Set AWS_REGION or AWS_DEFAULT_REGION." }));
+		return {
+			accountId: yield* getEnvRequired("AWS_ACCOUNT_ID").pipe(Effect.catch(() => getAccountId({
+				accessKeyId,
+				secretAccessKey,
+				sessionToken,
+				region
+			}))),
+			credentials: Effect.succeed({
+				accessKeyId,
+				secretAccessKey,
+				sessionToken
+			}),
+			region,
+			source: { type: "env" }
+		};
+	})), Match.when({ method: "stored" }, () => store.read(profileName, "aws").pipe(Effect.flatMap((creds) => creds == null ? Effect.fail(new AuthError({ message: "AWS stored credentials not found. Run: alchemy login --configure" })) : Effect.succeed({
+		accountId: creds.accountId,
+		credentials: Effect.succeed({
+			accessKeyId: Redacted.make(creds.accessKeyId),
+			secretAccessKey: Redacted.make(creds.secretAccessKey),
+			sessionToken: creds.sessionToken ? Redacted.make(creds.sessionToken) : void 0
+		}),
+		region: creds.region,
+		source: { type: "stored" }
+	})), Effect.flatMap((creds) => creds.accountId ? Effect.succeed(creds) : creds.credentials.pipe(Effect.flatMap((resolved) => getAccountId({
+		accessKeyId: resolved.accessKeyId,
+		secretAccessKey: resolved.secretAccessKey,
+		sessionToken: resolved.sessionToken,
+		region: creds.region
+	})), Effect.map((accountId) => ({
+		...creds,
+		accountId
+	})), Effect.tap((creds$1) => creds$1.credentials.pipe(Effect.tap(({ accessKeyId, secretAccessKey, sessionToken }) => store.write(profileName, "aws", {
+		accessKeyId: Redacted.value(accessKeyId),
+		secretAccessKey: Redacted.value(secretAccessKey),
+		sessionToken: sessionToken ? Redacted.value(sessionToken) : void 0,
+		region: creds$1.region,
+		accountId: creds$1.accountId
+	})))))))), Match.when({ method: "sso" }, (config$1) => Effect.gen(function* () {
+		const auth = yield* DistilledAuth.Default;
+		const profile$1 = yield* auth.loadProfile(config$1.ssoProfile).pipe(Effect.catch(() => Effect.succeed(void 0)));
+		return {
+			accountId: profile$1?.sso_account_id,
+			credentials: auth.loadProfileCredentials(config$1.ssoProfile).pipe(Effect.mapError((e) => new AuthError({
+				message: "failed to load credentials",
+				cause: e
+			})), Effect.orDie),
+			region: profile$1?.region,
+			source: {
+				type: "sso",
+				details: config$1.ssoProfile
+			}
+		};
+	})), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
+		message: "login failed",
+		cause: e
+	})));
+	const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap(Effect.fn(function* (creds) {
+		const { accessKeyId, secretAccessKey, sessionToken } = yield* creds.credentials;
+		yield* Console.log(`  accessKeyId:     ${displayRedacted(accessKeyId)}`);
+		yield* Console.log(`  secretAccessKey: ${displayRedacted(secretAccessKey)}`);
+		if (sessionToken) yield* Console.log(`  sessionToken:    ${displayRedacted(sessionToken)}`);
+		if (creds.region) yield* Console.log(`  region:          ${creds.region}`);
+		yield* Console.log(`  source: ${creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type}`);
+	})));
+	const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "sso" }, (config$1) => info(`AWS: running 'aws sso logout --profile ${config$1.ssoProfile}'...`).pipe(Effect.zip(runSsoCommand("logout", config$1.ssoProfile)), Effect.zip(clearDistilledSsoCache(config$1.ssoProfile)), Effect.match({
+		onSuccess: () => success("AWS: SSO logout complete"),
+		onFailure: (e) => warn(`AWS: SSO logout failed: \`${e.message}\``)
+	}))), Match.when({ method: "stored" }, () => store.delete(profileName, "aws").pipe(Effect.andThen(success("AWS: stored credentials removed")))), Match.exhaustive);
+	const login = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "sso" }, loginSSO), Match.when({ method: "stored" }, () => store.read(profileName, "aws").pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
+		message: "login failed",
+		cause: e
+	})));
+	return {
+		configure: configureCredentials,
+		login,
+		logout,
+		prettyPrint,
+		read: resolveCredentials
+	};
+}));
+const runSsoCommand = (command, ssoProfile) => Effect.gen(function* () {
+	const exit = yield* (yield* ChildProcess.make("aws", [
+		"sso",
+		command,
+		"--profile",
+		ssoProfile
+	], {
+		shell: false,
+		stdin: "inherit",
+		stdout: "inherit",
+		stderr: "inherit"
+	})).exitCode;
+	if (exit !== 0) return yield* new AuthError({ message: `aws sso ${command} exited with code ${exit}` });
+}).pipe(Effect.scoped);
+const loginSSO = (config) => info(`AWS SSO: running 'aws sso login --profile ${config.ssoProfile}'...`).pipe(Effect.andThen(runSsoCommand("login", config.ssoProfile)), Effect.matchEffect({
+	onSuccess: () => success("AWS SSO: login complete"),
+	onFailure: (e) => warn(`AWS SSO: login faield: \`${e.message}\``)
+}));
+/**
+* `aws sso logout` only clears AWS CLI's own caches — it does not know about the
+* `<sha1(sso_session)>.credentials.json` file that `@distilled.cloud/aws`
+* writes alongside the SSO token. Without this cleanup, `loadProfileCredentials`
+* short-circuits on the stale distilled cache file after logout and appears to
+* stay logged in until the role creds hit their TTL.
+*/
+const clearDistilledSsoCache = (ssoProfile) => Effect.gen(function* () {
+	const ssoSession = (yield* (yield* DistilledAuth.Default).loadProfile(ssoProfile)).sso_session;
+	if (!ssoSession) return;
+	const fs$1 = yield* FileSystem.FileSystem;
+	const path$2 = yield* Path$1.Path;
+	const hash = NodeCrypto.createHash("sha1").update(ssoSession).digest("hex");
+	const cacheFile = path$2.join(NodeOs.homedir(), ".aws", "sso", "cache", `${hash}.credentials.json`);
+	yield* fs$1.remove(cacheFile).pipe(Effect.catch(() => Effect.void));
+}).pipe(Effect.catch(() => Effect.void));
+
+//#endregion
+//#region lib/Axiom/AuthProvider.js
+init_AuthProvider();
+init_Credentials();
+const STORAGE_KEY = "axiom-stored";
+const options$4 = [{
+	value: "env",
+	label: "Environment Variables",
+	hint: "AXIOM_TOKEN (or AXIOM_API_KEY) + optional AXIOM_ORG_ID, AXIOM_URL"
+}, {
+	value: "stored",
+	label: "API Token or Personal Access Token",
+	hint: "enter credentials interactively, stored in ~/.alchemy/credentials"
+}];
+const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
+const promptOrgId = (required) => getEnv("AXIOM_ORG_ID").pipe(Effect.flatMap((envOrgId) => text({
+	message: required ? "Axiom Org ID (required for PAT)" : "Axiom Org ID (Enter to skip)",
+	placeholder: envOrgId ?? "",
+	defaultValue: envOrgId ?? "",
+	validate: required ? (v) => v.length === 0 ? "Required" : void 0 : void 0
+}).pipe(retryOnce)));
+/**
+* Layer that registers the Axiom {@link AuthProvider} into the
+* {@link AuthProviders} registry when built. Include this in the Axiom
+* `providers()` layer so `alchemy login` can discover it.
+*/
+const AxiomAuth = AuthProviderLayer()(AXIOM_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+	const store = yield* CredentialsStore;
+	const loginStored = Effect.fn(function* (profileName) {
+		const credentialType = yield* select({
+			message: "Axiom credential type",
+			options: [{
+				value: "apiToken",
+				label: "API Token",
+				hint: "recommended — scoped to specific datasets/actions"
+			}, {
+				value: "pat",
+				label: "Personal Access Token",
+				hint: "full account control, requires Org ID"
+			}]
+		}).pipe(retryOnce);
+		const apiBaseUrlPrompt = yield* text({
+			message: "Axiom API Base URL (Enter for default)",
+			placeholder: DEFAULT_API_BASE_URL,
+			defaultValue: DEFAULT_API_BASE_URL
+		}).pipe(retryOnce);
+		const apiBaseUrl = apiBaseUrlPrompt && apiBaseUrlPrompt.length > 0 ? apiBaseUrlPrompt : void 0;
+		return yield* Match.value(credentialType).pipe(Match.when("apiToken", () => Effect.gen(function* () {
+			const apiToken = yield* password({
+				message: "Axiom API Token",
+				validate: (v) => v.length === 0 ? "Required" : void 0
+			}).pipe(retryOnce);
+			const orgId = yield* promptOrgId(false);
+			yield* store.write(profileName, STORAGE_KEY, {
+				type: "apiToken",
+				apiToken,
+				apiBaseUrl,
+				orgId: orgId && orgId.length > 0 ? orgId : void 0
+			});
+			yield* success("Axiom: credentials saved.");
+			return {
+				method: "stored",
+				credentialType: "apiToken"
+			};
+		})), Match.when("pat", () => Effect.gen(function* () {
+			const apiToken = yield* password({
+				message: "Axiom Personal Access Token",
+				validate: (v) => v.length === 0 ? "Required" : void 0
+			}).pipe(retryOnce);
+			const orgId = yield* promptOrgId(true);
+			yield* store.write(profileName, STORAGE_KEY, {
+				type: "pat",
+				apiToken,
+				apiBaseUrl,
+				orgId
+			});
+			yield* success("Axiom: credentials saved.");
+			return {
+				method: "stored",
+				credentialType: "pat"
+			};
+		})), Match.exhaustive);
+	});
+	const configureInteractive = (profileName) => select({
+		message: "Axiom authentication method",
+		options: options$4
+	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
+		if (ctx.ci) return { method: "env" };
+		return yield* configureInteractive(profileName);
+	}).pipe(Effect.mapError((e) => new AuthError({
+		message: "failed to configure credentials",
+		cause: e
+	})));
+	const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fn(function* () {
+		const apiToken = (yield* getEnvRedacted("AXIOM_TOKEN")) ?? (yield* getEnvRedacted("AXIOM_API_KEY"));
+		if (!apiToken) return yield* new AuthError({ message: "Axiom env credentials not found. Set AXIOM_TOKEN (or AXIOM_API_KEY)." });
+		const apiBaseUrl = (yield* getEnv("AXIOM_URL")) ?? DEFAULT_API_BASE_URL;
+		const orgId = yield* getEnv("AXIOM_ORG_ID");
+		if (orgId) return {
+			type: "pat",
+			apiToken,
+			apiBaseUrl,
+			orgId,
+			source: { type: "env" }
+		};
+		return {
+			type: "apiToken",
+			apiToken,
+			apiBaseUrl,
+			source: { type: "env" }
+		};
+	})), Match.when({ method: "stored" }, () => store.read(profileName, STORAGE_KEY).pipe(Effect.flatMap((creds) => creds == null ? Effect.fail(new AuthError({ message: "Axiom stored credentials not found. Run: alchemy login --configure" })) : Effect.succeed(Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c$1) => ({
+		type: "apiToken",
+		apiToken: Redacted.make(c$1.apiToken),
+		apiBaseUrl: c$1.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+		orgId: c$1.orgId,
+		source: { type: "stored" }
+	})), Match.when({ type: "pat" }, (c$1) => ({
+		type: "pat",
+		apiToken: Redacted.make(c$1.apiToken),
+		apiBaseUrl: c$1.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+		orgId: c$1.orgId,
+		source: { type: "stored" }
+	})), Match.exhaustive))))), Match.exhaustive);
+	const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.delete(profileName, STORAGE_KEY).pipe(Effect.andThen(success("Axiom: stored credentials removed")))), Match.exhaustive);
+	const login = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.read(profileName, STORAGE_KEY).pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
+		message: "login failed",
+		cause: e
+	})));
+	const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
+		const sourceStr = creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type;
+		return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c$1) => Effect.all([
+			Console.log(`  apiToken: ${displayRedacted(c$1.apiToken, 9)}`),
+			Console.log(`  apiBaseUrl: ${c$1.apiBaseUrl}`),
+			Console.log(`  orgId: ${c$1.orgId ?? "(none)"}`),
+			Console.log(`  source: ${sourceStr}`)
+		])), Match.when({ type: "pat" }, (c$1) => Effect.all([
+			Console.log(`  apiToken: ${displayRedacted(c$1.apiToken, 9)}`),
+			Console.log(`  apiBaseUrl: ${c$1.apiBaseUrl}`),
+			Console.log(`  orgId: ${c$1.orgId}`),
+			Console.log(`  source: ${sourceStr}`)
+		])), Match.exhaustive);
+	}));
+	return {
+		configure: configureCredentials,
+		logout,
+		login,
+		prettyPrint,
+		read: resolveCredentials
+	};
+}));
+
+//#endregion
+//#region lib/Cloudflare/StateStore/CredentialsFile.js
+/**
+* Filename (under `~/.alchemy/credentials/{profile}/`) used to cache the
+* Cloudflare-deployed HTTP state store's endpoint + bearer token.
+*
+* Kept in this leaf module (rather than `StateStore/State.ts`) so the
+* Cloudflare auth provider can invalidate the cache on
+* `login --configure` / `logout` without importing the heavy state-store
+* module and creating an import cycle
+* (`StateStore/State.ts` -> `Providers.ts` -> `Auth/AuthProvider.ts`).
+*/
+const CREDENTIALS_FILE = "cloudflare-state-store";
+
+//#endregion
+//#region lib/Cloudflare/Auth/OAuthClient.js
+init_AuthProvider();
+var OAuthError$1 = class extends Data.TaggedError("OAuthError") {};
+function generateState$1(length = 32) {
+	return crypto$1.randomBytes(length).toString("base64url");
+}
+function generatePKCE(length = 96) {
+	const verifier = crypto$1.randomBytes(length).toString("base64url");
+	return {
+		verifier,
+		challenge: crypto$1.createHash("sha256").update(verifier).digest("base64url")
+	};
+}
+function extractCredentials$1(json) {
+	return {
+		type: "oauth",
+		access: json.access_token,
+		refresh: json.refresh_token,
+		expires: Date.now() + json.expires_in * 1e3,
+		scopes: json.scope.split(" ")
+	};
+}
+const tokenRequest$1 = (body) => Effect.gen(function* () {
+	const res = yield* Effect.tryPromise({
+		try: () => fetch(OAUTH_ENDPOINTS$1.token, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/x-www-form-urlencoded"
+			},
+			body: new URLSearchParams(body).toString()
+		}),
+		catch: (err) => new OAuthError$1({
+			error: "network_error",
+			errorDescription: `Token request failed: ${err}`
+		})
+	});
+	if (!res.ok) {
+		const json = yield* Effect.tryPromise({
+			try: () => res.json(),
+			catch: () => new OAuthError$1({
+				error: "parse_error",
+				errorDescription: `Token endpoint returned ${res.status}`
+			})
+		});
+		return yield* new OAuthError$1({
+			error: json.error,
+			errorDescription: json.error_description
+		});
+	}
+	return extractCredentials$1(yield* Effect.tryPromise({
+		try: () => res.json(),
+		catch: () => new OAuthError$1({
+			error: "parse_error",
+			errorDescription: "Failed to parse token response"
+		})
+	}));
+});
+/**
+* Generate an authorization URL with PKCE for the given scopes.
+*/
+function authorize$1(scopes) {
+	const state = generateState$1();
+	const pkce = generatePKCE();
+	const url = new URL(OAUTH_ENDPOINTS$1.authorize);
+	url.searchParams.set("client_id", OAUTH_CLIENT_ID$1);
+	url.searchParams.set("redirect_uri", OAUTH_REDIRECT_URI$1);
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("scope", scopes.join(" "));
+	url.searchParams.set("state", state);
+	url.searchParams.set("code_challenge", pkce.challenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	return {
+		url: url.toString(),
+		state,
+		verifier: pkce.verifier
+	};
+}
+/**
+* Exchange an authorization code for OAuth credentials.
+*/
+const exchange$1 = (code, verifier) => tokenRequest$1({
+	grant_type: "authorization_code",
+	code,
+	code_verifier: verifier,
+	client_id: OAUTH_CLIENT_ID$1,
+	redirect_uri: OAUTH_REDIRECT_URI$1
+});
+/**
+* Refresh expired OAuth credentials.
+*/
+const refresh$1 = (credentials) => tokenRequest$1({
+	grant_type: "refresh_token",
+	refresh_token: credentials.refresh,
+	client_id: OAUTH_CLIENT_ID$1,
+	redirect_uri: OAUTH_REDIRECT_URI$1
+});
+/**
+* Revoke OAuth credentials.
+*/
+const revoke = (credentials) => Effect.gen(function* () {
+	yield* Effect.tryPromise({
+		try: () => fetch(OAUTH_ENDPOINTS$1.revoke, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/x-www-form-urlencoded"
+			},
+			body: new URLSearchParams({
+				refresh_token: credentials.refresh,
+				client_id: OAUTH_CLIENT_ID$1,
+				redirect_uri: OAUTH_REDIRECT_URI$1
+			}).toString()
+		}),
+		catch: (err) => new OAuthError$1({
+			error: "network_error",
+			errorDescription: `Revoke request failed: ${err}`
+		})
+	});
+});
+/**
+* Start a local HTTP server to listen for the OAuth callback, exchange
+* the authorization code, and return the credentials.
+*
+* Times out after 5 minutes.
+*/
+const callback$1 = (authorization) => Effect.tryPromise({
+	try: () => callbackPromise$1(authorization),
+	catch: (err) => {
+		if (err instanceof OAuthError$1) return err;
+		return new OAuthError$1({
+			error: "callback_error",
+			errorDescription: `OAuth callback failed: ${err}`
+		});
+	}
+});
+function callbackPromise$1(authorization) {
+	const { pathname, port } = new URL(OAUTH_REDIRECT_URI$1);
+	return new Promise((resolve, reject) => {
+		const server = http.createServer(async (req, res) => {
+			const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+			if (url.pathname !== pathname) {
+				res.statusCode = 404;
+				res.end("Not Found");
+				return;
+			}
+			const error = url.searchParams.get("error");
+			const errorDescription = url.searchParams.get("error_description");
+			if (error) {
+				res.writeHead(302, { Location: AUTH_ERROR_URL });
+				res.end();
+				cleanup();
+				reject(new OAuthError$1({
+					error,
+					errorDescription: errorDescription ?? "An unknown error occurred."
+				}));
+				return;
+			}
+			const code = url.searchParams.get("code");
+			const state = url.searchParams.get("state");
+			if (!code || !state) {
+				res.writeHead(302, { Location: AUTH_ERROR_URL });
+				res.end();
+				cleanup();
+				reject(new OAuthError$1({
+					error: "invalid_request",
+					errorDescription: "Missing code or state"
+				}));
+				return;
+			}
+			if (state !== authorization.state) {
+				res.writeHead(302, { Location: AUTH_ERROR_URL });
+				res.end();
+				cleanup();
+				reject(new OAuthError$1({
+					error: "invalid_request",
+					errorDescription: "Invalid state"
+				}));
+				return;
+			}
+			try {
+				const credentials = await Effect.runPromise(exchange$1(code, authorization.verifier));
+				res.writeHead(302, { Location: AUTH_SUCCESS_URL });
+				res.end();
+				cleanup();
+				resolve(credentials);
+			} catch (err) {
+				res.writeHead(302, { Location: AUTH_ERROR_URL });
+				res.end();
+				cleanup();
+				reject(err);
+			}
+		});
+		const timeout = setTimeout(() => {
+			cleanup();
+			reject(new OAuthError$1({
+				error: "timeout",
+				errorDescription: "The authorization process timed out."
+			}));
+		}, 300 * 1e3);
+		function cleanup() {
+			clearTimeout(timeout);
+			server.close();
+		}
+		server.on("error", (err) => {
+			cleanup();
+			reject(new OAuthError$1({
+				error: "server_error",
+				errorDescription: `Failed to start callback server: ${err.message}`
+			}));
+		});
+		server.listen(Number(port));
+	});
+}
+
+//#endregion
+//#region lib/Cloudflare/Auth/AuthProvider.js
+init_AuthProvider();
+init_Credentials();
+const options$3 = [
+	{
+		value: "oauth",
+		label: "OAuth",
+		hint: "recommended — browser-based login with automatic token refresh"
+	},
+	{
+		value: "env",
+		label: "Environment Variables",
+		hint: "CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL"
+	},
+	{
+		value: "stored",
+		label: "API Token or API Key",
+		hint: "enter credentials interactively, stored in ~/.alchemy/credentials"
+	}
+];
+const CLOUDFLARE_AUTH_PROVIDER_NAME = "Cloudflare";
+const withOAuthCredentials$1 = (accessToken, effect) => Effect.provide(effect, Layer.mergeAll(CfCredentialsModule.fromOAuth({
+	load: Effect.succeed({ accessToken }),
+	refresh: () => Effect.die("refresh not expected during account selection")
+}), FetchHttpClient.layer));
+const selectAccount = (accessToken) => Effect.gen(function* () {
+	const accounts = (yield* (yield* cfAccounts.listAccounts)({})).result;
+	if (accounts.length === 0) return yield* new AuthError({ message: "Cloudflare: no accounts found for this credential." });
+	if (accounts.length === 1) {
+		const account = accounts[0];
+		yield* info(`Cloudflare: using account: ${account.name} (${account.id})`);
+		return account.id;
+	}
+	return yield* select({
+		message: "Select a Cloudflare account",
+		options: accounts.map((a) => ({
+			value: a.id,
+			label: a.name,
+			hint: a.id
+		}))
+	}).pipe(retryOnce);
+}).pipe((e) => withOAuthCredentials$1(accessToken, e));
+/**
+* Cloudflare account IDs are 32 lowercase hex characters. Placeholder
+* values ("", "-", "dummy", …) end up interpolated into API paths and
+* surface as baffling `InvalidRoute: Could not route to
+* /accounts/<value>/...` errors, so reject them up front with an
+* actionable message instead.
+*/
+const ACCOUNT_ID_PATTERN = /^[0-9a-f]{32}$/i;
+const validateAccountId = (accountId, source) => {
+	const trimmed = accountId?.trim() ?? "";
+	if (trimmed.length === 0) return Effect.fail(new AuthError({ message: `Cloudflare account ID is missing (${source}). Set CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login' and provide your account ID (found in the Cloudflare dashboard under Workers & Pages → Account details).` }));
+	if (!ACCOUNT_ID_PATTERN.test(trimmed)) return Effect.fail(new AuthError({ message: `'${trimmed}' is not a valid Cloudflare account ID (${source}) — expected 32 hex characters. Copy the account ID from the Cloudflare dashboard (Workers & Pages → Account details) into CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login'.` }));
+	return Effect.succeed(trimmed.toLowerCase());
+};
+const promptAccountId = () => getEnv("CLOUDFLARE_ACCOUNT_ID").pipe(Effect.flatMap((envAccountId) => text({
+	message: "Cloudflare Account ID (Enter to skip)",
+	placeholder: envAccountId ?? "",
+	defaultValue: envAccountId ?? "",
+	validate: (v) => v.trim().length === 0 || ACCOUNT_ID_PATTERN.test(v.trim()) ? void 0 : "Expected a 32-character hex account ID (Workers & Pages → Account details)"
+}).pipe(retryOnce)));
+const promptOAuthScopes = () => confirm({
+	message: "Customize OAuth scopes? (default covers typical use cases)",
+	initialValue: false
+}).pipe(retryOnce, Effect.flatMap((customize) => {
+	if (!customize) return Effect.succeed([...DEFAULT_SCOPES]);
+	return multiselect({
+		message: "Select OAuth scopes",
+		initialValues: DEFAULT_SCOPES,
+		options: Object.entries(ALL_SCOPES).map(([value, hint]) => ({
+			value,
+			label: value,
+			hint
+		})),
+		required: true
+	}).pipe(Effect.map((s) => s), retryOnce);
+}));
+/**
+* Layer that registers the Cloudflare {@link AuthProvider} into the
+* {@link AuthProviders} registry when built. Include this in the Cloudflare
+* `providers()` layer so `alchemy login` can discover it.
+*/
+const CloudflareAuth = AuthProviderLayer()(CLOUDFLARE_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+	const store = yield* CredentialsStore;
+	const oauthLogin = (profileName, scopes) => Effect.gen(function* () {
+		const authorization = authorize$1([...scopes, "offline_access"]);
+		yield* info("Cloudflare: opening browser for OAuth login...");
+		yield* info(authorization.url);
+		yield* openUrl(authorization.url).pipe(Effect.catch(() => warn("Cloudflare: could not open browser automatically. Please open the URL above manually.")));
+		yield* info("Cloudflare: waiting for authorization (up to 5 minutes)...");
+		const credentials = yield* callback$1(authorization);
+		yield* store.write(profileName, "cf-oauth", credentials);
+		yield* success("Cloudflare: OAuth credentials saved.");
+		return credentials;
+	});
+	const loginStored = Effect.fn(function* (profileName) {
+		const credentialType = yield* select({
+			message: "Cloudflare credential type",
+			options: [{
+				value: "apiToken",
+				label: "API Token",
+				hint: "recommended"
+			}, {
+				value: "apiKey",
+				label: "API Key + Email"
+			}]
+		}).pipe(retryOnce);
+		return yield* Match.value(credentialType).pipe(Match.when("apiToken", () => Effect.gen(function* () {
+			const apiToken = yield* password({
+				message: "Cloudflare API Token",
+				validate: (v) => v.length === 0 ? "Required" : void 0
+			}).pipe(retryOnce);
+			const accountId = yield* promptAccountId();
+			yield* store.write(profileName, "cf-stored", {
+				type: "apiToken",
+				apiToken,
+				accountId
+			});
+			yield* success("Cloudflare: credentials saved.");
+			return {
+				method: "stored",
+				credentialType: "apiToken"
+			};
+		})), Match.when("apiKey", () => Effect.gen(function* () {
+			const apiKey = yield* text({
+				message: "Cloudflare API Key",
+				validate: (v) => v.length === 0 ? "Required" : void 0
+			}).pipe(retryOnce);
+			const email = yield* text({
+				message: "Cloudflare Email",
+				validate: (v) => v.length === 0 ? "Required" : void 0
+			}).pipe(retryOnce);
+			const accountId = yield* promptAccountId();
+			yield* store.write(profileName, "cf-stored", {
+				type: "apiKey",
+				apiKey,
+				email,
+				accountId
+			});
+			yield* success("Cloudflare: credentials saved.");
+			return {
+				method: "stored",
+				credentialType: "apiKey"
+			};
+		})), Match.exhaustive);
+	});
+	const configureOAuth = Effect.fn(function* (profileName) {
+		const scopes = yield* promptOAuthScopes();
+		return {
+			method: "oauth",
+			scopes,
+			accountId: yield* selectAccount((yield* oauthLogin(profileName, scopes)).access).pipe(Effect.mapError((e) => new AuthError({
+				message: "Cloudflare: could not list accounts",
+				cause: e
+			})))
+		};
+	});
+	const configureInteractive = (profileName) => select({
+		message: "Cloudflare authentication method",
+		options: options$3
+	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("oauth", () => configureOAuth(profileName)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
+		const config = ctx.ci ? { method: "env" } : yield* configureInteractive(profileName);
+		yield* store.delete(profileName, CREDENTIALS_FILE).pipe(Effect.ignore);
+		return config;
+	}).pipe(Effect.mapError((e) => new AuthError({
+		message: "failed to configure credentials",
+		cause: e
+	})));
+	const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fn(function* () {
+		const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID").pipe(Effect.flatMap((id) => validateAccountId(id, "from the CLOUDFLARE_ACCOUNT_ID env var")));
+		const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
+		if (apiToken) return {
+			type: "apiToken",
+			apiToken,
+			accountId,
+			source: { type: "env" }
+		};
+		const apiKey = yield* getEnvRedacted("CLOUDFLARE_API_KEY");
+		const email = yield* getEnvRedacted("CLOUDFLARE_EMAIL");
+		if (apiKey && email) return {
+			type: "apiKey",
+			apiKey,
+			email,
+			accountId,
+			source: { type: "env" }
+		};
+		return yield* new AuthError({ message: "Cloudflare env credentials not found. Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL." });
+	})), Match.when({ method: "stored" }, () => store.read(profileName, "cf-stored").pipe(Effect.flatMap((creds) => creds == null ? Effect.fail(new AuthError({ message: "Cloudflare stored credentials not found. Run: alchemy login --configure" })) : Effect.gen(function* () {
+		const envAccountId = yield* getEnv("CLOUDFLARE_ACCOUNT_ID");
+		const accountId = yield* validateAccountId(creds.accountId?.trim() || envAccountId, `stored for profile '${profileName}'`);
+		return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c$1) => ({
+			type: "apiToken",
+			apiToken: Redacted.make(c$1.apiToken),
+			accountId,
+			source: { type: "stored" }
+		})), Match.when({ type: "apiKey" }, (c$1) => ({
+			type: "apiKey",
+			apiKey: Redacted.make(c$1.apiKey),
+			email: Redacted.make(c$1.email),
+			accountId,
+			source: { type: "stored" }
+		})), Match.exhaustive);
+	})))), Match.when({ method: "oauth" }, (cfg) => Effect.gen(function* () {
+		const accountId = yield* validateAccountId(cfg.accountId, `configured for profile '${profileName}'`);
+		const creds = yield* store.read(profileName, "cf-oauth");
+		if (creds == null || creds.type !== "oauth") return yield* Effect.fail(new AuthError({ message: "Cloudflare OAuth credentials not found. Run: alchemy login" }));
+		const fresh = creds.expires > Date.now() + 1e4 ? creds : yield* refresh$1(creds).pipe(Effect.tap((refreshed) => store.write(profileName, "cf-oauth", refreshed)), Effect.mapError((e) => new AuthError({
+			message: "Cloudflare OAuth refresh failed. Run: alchemy login",
+			cause: e
+		})));
+		return {
+			type: "oauth",
+			accessToken: Redacted.make(fresh.access),
+			expires: fresh.expires,
+			accountId,
+			source: { type: "oauth" }
+		};
+	})), Match.exhaustive);
+	const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.delete(profileName, "cf-stored").pipe(Effect.andThen(success("Cloudflare: stored credentials removed")))), Match.when({ method: "oauth" }, () => store.read(profileName, "cf-oauth").pipe(Effect.tap((creds) => creds?.type === "oauth" ? revoke(creds).pipe(Effect.catchTag("OAuthError", (err) => warn(`Cloudflare: could not revoke OAuth token: ${err.errorDescription}`))) : Effect.void), Effect.andThen(store.delete(profileName, "cf-oauth")), Effect.andThen(success("Cloudflare: OAuth credentials removed.")))), Match.exhaustive).pipe(Effect.andThen(store.delete(profileName, CREDENTIALS_FILE).pipe(Effect.ignore)));
+	const login = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.read(profileName, "cf-stored").pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.when({ method: "oauth" }, (c$1) => Effect.gen(function* () {
+		const creds = yield* store.read(profileName, "cf-oauth");
+		if (creds?.type === "oauth") {
+			yield* info("Cloudflare: refreshing OAuth credentials...");
+			yield* refresh$1(creds).pipe(Effect.flatMap((refreshed) => store.write(profileName, "cf-oauth", refreshed).pipe(Effect.andThen(success("Cloudflare: OAuth credentials refreshed.")))), Effect.catchTag("OAuthError", () => oauthLogin(profileName, c$1.scopes).pipe(Effect.asVoid)));
+			return;
+		}
+		yield* oauthLogin(profileName, c$1.scopes);
+	})), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
+		message: "login failed",
+		cause: e
+	})));
+	const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
+		const sourceStr = creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type;
+		return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c$1) => Effect.all([
+			Console.log(`  apiToken: ${displayRedacted(c$1.apiToken, 9)}`),
+			Console.log(`  accountId: ${c$1.accountId}`),
+			Console.log(`  source: ${sourceStr}`)
+		])), Match.when({ type: "apiKey" }, (c$1) => Effect.all([
+			Console.log(`  apiKey: ${displayRedacted(c$1.apiKey)}`),
+			Console.log(`  email:  ${displayRedacted(c$1.email)}`),
+			Console.log(`  accountId: ${c$1.accountId}`),
+			Console.log(`  source: ${sourceStr}`)
+		])), Match.when({ type: "oauth" }, (c$1) => {
+			const remainingMs = c$1.expires - Date.now();
+			const expiresAt = new Date(c$1.expires).toISOString();
+			const expiresStr = remainingMs <= 0 ? `expired (${expiresAt})` : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
+			return Effect.all([
+				Console.log(`  accessToken: ${displayRedacted(c$1.accessToken)}`),
+				Console.log(`  expires: ${expiresStr}`),
+				Console.log(`  accountId: ${c$1.accountId}`),
+				Console.log(`  source: ${sourceStr}`)
+			]);
+		}), Match.exhaustive);
+	}));
+	return {
+		configure: configureCredentials,
+		logout,
+		login,
+		prettyPrint,
+		read: resolveCredentials
+	};
+}));
+const ALL_SCOPES = {
+	"access:read": "See Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
+	"access:write": "See and change Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
+	"account:read": "See your account info such as account details, analytics, and memberships",
+	"agw:read": "Grants read level access to Agents Gateway",
+	"agw:run": "Grants run level access to Agents Gateway",
+	"agw:write": "Grants read and write level access to Agents Gateway",
+	"ai:read": "Grants read level access to Workers AI",
+	"ai:write": "Grants write level access to Workers AI",
+	"aiaudit:read": "Grants read level access to AI Audit",
+	"aiaudit:write": "Grants write level access to AI Audit",
+	"aig:read": "Grants read level access to AI Gateway",
+	"aig:write": "Grants write level access to AI Gateway",
+	"auditlogs:read": "View Cloudflare Account Audit Logs",
+	"browser:read": "Grants read level access to Browser Rendering",
+	"browser:write": "Grants write level access to Browser Rendering",
+	"cfone:read": "Grants read level access to Cloudforce One data",
+	"cfone:write": "Grants write level access to Cloudforce One data",
+	"cloudchamber:write": "See and make changes to Cloudchamber",
+	"connectivity:admin": "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel",
+	"connectivity:bind": "read, list, and bind to Connectivity Directory services, as well as read and list Cloudflare Tunnels",
+	"connectivity:read": "See Connectivity Directory services and Cloudflare Tunnels",
+	"constellation:write": "Grants write access to Constellation configuration and models",
+	"containers:write": "See and make changes to Workers Containers",
+	"d1:write": "See and make changes to D1",
+	"dex:read": "Grants read level access to Cloudflare DEX",
+	"dex:write": "Grants write level access to Cloudflare DEX",
+	"dns_analytics:read": "Grants read level access to Cloudflare DNS Analytics",
+	"dns_records:edit": "Grants edit level access to dns records",
+	"dns_records:read": "Grants read level access to dns records",
+	"dns_settings:read": "Grants read level access to Cloudflare DNS Settings",
+	"firstpartytags:write": "Can see, edit and publish Google tag gateway configuration.",
+	"lb:edit": "Grants edit level access to lb and lb pools",
+	"lb:read": "Grants read level access to lb and lb pools",
+	"logpush:read": "See Cloudflare Logpush data",
+	"logpush:write": "See and change Cloudflare Logpush data",
+	"notification:read": "View Cloudflare Notifications",
+	"notification:write": "View and Modify Cloudflare Notifications",
+	"pages:read": "See Cloudflare Pages projects, settings and deployments",
+	"pages:write": "See and change Cloudflare Pages projects, settings and deployments",
+	"pipelines:read": "Grants read level access to Cloudflare Pipelines",
+	"pipelines:setup": "Grants permission to generate R2 tokens for Workers Pipelines",
+	"pipelines:write": "Grants write level access to Cloudflare Pipelines",
+	"query_cache:write": "See and make changes to Hyperdrive",
+	"queues:write": "See and change Cloudflare Queues settings and data",
+	"r2_catalog:write": "Grants write level access to R2 Data Catalog",
+	"radar:read": "Grants access to read Cloudflare Radar data",
+	"ai-search:read": "Grants read level access to AI Search",
+	"ai-search:write": "Grants write level access to AI Search",
+	"ai-search:run": "Grants run level access to AI Search",
+	"secrets_store:read": "Grants read level access to Secrets Store",
+	"secrets_store:write": "Grants write level access to Secrets Store",
+	"ssl_certs:write": "Grants read and write access to SSL MTLS certificates or Certificate Store",
+	"sso-connector:read": "See Cloudflare SSO connectors",
+	"sso-connector:write": "See Cloudflare SSO connectors to toggle activation and deactivation of SSO",
+	"teams:pii": "See personally identifiable Cloudflare Teams data",
+	"teams:read": "See Cloudflare Teams data such as zones, gateway, and argo tunnel details",
+	"teams:secure_location": "See all DNS Location data but can only change secure DNS Locations",
+	"teams:write": "See and change Cloudflare Teams data such as zones, gateway, and argo tunnel details",
+	"url_scanner:read": "Grants read level access to URL Scanner",
+	"url_scanner:write": "Grants write level access to URL Scanner",
+	"user:read": "See your user info such as name, email address, and account memberships",
+	"vectorize:write": "See and make changes to Vectorize",
+	"workers:read": "See Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
+	"workers:write": "See and change Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
+	"workers_builds:read": "See Cloudflare Workers Builds data such as builds, build configuration, and build logs",
+	"workers_builds:write": "See and change Cloudflare Workers Builds data such as builds, build configuration, and build logs",
+	"workers_kv:write": "See and change Cloudflare Workers KV Storage data such as keys and namespaces",
+	"workers_observability:read": "Grants read access to Cloudflare Workers Observability",
+	"workers_observability:write": "Grants read and write access to Cloudflare Workers Observability",
+	"workers_observability_telemetry:write": "Grants write access to Cloudflare Workers Observability Telemetry API",
+	"workers_routes:write": "See and change Cloudflare Workers data such as filters and routes",
+	"workers_scripts:write": "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data",
+	"workers_tail:read": "See Cloudflare Workers tail and script data",
+	"zone:read": "Grants read level access to account zone"
+};
+const DEFAULT_SCOPES = [
+	"account:read",
+	"ai-search:write",
+	"ai-search:run",
+	"ai:write",
+	"aig:read",
+	"aig:write",
+	"cloudchamber:write",
+	"connectivity:admin",
+	"containers:write",
+	"d1:write",
+	"pages:write",
+	"pipelines:write",
+	"queues:write",
+	"secrets_store:write",
+	"ssl_certs:write",
+	"user:read",
+	"vectorize:write",
+	"workers_kv:write",
+	"workers_observability:read",
+	"workers_observability:write",
+	"workers_observability_telemetry:write",
+	"workers_routes:write",
+	"workers_scripts:write",
+	"workers_tail:read",
+	"workers:write",
+	"zone:read"
+];
+const OAUTH_CLIENT_ID$1 = "6d8c2255-0773-45f6-b376-2914632e6f91";
+const OAUTH_REDIRECT_URI$1 = "http://localhost:9976/auth/callback";
+const OAUTH_ENDPOINTS$1 = {
+	authorize: "https://dash.cloudflare.com/oauth2/authorize",
+	token: "https://dash.cloudflare.com/oauth2/token",
+	revoke: "https://dash.cloudflare.com/oauth2/revoke"
+};
+
+//#endregion
+//#region lib/GitHub/AuthProvider.js
+init_AuthProvider();
+init_Credentials();
+const options$2 = [
+	{
+		value: "gh-cli",
+		label: "GitHub CLI",
+		hint: "delegate to `gh auth token` (run `gh auth login` first)"
+	},
+	{
+		value: "env",
+		label: "Environment Variables",
+		hint: "GITHUB_ACCESS_TOKEN or GITHUB_TOKEN"
+	},
+	{
+		value: "stored",
+		label: "Personal Access Token",
+		hint: "enter PAT interactively, stored in ~/.alchemy/credentials"
+	}
+];
+const GITHUB_AUTH_PROVIDER_NAME = "GitHub";
+var GhCliError = class extends Error {
+	_tag = "GhCliError";
+};
+/**
+* Layer that registers the GitHub {@link AuthProvider} into the
+* {@link AuthProviders} registry when built. Include this in the GitHub
+* `providers()` layer so `alchemy login` can discover it.
+*
+* Supported methods:
+* - `gh-cli`: shells out to `gh auth token` (recommended).
+* - `env`: reads `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN`.
+* - `stored`: prompts for a PAT and writes it to `~/.alchemy/credentials`.
+*
+* Browser/device OAuth is intentionally not implemented: GitHub's
+* OAuth App flow requires a `client_secret` we cannot ship, and
+* device flow is exactly what `gh auth login` already does.
+*/
+const GitHubAuth = AuthProviderLayer()(GITHUB_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+	const store = yield* CredentialsStore;
+	const cp = yield* ChildProcessSpawner;
+	const ghCliToken = () => Effect.gen(function* () {
+		const handle = yield* cp.spawn(ChildProcess$1.make("gh", ["auth", "token"], { shell: false }));
+		const [exitCode, stdout, stderr] = yield* Effect.all([
+			handle.exitCode,
+			Stream.mkString(Stream.decodeText(handle.stdout)),
+			Stream.mkString(Stream.decodeText(handle.stderr))
+		], { concurrency: 3 });
+		if (exitCode !== 0) return yield* Effect.fail(new GhCliError(`gh auth token exited with ${exitCode}: ${stderr.trim() || stdout.trim()}`));
+		const token = stdout.trim();
+		if (!token) return yield* Effect.fail(new GhCliError("gh auth token returned empty output"));
+		return token;
+	}).pipe(Effect.scoped, Effect.mapError((e) => e instanceof GhCliError ? new AuthError({
+		message: e.message,
+		cause: e
+	}) : new AuthError({
+		message: "Could not invoke `gh`. Install GitHub CLI from https://cli.github.com/ and run `gh auth login`.",
+		cause: e
+	})));
+	const loginStored = Effect.fn(function* (profileName) {
+		const token = yield* password({
+			message: "GitHub Personal Access Token (needs `repo` scope; `workflow` for Actions)",
+			validate: (v) => v.length === 0 ? "Required" : void 0
+		}).pipe(retryOnce);
+		yield* store.write(profileName, "gh-stored", {
+			type: "pat",
+			token
+		});
+		yield* success("GitHub: credentials saved.");
+		return { method: "stored" };
+	});
+	const configureInteractive = (profileName) => select({
+		message: "GitHub authentication method",
+		options: options$2
+	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("gh-cli", () => ghCliToken().pipe(Effect.as({ method: "gh-cli" }), Effect.mapError((e) => new AuthError({
+		message: `gh CLI not available: ${e.message}`,
+		cause: e
+	})))), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
+		if (ctx.ci) return { method: "env" };
+		return yield* configureInteractive(profileName);
+	}).pipe(Effect.mapError((e) => new AuthError({
+		message: "failed to configure credentials",
+		cause: e
+	})));
+	const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fn(function* () {
+		const access = yield* getEnvRedacted("GITHUB_ACCESS_TOKEN");
+		if (access) return {
+			type: "token",
+			token: access,
+			source: {
+				type: "env",
+				details: "GITHUB_ACCESS_TOKEN"
+			}
+		};
+		const token = yield* getEnvRedacted("GITHUB_TOKEN");
+		if (token) return {
+			type: "token",
+			token,
+			source: {
+				type: "env",
+				details: "GITHUB_TOKEN"
+			}
+		};
+		return yield* new AuthError({ message: "GitHub env credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN." });
+	})), Match.when({ method: "stored" }, () => store.read(profileName, "gh-stored").pipe(Effect.flatMap((creds) => creds == null ? Effect.fail(new AuthError({ message: "GitHub stored credentials not found. Run: alchemy login --configure" })) : Effect.succeed({
+		type: "token",
+		token: Redacted.make(creds.token),
+		source: { type: "stored" }
+	})))), Match.when({ method: "gh-cli" }, () => ghCliToken().pipe(Effect.map((token) => ({
+		type: "token",
+		token: Redacted.make(token),
+		source: { type: "gh-cli" }
+	})))), Match.exhaustive);
+	const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "gh-cli" }, () => Effect.void), Match.when({ method: "stored" }, () => store.delete(profileName, "gh-stored").pipe(Effect.andThen(success("GitHub: stored credentials removed")))), Match.exhaustive);
+	const login = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "gh-cli" }, () => ghCliToken().pipe(Effect.tap(() => success("GitHub: gh CLI authentication available.")), Effect.asVoid)), Match.when({ method: "stored" }, () => store.read(profileName, "gh-stored").pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
+		message: "login failed",
+		cause: e
+	})));
+	const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
+		const sourceStr = creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type;
+		return Effect.all([Console.log(`  token: ${displayRedacted(creds.token, 6)}`), Console.log(`  source: ${sourceStr}`)]);
+	}));
+	return {
+		configure: configureCredentials,
+		logout,
+		login,
+		prettyPrint,
+		read: resolveCredentials
+	};
+}));
+
+//#endregion
+//#region lib/Neon/AuthProvider.js
+init_AuthProvider();
+init_Credentials();
+init_Profile();
+const NEON_AUTH_PROVIDER_NAME = "Neon";
+const options$1 = [{
+	value: "env",
+	label: "Environment Variable",
+	hint: "NEON_API_KEY"
+}, {
+	value: "stored",
+	label: "API Key",
+	hint: "enter interactively, stored in ~/.alchemy/credentials"
+}];
+/**
+* Layer that registers the Neon {@link AuthProvider} into the
+* {@link AuthProviders} registry.
+*/
+const NeonAuth = AuthProviderLayer()(NEON_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+	const profiles = yield* AlchemyProfile;
+	const store = yield* CredentialsStore;
+	const loginStored = Effect.fn(function* (profileName) {
+		const apiKey = yield* password({
+			message: "Neon API Key",
+			validate: (v) => v.length === 0 ? "Required" : void 0
+		}).pipe(retryOnce);
+		yield* store.write(profileName, "neon-stored", {
+			type: "apiKey",
+			apiKey
+		});
+		yield* success("Neon: credentials saved.");
+		return { method: "stored" };
+	});
+	const configureInteractive = (profileName) => select({
+		message: "Neon authentication method",
+		options: options$1
+	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
+		if (ctx.ci) return { method: "env" };
+		return yield* configureInteractive(profileName);
+	}).pipe(Effect.mapError((e) => new AuthError({
+		message: "failed to configure credentials",
+		cause: e
+	})));
+	const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fn(function* () {
+		const apiKey = yield* getEnvRedacted("NEON_API_KEY");
+		if (!apiKey) return yield* new AuthError({ message: "Neon env credentials not found. Set NEON_API_KEY." });
+		return {
+			type: "apiKey",
+			apiKey,
+			source: { type: "env" }
+		};
+	})), Match.when({ method: "stored" }, () => store.read(profileName, "neon-stored").pipe(Effect.flatMap((creds) => creds == null ? Effect.fail(new AuthError({ message: "Neon stored credentials not found. Run: alchemy login --configure" })) : Effect.succeed({
+		type: "apiKey",
+		apiKey: Redacted.make(creds.apiKey),
+		source: { type: "stored" }
+	})))), Match.exhaustive);
+	const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.delete(profileName, "neon-stored").pipe(Effect.andThen(success("Neon: stored credentials removed")))), Match.exhaustive);
+	const login = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => getEnvRedacted("NEON_API_KEY").pipe(Effect.flatMap((apiKey) => apiKey ? Effect.void : Effect.gen(function* () {
+		const next = yield* configureInteractive(profileName);
+		const existing = yield* profiles.getProfile(profileName);
+		yield* profiles.setProfile(profileName, {
+			...existing,
+			[NEON_AUTH_PROVIDER_NAME]: next
+		});
+	})))), Match.when({ method: "stored" }, () => store.read(profileName, "neon-stored").pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
+		message: "login failed",
+		cause: e
+	})));
+	const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
+		const sourceStr = creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type;
+		return Effect.all([Console.log(`  apiKey: ${displayRedacted(creds.apiKey, 9)}`), Console.log(`  source: ${sourceStr}`)]);
+	}));
+	return {
+		configure: configureCredentials,
+		logout,
+		login,
+		prettyPrint,
+		read: resolveCredentials
+	};
+}));
+
+//#endregion
+//#region lib/Planetscale/OAuthClient.js
+init_AuthProvider();
+var OAuthError = class extends Data.TaggedError("OAuthError") {};
+/**
+* Registered PlanetScale OAuth application credentials.
+*
+* Unlike Cloudflare, PlanetScale OAuth has **no public-client flow** — the
+* token endpoint requires client authentication for every grant (PKCE is
+* advertised in their discovery doc but does not lift that requirement), so
+* exchanging the authorization code (and refreshing the token) requires the
+* application's `client_secret`. There is no way to keep that secret out of
+* a distributed CLI, so it ships here: the exposure is the same posture as a
+* public `client_id` (a stolen refresh token is usable, exactly like
+* Cloudflare's secret-less refresh), and it can be rotated by cutting a new
+* release. PlanetScale's own CLI ships its OAuth `client_secret` in source
+* the same way:
+* https://github.com/planetscale/cli/blob/main/internal/auth/authenticator.go
+*
+* Registered at https://app.planetscale.com with redirect URI
+* {@link OAUTH_REDIRECT_URI}. Scopes are configured on the application
+* itself, not requested per-authorization. Rotate by registering a new
+* secret and cutting a release.
+*/
+const OAUTH_CLIENT_ID = "pscale_app_aa12e3938baebb788aac443f66e422da";
+const OAUTH_CLIENT_SECRET = "pscale_app_secret_yyZ3Q8oe99GP9_yA5wrA5er6RuN6Lz9dC66Bj1OJzpg";
+const OAUTH_REDIRECT_URI = "http://localhost:9976/auth/callback";
+const OAUTH_ENDPOINTS = {
+	authorize: "https://app.planetscale.com/oauth/authorize",
+	token: "https://auth.planetscale.com/oauth/token"
+};
+function generateState(length = 32) {
+	return crypto$1.randomBytes(length).toString("base64url");
+}
+function extractCredentials(json) {
+	return {
+		type: "oauth",
+		access: json.access_token,
+		refresh: json.refresh_token,
+		expires: Date.now() + json.expires_in * 1e3,
+		scopes: json.scope ? json.scope.split(" ") : []
+	};
+}
+const tokenRequest = (params) => Effect.gen(function* () {
+	const url = new URL(OAUTH_ENDPOINTS.token);
+	for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+	const res = yield* Effect.tryPromise({
+		try: () => fetch(url.toString(), {
+			method: "POST",
+			headers: { Accept: "application/json" }
+		}),
+		catch: (err) => new OAuthError({
+			error: "network_error",
+			errorDescription: `Token request failed: ${err}`
+		})
+	});
+	if (!res.ok) {
+		const json = yield* Effect.tryPromise({
+			try: () => res.json(),
+			catch: () => new OAuthError({
+				error: "parse_error",
+				errorDescription: `Token endpoint returned ${res.status}`
+			})
+		});
+		return yield* new OAuthError({
+			error: json.error,
+			errorDescription: json.error_description
+		});
+	}
+	return extractCredentials(yield* Effect.tryPromise({
+		try: () => res.json(),
+		catch: () => new OAuthError({
+			error: "parse_error",
+			errorDescription: "Failed to parse token response"
+		})
+	}));
+});
+/**
+* Generate a PlanetScale authorization URL.
+*
+* No `scope` parameter is sent: PlanetScale scopes are configured on the
+* OAuth application itself, not requested per-authorization, so the
+* consent screen shows whatever the app is registered with.
+*/
+function authorize() {
+	const state = generateState();
+	const url = new URL(OAUTH_ENDPOINTS.authorize);
+	url.searchParams.set("client_id", OAUTH_CLIENT_ID);
+	url.searchParams.set("redirect_uri", OAUTH_REDIRECT_URI);
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("state", state);
+	return {
+		url: url.toString(),
+		state
+	};
+}
+/**
+* Exchange an authorization code for OAuth credentials.
+*/
+const exchange = (code) => tokenRequest({
+	grant_type: "authorization_code",
+	code,
+	client_id: OAUTH_CLIENT_ID,
+	client_secret: OAUTH_CLIENT_SECRET,
+	redirect_uri: OAUTH_REDIRECT_URI
+});
+/**
+* Refresh expired OAuth credentials.
+*/
+const refresh = (credentials) => tokenRequest({
+	grant_type: "refresh_token",
+	refresh_token: credentials.refresh,
+	client_id: OAUTH_CLIENT_ID,
+	client_secret: OAUTH_CLIENT_SECRET
+});
+/**
+* Start a local HTTP server to listen for the OAuth callback, exchange
+* the authorization code, and return the credentials.
+*
+* Times out after 5 minutes.
+*/
+const callback = (authorization) => Effect.tryPromise({
+	try: () => callbackPromise(authorization),
+	catch: (err) => {
+		if (err instanceof OAuthError) return err;
+		return new OAuthError({
+			error: "callback_error",
+			errorDescription: `OAuth callback failed: ${err}`
+		});
+	}
+});
+function callbackPromise(authorization) {
+	const { pathname, port } = new URL(OAUTH_REDIRECT_URI);
+	return new Promise((resolve, reject) => {
+		const server = http.createServer(async (req, res) => {
+			const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+			if (url.pathname !== pathname) {
+				res.statusCode = 404;
+				res.end("Not Found");
+				return;
+			}
+			const error = url.searchParams.get("error");
+			const errorDescription = url.searchParams.get("error_description");
+			if (error) {
+				res.writeHead(302, { Location: AUTH_ERROR_URL });
+				res.end();
+				cleanup();
+				reject(new OAuthError({
+					error,
+					errorDescription: errorDescription ?? "An unknown error occurred."
+				}));
+				return;
+			}
+			const code = url.searchParams.get("code");
+			const state = url.searchParams.get("state");
+			if (!code || !state) {
+				res.writeHead(302, { Location: AUTH_ERROR_URL });
+				res.end();
+				cleanup();
+				reject(new OAuthError({
+					error: "invalid_request",
+					errorDescription: "Missing code or state"
+				}));
+				return;
+			}
+			if (state !== authorization.state) {
+				res.writeHead(302, { Location: AUTH_ERROR_URL });
+				res.end();
+				cleanup();
+				reject(new OAuthError({
+					error: "invalid_request",
+					errorDescription: "Invalid state"
+				}));
+				return;
+			}
+			try {
+				const credentials = await Effect.runPromise(exchange(code));
+				res.writeHead(302, { Location: AUTH_SUCCESS_URL });
+				res.end();
+				cleanup();
+				resolve(credentials);
+			} catch (err) {
+				res.writeHead(302, { Location: AUTH_ERROR_URL });
+				res.end();
+				cleanup();
+				reject(err);
+			}
+		});
+		const timeout = setTimeout(() => {
+			cleanup();
+			reject(new OAuthError({
+				error: "timeout",
+				errorDescription: "The authorization process timed out."
+			}));
+		}, 300 * 1e3);
+		function cleanup() {
+			clearTimeout(timeout);
+			server.close();
+		}
+		server.on("error", (err) => {
+			cleanup();
+			reject(new OAuthError({
+				error: "server_error",
+				errorDescription: `Failed to start callback server: ${err.message}`
+			}));
+		});
+		server.listen(Number(port));
+	});
+}
+
+//#endregion
+//#region lib/Planetscale/AuthProvider.js
+init_AuthProvider();
+init_Credentials();
+/**
+* Canonical name registered in {@link AuthProviders}. Use this key to look
+* up the PlanetScale {@link AuthProvider} from inside provider Layers.
+*/
+const PLANETSCALE_AUTH_PROVIDER_NAME = "Planetscale";
+/**
+* Provide PlanetScale `Credentials` + `HttpClient` to an Effect using a
+* just-obtained OAuth access token. Used during configure to call
+* org-discovery endpoints before the user has chosen an org.
+*
+* `organization` is required by the credential type but isn't consulted by
+* `listOrganizations` (it's a user-scoped endpoint), so an empty string is
+* fine here.
+*/
+const withOAuthCredentials = (accessToken, effect) => Effect.provide(effect, Layer.mergeAll(PsCredentialsModule.fromOAuth({
+	accessToken,
+	organization: ""
+}), FetchHttpClient.layer));
+/**
+* List the organizations the OAuth user belongs to and either auto-pick
+* (one org) or prompt the user to choose. Returns the org's URL slug
+* (`name` field, used as `{organization}` in API paths).
+*/
+const selectOrganization = (accessToken) => Effect.gen(function* () {
+	const orgs = (yield* (yield* listOrganizations)({})).data;
+	if (orgs.length === 0) return yield* new AuthError({ message: "Planetscale: no organizations found for this credential." });
+	if (orgs.length === 1) {
+		const org = orgs[0];
+		yield* info(`Planetscale: using organization: ${org.name} (${org.id})`);
+		return org.name;
+	}
+	return yield* select({
+		message: "Select a Planetscale organization",
+		options: orgs.map((o) => ({
+			value: o.name,
+			label: o.name,
+			hint: o.id
+		}))
+	}).pipe(retryOnce);
+}).pipe((e) => withOAuthCredentials(accessToken, e));
+const options = [
+	{
+		value: "env",
+		label: "Environment Variables",
+		hint: "PLANETSCALE_API_TOKEN_ID + PLANETSCALE_API_TOKEN + PLANETSCALE_ORGANIZATION"
+	},
+	{
+		value: "oauth",
+		label: "OAuth",
+		hint: "recommended — browser-based login with automatic token refresh"
+	},
+	{
+		value: "stored",
+		label: "Service Token",
+		hint: "enter service token interactively, stored in ~/.alchemy/credentials"
+	}
+];
+/**
+* Layer that registers the PlanetScale {@link AuthProvider} into the
+* {@link AuthProviders} registry when built. Include this in the
+* PlanetScale `providers()` layer so `alchemy login` can discover it.
+*
+* Supported methods:
+* - `env`: reads `PLANETSCALE_API_TOKEN_ID`/`PLANETSCALE_API_TOKEN`/`PLANETSCALE_ORGANIZATION`.
+* - `stored`: prompts for a service token interactively and writes it to
+*   `~/.alchemy/credentials/<profile>/planetscale-stored.json`.
+* - `oauth`: browser-based login storing access/refresh tokens at
+*   `~/.alchemy/credentials/<profile>/planetscale-oauth.json`.
+*/
+const PlanetscaleAuth = AuthProviderLayer()(PLANETSCALE_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+	const store = yield* CredentialsStore;
+	const oauthLogin = (profileName) => Effect.gen(function* () {
+		const authorization = authorize();
+		yield* info("Planetscale: opening browser for OAuth login...");
+		yield* info(authorization.url);
+		yield* openUrl(authorization.url).pipe(Effect.catch(() => warn("Planetscale: could not open browser automatically. Please open the URL above manually.")));
+		yield* info("Planetscale: waiting for authorization (up to 5 minutes)...");
+		const credentials = yield* callback(authorization);
+		yield* store.write(profileName, "planetscale-oauth", credentials);
+		yield* success("Planetscale: OAuth credentials saved.");
+		return credentials;
+	});
+	const configureOAuth = Effect.fn(function* (profileName) {
+		return {
+			method: "oauth",
+			organization: yield* selectOrganization((yield* oauthLogin(profileName)).access).pipe(Effect.catch((e) => Effect.gen(function* () {
+				yield* warn(`Planetscale: could not auto-list organizations (${String(e)}). Falling back to manual entry.`);
+				return yield* text({
+					message: "Planetscale Organization (URL slug)",
+					validate: (v) => v.length === 0 ? "Required" : void 0
+				}).pipe(retryOnce);
+			})))
+		};
+	});
+	const loginStored = Effect.fn(function* (profileName) {
+		const tokenId = yield* text({
+			message: "Planetscale Service Token ID",
+			validate: (v) => v.length === 0 ? "Required" : void 0
+		}).pipe(retryOnce);
+		const token = yield* password({
+			message: "Planetscale Service Token",
+			validate: (v) => v.length === 0 ? "Required" : void 0
+		}).pipe(retryOnce);
+		const organization = yield* text({
+			message: "Planetscale Organization (URL slug)",
+			validate: (v) => v.length === 0 ? "Required" : void 0
+		}).pipe(retryOnce);
+		yield* store.write(profileName, "planetscale-stored", {
+			type: "apiToken",
+			tokenId,
+			token,
+			organization
+		});
+		yield* success("Planetscale: credentials saved.");
+		return { method: "stored" };
+	});
+	const configureInteractive = (profileName) => select({
+		message: "Planetscale authentication method",
+		options
+	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("oauth", () => configureOAuth(profileName)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
+		if (ctx.ci) return { method: "env" };
+		return yield* configureInteractive(profileName);
+	}).pipe(Effect.mapError((e) => new AuthError({
+		message: "failed to configure credentials",
+		cause: e
+	})));
+	const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fn(function* () {
+		return {
+			type: "apiToken",
+			tokenId: yield* getEnvRedactedRequired("PLANETSCALE_API_TOKEN_ID"),
+			token: yield* getEnvRedactedRequired("PLANETSCALE_API_TOKEN"),
+			organization: yield* getEnvRequired("PLANETSCALE_ORGANIZATION"),
+			source: {
+				type: "env",
+				details: "PLANETSCALE_API_TOKEN_ID/PLANETSCALE_API_TOKEN"
+			}
+		};
+	})), Match.when({ method: "stored" }, () => store.read(profileName, "planetscale-stored").pipe(Effect.flatMap((creds) => creds == null ? Effect.fail(new AuthError({ message: "Planetscale stored credentials not found. Run: alchemy login --configure" })) : Effect.succeed({
+		type: "apiToken",
+		tokenId: Redacted.make(creds.tokenId),
+		token: Redacted.make(creds.token),
+		organization: creds.organization,
+		source: {
+			type: "stored",
+			details: void 0
+		}
+	})))), Match.when({ method: "oauth" }, (cfg) => Effect.gen(function* () {
+		const creds = yield* store.read(profileName, "planetscale-oauth");
+		if (creds == null || creds.type !== "oauth") return yield* Effect.fail(new AuthError({ message: "Planetscale OAuth credentials not found. Run: alchemy login" }));
+		const fresh = creds.expires > Date.now() + 1e4 ? creds : yield* refresh(creds).pipe(Effect.tap((refreshed) => store.write(profileName, "planetscale-oauth", refreshed)), Effect.mapError((e) => new AuthError({
+			message: "Planetscale OAuth refresh failed. Run: alchemy login",
+			cause: e
+		})));
+		return {
+			type: "oauth",
+			accessToken: Redacted.make(fresh.access),
+			expires: fresh.expires,
+			organization: cfg.organization,
+			source: { type: "oauth" }
+		};
+	})), Match.exhaustive);
+	const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.delete(profileName, "planetscale-stored").pipe(Effect.andThen(success("Planetscale: stored credentials removed")))), Match.when({ method: "oauth" }, () => store.delete(profileName, "planetscale-oauth").pipe(Effect.andThen(success("Planetscale: OAuth credentials removed.")))), Match.exhaustive);
+	const login = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.read(profileName, "planetscale-stored").pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.when({ method: "oauth" }, (c$1) => Effect.gen(function* () {
+		const creds = yield* store.read(profileName, "planetscale-oauth");
+		if (creds?.type === "oauth") {
+			yield* info("Planetscale: refreshing OAuth credentials...");
+			yield* refresh(creds).pipe(Effect.flatMap((refreshed) => store.write(profileName, "planetscale-oauth", refreshed).pipe(Effect.andThen(success("Planetscale: OAuth credentials refreshed.")))), Effect.catchTag("OAuthError", () => oauthLogin(profileName).pipe(Effect.asVoid)));
+			return;
+		}
+		yield* oauthLogin(profileName);
+	})), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
+		message: "login failed",
+		cause: e
+	})));
+	const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
+		const sourceStr = creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type;
+		return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c$1) => Effect.all([
+			Console.log(`  tokenId: ${displayRedacted(c$1.tokenId, 3)}`),
+			Console.log(`  token: ${displayRedacted(c$1.token, 6)}`),
+			Console.log(`  organization: ${c$1.organization}`),
+			Console.log(`  source: ${sourceStr}`)
+		])), Match.when({ type: "oauth" }, (c$1) => {
+			const remainingMs = c$1.expires - Date.now();
+			const expiresAt = new Date(c$1.expires).toISOString();
+			const expiresStr = remainingMs <= 0 ? `expired (${expiresAt})` : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
+			return Effect.all([
+				Console.log(`  accessToken: ${displayRedacted(c$1.accessToken)}`),
+				Console.log(`  expires: ${expiresStr}`),
+				Console.log(`  organization: ${c$1.organization}`),
+				Console.log(`  source: ${sourceStr}`)
+			]);
+		}), Match.exhaustive);
+	}));
+	return {
+		configure: configureCredentials,
+		logout,
+		login,
+		prettyPrint,
+		read: resolveCredentials
+	};
+}));
+
 //#endregion
 //#region lib/Cli/commands/_shared.js
-var __rewriteRelativeImportExtension = void 0 && (void 0).__rewriteRelativeImportExtension || function(path$1, preserveJsx) {
-	if (typeof path$1 === "string" && /^\.\.?\//.test(path$1)) return path$1.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+init_AuthProvider();
+init_Profile();
+init_Stack();
+init_Stage();
+init_ConfigProvider();
+init_FileLogger();
+var __rewriteRelativeImportExtension = void 0 && (void 0).__rewriteRelativeImportExtension || function(path$2, preserveJsx) {
+	if (typeof path$2 === "string" && /^\.\.?\//.test(path$2)) return path$2.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
 		return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
 	});
-	return path$1;
+	return path$2;
 };
 const USER = Config.string("USER").pipe(Config.orElse(() => Config.string("USERNAME")), Config.withDefault("unknown"));
 const STAGE = Config.string("stage").pipe(Config.option, (a) => a, Effect.map(Option.getOrUndefined));
@@ -2556,7 +4447,10 @@ const dryRun = Flag.boolean("dry-run").pipe(Flag.withDescription("Dry run the de
 const yes = Flag.boolean("yes").pipe(Flag.withDescription("Yes to all prompts"), Flag.withDefault(false));
 const force = Flag.boolean("force").pipe(Flag.withDescription("Force updates for resources that would otherwise no-op"), Flag.withDefault(false));
 const script = Argument.file("main", { mustExist: true }).pipe(Argument.withDescription("Main file to deploy, defaults to alchemy.run.ts"), Argument.withDefault("alchemy.run.ts"));
-const profile = Flag.string("profile").pipe(Flag.withDescription("Auth profile to use (~/.alchemy/profiles.json). Defaults to 'default' or $ALCHEMY_PROFILE."), Flag.optional, Flag.map(Option.getOrElse(() => "default")));
+const profile = Flag.string("profile").pipe(Flag.withDescription("Auth profile to use (~/.alchemy/profiles.json). Defaults to $ALCHEMY_PROFILE or 'default'."), Flag.optional, Flag.mapEffect(Effect.fn(function* (profile$1) {
+	if (Option.isSome(profile$1)) return profile$1.value;
+	return yield* ALCHEMY_PROFILE.pipe(Effect.catch(() => Effect.succeed("default")));
+})));
 const resourceFilter = Flag.string("filter").pipe(Flag.withDescription("Comma-separated logical resource IDs (e.g. Api,Sandbox). Only those resources are included."), Flag.optional, Flag.map(Option.getOrUndefined));
 /**
 * Wraps a CLI command handler with a top-level OpenTelemetry span
@@ -2603,7 +4497,11 @@ const printProfile = Effect.fn(function* (profile$1, stored, registry) {
 			for (const [k, v] of Object.entries(rest)) yield* Console.log(`  ${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`);
 			continue;
 		}
-		yield* provider.prettyPrint(profile$1, cfg);
+		yield* provider.prettyPrint(profile$1, cfg).pipe(Effect.catchCause((cause) => {
+			const error = Cause.squash(cause);
+			const message = error instanceof Error ? error.message : String(error);
+			return Console.log(`  Failed to retrieve credentials: ${message}`);
+		}));
 	}
 });
 const importStack = Effect.fn(function* (main) {
@@ -2612,6 +4510,59 @@ const importStack = Effect.fn(function* (main) {
 	if (!Effect.isEffect(stackEffect)) return yield* Effect.die(/* @__PURE__ */ new Error(`Main file '${main}' must export a default stack definition (export default Alchemy.Stack({...}))`));
 	return stackEffect;
 });
+/**
+* Placeholder {@link Stack.Stack} value used while building a stack's
+* `providers()` layer out of band. No real resources exist yet — we only
+* want the layer's provider/auth registrations and cloud-environment
+* services, so `resources`/`bindings`/`actions` are empty and the stage is a
+* sentinel.
+*/
+const placeholderStack = (name) => ({
+	actions: {},
+	bindings: {},
+	name,
+	resources: {},
+	stage: "placeholder"
+});
+/**
+* Import a stack entrypoint and build its `providers()` (+ `state()`) layer
+* out of band against placeholder {@link Stack.Stack}/{@link Stage} services,
+* so its `AuthProviderLayer` registrations land in an {@link AuthProviders}
+* registry and the built context holds every resource provider plus the
+* cloud-environment services their operations need.
+*
+* Shared by `alchemy login`, `alchemy profile show`, and `alchemy unsafe
+* nuke`. The caller decides what to do with the result — use `authProviders`
+* (login / profile show) or `context` (nuke) — and whether a missing/invalid
+* entrypoint is fatal (login / nuke let it propagate) or best-effort
+* (profile show wraps the call in `Effect.catchCause`).
+*/
+const buildStackProviders = Effect.fn("buildStackProviders")(function* (options$6) {
+	const authProviders = options$6.registry ?? {};
+	const stackEffect = yield* importStack(options$6.main);
+	const configProvider = withProfileOverride(yield* loadConfigProvider(options$6.envFile), options$6.profile);
+	return {
+		authProviders,
+		context: yield* Layer.build((stackEffect.providers ?? Layer.empty).pipe(Layer.provideMerge(stackEffect.state ?? Layer.empty), Layer.provideMerge(Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(configProvider), options$6.logger ?? Logger.layer([fileLogger("out")], { mergeWithExisting: true }), Layer.succeed(Stage, "placeholder"), Layer.succeed(Stack, placeholderStack(stackEffect.stackName)), options$6.extra ?? Layer.empty)))),
+		stackEffect
+	};
+});
+/**
+* The auth providers Alchemy ships with. Used as the baseline registry so
+* `alchemy login` works from any folder (no `alchemy.run.ts` required) and
+* `alchemy profile show` can pretty-print any provider a profile mentions,
+* even one the current stack doesn't wire up.
+*/
+const builtinAuth = Layer.mergeAll(AwsAuth, AxiomAuth, CloudflareAuth, GitHubAuth, NeonAuth, PlanetscaleAuth);
+/**
+* Build {@link builtinAuth} against `registry` so every built-in auth
+* provider registers itself, without importing any stack entrypoint.
+*/
+const buildBuiltinAuthProviders = Effect.fn("buildBuiltinAuthProviders")(function* (options$6) {
+	const authProviders = options$6.registry ?? {};
+	yield* Layer.build(Layer.provide(builtinAuth, Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(options$6.envFile), options$6.profile)), Logger.layer([fileLogger("out")], { mergeWithExisting: true }))));
+	return authProviders;
+});
 
 //#endregion
 //#region lib/Cli/commands/deploy.js
@@ -2788,17 +4739,14 @@ const LoggingCli = Layer.succeed(Cli, Cli.of({
 			fail: 0
 		};
 		return {
-			emit: (event) => Effect.sync(() => {
-				if (event.kind === "annotate") {
-					console.log(`${tag(event.id)} ${blue(event.message)}`);
-					return;
-				}
+			emit: (event) => Effect.suspend(() => {
+				if (event.kind === "annotate") return Console.log(`${tag(event.id)} ${blue(event.message)}`);
 				const id = event.bindingId ? `${event.id}/${event.bindingId}` : event.id;
 				const status = statusColor$1(event.status)(event.status);
 				const msg = event.message ? ` ${dim("—")} ${event.message}` : "";
-				console.log(`${tag(id)} ${status}${msg}`);
 				if (isTerminal(event.status)) if (event.status === "fail") counts.fail++;
 				else counts.ok++;
+				return Console.log(`${tag(id)} ${status}${msg}`);
 			}),
 			done: () => Console.log(`\n${bold("Done:")} ${green(`${counts.ok} succeeded`)}${counts.fail ? dim(", ") + red(`${counts.fail} failed`) : ""}`)
 		};
@@ -2815,15 +4763,15 @@ function buildNamespaceTree(items, actions = []) {
 		resources: [],
 		actions: []
 	};
-	const getNode = (path$1) => {
+	const getNode = (path$2) => {
 		let current = root;
-		for (let i = 0; i < path$1.length; i++) {
-			const segment = path$1[i];
+		for (let i = 0; i < path$2.length; i++) {
+			const segment = path$2[i];
 			let child = current.children.get(segment);
 			if (!child) {
 				child = {
 					id: segment,
-					path: path$1.slice(0, i + 1),
+					path: path$2.slice(0, i + 1),
 					children: /* @__PURE__ */ new Map(),
 					resources: [],
 					actions: []