alchemy 2.0.0-beta.64 → 2.0.0-beta.65

package/src/Cloudflare/Workers/WorkerBundle.ts

@@ -20,6 +20,25 @@ import {
   type DurableObjectExport,
 } from "./DurableObject.ts";
 
+/**
+ * Bundler options for a Worker: the generic {@link Bundle.BundleExtraOptions}
+ * plus rolldown output overrides merged over Alchemy's defaults.
+ */
+export interface WorkerBuildOptions extends Bundle.BundleExtraOptions {
+  /**
+   * Rolldown output options merged over Alchemy's defaults. Use this to
+   * control chunking (`codeSplitting`), minification, etc.
+   */
+  output?: rolldown.OutputOptions;
+  /**
+   * Forwarded to rolldown's `preserveEntrySignatures` input option. Some
+   * `output.codeSplitting` configurations require relaxing it (e.g.
+   * `includeDependenciesRecursively: false` needs `"allow-extension"`).
+   * Workers must keep their entry exports, so never pass `false`.
+   */
+  preserveEntrySignatures?: rolldown.InputOptions["preserveEntrySignatures"];
+}
+
 export interface WorkerBundleOptions {
   id: string;
   main: string;
@@ -36,7 +55,7 @@ export interface WorkerBundleOptions {
         exports: Record<string, DurableObjectExport | WorkflowExport>;
       };
   stack: { name: string; stage: string };
-  extraOptions: Bundle.BundleExtraOptions | undefined;
+  extraOptions: WorkerBuildOptions | undefined;
 }
 
 export const WorkerBundle = Effect.gen(function* () {
@@ -48,6 +67,7 @@ export const WorkerBundle = Effect.gen(function* () {
     const realMain = yield* sanitizeMain(options.main);
     const inputOptions: rolldown.InputOptions = {
       input: realMain,
+      preserveEntrySignatures: options.extraOptions?.preserveEntrySignatures,
       // Forever-devtool native modules that vite/chokidar reference behind
       // runtime guards. Rolldown resolves before tree-shaking, so the dead
       // `require('../pkg')` (lightningcss < 1.32) and `require('fsevents')`
@@ -89,7 +109,17 @@ export const WorkerBundle = Effect.gen(function* () {
       sourcemap: "hidden",
       minify: true,
       keepNames: true,
+      // Rolldown's default chunking can split top-level initializer modules
+      // (e.g. Drizzle `pgTable` schemas) away from the classes they read,
+      // and workerd then evaluates a reader before its imported binding is
+      // initialized — the script fails Cloudflare startup validation with
+      // `ScriptStartupError: Cannot access '<minified>' before
+      // initialization` (#749). `strictExecutionOrder` wraps cross-chunk
+      // modules so evaluation follows ESM semantics regardless of how the
+      // graph was chunked. See DrizzleSchemaChunks.test.ts.
+      strictExecutionOrder: true,
       dir: `.alchemy/bundles/${options.id}`,
+      ...options.extraOptions?.output,
     };
     return { inputOptions, outputOptions, extraOptions: options.extraOptions };
   });

package/src/Cloudflare/Workers/WorkerProvider.ts

@@ -23,7 +23,12 @@ import { sha256Object } from "../../Util/sha256.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import { CloudflareLogs } from "../Logs.ts";
 import { listAllZones, resolveZoneId } from "../Zone/lookup.ts";
-import { readAssets, uploadAssets } from "./Assets.ts";
+import {
+  mergeAssetsConfigFiles,
+  readAssets,
+  readAssetsConfigFiles,
+  uploadAssets,
+} from "./Assets.ts";
 import { getCompatibility } from "./Compatibility.ts";
 import { isDurableObjectExport } from "./DurableObject.ts";
 import { LocalWorkerProvider } from "./LocalWorkerProvider.ts";
@@ -1360,8 +1365,8 @@ export const LiveWorkerProvider = () =>
         output: Worker["Attributes"] | undefined,
       ) => {
         if (!Predicate.hasProperty(assets, "hash")) return undefined;
-        const { directory: _, hash, ...config } = assets;
-        return { config, hash, skip: hash === output?.hash?.assets };
+        const { directory, hash, ...config } = assets;
+        return { directory, config, hash, skip: hash === output?.hash?.assets };
       };
 
       const putWorker = Effect.fn(function* (
@@ -1445,7 +1450,16 @@ export const LiveWorkerProvider = () =>
             `Cloudflare Worker update: assets unchanged for ${name}, keeping existing`,
           );
           keepAssets = true;
-          metadataAssets = { config: prebuiltAssets.config };
+          // `keepAssets` only preserves the uploaded files — the PUT
+          // replaces the asset config wholesale. The skip path never
+          // walked the directory, so read just `_headers`/`_redirects`
+          // here or a no-op deploy would wipe their rules.
+          metadataAssets = {
+            config: mergeAssetsConfigFiles(
+              prebuiltAssets.config,
+              yield* readAssetsConfigFiles(prebuiltAssets.directory),
+            ),
+          };
           metadataBindings.push({
             type: "assets",
             name: "ASSETS",

package/src/Cloudflare/Workflows/WorkflowBridge.ts

@@ -116,7 +116,7 @@ const wrapWorkflowEvent = (event: any): WorkflowEventService["Service"] => ({
   schedule: event.schedule,
 });
 
-const wrapWorkflowStep = (step: any): WorkflowStep["Service"] => ({
+export const wrapWorkflowStep = (step: any): WorkflowStep["Service"] => ({
   do: <T>(options: WorkflowTaskOptions<T, any, any>): Effect.Effect<T> => {
     const { name } = options;
     // The surrounding body context is already provided in `task`; the bridge
@@ -151,7 +151,7 @@ const wrapWorkflowStep = (step: any): WorkflowStep["Service"] => ({
           rollbackConfig: options.rollbackConfig,
         }
       : undefined;
-    return Effect.tryPromise(() => {
+    return Effect.promise(() => {
       if (config && rollback) return step.do(name, config, callback, rollback);
       if (config) return step.do(name, config, callback);
       if (rollback) return step.do(name, callback, rollback);
@@ -159,14 +159,14 @@ const wrapWorkflowStep = (step: any): WorkflowStep["Service"] => ({
     });
   },
   sleep: (name: string, duration: string | number): Effect.Effect<void> =>
-    Effect.tryPromise(() => step.sleep(name, duration)),
+    Effect.promise(() => step.sleep(name, duration)),
   sleepUntil: (name: string, timestamp: Date | number): Effect.Effect<void> =>
-    Effect.tryPromise(() => step.sleepUntil(name, timestamp)),
+    Effect.promise(() => step.sleepUntil(name, timestamp)),
   waitForEvent: <T>(
     name: string,
     options: any,
   ): Effect.Effect<WorkflowStepEvent<T>> =>
-    Effect.tryPromise(
+    Effect.promise(
       () => step.waitForEvent(name, options) as Promise<WorkflowStepEvent<T>>,
     ),
 });

package/src/Cloudflare/Workflows/index.ts

@@ -1,2 +1,2 @@
 export * from "./Workflow.ts";
-export * from "./WorkflowBridge.ts";
+export { makeWorkflowBridge } from "./WorkflowBridge.ts";

package/src/Docker/Container.ts

@@ -8,6 +8,7 @@ import { isResolved } from "../Diff.ts";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
 import { createInternalTags, hasAlchemyTags } from "../Tags.ts";
+import { toSeconds } from "../Util/Duration.ts";
 import { Docker, dockerPhysicalName } from "./Docker.ts";
 import type { Providers } from "./Providers.ts";
 
@@ -30,6 +31,16 @@ export interface ContainerProps {
   volumes?: Container.VolumeMapping[];
   /** Restart policy. */
   restart?: "no" | "always" | "on-failure" | "unless-stopped";
+  /**
+   * Container labels. Alchemy's internal ownership labels are added
+   * automatically.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Grace period before Docker forcefully kills the container after stopping
+   * it.
+   */
+  stopTimeout?: Duration.Input;
   /** Networks to connect after create. */
   networks?: Container.NetworkMapping[];
   /** Remove the container when it exits. @default false */
@@ -161,6 +172,22 @@ export interface Container extends Resource<
  * });
  * const runtime = yield* Docker.inspectContainer(postgresName);
  * ```
+ *
+ * @section Traefik
+ * @example Route a container through Traefik
+ * ```typescript
+ * const api = yield* Docker.Container("api", {
+ *   image: "ghcr.io/acme/api:latest",
+ *   networks: [{ name: "traefik" }],
+ *   labels: {
+ *     "traefik.enable": "true",
+ *     "traefik.http.routers.api.rule": "Host(`api.example.com`)",
+ *     "traefik.http.services.api.loadbalancer.server.port": "3000",
+ *   },
+ *   stopTimeout: "30 seconds",
+ *   start: true,
+ * });
+ * ```
  */
 export const Container = Resource<Container>("Docker.Container");
 
@@ -308,7 +335,7 @@ export const ContainerProvider = () =>
           const internalTags = yield* createInternalTags(id);
           const { stdout: containerId } = yield* docker.container.create({
             ...args,
-            label: internalTags,
+            label: { ...args.label, ...internalTags },
           });
           yield* Effect.forEach(
             news.networks ?? [],
@@ -355,6 +382,8 @@ const makeCreateArgs = (id: string, news: ContainerProps, instanceId: string) =>
             `${port.external}:${port.internal}/${port.protocol ?? "tcp"}`,
         ),
         restart: news.restart ?? "no",
+        label: news.labels,
+        "stop-timeout": toSeconds(news.stopTimeout)?.toString(),
         rm: news.removeOnExit ?? false,
         ...(news.healthcheck
           ? {

package/src/Docker/Docker.ts

@@ -49,6 +49,7 @@ export class Docker extends Context.Service<
         "health-retries": number | undefined;
         "health-start-period": string | undefined;
         "health-start-interval": string | undefined;
+        "stop-timeout": string | undefined;
         p: Array<string> | undefined;
         command: Array<string> | undefined;
         label?: Record<string, string>;
@@ -193,6 +194,7 @@ export declare namespace Docker {
       Cmd: string[] | null;
       Env: string[] | null;
       Labels: Record<string, string> | null;
+      StopTimeout?: number;
       Healthcheck?: {
         Test: string[] | null;
         Interval?: number;

package/src/Output.ts

@@ -12,7 +12,7 @@ import { RuntimeContext, sanitizeKey } from "./RuntimeContext.ts";
 import { Stack } from "./Stack.ts";
 import { Stage } from "./Stage.ts";
 import * as State from "./State/State.ts";
-import { isPrimitive } from "./Util/data.ts";
+import { isPrimitive, type Primitive } from "./Util/data.ts";
 
 const inspect = Symbol.for("nodejs.util.inspect.custom");
 
@@ -73,16 +73,24 @@ export interface Output<A = any, Req = any> extends Pipeable {
 
 export interface Accessor<A> extends Effect.Effect<A> {}
 
-export type ToOutput<A, Req = never> = [Extract<A, object>] extends [never]
-  ? Output<A, Req>
-  : [Extract<A, any[]>] extends [never]
-    ? ObjectExpr<
-        {
-          [attr in keyof A]: A[attr];
-        },
-        Req
-      >
-    : ArrayExpr<Extract<A, any[]>, Req>;
+export type ToOutput<A, Req = never> =
+  // Branded primitives (`string & Brand<"...">`) are assignable to `object`
+  // via the brand intersection, so they must short-circuit to a plain Output
+  // before the object check — otherwise they explode into an ObjectExpr
+  // mapped over every String/Number method. Date is opaque for the same
+  // reason (mirrors AttrOutput in Resource.ts).
+  [A] extends [Primitive | Date]
+    ? Output<A, Req>
+    : [Extract<A, object>] extends [never]
+      ? Output<A, Req>
+      : [Extract<A, any[]>] extends [never]
+        ? ObjectExpr<
+            {
+              [attr in keyof A]: A[attr];
+            },
+            Req
+          >
+        : ArrayExpr<Extract<A, any[]>, Req>;
 
 export const ExprSymbol = Symbol.for("alchemy/Expr");
 

package/src/Provider.ts

@@ -134,6 +134,26 @@ export interface ProviderService<
      * {@link singleton}, these are ordinary multi-instance resources.
      */
     skip?: boolean;
+    /**
+     * Provider IDs (picomatch globs, e.g. `"AWS.IAM.Role"` or `"AWS.EC2.*"`)
+     * whose resources this type's **cloud-side teardown** consumes — they
+     * must still exist while this type is deleting. `alchemy unsafe nuke`
+     * topologically orders deletion so every resource of this type is fully
+     * gone before any matching type starts deleting; if this type's deletes
+     * fail, the matching types are held back rather than deleted out from
+     * under an in-flight teardown.
+     *
+     * Example: SageMaker HyperPod deletes node ENIs by assuming the
+     * instance group's execution role — deleting the role (or the VPC)
+     * mid-teardown wedges the cluster in `Deleting` permanently, so
+     * `AWS.SageMaker.Cluster` declares `dependsOn: ["AWS.IAM.Role", ...]`.
+     *
+     * The constraint only takes effect when resources of this type are
+     * actually present in the nuke target set; declaration cycles collapse
+     * into a single concurrent wave (with a logged warning) instead of
+     * failing.
+     */
+    dependsOn?: readonly string[];
   };
   /**
    * Enumerates every existing resource of this type in the ambient scope

package/src/Resource.ts

@@ -190,9 +190,26 @@ export type Resource<
       ...args: any[]
     ): (binding: Input<Binding>) => Effect.Effect<void>;
   } & {
-    [attr in keyof Attributes]-?: Output.Output<Attributes[attr], never>;
+    [attr in keyof Attributes]-?: AttrOutput<Attributes[attr]>;
   };
 
+/**
+ * Accessor type for one attribute. Pure object attributes upgrade to
+ * {@link Output.ObjectExpr} so nested access is typed —
+ * `hyperpod.instanceGroups.workers` — while primitives, unions with
+ * `undefined`, branded string unions (`"a" | (string & {})`), and arrays
+ * stay plain {@link Output.Output} (running them through `ToOutput` would
+ * classify the `string & {}` branch as an object and explode into
+ * String-method mapped types).
+ */
+type AttrOutput<A> = [A] extends [
+  string | number | boolean | bigint | null | undefined | Date | any[],
+]
+  ? Output.Output<A, never>
+  : [A] extends [Record<string, any>]
+    ? Output.ObjectExpr<A, never>
+    : Output.Output<A, never>;
+
 export interface ResourceOptions {
   /**
    * Default removal policy for this resource type when the caller has not

package/src/SQL/D1.ts

@@ -31,7 +31,7 @@ export type D1Config = Omit<D1Client.D1ClientConfig, "db">;
  * resolved once at Worker init and used from any handler:
  *
  * ```typescript
- * import * as SQL from "alchemy/SQL";
+ * import * as SQL from "alchemy/SQL/D1";
  *
  * const d1 = yield* Cloudflare.D1.QueryDatabase(Db);
  * const sql = yield* SQL.D1(d1);

package/src/SQL/Postgres.ts

@@ -28,7 +28,7 @@ export type PostgresConfig<E, R> = Omit<PgClient.PgPoolConfig, "url"> & {
  * handler:
  *
  * ```typescript
- * import * as SQL from "alchemy/SQL";
+ * import * as SQL from "alchemy/SQL/Postgres";
  *
  * const hd = yield* Cloudflare.Hyperdrive.Connect(Hyperdrive);
  * const sql = yield* SQL.Postgres({ url: hd.connectionString });

package/src/Test/Alchemy.ts

@@ -3,7 +3,7 @@
 /**
  * Test adapter for the `alchemy-test` runner (see `packages/alchemy-test`).
  *
- * Same shape as {@link "./Bun.ts"}, but registers
+ * Same shape as {@link "./Vitest.ts"} / {@link "./Bun.ts"}, but registers
  * tests as raw Effects with the alchemy-test harness so the single-process
  * runner can inject a buffering Logger/Console per test and manage
  * concurrency + timeouts itself.

package/src/Test/Vitest.ts

@@ -0,0 +1,244 @@
+/** @effect-diagnostics anyUnknownInErrorContext:off */
+import { it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Scope from "effect/Scope";
+import {
+  afterAll as vitestAfterAll,
+  afterEach as vitestAfterEach,
+  beforeAll as vitestBeforeAll,
+  beforeEach as vitestBeforeEach,
+} from "vitest";
+
+import type { AlchemyContext } from "../AlchemyContext.ts";
+import type { CompiledStack } from "../Stack.ts";
+import type { Stage } from "../Stage.ts";
+import * as Core from "./Core.ts";
+
+export {
+  executeWhenReady,
+  getWhenReady,
+  guardContentType,
+  guardedFetchLayer,
+  rpcClientLayer,
+  WorkerNotReady,
+  type EdgeGuardOptions,
+  type WhenReadyOptions,
+} from "./Http.ts";
+
+export type MakeOptions<ROut = any> = Core.MakeOptions<ROut>;
+export type ScratchStack = Core.ScratchStack;
+export type TestEffect<A, R = never> = Core.TestEffect<A, R>;
+
+type TestOptions = number | { timeout?: number };
+
+const timeoutOf = (opts: TestOptions | undefined): number | undefined =>
+  typeof opts === "number" ? opts : opts?.timeout;
+
+interface TestFn {
+  (name: string, eff: TestEffect<void>, options?: TestOptions): void;
+  skip: (name: string, eff: TestEffect<void>, options?: TestOptions) => void;
+  skipIf: (
+    condition: boolean,
+  ) => (name: string, eff: TestEffect<void>, options?: TestOptions) => void;
+  only: (name: string, eff: TestEffect<void>, options?: TestOptions) => void;
+  todo: (name: string, eff: TestEffect<void>, options?: TestOptions) => void;
+  provider: ProviderFn;
+}
+
+interface ProviderFn {
+  (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+    options?: TestOptions,
+  ): void;
+  skip: (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+    options?: TestOptions,
+  ) => void;
+  skipIf: (
+    condition: boolean,
+  ) => (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+    options?: TestOptions,
+  ) => void;
+}
+
+interface BeforeAllFn {
+  <A>(eff: TestEffect<A>, options?: TestOptions): Effect.Effect<A>;
+}
+
+interface BeforeEachFn {
+  (eff: TestEffect<void>, options?: TestOptions): void;
+}
+
+interface AfterAllFn {
+  (eff: TestEffect<any>, options?: TestOptions): void;
+  skipIf: (
+    predicate: boolean,
+  ) => (eff: TestEffect<any>, options?: TestOptions) => void;
+}
+
+interface AfterEachFn {
+  (eff: TestEffect<void>, options?: TestOptions): void;
+}
+
+export interface TestApi {
+  test: TestFn;
+  beforeAll: BeforeAllFn;
+  beforeEach: BeforeEachFn;
+  afterAll: AfterAllFn;
+  afterEach: AfterEachFn;
+  deploy: <A>(
+    stack: TestEffect<CompiledStack<A>, Stage | AlchemyContext>,
+    options?: { stage?: string },
+  ) => ReturnType<typeof Core.deploy<A>>;
+  destroy: (
+    stack: TestEffect<CompiledStack, Stage | AlchemyContext>,
+    options?: { stage?: string },
+  ) => ReturnType<typeof Core.destroy>;
+}
+
+const DEFAULT_TIMEOUT = 120_000;
+
+/**
+ * Build the per-file test API. See {@link "./Bun.ts"} for the same shape
+ * over `bun:test`. Vitest variant uses `@effect/vitest`'s `it.live` so
+ * Effect-aware tests stay first-class.
+ */
+export const make = <ROut = any>(options: MakeOptions<ROut>): TestApi => {
+  // See `Test/Bun.ts` for the rationale: the dev sidecar must outlive a
+  // single `runPromise` boundary, so all hooks share one scope that's only
+  // closed after `destroy(...)` runs.
+  const sharedScope = Scope.makeUnsafe("sequential");
+  const wrap = <A>(eff: TestEffect<A>) =>
+    Core.toEffect(eff, options, sharedScope);
+  const runEff = <A>(eff: TestEffect<A>) => Core.run(eff, options, sharedScope);
+
+  const test = ((name, eff, opts) => {
+    it.live(name, () => wrap(eff), timeoutOf(opts));
+  }) as TestFn;
+
+  test.skip = (name, _eff, opts) => {
+    it.skip(name, () => {}, timeoutOf(opts));
+  };
+  test.skipIf = (condition) => (name, eff, opts) => {
+    if (condition) {
+      it.skip(name, () => {}, timeoutOf(opts));
+    } else {
+      it.live(name, () => wrap(eff), timeoutOf(opts));
+    }
+  };
+  test.only = (name, eff, opts) => {
+    it.only(name, () => wrap(eff) as Effect.Effect<any>, timeoutOf(opts));
+  };
+  test.todo = (name, _eff, _opts) => {
+    it.todo(name);
+  };
+
+  const wrapProvider = (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+  ) => {
+    const scratch = Core.scratchStack(options, name);
+    // Guarantee teardown. `test.provider` has no built-in cleanup, so a body
+    // that fails (assertion, API error like a 409/Unauthorized) or is
+    // interrupted (vitest timeout) BEFORE its trailing `stack.destroy()` would
+    // otherwise leak every cloud resource it deployed: the scratch's in-memory
+    // state is discarded with the process, so no later run can reclaim the
+    // orphan (only an account-wide `nuke` can). `scratch.destroy()` is
+    // idempotent (empty-plan apply against the shared scratch state) — a no-op
+    // when the body already destroyed, and it reclaims the orphans otherwise.
+    // `Effect.ensuring` runs the finalizer on success, failure, AND interruption.
+    const body = Core.withProviders(fn(scratch), options, scratch.name).pipe(
+      Effect.ensuring(scratch.destroy().pipe(Effect.ignore)),
+    );
+    return Core.toEffect(
+      body,
+      { ...options, state: scratch.state },
+      sharedScope,
+    );
+  };
+
+  const provider = ((name, fn, opts) => {
+    it.live(name, () => wrapProvider(name, fn), timeoutOf(opts));
+  }) as ProviderFn;
+  provider.skip = (name, _fn, opts) => {
+    it.skip(name, () => {}, timeoutOf(opts));
+  };
+  provider.skipIf = (condition) => (name, fn, opts) => {
+    if (condition) {
+      it.skip(name, () => {}, timeoutOf(opts));
+    } else {
+      it.live(name, () => wrapProvider(name, fn), timeoutOf(opts));
+    }
+  };
+  test.provider = provider;
+
+  const beforeAll: BeforeAllFn = <A>(
+    eff: TestEffect<A>,
+    hookOptions?: TestOptions,
+  ) => {
+    let result: A;
+    vitestBeforeAll(
+      () => runEff(eff).then((v) => (result = v)),
+      timeoutOf(hookOptions) ?? DEFAULT_TIMEOUT,
+    );
+    return Effect.sync(() => result);
+  };
+
+  const beforeEach: BeforeEachFn = (eff, hookOptions) => {
+    vitestBeforeEach(() => runEff(eff), timeoutOf(hookOptions));
+  };
+
+  const afterAll = ((eff, hookOptions) => {
+    vitestAfterAll(
+      () => runEff(eff),
+      timeoutOf(hookOptions) ?? DEFAULT_TIMEOUT,
+    );
+  }) as AfterAllFn;
+  afterAll.skipIf = (predicate) => (eff, hookOptions) => {
+    if (predicate) return;
+    vitestAfterAll(
+      () => runEff(eff),
+      timeoutOf(hookOptions) ?? DEFAULT_TIMEOUT,
+    );
+  };
+
+  const afterEach: AfterEachFn = (eff, hookOptions) => {
+    vitestAfterEach(() => runEff(eff), timeoutOf(hookOptions));
+  };
+
+  // `destroy(Stack)` needs the dev sidecar alive so it can call `sidecar.stop`.
+  // `Scope.close` on an already-closed scope is a no-op, so the destroy
+  // wrapper AND the fallback cleanup hook below can both call it safely.
+  const closeScope = Effect.suspend(() =>
+    Scope.close(sharedScope, Exit.void),
+  ).pipe(Effect.ignore);
+
+  // Fallback cleanup: if the user never calls `destroy(Stack)` (e.g.
+  // `NO_DESTROY=1`), nothing else closes the shared scope and the sidecar
+  // child process leaks past the test process. Register an `afterAll` that
+  // closes it. We defer registration to a microtask so it runs AFTER any
+  // user-registered `afterAll` (including `destroy(Stack)`); vitest runs
+  // afterAll hooks in registration order.
+  queueMicrotask(() => {
+    vitestAfterAll(() => Effect.runPromise(closeScope), DEFAULT_TIMEOUT);
+  });
+
+  return {
+    test,
+    beforeAll,
+    beforeEach,
+    afterAll,
+    afterEach,
+    deploy: (stack, callOpts) =>
+      Core.deploy(options, stack, { ...callOpts, scope: sharedScope }),
+    destroy: (stack, callOpts) =>
+      Core.destroy(options, stack, { ...callOpts, scope: sharedScope }).pipe(
+        Effect.ensuring(closeScope),
+      ),
+  };
+};