alchemy 2.0.0-beta.65 → 2.0.0-beta.66

package/bin/exec.js

@@ -392,14 +392,15 @@ var init_FQN = __esm({ "lib/FQN.js": (() => {
 
 //#endregion
 //#region lib/Provider.js
-var Provider, isProviderCollectionService, isProviderService, findProviderByType, MissingProviderError, missingProviderError, tryFindProviderByType;
+var Provider, isProviderCollectionService, isProviderService, providerForMode, findProviderByType, MissingProviderError, missingProviderError, tryFindProviderByType;
 var init_Provider = __esm({ "lib/Provider.js": (() => {
 	Provider = (type) => EffectContext.Service()(type);
 	isProviderCollectionService = (value) => {
 		return typeof value === "object" && value !== null && "kind" in value && value.kind === "ProviderCollection";
 	};
 	isProviderService = (value) => typeof value === "object" && value !== null && "reconcile" in value && typeof value.reconcile === "function" && "delete" in value && typeof value.delete === "function";
-	findProviderByType = ((type) => tryFindProviderByType(type).pipe(Effect.flatMap(Option.match({
+	providerForMode = (service, mode) => mode !== void 0 && service.modes !== void 0 ? service.modes[mode] : Effect.succeed(service);
+	findProviderByType = ((type, mode) => tryFindProviderByType(type, mode).pipe(Effect.flatMap(Option.match({
 		onNone: () => Effect.die(`Provider not found for ${type}`),
 		onSome: (provider) => Effect.succeed(provider)
 	}))));
@@ -409,19 +410,39 @@ var init_Provider = __esm({ "lib/Provider.js": (() => {
 		resourceType,
 		fqn
 	});
-	tryFindProviderByType = Effect.fn(function* (resourceType) {
-		const Tag = Provider(resourceType);
-		const direct = yield* Effect.serviceOption(Tag);
-		if (Option.isSome(direct)) return direct;
-		const context = yield* Effect.context();
-		for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
-			const provider = value.get(resourceType);
-			if (provider) return Option.some(provider);
-		}
-		for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
-			for (const provider of Object.values(value.providers)) if (provider.aliases?.includes(resourceType)) return Option.some(provider);
-		} else if (isProviderService(value) && value.aliases?.includes(resourceType)) return Option.some(value);
-		return Option.none();
+	tryFindProviderByType = Effect.fn(function* (resourceType, mode) {
+		const found = yield* Effect.gen(function* () {
+			const Tag = Provider(resourceType);
+			const direct = yield* Effect.serviceOption(Tag);
+			if (Option.isSome(direct)) return direct;
+			const context = yield* Effect.context();
+			for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
+				const provider = value.get(resourceType);
+				if (provider) return Option.some(provider);
+			}
+			for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
+				for (const provider of Object.values(value.providers)) if (provider.aliases?.includes(resourceType)) return Option.some(provider);
+			} else if (isProviderService(value) && value.aliases?.includes(resourceType)) return Option.some(value);
+			return Option.none();
+		});
+		if (Option.isNone(found)) return found;
+		return Option.some(yield* providerForMode(found.value, mode));
+	});
+}) });
+
+//#endregion
+//#region lib/ProviderMode.js
+var ProviderModePolicy, defaultProviderMode;
+var init_ProviderMode = __esm({ "lib/ProviderMode.js": (() => {
+	init_AlchemyContext();
+	ProviderModePolicy = EffectContext.Reference("ProviderModePolicy", { defaultValue: () => void 0 });
+	defaultProviderMode = Effect.gen(function* () {
+		if (yield* ProviderModePolicy) return "live";
+		const ctx = yield* Effect.serviceOption(AlchemyContext);
+		return Option.match(ctx, {
+			onNone: () => "live",
+			onSome: (c$1) => c$1.dev ? "local" : "live"
+		});
 	});
 }) });
 
@@ -1314,6 +1335,7 @@ init_Artifacts();
 init_FQN();
 init_Output();
 init_Provider();
+init_ProviderMode();
 init_Resource();
 init_sha256();
 const make = (stack, options$6 = {}) => Effect.gen(function* () {
@@ -1331,6 +1353,32 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			onSome: (c$1) => c$1.adopt
 		});
 	});
+	const runDefaultMode = yield* defaultProviderMode;
+	/**
+	* Resolve the effective provider mode and the concrete provider
+	* service for a resource.
+	*
+	* The mode only "sticks" when the provider actually distinguishes
+	* modes (registered via `ProviderLayer.dual`). Mode-agnostic providers
+	* satisfy any requested mode with their single implementation — in a
+	* dev run, a construct that mixes emulatable resources with live-only
+	* ones (e.g. R2 buckets) just works.
+	*/
+	const resolveProviderAndMode = Effect.fn(function* (resource) {
+		const base$1 = yield* findProviderByType(resource.Type);
+		const mode = base$1.modes !== void 0 ? resource.Mode ?? runDefaultMode : void 0;
+		return {
+			provider: yield* providerForMode(base$1, mode),
+			mode
+		};
+	});
+	/**
+	* Has this resource switched provider modes since it was last
+	* reconciled? Rows without a persisted mode (legacy rows, or rows
+	* written by a mode-agnostic provider) are assumed to already be in
+	* the current run's mode — no replacement churn.
+	*/
+	const hasModeSwitched = (mode, oldState) => mode !== void 0 && oldState?.providerMode !== void 0 && oldState.providerMode !== mode;
 	const resourceFqns = yield* state.list({
 		stack: stackName,
 		stage: stage$1
@@ -1345,7 +1393,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		if (isAction(resourceExpr.src)) return resourceExpr;
 		return yield* resolvedResources[resourceExpr.src.FQN] ??= yield* Effect.cached(Effect.gen(function* () {
 			const resource = resourceExpr.src;
-			const provider = yield* findProviderByType(resource.Type);
+			const { provider, mode } = yield* resolveProviderAndMode(resource);
 			const props = yield* resolveInput(resource.Props);
 			const persisted = yield* state.get({
 				stack: stackName,
@@ -1354,6 +1402,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			});
 			const oldState = isActionState(persisted) ? void 0 : persisted;
 			if (!oldState || oldState.status === "creating") return resourceExpr;
+			if (hasModeSwitched(mode, oldState)) return resourceExpr;
 			const oldProps = oldState.status === "updating" ? oldState.old.props : oldState.props;
 			const oldBindings = dedupeBindings(oldState.bindings ?? []);
 			const newBindings = dedupeBindings(stack.bindings[resource.FQN] ?? []);
@@ -1476,7 +1525,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 	};
 	const newDownstreamDependencies = Object.fromEntries([...resources.map((resource) => [resource.FQN, computeDownstream(resource.FQN)]), ...actions.map((action) => [action.FQN, computeDownstream(action.FQN)])]);
 	const resourceGraph = Object.fromEntries((yield* Effect.all(resources.map(Effect.fn("plan.diff.resource")(function* (resource) {
-		const provider = yield* findProviderByType(resource.Type);
+		const { provider, mode } = yield* resolveProviderAndMode(resource);
 		const id = resource.LogicalId;
 		const fqn = resource.FQN;
 		const news = yield* resolveInput(resource.Props);
@@ -1518,26 +1567,29 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 					providerVersion: provider.version ?? 0,
 					bindings: [],
 					downstream,
-					removalPolicy: resource.RemovalPolicy
+					removalPolicy: resource.RemovalPolicy,
+					providerMode: mode
 				};
 				forceUpdateAfterAdoption = true;
 			}
 		}
 		const oldBindings = dedupeBindings(oldState?.bindings ?? []);
 		const bindingDiffs = diffBindings(oldBindings, newBindings);
+		const modeSwitched = hasModeSwitched(mode, oldState);
 		const Node = (node) => ({
 			...node,
 			provider,
 			resource,
 			bindings: bindingDiffs,
-			downstream
+			downstream,
+			mode
 		});
 		if (oldState === void 0) return Node({
 			action: "create",
 			props: news,
 			state: oldState
 		});
-		else if (oldState.status === "creating" && oldState.attr === void 0) {
+		else if (!modeSwitched && oldState.status === "creating" && oldState.attr === void 0) {
 			if (provider.read && isResolved(oldState.props)) {
 				const attr = yield* provider.read({
 					id,
@@ -1546,7 +1598,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 					olds: oldState.props,
 					output: oldState.attr
 				}).pipe(providePlanScope(fqn, oldState.instanceId));
-				if (attr) {
+				if (attr !== void 0) {
 					if (Unowned.is(attr)) {
 						if (!(resource.Adopt ?? (yield* shouldAdopt))) return yield* new OwnedBySomeoneElse({
 							message: `Cannot resume creating resource '${fqn}' (${resource.Type}): a resource with its physical identity exists in the cloud but is not owned by this stack/stage/logical-id. Re-run with \`--adopt\` (or wrap the effect in \`adopt(true)\`) to take it over.`,
@@ -1554,19 +1606,18 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 							logicalId: id
 						});
 					}
-					return Node({
-						action: "create",
-						props: news,
-						state: {
-							...oldState,
-							attr: stripUnowned(attr)
-						}
-					});
+					oldState = {
+						...oldState,
+						attr: stripUnowned(attr)
+					};
 				}
 			}
 		}
 		const oldProps = oldState.props;
-		const diff = yield* asEffect(provider?.diff?.({
+		const diff = modeSwitched ? {
+			action: "replace",
+			deleteFirst: false
+		} : yield* asEffect(provider?.diff?.({
 			id,
 			fqn,
 			olds: oldProps,
@@ -1651,6 +1702,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		});
 		else if (diff.action === "update") return Node({
 			action: "update",
+			adopting: forceUpdateAfterAdoption,
 			props: news,
 			state: oldState
 		});
@@ -1774,12 +1826,13 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		if (oldState) {
 			const { logicalId } = parseFqn(fqn);
 			const resourceType = oldState.resourceType;
-			const providerOption = yield* tryFindProviderByType(resourceType);
+			const providerOption = yield* tryFindProviderByType(resourceType, oldState.providerMode);
 			if (Option.isNone(providerOption)) return yield* Effect.die(missingProviderError(resourceType, fqn));
 			return [fqn, {
 				action: "delete",
 				state: oldState,
 				provider: providerOption.value,
+				mode: oldState.providerMode,
 				resource: {
 					Namespace: oldState.namespace,
 					FQN: fqn,
@@ -1791,6 +1844,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 					Provider: Provider(resourceType),
 					RemovalPolicy: oldState.removalPolicy,
 					Adopt: void 0,
+					Mode: oldState.providerMode,
 					RuntimeContext: void 0,
 					Providers: void 0
 				},
@@ -1825,6 +1879,29 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 	"alchemy.resources.count": Object.keys(stack.resources).length,
 	"alchemy.force": !!options$6.force
 } }));
+/**
+* Build the plan that destroys every resource of `(stack.name, stack.stage)`.
+*
+* The spec is emptied out so every persisted resource becomes an orphan
+* deletion, and `output` is left undefined so `apply` does not overwrite the
+* last deploy's persisted stack output with an empty husk. `apply` recognizes
+* the `destroy` marker and deletes the stage's remaining persisted state (the
+* stack output record) once the destroy has converged, so `state.getOutput`
+* and `state.listStages` agree the stage is gone.
+*
+* @see https://github.com/alchemy-run/alchemy/issues/961
+*/
+const destroy = (stack) => make({
+	name: stack.name,
+	stage: stack.stage,
+	resources: {},
+	bindings: {},
+	actions: {},
+	output: void 0
+}).pipe(Effect.map((plan) => ({
+	...plan,
+	destroy: true
+})));
 const providePlanScope = (fqn, instanceId) => (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrElse(createArtifactStore)), Effect.flatMap((store) => effect.pipe(Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)), Effect.provideService(InstanceId, instanceId))));
 var DeleteResourceHasDownstreamDependencies = class extends Data.TaggedError("DeleteResourceHasDownstreamDependencies") {};
 var UnsatisfiedResourceCycle = class extends Data.TaggedError("UnsatisfiedResourceCycle") {};
@@ -1876,6 +1953,13 @@ const apply = (plan) => Effect.gen(function* () {
 		status
 	}), { concurrency: "unbounded" });
 	yield* session.done();
+	if (plan.destroy) {
+		yield* state.deleteStack({
+			stack: stackName,
+			stage: stage$1
+		});
+		return;
+	}
 	if (!plan.output) return;
 	const outputs = Object.fromEntries(Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]));
 	const resolved = yield* evaluate(plan.output, outputs);
@@ -1983,7 +2067,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				providerVersion: node.provider.version ?? 0,
 				resourceType: node.resource.Type,
 				bindings: excludeDeletedBindings(node.bindings),
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			return id;
 		} else if (node.action === "replace") {
@@ -2001,7 +2086,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				bindings: excludeDeletedBindings(node.bindings),
 				old: node.state,
 				deleteFirst: node.deleteFirst,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			return id;
 		} else if (node.state?.instanceId) return node.state.instanceId;
@@ -2020,7 +2106,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				providerVersion: node.provider.version ?? 0,
 				bindings: excludeDeletedBindings(node.bindings),
 				downstream: node.downstream,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			let attr = node.state?.attr;
 			if (attr !== void 0) yield* storeAndSignal({
@@ -2050,7 +2137,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 					providerVersion: node.provider.version ?? 0,
 					bindings: excludeDeletedBindings(node.bindings),
 					downstream: node.downstream,
-					removalPolicy: node.resource.RemovalPolicy
+					removalPolicy: node.resource.RemovalPolicy,
+					providerMode: node.mode
 				});
 				yield* storeAndSignal({
 					output: attr,
@@ -2086,7 +2174,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				bindings: bindingOutputs,
 				providerVersion: node.provider.version ?? 0,
 				downstream: node.downstream,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			tracker[fqn] = {
 				output: attr,
@@ -2110,10 +2199,12 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 			yield* waitForDeps(allUpstreamFqns());
 			const outputs = getOutputs();
 			const news = yield* evaluate(node.props, outputs);
+			const adopting = node.adopting === true || node.state.status === "updating" && node.state.adopting === true;
 			yield* node.state.status === "replaced" ? commit({
 				...node.state,
 				attr: node.state.attr,
-				props: news
+				props: news,
+				providerMode: node.mode
 			}) : commit({
 				status: "updating",
 				fqn,
@@ -2126,10 +2217,12 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				bindings: excludeDeletedBindings(node.bindings),
 				downstream: node.downstream,
 				old: node.state.status === "updating" ? node.state.old : node.state,
-				removalPolicy: node.resource.RemovalPolicy
+				adopting: adopting ? true : void 0,
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			yield* report("updating");
-			const previousProps = node.state.status === "created" || node.state.status === "updated" || node.state.status === "replaced" ? node.state.props : node.state.old.props;
+			const previousProps = adopting ? void 0 : node.state.status === "created" || node.state.status === "updated" || node.state.status === "replaced" ? node.state.props : node.state.old.props;
 			const bindingOutputs = excludeDeletedBindings(yield* evaluate(node.bindings, outputs));
 			const attr = yield* node.provider.reconcile({
 				id: logicalId,
@@ -2144,7 +2237,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 			if (node.state.status === "replaced") yield* commit({
 				...node.state,
 				attr,
-				props: news
+				props: news,
+				providerMode: node.mode
 			});
 			else yield* commit({
 				status: "updated",
@@ -2157,7 +2251,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				bindings: bindingOutputs,
 				providerVersion: node.provider.version ?? 0,
 				downstream: node.downstream,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			tracker[fqn] = {
 				output: attr,
@@ -2197,12 +2292,13 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				deleteFirst: node.deleteFirst,
 				old: node.state,
 				downstream: node.downstream,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			else replState = node.state;
 			const deleteOldGenerations = (old) => Effect.gen(function* () {
 				const retain = node.resource.RemovalPolicy === "retain";
-				if (old.attr !== void 0 && !retain) yield* node.provider.delete({
+				if (old.attr !== void 0 && !retain) yield* (yield* findProviderByType(node.resource.Type, old.providerMode)).delete({
 					id: logicalId,
 					fqn,
 					instanceId: old.instanceId,
@@ -2247,7 +2343,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 					downstream: node.downstream,
 					old: replState.old,
 					deleteFirst: node.deleteFirst,
-					removalPolicy: node.resource.RemovalPolicy
+					removalPolicy: node.resource.RemovalPolicy,
+					providerMode: node.mode
 				});
 				yield* storeAndSignal({
 					output: attr,
@@ -2283,7 +2380,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				providerVersion: node.provider.version ?? 0,
 				bindings: bindingOutputs,
 				downstream: node.downstream,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			else yield* commit({
 				status: "replaced",
@@ -2298,7 +2396,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				downstream: node.downstream,
 				old: replState.old,
 				deleteFirst: node.deleteFirst,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			tracker[fqn] = {
 				output: attr,
@@ -2503,7 +2602,8 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
 					bindings: stripUnresolved(newBindings),
 					downstream: node.downstream,
 					namespace,
-					removalPolicy: node.resource.RemovalPolicy
+					removalPolicy: node.resource.RemovalPolicy,
+					providerMode: node.mode
 				}
 			});
 			terminalStatuses.set(fqn, {
@@ -2571,18 +2671,24 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
 	}
 });
 /**
-* Internal marker: this node's deletion was skipped because a DEPENDENT
-* resource (one that still references it) failed to delete. The dependent's
-* own failure is already recorded in the GC failure list, so nodes failing
-* with ONLY this marker are not re-recorded — they just keep their state so
-* the next destroy retries the whole chain.
+* Aggregate raised at the end of the deletion phase when one or more
+* resource deletes failed. Every resource whose delete did not depend on a
+* failed one was still attempted — a single failure no longer strands
+* unrelated siblings.
 */
-var DependentDeletionFailed = class extends Data.TaggedError("DependentDeletionFailed") {};
+var DestroyError = class extends Data.TaggedError("DestroyError") {
+	get message() {
+		return [
+			`Failed to delete ${this.failures.length} resource(s)` + (this.blocked.length > 0 ? ` (${this.blocked.length} more skipped because a dependent's delete failed)` : "") + ":",
+			...this.failures.map((f) => `  ✗ ${f.fqn} (${f.resourceType}): ${Cause.pretty(f.cause)}`),
+			...this.blocked.map((b) => `  ⊘ ${b.fqn} (${b.resourceType}): skipped — blocked by failed delete of ${b.blockedBy.join(", ")}`)
+		].join("\n");
+	}
+};
 const collectGarbage = Effect.fn(function* (plan, session) {
 	const state = yield* yield* State;
 	const stackName = (yield* Stack).name;
 	const stage$1 = yield* Stage;
-	const failures = [];
 	yield* Effect.all(Object.entries(plan.actionDeletions ?? {}).map(([fqn, node]) => node === void 0 ? Effect.void : Effect.gen(function* () {
 		yield* session.emit({
 			kind: "status-change",
@@ -2602,11 +2708,14 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 			status: "deleted"
 		});
 	})), { concurrency: "unbounded" });
+	const failures = [];
+	const blockedDeletes = [];
+	const unresolved = /* @__PURE__ */ new Set();
 	const deleteGraph = Effect.fn(function* (deletionGraph) {
 		const deletions = {};
 		const deleteResource = (node, ancestors = /* @__PURE__ */ new Set()) => Effect.gen(function* () {
 			const isDeleteNode = (node$1) => "action" in node$1;
-			const { fqn, logicalId, namespace, resourceType, instanceId, downstream, props, attr: persistedAttr, provider } = isDeleteNode(node) ? {
+			const { fqn, logicalId, namespace, resourceType, instanceId, downstream, props, attr: persistedAttr, provider, providerMode } = isDeleteNode(node) ? {
 				fqn: node.resource.FQN,
 				logicalId: node.resource.LogicalId,
 				namespace: node.resource.Namespace,
@@ -2615,7 +2724,8 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 				downstream: node.downstream,
 				props: node.state.props,
 				attr: node.state.attr,
-				provider: node.provider
+				provider: node.provider,
+				providerMode: node.state.providerMode
 			} : {
 				fqn: node.fqn,
 				logicalId: node.logicalId,
@@ -2625,10 +2735,11 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 				downstream: node.old.downstream,
 				props: node.old.props,
 				attr: node.old.attr,
-				provider: yield* tryFindProviderByType(node.old.resourceType).pipe(Effect.flatMap(Option.match({
+				provider: yield* tryFindProviderByType(node.old.resourceType, node.old.providerMode).pipe(Effect.flatMap(Option.match({
 					onNone: () => Effect.die(missingProviderError(node.old.resourceType, node.fqn)),
 					onSome: Effect.succeed
-				})))
+				}))),
+				providerMode: node.old.providerMode
 			};
 			let attr = persistedAttr;
 			const nextAncestors = new Set(ancestors).add(fqn);
@@ -2658,121 +2769,154 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 				})
 			};
 			return yield* deletions[fqn] ??= yield* Effect.cached(Effect.gen(function* () {
-				yield* Effect.all(downstream.map((dep) => dep !== fqn && dep in deletionGraph && !ancestors.has(dep) ? deleteResource(deletionGraph[dep], nextAncestors) : Effect.void), { concurrency: "unbounded" }).pipe(Effect.catchCause(() => Effect.fail(new DependentDeletionFailed({ fqn }))));
-				if (isDeleteNode(node)) {
-					yield* report("deleting");
-					if (node.resource.RemovalPolicy === "retain") {
-						yield* state.delete({
-							stack: stackName,
-							stage: stage$1,
-							fqn
-						});
-						yield* report("retained");
-						return;
-					}
-				}
-				const retainOldGeneration = !isDeleteNode(node) && node.removalPolicy === "retain";
-				if (retainOldGeneration) yield* scopedSession.note("Retaining replaced resource (removal policy: retain)...");
-				if (attr === void 0 && !retainOldGeneration) if (provider.read) {
-					const recovered = yield* provider.read({
-						id: logicalId,
+				const blockedBy = (yield* Effect.all(downstream.map((dep) => dep !== fqn && !ancestors.has(dep) ? dep in deletionGraph ? deleteResource(deletionGraph[dep], nextAncestors).pipe(Effect.map((outcome) => ({
+					dep,
+					outcome
+				}))) : Effect.sync(() => ({
+					dep,
+					outcome: unresolved.has(dep) ? "failed" : "deleted"
+				})) : Effect.succeed({
+					dep,
+					outcome: "deleted"
+				})), { concurrency: "unbounded" })).filter(({ outcome }) => outcome !== "deleted").map(({ dep }) => dep);
+				if (blockedBy.length > 0) {
+					unresolved.add(fqn);
+					blockedDeletes.push({
 						fqn,
-						instanceId,
-						olds: props,
-						output: void 0
-					}).pipe(instrumentLifecycle("read", fqn, resourceType, logicalId, instanceId));
-					if (recovered !== void 0) if (Unowned.is(recovered)) yield* scopedSession.note("Resource exists in the cloud but is not owned by this stack — leaving it in place (re-deploy with --adopt to take ownership, then destroy).");
-					else attr = stripUnowned(recovered);
-				} else yield* scopedSession.note("No attributes were recorded for this resource (its create was interrupted) and the provider does not implement `read` — if a physical resource was created, it must be cleaned up manually.");
-				if (isDeleteNode(node)) yield* commit({
-					status: "deleting",
-					fqn,
-					logicalId,
-					instanceId,
-					resourceType,
-					props,
-					attr,
-					downstream,
-					providerVersion: provider.version ?? 0,
-					bindings: excludeDeletedBindings(node.bindings),
-					removalPolicy: node.resource.RemovalPolicy
-				});
-				if (attr !== void 0 && !retainOldGeneration) yield* provider.delete({
-					id: logicalId,
-					fqn,
-					instanceId,
-					olds: props,
-					output: attr,
-					session: scopedSession,
-					bindings: []
-				}).pipe(instrumentLifecycle("delete", fqn, resourceType, logicalId, instanceId));
-				if (isDeleteNode(node)) {
-					yield* state.delete({
-						stack: stackName,
-						stage: stage$1,
-						fqn
+						logicalId,
+						resourceType,
+						blockedBy
 					});
-					yield* report("deleted");
-				} else {
-					if (!retainOldGeneration) yield* scopedSession.note("Cleaning up replaced resource...");
-					if (node.old.status === "replacing" || node.old.status === "replaced") yield* commit({
-						status: "replaced",
+					yield* scopedSession.note(`Skipping delete — blocked by failed delete of ${blockedBy.join(", ")}.`);
+					yield* report("skipped");
+					return "blocked";
+				}
+				return yield* deleteResourceBody().pipe(Effect.catchCause((cause) => Effect.gen(function* () {
+					unresolved.add(fqn);
+					failures.push({
 						fqn,
-						logicalId: node.logicalId,
-						instanceId: node.instanceId,
-						resourceType: node.resourceType,
-						props: node.props,
-						attr: node.attr,
-						providerVersion: node.providerVersion,
-						downstream: node.downstream,
-						bindings: excludeDeletedBindings(node.bindings),
-						old: node.old.old,
-						deleteFirst: node.deleteFirst,
-						removalPolicy: node.removalPolicy
+						logicalId,
+						resourceType,
+						cause
 					});
-					else yield* commit({
-						status: "created",
+					yield* report("fail");
+					return "failed";
+				})));
+			}));
+			function deleteResourceBody() {
+				return Effect.gen(function* () {
+					if (isDeleteNode(node)) {
+						yield* report("deleting");
+						if (node.resource.RemovalPolicy === "retain") {
+							yield* state.delete({
+								stack: stackName,
+								stage: stage$1,
+								fqn
+							});
+							yield* report("retained");
+							return "deleted";
+						}
+					}
+					const retainOldGeneration = !isDeleteNode(node) && node.removalPolicy === "retain";
+					if (retainOldGeneration) yield* scopedSession.note("Retaining replaced resource (removal policy: retain)...");
+					if (attr === void 0 && !retainOldGeneration) if (provider.read) {
+						const recovered = yield* provider.read({
+							id: logicalId,
+							fqn,
+							instanceId,
+							olds: props,
+							output: void 0
+						}).pipe(instrumentLifecycle("read", fqn, resourceType, logicalId, instanceId));
+						if (recovered !== void 0) if (Unowned.is(recovered)) yield* scopedSession.note("Resource exists in the cloud but is not owned by this stack — leaving it in place (re-deploy with --adopt to take ownership, then destroy).");
+						else attr = stripUnowned(recovered);
+					} else yield* scopedSession.note("No attributes were recorded for this resource (its create was interrupted) and the provider does not implement `read` — if a physical resource was created, it must be cleaned up manually.");
+					if (isDeleteNode(node)) yield* commit({
+						status: "deleting",
 						fqn,
-						logicalId: node.logicalId,
-						instanceId: node.instanceId,
-						resourceType: node.resourceType,
-						props: node.props,
-						attr: node.attr,
-						providerVersion: node.providerVersion,
-						downstream: node.downstream,
+						logicalId,
+						instanceId,
+						resourceType,
+						props,
+						attr,
+						downstream,
+						providerVersion: provider.version ?? 0,
 						bindings: excludeDeletedBindings(node.bindings),
-						removalPolicy: node.removalPolicy
+						removalPolicy: node.resource.RemovalPolicy,
+						providerMode
 					});
-					yield* scopedSession.note(retainOldGeneration ? "Replaced resource retained." : "Replaced resource cleanup complete.");
-				}
-			}).pipe(Effect.catchCause((cause) => Effect.gen(function* () {
-				if (!cause.reasons.every((reason) => Cause.isFailReason(reason) && reason.error instanceof DependentDeletionFailed)) failures.push({
-					fqn,
-					logicalId,
-					type: resourceType,
-					cause
+					if (attr !== void 0 && !retainOldGeneration) yield* provider.delete({
+						id: logicalId,
+						fqn,
+						instanceId,
+						olds: props,
+						output: attr,
+						session: scopedSession,
+						bindings: []
+					}).pipe(instrumentLifecycle("delete", fqn, resourceType, logicalId, instanceId));
+					if (isDeleteNode(node)) {
+						yield* state.delete({
+							stack: stackName,
+							stage: stage$1,
+							fqn
+						});
+						yield* report("deleted");
+					} else {
+						if (!retainOldGeneration) yield* scopedSession.note("Cleaning up replaced resource...");
+						if (node.old.status === "replacing" || node.old.status === "replaced") yield* commit({
+							status: "replaced",
+							fqn,
+							logicalId: node.logicalId,
+							instanceId: node.instanceId,
+							resourceType: node.resourceType,
+							props: node.props,
+							attr: node.attr,
+							providerVersion: node.providerVersion,
+							downstream: node.downstream,
+							bindings: excludeDeletedBindings(node.bindings),
+							old: node.old.old,
+							deleteFirst: node.deleteFirst,
+							removalPolicy: node.removalPolicy,
+							providerMode: node.providerMode
+						});
+						else yield* commit({
+							status: "created",
+							fqn,
+							logicalId: node.logicalId,
+							instanceId: node.instanceId,
+							resourceType: node.resourceType,
+							props: node.props,
+							attr: node.attr,
+							providerVersion: node.providerVersion,
+							downstream: node.downstream,
+							bindings: excludeDeletedBindings(node.bindings),
+							removalPolicy: node.removalPolicy,
+							providerMode: node.providerMode
+						});
+						yield* scopedSession.note(retainOldGeneration ? "Replaced resource retained." : "Replaced resource cleanup complete.");
+					}
+					return "deleted";
 				});
-				yield* report("fail");
-				return yield* Effect.failCause(cause);
-			}))));
+			}
 		});
-		yield* Effect.all(Object.values(deletionGraph).filter((node) => node !== void 0).map((node) => deleteResource(node).pipe(Effect.ignore)), { concurrency: "unbounded" });
+		yield* Effect.all(Object.values(deletionGraph).filter((node) => node !== void 0).map((node) => deleteResource(node)), { concurrency: "unbounded" });
 	});
 	let first = true;
 	while (true) {
-		const remainingReplacedResources = yield* state.getReplacedResources({
+		const remainingReplacedResources = (yield* state.getReplacedResources({
 			stack: stackName,
 			stage: stage$1
-		});
+		})).filter((replaced) => !unresolved.has(replaced.fqn));
 		if (!first && remainingReplacedResources.length === 0) break;
 		yield* deleteGraph({
 			...first ? plan.deletions : {},
 			...Object.fromEntries(remainingReplacedResources.map((replaced) => [replaced.fqn, replaced]))
 		});
 		first = false;
-		if (failures.length > 0) break;
 	}
-	if (failures.length > 0) return yield* Effect.failCause(failures.map((f) => f.cause).reduce(Cause.combine));
+	if (failures.length > 0) return yield* Effect.fail(new DestroyError({
+		failures,
+		blocked: blockedDeletes
+	}));
 });
 const excludeDeletedBindings = (bindings) => bindings.flatMap(({ action, sid, data }) => action === "delete" ? [] : [{
 	sid,
@@ -2789,13 +2933,12 @@ const retryIfCancelled = Effect.retry({ while: (e) => e instanceof PromptCancell
 *
 * Returns `undefined` if the user cancels (Ctrl+C / Escape).
 *
-* Uses `Effect.callback` so fiber interruption propagates via the abort
-* signal to any async resources we own; the clack prompt itself is left
-* to resolve — its result is ignored after interruption.
+* Uses `Effect.callback` so fiber interruption propagates to the clack
+* prompt through its abort signal, releasing stdin and restoring the cursor.
 */
 const prompt = (fn) => Effect.callback((resume, signal) => {
 	let settled = false;
-	fn().then((result) => {
+	fn(signal).then((result) => {
 		if (settled || signal.aborted) return;
 		settled = true;
 		if (p.isCancel(result)) resume(Effect.fail(new PromptCancelled()));
@@ -2809,11 +2952,34 @@ const prompt = (fn) => Effect.callback((resume, signal) => {
 const success = (str) => Effect.sync(() => p.log.success(str));
 const warn = (str) => Effect.sync(() => p.log.warn(str));
 const info = (str) => Effect.sync(() => p.log.info(str));
-const text = (opts) => prompt(() => p.text(opts));
-const password = (opts) => prompt(() => p.password(opts));
-const select = (opts) => prompt(() => p.select(opts));
-const confirm = (opts) => prompt(() => p.confirm(opts));
-const multiselect = (opts) => prompt(() => p.multiselect(opts));
+const text = (opts) => {
+	const validate = opts.validate;
+	return prompt((signal) => p.text({
+		...opts,
+		signal,
+		validate: validate === void 0 ? void 0 : (value) => validate(value ?? "")
+	}));
+};
+const password = (opts) => {
+	const validate = opts.validate;
+	return prompt((signal) => p.password({
+		...opts,
+		signal,
+		validate: validate === void 0 ? void 0 : (value) => validate(value ?? "")
+	}));
+};
+const select = (opts) => prompt((signal) => p.select({
+	...opts,
+	signal
+}));
+const confirm = (opts) => prompt((signal) => p.confirm({
+	...opts,
+	signal
+}));
+const multiselect = (opts) => prompt((signal) => p.multiselect({
+	...opts,
+	signal
+}));
 /**
 * Open a URL in the user's default browser.
 *
@@ -3388,13 +3554,42 @@ const revoke = (credentials) => Effect.gen(function* () {
 	});
 });
 /**
+* Exchange a code copied from the hosted relay page, or extract the code from
+* either the hosted or loopback callback URL.
+*/
+const exchangeCallbackInput$1 = (input, authorization) => Effect.gen(function* () {
+	const value = input.trim();
+	let code = value;
+	let state = null;
+	try {
+		const url = new URL(value);
+		code = url.searchParams.get("code") ?? "";
+		state = url.searchParams.get("state");
+	} catch {
+		const separator = value.lastIndexOf("#");
+		if (separator >= 0) {
+			code = value.slice(0, separator);
+			state = value.slice(separator + 1);
+		}
+	}
+	if (!code) return yield* new OAuthError$1({
+		error: "invalid_request",
+		errorDescription: "The authorization code is missing."
+	});
+	if (state !== null && state !== authorization.state) return yield* new OAuthError$1({
+		error: "invalid_request",
+		errorDescription: "The authorization state does not match."
+	});
+	return yield* exchange$1(code, authorization.verifier);
+});
+/**
 * Start a local HTTP server to listen for the OAuth callback, exchange
 * the authorization code, and return the credentials.
 *
 * Times out after 5 minutes.
 */
 const callback$1 = (authorization) => Effect.tryPromise({
-	try: () => callbackPromise$1(authorization),
+	try: (signal) => callbackPromise$1(authorization, signal),
 	catch: (err) => {
 		if (err instanceof OAuthError$1) return err;
 		return new OAuthError$1({
@@ -3403,11 +3598,21 @@ const callback$1 = (authorization) => Effect.tryPromise({
 		});
 	}
 });
-function callbackPromise$1(authorization) {
-	const { pathname, port } = new URL(OAUTH_REDIRECT_URI$1);
+function callbackPromise$1(authorization, signal) {
+	const { pathname, port } = new URL(OAUTH_LOCAL_CALLBACK_URI$1);
 	return new Promise((resolve, reject) => {
 		const server = http.createServer(async (req, res) => {
 			const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+			if (url.pathname === "/auth/ping") {
+				res.writeHead(req.method === "OPTIONS" ? 204 : 200, {
+					"Access-Control-Allow-Origin": new URL(OAUTH_REDIRECT_URI$1).origin,
+					"Access-Control-Allow-Methods": "GET, OPTIONS",
+					"Access-Control-Allow-Private-Network": "true",
+					"Cache-Control": "no-store"
+				});
+				res.end();
+				return;
+			}
 			if (url.pathname !== pathname) {
 				res.statusCode = 404;
 				res.end("Not Found");
@@ -3469,8 +3674,10 @@ function callbackPromise$1(authorization) {
 		}, 300 * 1e3);
 		function cleanup() {
 			clearTimeout(timeout);
+			signal.removeEventListener("abort", cleanup);
 			server.close();
 		}
+		signal.addEventListener("abort", cleanup, { once: true });
 		server.on("error", (err) => {
 			cleanup();
 			reject(new OAuthError$1({
@@ -3573,8 +3780,12 @@ const CloudflareAuth = AuthProviderLayer()(CLOUDFLARE_AUTH_PROVIDER_NAME, Effect
 		yield* info("Cloudflare: opening browser for OAuth login...");
 		yield* info(authorization.url);
 		yield* openUrl(authorization.url).pipe(Effect.catch(() => warn("Cloudflare: could not open browser automatically. Please open the URL above manually.")));
-		yield* info("Cloudflare: waiting for authorization (up to 5 minutes)...");
-		const credentials = yield* callback$1(authorization);
+		yield* info("Cloudflare: waiting for authorization (up to 5 minutes).");
+		const credentials = yield* Effect.raceFirst(callback$1(authorization), text({
+			message: "Paste the authorization code or callback URL",
+			placeholder: "The browser will complete this automatically when local",
+			validate: (value) => value.trim().length > 0 ? void 0 : "Paste a code or URL"
+		}).pipe(Effect.flatMap((input) => exchangeCallbackInput$1(input, authorization))));
 		yield* store.write(profileName, "cf-oauth", credentials);
 		yield* success("Cloudflare: OAuth credentials saved.");
 		return credentials;
@@ -3852,7 +4063,8 @@ const DEFAULT_SCOPES = [
 	"zone:read"
 ];
 const OAUTH_CLIENT_ID$1 = "6d8c2255-0773-45f6-b376-2914632e6f91";
-const OAUTH_REDIRECT_URI$1 = "http://localhost:9976/auth/callback";
+const OAUTH_REDIRECT_URI$1 = "https://alchemy.run/auth/callback";
+const OAUTH_LOCAL_CALLBACK_URI$1 = "http://localhost:9976/auth/callback";
 const OAUTH_ENDPOINTS$1 = {
 	authorize: "https://dash.cloudflare.com/oauth2/authorize",
 	token: "https://dash.cloudflare.com/oauth2/token",
@@ -4198,7 +4410,8 @@ var OAuthError = class extends Data.TaggedError("OAuthError") {};
 */
 const OAUTH_CLIENT_ID = "pscale_app_aa12e3938baebb788aac443f66e422da";
 const OAUTH_CLIENT_SECRET = "pscale_app_secret_yyZ3Q8oe99GP9_yA5wrA5er6RuN6Lz9dC66Bj1OJzpg";
-const OAUTH_REDIRECT_URI = "http://localhost:9976/auth/callback";
+const OAUTH_REDIRECT_URI = "https://alchemy.run/auth/callback";
+const OAUTH_LOCAL_CALLBACK_URI = "http://localhost:9976/auth/callback";
 const OAUTH_ENDPOINTS = {
 	authorize: "https://app.planetscale.com/oauth/authorize",
 	token: "https://auth.planetscale.com/oauth/token"
@@ -4288,13 +4501,42 @@ const refresh = (credentials) => tokenRequest({
 	client_secret: OAUTH_CLIENT_SECRET
 });
 /**
+* Exchange a code copied from the hosted relay page, or extract the code from
+* either the hosted or loopback callback URL.
+*/
+const exchangeCallbackInput = (input, authorization) => Effect.gen(function* () {
+	const value = input.trim();
+	let code = value;
+	let state = null;
+	try {
+		const url = new URL(value);
+		code = url.searchParams.get("code") ?? "";
+		state = url.searchParams.get("state");
+	} catch {
+		const separator = value.lastIndexOf("#");
+		if (separator >= 0) {
+			code = value.slice(0, separator);
+			state = value.slice(separator + 1);
+		}
+	}
+	if (!code) return yield* new OAuthError({
+		error: "invalid_request",
+		errorDescription: "The authorization code is missing."
+	});
+	if (state !== null && state !== authorization.state) return yield* new OAuthError({
+		error: "invalid_request",
+		errorDescription: "The authorization state does not match."
+	});
+	return yield* exchange(code);
+});
+/**
 * Start a local HTTP server to listen for the OAuth callback, exchange
 * the authorization code, and return the credentials.
 *
 * Times out after 5 minutes.
 */
 const callback = (authorization) => Effect.tryPromise({
-	try: () => callbackPromise(authorization),
+	try: (signal) => callbackPromise(authorization, signal),
 	catch: (err) => {
 		if (err instanceof OAuthError) return err;
 		return new OAuthError({
@@ -4303,11 +4545,21 @@ const callback = (authorization) => Effect.tryPromise({
 		});
 	}
 });
-function callbackPromise(authorization) {
-	const { pathname, port } = new URL(OAUTH_REDIRECT_URI);
+function callbackPromise(authorization, signal) {
+	const { pathname, port } = new URL(OAUTH_LOCAL_CALLBACK_URI);
 	return new Promise((resolve, reject) => {
 		const server = http.createServer(async (req, res) => {
 			const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+			if (url.pathname === "/auth/ping") {
+				res.writeHead(req.method === "OPTIONS" ? 204 : 200, {
+					"Access-Control-Allow-Origin": new URL(OAUTH_REDIRECT_URI).origin,
+					"Access-Control-Allow-Methods": "GET, OPTIONS",
+					"Access-Control-Allow-Private-Network": "true",
+					"Cache-Control": "no-store"
+				});
+				res.end();
+				return;
+			}
 			if (url.pathname !== pathname) {
 				res.statusCode = 404;
 				res.end("Not Found");
@@ -4369,8 +4621,10 @@ function callbackPromise(authorization) {
 		}, 300 * 1e3);
 		function cleanup() {
 			clearTimeout(timeout);
+			signal.removeEventListener("abort", cleanup);
 			server.close();
 		}
+		signal.addEventListener("abort", cleanup, { once: true });
 		server.on("error", (err) => {
 			cleanup();
 			reject(new OAuthError({
@@ -4462,8 +4716,12 @@ const PlanetscaleAuth = AuthProviderLayer()(PLANETSCALE_AUTH_PROVIDER_NAME, Effe
 		yield* info("Planetscale: opening browser for OAuth login...");
 		yield* info(authorization.url);
 		yield* openUrl(authorization.url).pipe(Effect.catch(() => warn("Planetscale: could not open browser automatically. Please open the URL above manually.")));
-		yield* info("Planetscale: waiting for authorization (up to 5 minutes)...");
-		const credentials = yield* callback(authorization);
+		yield* info("Planetscale: waiting for authorization (up to 5 minutes).");
+		const credentials = yield* Effect.raceFirst(callback(authorization), text({
+			message: "Paste the authorization code or callback URL",
+			placeholder: "The browser will complete this automatically when local",
+			validate: (value) => value.trim().length > 0 ? void 0 : "Paste a code or URL"
+		}).pipe(Effect.flatMap((input) => exchangeCallbackInput(input, authorization))));
 		yield* store.write(profileName, "planetscale-oauth", credentials);
 		yield* success("Planetscale: OAuth credentials saved.");
 		return credentials;
@@ -4765,7 +5023,7 @@ const stackSpanAttrs = (args) => ({
 	"alchemy.adopt": !!args.adopt
 });
 const adopt = Flag.boolean("adopt").pipe(Flag.withDescription("Adopt pre-existing cloud resources that conflict with this stack instead of failing. Useful for re-importing infrastructure into a fresh state store."), Flag.withDefault(false));
-const execStack = Effect.fn(function* ({ main, stage: stage$1, envFile: envFile$1, profile: profile$1, dryRun: dryRun$1 = false, force: force$1 = false, yes: yes$1 = false, destroy = false, dev = false, adopt: adopt$1 = false }) {
+const execStack = Effect.fn(function* ({ main, stage: stage$1, envFile: envFile$1, profile: profile$1, dryRun: dryRun$1 = false, force: force$1 = false, yes: yes$1 = false, destroy: destroy$1 = false, dev = false, adopt: adopt$1 = false }) {
 	const stackEffect = yield* importStack(main);
 	const services$1 = Layer.mergeAll(Layer.effect(AlchemyContext, AlchemyContext.pipe(Effect.map((ctx) => ({
 		...ctx,
@@ -4777,13 +5035,7 @@ const execStack = Effect.fn(function* ({ main, stage: stage$1, envFile: envFile$
 		const cli = yield* Cli;
 		const stack = yield* stackEffect;
 		yield* Effect.gen(function* () {
-			const updatePlan = yield* make(destroy ? {
-				...stack,
-				resources: {},
-				bindings: {},
-				actions: {},
-				output: {}
-			} : stack, { force: force$1 });
+			const updatePlan = destroy$1 ? yield* destroy(stack) : yield* make(stack, { force: force$1 });
 			if (dryRun$1) yield* cli.displayPlan(updatePlan);
 			else {
 				const hasChanges = Object.keys(updatePlan.deletions).length > 0 || Object.values(updatePlan.resources).some((node) => node.action !== "noop" || node.bindings.some((b) => b.action !== "noop"));