alchemy 2.0.0-beta.65 → 2.0.0-beta.67

package/bin/exec.js

@@ -392,14 +392,15 @@ var init_FQN = __esm({ "lib/FQN.js": (() => {
 
 //#endregion
 //#region lib/Provider.js
-var Provider, isProviderCollectionService, isProviderService, findProviderByType, MissingProviderError, missingProviderError, tryFindProviderByType;
+var Provider, isProviderCollectionService, isProviderService, providerForMode, findProviderByType, MissingProviderError, missingProviderError, tryFindProviderByType;
 var init_Provider = __esm({ "lib/Provider.js": (() => {
 	Provider = (type) => EffectContext.Service()(type);
 	isProviderCollectionService = (value) => {
 		return typeof value === "object" && value !== null && "kind" in value && value.kind === "ProviderCollection";
 	};
 	isProviderService = (value) => typeof value === "object" && value !== null && "reconcile" in value && typeof value.reconcile === "function" && "delete" in value && typeof value.delete === "function";
-	findProviderByType = ((type) => tryFindProviderByType(type).pipe(Effect.flatMap(Option.match({
+	providerForMode = (service, mode) => mode !== void 0 && service.modes !== void 0 ? service.modes[mode] : Effect.succeed(service);
+	findProviderByType = ((type, mode) => tryFindProviderByType(type, mode).pipe(Effect.flatMap(Option.match({
 		onNone: () => Effect.die(`Provider not found for ${type}`),
 		onSome: (provider) => Effect.succeed(provider)
 	}))));
@@ -409,19 +410,39 @@ var init_Provider = __esm({ "lib/Provider.js": (() => {
 		resourceType,
 		fqn
 	});
-	tryFindProviderByType = Effect.fn(function* (resourceType) {
-		const Tag = Provider(resourceType);
-		const direct = yield* Effect.serviceOption(Tag);
-		if (Option.isSome(direct)) return direct;
-		const context = yield* Effect.context();
-		for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
-			const provider = value.get(resourceType);
-			if (provider) return Option.some(provider);
-		}
-		for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
-			for (const provider of Object.values(value.providers)) if (provider.aliases?.includes(resourceType)) return Option.some(provider);
-		} else if (isProviderService(value) && value.aliases?.includes(resourceType)) return Option.some(value);
-		return Option.none();
+	tryFindProviderByType = Effect.fn(function* (resourceType, mode) {
+		const found = yield* Effect.gen(function* () {
+			const Tag = Provider(resourceType);
+			const direct = yield* Effect.serviceOption(Tag);
+			if (Option.isSome(direct)) return direct;
+			const context = yield* Effect.context();
+			for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
+				const provider = value.get(resourceType);
+				if (provider) return Option.some(provider);
+			}
+			for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
+				for (const provider of Object.values(value.providers)) if (provider.aliases?.includes(resourceType)) return Option.some(provider);
+			} else if (isProviderService(value) && value.aliases?.includes(resourceType)) return Option.some(value);
+			return Option.none();
+		});
+		if (Option.isNone(found)) return found;
+		return Option.some(yield* providerForMode(found.value, mode));
+	});
+}) });
+
+//#endregion
+//#region lib/ProviderMode.js
+var ProviderModePolicy, defaultProviderMode;
+var init_ProviderMode = __esm({ "lib/ProviderMode.js": (() => {
+	init_AlchemyContext();
+	ProviderModePolicy = EffectContext.Reference("ProviderModePolicy", { defaultValue: () => void 0 });
+	defaultProviderMode = Effect.gen(function* () {
+		if (yield* ProviderModePolicy) return "live";
+		const ctx = yield* Effect.serviceOption(AlchemyContext);
+		return Option.match(ctx, {
+			onNone: () => "live",
+			onSome: (c$1) => c$1.dev ? "local" : "live"
+		});
 	});
 }) });
 
@@ -688,7 +709,7 @@ var init_Output = __esm({ "lib/Output.js": (() => {
 			return `stackRef(${this.stack}${this.stage ? `, { stage: ${this.stage} }` : ""})`;
 		}
 	};
-	stackRef = (stack, options$6 = {}) => Effect.succeed(new StackRefExpr(stack, options$6.stage));
+	stackRef = (stack, options$7 = {}) => Effect.succeed(new StackRefExpr(stack, options$7.stage));
 	MissingSourceError = class extends Data.TaggedError("MissingSourceError") {};
 	InvalidReferenceError = class extends Data.TaggedError("InvalidReferenceError") {};
 	evaluate = (expr, upstream$1) => Effect.gen(function* () {
@@ -853,9 +874,9 @@ var init_PlatformServices = __esm({ "lib/Util/PlatformServices.js": (() => {
 			return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
 		}
 	});
-	runMain = (effect, options$6) => {
-		if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options$6));
-		else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options$6));
+	runMain = (effect, options$7) => {
+		if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options$7));
+		else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options$7));
 	};
 }) });
 
@@ -870,31 +891,31 @@ var init_Stack = __esm({ "lib/Stack.js": (() => {
 	init_effect();
 	init_FileLogger();
 	init_PlatformServices();
-	Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (stackName, options$6, eff) => {
+	Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (stackName, options$7, eff) => {
 		if (!stackName) return (stackName$1) => Object.assign(stackRef(stackName$1).pipe(effectClass), {
 			stackName: stackName$1,
 			stage: createStageProxy(stackName$1),
-			state: options$6?.state,
-			providers: options$6?.providers,
-			make: (options$7, eff$1) => Stack(stackName$1, options$7, eff$1)
+			state: options$7?.state,
+			providers: options$7?.providers,
+			make: (options$8, eff$1) => Stack(stackName$1, options$8, eff$1)
 		});
 		return eff.pipe(make$2({
 			name: stackName,
-			...options$6
+			...options$7
 		}), (eff$1) => Object.assign(eff$1, {
 			stackName,
 			stage: createStageProxy(stackName),
-			state: options$6?.state,
-			providers: options$6?.providers
+			state: options$7?.state,
+			providers: options$7?.providers
 		}));
 	}));
 	createStageProxy = (stackName) => new Proxy({}, { get: (_, stage$1) => stackRef(stackName, { stage: stage$1 }) });
 	StackName = Stack.use((stack) => Effect.succeed(stack.name));
-	make$2 = (options$6) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
-		if (options$6.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options$6.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options$6.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://alchemy.run/state-store for available state stores.`));
-		if (options$6.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options$6.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options$6.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
-		return options$6.providers.pipe(Layer.provideMerge(options$6.state), Layer.provideMerge(Layer.effect(Stack, Stage.pipe(Effect.map((stage$1) => options$6.stack ?? {
-			name: options$6.name,
+	make$2 = (options$7) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
+		if (options$7.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options$7.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options$7.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://alchemy.run/state-store for available state stores.`));
+		if (options$7.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options$7.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options$7.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
+		return options$7.providers.pipe(Layer.provideMerge(options$7.state), Layer.provideMerge(Layer.effect(Stack, Stage.pipe(Effect.map((stage$1) => options$7.stack ?? {
+			name: options$7.name,
 			stage: stage$1,
 			resources: {},
 			bindings: {},
@@ -1314,9 +1335,10 @@ init_Artifacts();
 init_FQN();
 init_Output();
 init_Provider();
+init_ProviderMode();
 init_Resource();
 init_sha256();
-const make = (stack, options$6 = {}) => Effect.gen(function* () {
+const make = (stack, options$7 = {}) => Effect.gen(function* () {
 	const state = yield* yield* State;
 	const resources = Object.values(stack.resources);
 	const actions = Object.values(stack.actions ?? {});
@@ -1331,6 +1353,32 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			onSome: (c$1) => c$1.adopt
 		});
 	});
+	const runDefaultMode = yield* defaultProviderMode;
+	/**
+	* Resolve the effective provider mode and the concrete provider
+	* service for a resource.
+	*
+	* The mode only "sticks" when the provider actually distinguishes
+	* modes (registered via `ProviderLayer.dual`). Mode-agnostic providers
+	* satisfy any requested mode with their single implementation — in a
+	* dev run, a construct that mixes emulatable resources with live-only
+	* ones (e.g. R2 buckets) just works.
+	*/
+	const resolveProviderAndMode = Effect.fn(function* (resource) {
+		const base$1 = yield* findProviderByType(resource.Type);
+		const mode = base$1.modes !== void 0 ? resource.Mode ?? runDefaultMode : void 0;
+		return {
+			provider: yield* providerForMode(base$1, mode),
+			mode
+		};
+	});
+	/**
+	* Has this resource switched provider modes since it was last
+	* reconciled? Rows without a persisted mode (legacy rows, or rows
+	* written by a mode-agnostic provider) are assumed to already be in
+	* the current run's mode — no replacement churn.
+	*/
+	const hasModeSwitched = (mode, oldState) => mode !== void 0 && oldState?.providerMode !== void 0 && oldState.providerMode !== mode;
 	const resourceFqns = yield* state.list({
 		stack: stackName,
 		stage: stage$1
@@ -1345,7 +1393,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		if (isAction(resourceExpr.src)) return resourceExpr;
 		return yield* resolvedResources[resourceExpr.src.FQN] ??= yield* Effect.cached(Effect.gen(function* () {
 			const resource = resourceExpr.src;
-			const provider = yield* findProviderByType(resource.Type);
+			const { provider, mode } = yield* resolveProviderAndMode(resource);
 			const props = yield* resolveInput(resource.Props);
 			const persisted = yield* state.get({
 				stack: stackName,
@@ -1354,6 +1402,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			});
 			const oldState = isActionState(persisted) ? void 0 : persisted;
 			if (!oldState || oldState.status === "creating") return resourceExpr;
+			if (hasModeSwitched(mode, oldState)) return resourceExpr;
 			const oldProps = oldState.status === "updating" ? oldState.old.props : oldState.props;
 			const oldBindings = dedupeBindings(oldState.bindings ?? []);
 			const newBindings = dedupeBindings(stack.bindings[resource.FQN] ?? []);
@@ -1373,7 +1422,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 				if (havePropsChanged(oldProps, props)) return withStables(oldState?.attr);
 			} else if (diff.action === "update") return withStables(oldState?.attr);
 			else if (diff.action === "replace") return resourceExpr;
-			if (options$6.force) return withStables(oldState?.attr);
+			if (options$7.force) return withStables(oldState?.attr);
 			if (oldState.status === "created" || oldState.status === "updated" || oldState.status === "replaced") return oldState?.attr;
 			else return resourceExpr;
 		}));
@@ -1476,7 +1525,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 	};
 	const newDownstreamDependencies = Object.fromEntries([...resources.map((resource) => [resource.FQN, computeDownstream(resource.FQN)]), ...actions.map((action) => [action.FQN, computeDownstream(action.FQN)])]);
 	const resourceGraph = Object.fromEntries((yield* Effect.all(resources.map(Effect.fn("plan.diff.resource")(function* (resource) {
-		const provider = yield* findProviderByType(resource.Type);
+		const { provider, mode } = yield* resolveProviderAndMode(resource);
 		const id = resource.LogicalId;
 		const fqn = resource.FQN;
 		const news = yield* resolveInput(resource.Props);
@@ -1518,26 +1567,29 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 					providerVersion: provider.version ?? 0,
 					bindings: [],
 					downstream,
-					removalPolicy: resource.RemovalPolicy
+					removalPolicy: resource.RemovalPolicy,
+					providerMode: mode
 				};
 				forceUpdateAfterAdoption = true;
 			}
 		}
 		const oldBindings = dedupeBindings(oldState?.bindings ?? []);
 		const bindingDiffs = diffBindings(oldBindings, newBindings);
+		const modeSwitched = hasModeSwitched(mode, oldState);
 		const Node = (node) => ({
 			...node,
 			provider,
 			resource,
 			bindings: bindingDiffs,
-			downstream
+			downstream,
+			mode
 		});
 		if (oldState === void 0) return Node({
 			action: "create",
 			props: news,
 			state: oldState
 		});
-		else if (oldState.status === "creating" && oldState.attr === void 0) {
+		else if (!modeSwitched && oldState.status === "creating" && oldState.attr === void 0) {
 			if (provider.read && isResolved(oldState.props)) {
 				const attr = yield* provider.read({
 					id,
@@ -1546,7 +1598,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 					olds: oldState.props,
 					output: oldState.attr
 				}).pipe(providePlanScope(fqn, oldState.instanceId));
-				if (attr) {
+				if (attr !== void 0) {
 					if (Unowned.is(attr)) {
 						if (!(resource.Adopt ?? (yield* shouldAdopt))) return yield* new OwnedBySomeoneElse({
 							message: `Cannot resume creating resource '${fqn}' (${resource.Type}): a resource with its physical identity exists in the cloud but is not owned by this stack/stage/logical-id. Re-run with \`--adopt\` (or wrap the effect in \`adopt(true)\`) to take it over.`,
@@ -1554,19 +1606,18 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 							logicalId: id
 						});
 					}
-					return Node({
-						action: "create",
-						props: news,
-						state: {
-							...oldState,
-							attr: stripUnowned(attr)
-						}
-					});
+					oldState = {
+						...oldState,
+						attr: stripUnowned(attr)
+					};
 				}
 			}
 		}
 		const oldProps = oldState.props;
-		const diff = yield* asEffect(provider?.diff?.({
+		const diff = modeSwitched ? {
+			action: "replace",
+			deleteFirst: false
+		} : yield* asEffect(provider?.diff?.({
 			id,
 			fqn,
 			olds: oldProps,
@@ -1575,7 +1626,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			news,
 			oldBindings,
 			newBindings
-		}).pipe(providePlanScope(fqn, oldState.instanceId))).pipe(Effect.map((diff$1) => diff$1 ?? { action: havePropsChanged(oldProps, news) || bindingDiffs.some((b) => b.action !== "noop") ? "update" : "noop" }), Effect.map((diff$1) => options$6.force && diff$1.action === "noop" ? { action: "update" } : diff$1), Effect.map((diff$1) => forceUpdateAfterAdoption && diff$1.action === "noop" ? { action: "update" } : diff$1));
+		}).pipe(providePlanScope(fqn, oldState.instanceId))).pipe(Effect.map((diff$1) => diff$1 ?? { action: havePropsChanged(oldProps, news) || bindingDiffs.some((b) => b.action !== "noop") ? "update" : "noop" }), Effect.map((diff$1) => options$7.force && diff$1.action === "noop" ? { action: "update" } : diff$1), Effect.map((diff$1) => forceUpdateAfterAdoption && diff$1.action === "noop" ? { action: "update" } : diff$1));
 		if (oldState.status === "creating") if (diff.action === "noop") return Node({
 			action: "create",
 			props: news,
@@ -1651,6 +1702,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		});
 		else if (diff.action === "update") return Node({
 			action: "update",
+			adopting: forceUpdateAfterAdoption,
 			props: news,
 			state: oldState
 		});
@@ -1684,7 +1736,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			forced: false
 		}];
 		const prior = oldState;
-		if (prior?.status === "ran" && prior.inputHash === inputHash && !options$6.force) return [fqn, {
+		if (prior?.status === "ran" && prior.inputHash === inputHash && !options$7.force) return [fqn, {
 			kind: "action",
 			action: "noop",
 			def: action,
@@ -1698,7 +1750,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			input: action.Input,
 			state: prior,
 			downstream,
-			forced: !!options$6.force
+			forced: !!options$7.force
 		}];
 	})), { concurrency: "unbounded" }));
 	const cycleMembers = combinedCycleMembers;
@@ -1774,12 +1826,13 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		if (oldState) {
 			const { logicalId } = parseFqn(fqn);
 			const resourceType = oldState.resourceType;
-			const providerOption = yield* tryFindProviderByType(resourceType);
+			const providerOption = yield* tryFindProviderByType(resourceType, oldState.providerMode);
 			if (Option.isNone(providerOption)) return yield* Effect.die(missingProviderError(resourceType, fqn));
 			return [fqn, {
 				action: "delete",
 				state: oldState,
 				provider: providerOption.value,
+				mode: oldState.providerMode,
 				resource: {
 					Namespace: oldState.namespace,
 					FQN: fqn,
@@ -1791,6 +1844,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 					Provider: Provider(resourceType),
 					RemovalPolicy: oldState.removalPolicy,
 					Adopt: void 0,
+					Mode: oldState.providerMode,
 					RuntimeContext: void 0,
 					Providers: void 0
 				},
@@ -1823,8 +1877,31 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 	"alchemy.stack": stack.name,
 	"alchemy.stage": stack.stage,
 	"alchemy.resources.count": Object.keys(stack.resources).length,
-	"alchemy.force": !!options$6.force
+	"alchemy.force": !!options$7.force
 } }));
+/**
+* Build the plan that destroys every resource of `(stack.name, stack.stage)`.
+*
+* The spec is emptied out so every persisted resource becomes an orphan
+* deletion, and `output` is left undefined so `apply` does not overwrite the
+* last deploy's persisted stack output with an empty husk. `apply` recognizes
+* the `destroy` marker and deletes the stage's remaining persisted state (the
+* stack output record) once the destroy has converged, so `state.getOutput`
+* and `state.listStages` agree the stage is gone.
+*
+* @see https://github.com/alchemy-run/alchemy/issues/961
+*/
+const destroy = (stack) => make({
+	name: stack.name,
+	stage: stack.stage,
+	resources: {},
+	bindings: {},
+	actions: {},
+	output: void 0
+}).pipe(Effect.map((plan) => ({
+	...plan,
+	destroy: true
+})));
 const providePlanScope = (fqn, instanceId) => (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrElse(createArtifactStore)), Effect.flatMap((store) => effect.pipe(Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)), Effect.provideService(InstanceId, instanceId))));
 var DeleteResourceHasDownstreamDependencies = class extends Data.TaggedError("DeleteResourceHasDownstreamDependencies") {};
 var UnsatisfiedResourceCycle = class extends Data.TaggedError("UnsatisfiedResourceCycle") {};
@@ -1876,6 +1953,13 @@ const apply = (plan) => Effect.gen(function* () {
 		status
 	}), { concurrency: "unbounded" });
 	yield* session.done();
+	if (plan.destroy) {
+		yield* state.deleteStack({
+			stack: stackName,
+			stage: stage$1
+		});
+		return;
+	}
 	if (!plan.output) return;
 	const outputs = Object.fromEntries(Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]));
 	const resolved = yield* evaluate(plan.output, outputs);
@@ -1983,7 +2067,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				providerVersion: node.provider.version ?? 0,
 				resourceType: node.resource.Type,
 				bindings: excludeDeletedBindings(node.bindings),
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			return id;
 		} else if (node.action === "replace") {
@@ -2001,7 +2086,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				bindings: excludeDeletedBindings(node.bindings),
 				old: node.state,
 				deleteFirst: node.deleteFirst,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			return id;
 		} else if (node.state?.instanceId) return node.state.instanceId;
@@ -2020,7 +2106,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				providerVersion: node.provider.version ?? 0,
 				bindings: excludeDeletedBindings(node.bindings),
 				downstream: node.downstream,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			let attr = node.state?.attr;
 			if (attr !== void 0) yield* storeAndSignal({
@@ -2050,7 +2137,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 					providerVersion: node.provider.version ?? 0,
 					bindings: excludeDeletedBindings(node.bindings),
 					downstream: node.downstream,
-					removalPolicy: node.resource.RemovalPolicy
+					removalPolicy: node.resource.RemovalPolicy,
+					providerMode: node.mode
 				});
 				yield* storeAndSignal({
 					output: attr,
@@ -2086,7 +2174,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				bindings: bindingOutputs,
 				providerVersion: node.provider.version ?? 0,
 				downstream: node.downstream,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			tracker[fqn] = {
 				output: attr,
@@ -2110,10 +2199,12 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 			yield* waitForDeps(allUpstreamFqns());
 			const outputs = getOutputs();
 			const news = yield* evaluate(node.props, outputs);
+			const adopting = node.adopting === true || node.state.status === "updating" && node.state.adopting === true;
 			yield* node.state.status === "replaced" ? commit({
 				...node.state,
 				attr: node.state.attr,
-				props: news
+				props: news,
+				providerMode: node.mode
 			}) : commit({
 				status: "updating",
 				fqn,
@@ -2126,10 +2217,12 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				bindings: excludeDeletedBindings(node.bindings),
 				downstream: node.downstream,
 				old: node.state.status === "updating" ? node.state.old : node.state,
-				removalPolicy: node.resource.RemovalPolicy
+				adopting: adopting ? true : void 0,
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			yield* report("updating");
-			const previousProps = node.state.status === "created" || node.state.status === "updated" || node.state.status === "replaced" ? node.state.props : node.state.old.props;
+			const previousProps = adopting ? void 0 : node.state.status === "created" || node.state.status === "updated" || node.state.status === "replaced" ? node.state.props : node.state.old.props;
 			const bindingOutputs = excludeDeletedBindings(yield* evaluate(node.bindings, outputs));
 			const attr = yield* node.provider.reconcile({
 				id: logicalId,
@@ -2144,7 +2237,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 			if (node.state.status === "replaced") yield* commit({
 				...node.state,
 				attr,
-				props: news
+				props: news,
+				providerMode: node.mode
 			});
 			else yield* commit({
 				status: "updated",
@@ -2157,7 +2251,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				bindings: bindingOutputs,
 				providerVersion: node.provider.version ?? 0,
 				downstream: node.downstream,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			tracker[fqn] = {
 				output: attr,
@@ -2197,12 +2292,13 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				deleteFirst: node.deleteFirst,
 				old: node.state,
 				downstream: node.downstream,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			else replState = node.state;
 			const deleteOldGenerations = (old) => Effect.gen(function* () {
 				const retain = node.resource.RemovalPolicy === "retain";
-				if (old.attr !== void 0 && !retain) yield* node.provider.delete({
+				if (old.attr !== void 0 && !retain) yield* (yield* findProviderByType(node.resource.Type, old.providerMode)).delete({
 					id: logicalId,
 					fqn,
 					instanceId: old.instanceId,
@@ -2247,7 +2343,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 					downstream: node.downstream,
 					old: replState.old,
 					deleteFirst: node.deleteFirst,
-					removalPolicy: node.resource.RemovalPolicy
+					removalPolicy: node.resource.RemovalPolicy,
+					providerMode: node.mode
 				});
 				yield* storeAndSignal({
 					output: attr,
@@ -2283,7 +2380,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				providerVersion: node.provider.version ?? 0,
 				bindings: bindingOutputs,
 				downstream: node.downstream,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			else yield* commit({
 				status: "replaced",
@@ -2298,7 +2396,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				downstream: node.downstream,
 				old: replState.old,
 				deleteFirst: node.deleteFirst,
-				removalPolicy: node.resource.RemovalPolicy
+				removalPolicy: node.resource.RemovalPolicy,
+				providerMode: node.mode
 			});
 			tracker[fqn] = {
 				output: attr,
@@ -2503,7 +2602,8 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
 					bindings: stripUnresolved(newBindings),
 					downstream: node.downstream,
 					namespace,
-					removalPolicy: node.resource.RemovalPolicy
+					removalPolicy: node.resource.RemovalPolicy,
+					providerMode: node.mode
 				}
 			});
 			terminalStatuses.set(fqn, {
@@ -2571,18 +2671,24 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
 	}
 });
 /**
-* Internal marker: this node's deletion was skipped because a DEPENDENT
-* resource (one that still references it) failed to delete. The dependent's
-* own failure is already recorded in the GC failure list, so nodes failing
-* with ONLY this marker are not re-recorded — they just keep their state so
-* the next destroy retries the whole chain.
+* Aggregate raised at the end of the deletion phase when one or more
+* resource deletes failed. Every resource whose delete did not depend on a
+* failed one was still attempted — a single failure no longer strands
+* unrelated siblings.
 */
-var DependentDeletionFailed = class extends Data.TaggedError("DependentDeletionFailed") {};
+var DestroyError = class extends Data.TaggedError("DestroyError") {
+	get message() {
+		return [
+			`Failed to delete ${this.failures.length} resource(s)` + (this.blocked.length > 0 ? ` (${this.blocked.length} more skipped because a dependent's delete failed)` : "") + ":",
+			...this.failures.map((f) => `  ✗ ${f.fqn} (${f.resourceType}): ${Cause.pretty(f.cause)}`),
+			...this.blocked.map((b) => `  ⊘ ${b.fqn} (${b.resourceType}): skipped — blocked by failed delete of ${b.blockedBy.join(", ")}`)
+		].join("\n");
+	}
+};
 const collectGarbage = Effect.fn(function* (plan, session) {
 	const state = yield* yield* State;
 	const stackName = (yield* Stack).name;
 	const stage$1 = yield* Stage;
-	const failures = [];
 	yield* Effect.all(Object.entries(plan.actionDeletions ?? {}).map(([fqn, node]) => node === void 0 ? Effect.void : Effect.gen(function* () {
 		yield* session.emit({
 			kind: "status-change",
@@ -2602,11 +2708,14 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 			status: "deleted"
 		});
 	})), { concurrency: "unbounded" });
+	const failures = [];
+	const blockedDeletes = [];
+	const unresolved = /* @__PURE__ */ new Set();
 	const deleteGraph = Effect.fn(function* (deletionGraph) {
 		const deletions = {};
 		const deleteResource = (node, ancestors = /* @__PURE__ */ new Set()) => Effect.gen(function* () {
 			const isDeleteNode = (node$1) => "action" in node$1;
-			const { fqn, logicalId, namespace, resourceType, instanceId, downstream, props, attr: persistedAttr, provider } = isDeleteNode(node) ? {
+			const { fqn, logicalId, namespace, resourceType, instanceId, downstream, props, attr: persistedAttr, provider, providerMode } = isDeleteNode(node) ? {
 				fqn: node.resource.FQN,
 				logicalId: node.resource.LogicalId,
 				namespace: node.resource.Namespace,
@@ -2615,7 +2724,8 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 				downstream: node.downstream,
 				props: node.state.props,
 				attr: node.state.attr,
-				provider: node.provider
+				provider: node.provider,
+				providerMode: node.state.providerMode
 			} : {
 				fqn: node.fqn,
 				logicalId: node.logicalId,
@@ -2625,10 +2735,11 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 				downstream: node.old.downstream,
 				props: node.old.props,
 				attr: node.old.attr,
-				provider: yield* tryFindProviderByType(node.old.resourceType).pipe(Effect.flatMap(Option.match({
+				provider: yield* tryFindProviderByType(node.old.resourceType, node.old.providerMode).pipe(Effect.flatMap(Option.match({
 					onNone: () => Effect.die(missingProviderError(node.old.resourceType, node.fqn)),
 					onSome: Effect.succeed
-				})))
+				}))),
+				providerMode: node.old.providerMode
 			};
 			let attr = persistedAttr;
 			const nextAncestors = new Set(ancestors).add(fqn);
@@ -2658,121 +2769,154 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 				})
 			};
 			return yield* deletions[fqn] ??= yield* Effect.cached(Effect.gen(function* () {
-				yield* Effect.all(downstream.map((dep) => dep !== fqn && dep in deletionGraph && !ancestors.has(dep) ? deleteResource(deletionGraph[dep], nextAncestors) : Effect.void), { concurrency: "unbounded" }).pipe(Effect.catchCause(() => Effect.fail(new DependentDeletionFailed({ fqn }))));
-				if (isDeleteNode(node)) {
-					yield* report("deleting");
-					if (node.resource.RemovalPolicy === "retain") {
-						yield* state.delete({
-							stack: stackName,
-							stage: stage$1,
-							fqn
-						});
-						yield* report("retained");
-						return;
-					}
-				}
-				const retainOldGeneration = !isDeleteNode(node) && node.removalPolicy === "retain";
-				if (retainOldGeneration) yield* scopedSession.note("Retaining replaced resource (removal policy: retain)...");
-				if (attr === void 0 && !retainOldGeneration) if (provider.read) {
-					const recovered = yield* provider.read({
-						id: logicalId,
+				const blockedBy = (yield* Effect.all(downstream.map((dep) => dep !== fqn && !ancestors.has(dep) ? dep in deletionGraph ? deleteResource(deletionGraph[dep], nextAncestors).pipe(Effect.map((outcome) => ({
+					dep,
+					outcome
+				}))) : Effect.sync(() => ({
+					dep,
+					outcome: unresolved.has(dep) ? "failed" : "deleted"
+				})) : Effect.succeed({
+					dep,
+					outcome: "deleted"
+				})), { concurrency: "unbounded" })).filter(({ outcome }) => outcome !== "deleted").map(({ dep }) => dep);
+				if (blockedBy.length > 0) {
+					unresolved.add(fqn);
+					blockedDeletes.push({
 						fqn,
-						instanceId,
-						olds: props,
-						output: void 0
-					}).pipe(instrumentLifecycle("read", fqn, resourceType, logicalId, instanceId));
-					if (recovered !== void 0) if (Unowned.is(recovered)) yield* scopedSession.note("Resource exists in the cloud but is not owned by this stack — leaving it in place (re-deploy with --adopt to take ownership, then destroy).");
-					else attr = stripUnowned(recovered);
-				} else yield* scopedSession.note("No attributes were recorded for this resource (its create was interrupted) and the provider does not implement `read` — if a physical resource was created, it must be cleaned up manually.");
-				if (isDeleteNode(node)) yield* commit({
-					status: "deleting",
-					fqn,
-					logicalId,
-					instanceId,
-					resourceType,
-					props,
-					attr,
-					downstream,
-					providerVersion: provider.version ?? 0,
-					bindings: excludeDeletedBindings(node.bindings),
-					removalPolicy: node.resource.RemovalPolicy
-				});
-				if (attr !== void 0 && !retainOldGeneration) yield* provider.delete({
-					id: logicalId,
-					fqn,
-					instanceId,
-					olds: props,
-					output: attr,
-					session: scopedSession,
-					bindings: []
-				}).pipe(instrumentLifecycle("delete", fqn, resourceType, logicalId, instanceId));
-				if (isDeleteNode(node)) {
-					yield* state.delete({
-						stack: stackName,
-						stage: stage$1,
-						fqn
+						logicalId,
+						resourceType,
+						blockedBy
 					});
-					yield* report("deleted");
-				} else {
-					if (!retainOldGeneration) yield* scopedSession.note("Cleaning up replaced resource...");
-					if (node.old.status === "replacing" || node.old.status === "replaced") yield* commit({
-						status: "replaced",
+					yield* scopedSession.note(`Skipping delete — blocked by failed delete of ${blockedBy.join(", ")}.`);
+					yield* report("skipped");
+					return "blocked";
+				}
+				return yield* deleteResourceBody().pipe(Effect.catchCause((cause) => Effect.gen(function* () {
+					unresolved.add(fqn);
+					failures.push({
 						fqn,
-						logicalId: node.logicalId,
-						instanceId: node.instanceId,
-						resourceType: node.resourceType,
-						props: node.props,
-						attr: node.attr,
-						providerVersion: node.providerVersion,
-						downstream: node.downstream,
-						bindings: excludeDeletedBindings(node.bindings),
-						old: node.old.old,
-						deleteFirst: node.deleteFirst,
-						removalPolicy: node.removalPolicy
+						logicalId,
+						resourceType,
+						cause
 					});
-					else yield* commit({
-						status: "created",
+					yield* report("fail");
+					return "failed";
+				})));
+			}));
+			function deleteResourceBody() {
+				return Effect.gen(function* () {
+					if (isDeleteNode(node)) {
+						yield* report("deleting");
+						if (node.resource.RemovalPolicy === "retain") {
+							yield* state.delete({
+								stack: stackName,
+								stage: stage$1,
+								fqn
+							});
+							yield* report("retained");
+							return "deleted";
+						}
+					}
+					const retainOldGeneration = !isDeleteNode(node) && node.removalPolicy === "retain";
+					if (retainOldGeneration) yield* scopedSession.note("Retaining replaced resource (removal policy: retain)...");
+					if (attr === void 0 && !retainOldGeneration) if (provider.read) {
+						const recovered = yield* provider.read({
+							id: logicalId,
+							fqn,
+							instanceId,
+							olds: props,
+							output: void 0
+						}).pipe(instrumentLifecycle("read", fqn, resourceType, logicalId, instanceId));
+						if (recovered !== void 0) if (Unowned.is(recovered)) yield* scopedSession.note("Resource exists in the cloud but is not owned by this stack — leaving it in place (re-deploy with --adopt to take ownership, then destroy).");
+						else attr = stripUnowned(recovered);
+					} else yield* scopedSession.note("No attributes were recorded for this resource (its create was interrupted) and the provider does not implement `read` — if a physical resource was created, it must be cleaned up manually.");
+					if (isDeleteNode(node)) yield* commit({
+						status: "deleting",
 						fqn,
-						logicalId: node.logicalId,
-						instanceId: node.instanceId,
-						resourceType: node.resourceType,
-						props: node.props,
-						attr: node.attr,
-						providerVersion: node.providerVersion,
-						downstream: node.downstream,
+						logicalId,
+						instanceId,
+						resourceType,
+						props,
+						attr,
+						downstream,
+						providerVersion: provider.version ?? 0,
 						bindings: excludeDeletedBindings(node.bindings),
-						removalPolicy: node.removalPolicy
+						removalPolicy: node.resource.RemovalPolicy,
+						providerMode
 					});
-					yield* scopedSession.note(retainOldGeneration ? "Replaced resource retained." : "Replaced resource cleanup complete.");
-				}
-			}).pipe(Effect.catchCause((cause) => Effect.gen(function* () {
-				if (!cause.reasons.every((reason) => Cause.isFailReason(reason) && reason.error instanceof DependentDeletionFailed)) failures.push({
-					fqn,
-					logicalId,
-					type: resourceType,
-					cause
+					if (attr !== void 0 && !retainOldGeneration) yield* provider.delete({
+						id: logicalId,
+						fqn,
+						instanceId,
+						olds: props,
+						output: attr,
+						session: scopedSession,
+						bindings: []
+					}).pipe(instrumentLifecycle("delete", fqn, resourceType, logicalId, instanceId));
+					if (isDeleteNode(node)) {
+						yield* state.delete({
+							stack: stackName,
+							stage: stage$1,
+							fqn
+						});
+						yield* report("deleted");
+					} else {
+						if (!retainOldGeneration) yield* scopedSession.note("Cleaning up replaced resource...");
+						if (node.old.status === "replacing" || node.old.status === "replaced") yield* commit({
+							status: "replaced",
+							fqn,
+							logicalId: node.logicalId,
+							instanceId: node.instanceId,
+							resourceType: node.resourceType,
+							props: node.props,
+							attr: node.attr,
+							providerVersion: node.providerVersion,
+							downstream: node.downstream,
+							bindings: excludeDeletedBindings(node.bindings),
+							old: node.old.old,
+							deleteFirst: node.deleteFirst,
+							removalPolicy: node.removalPolicy,
+							providerMode: node.providerMode
+						});
+						else yield* commit({
+							status: "created",
+							fqn,
+							logicalId: node.logicalId,
+							instanceId: node.instanceId,
+							resourceType: node.resourceType,
+							props: node.props,
+							attr: node.attr,
+							providerVersion: node.providerVersion,
+							downstream: node.downstream,
+							bindings: excludeDeletedBindings(node.bindings),
+							removalPolicy: node.removalPolicy,
+							providerMode: node.providerMode
+						});
+						yield* scopedSession.note(retainOldGeneration ? "Replaced resource retained." : "Replaced resource cleanup complete.");
+					}
+					return "deleted";
 				});
-				yield* report("fail");
-				return yield* Effect.failCause(cause);
-			}))));
+			}
 		});
-		yield* Effect.all(Object.values(deletionGraph).filter((node) => node !== void 0).map((node) => deleteResource(node).pipe(Effect.ignore)), { concurrency: "unbounded" });
+		yield* Effect.all(Object.values(deletionGraph).filter((node) => node !== void 0).map((node) => deleteResource(node)), { concurrency: "unbounded" });
 	});
 	let first = true;
 	while (true) {
-		const remainingReplacedResources = yield* state.getReplacedResources({
+		const remainingReplacedResources = (yield* state.getReplacedResources({
 			stack: stackName,
 			stage: stage$1
-		});
+		})).filter((replaced) => !unresolved.has(replaced.fqn));
 		if (!first && remainingReplacedResources.length === 0) break;
 		yield* deleteGraph({
 			...first ? plan.deletions : {},
 			...Object.fromEntries(remainingReplacedResources.map((replaced) => [replaced.fqn, replaced]))
 		});
 		first = false;
-		if (failures.length > 0) break;
 	}
-	if (failures.length > 0) return yield* Effect.failCause(failures.map((f) => f.cause).reduce(Cause.combine));
+	if (failures.length > 0) return yield* Effect.fail(new DestroyError({
+		failures,
+		blocked: blockedDeletes
+	}));
 });
 const excludeDeletedBindings = (bindings) => bindings.flatMap(({ action, sid, data }) => action === "delete" ? [] : [{
 	sid,
@@ -2789,13 +2933,12 @@ const retryIfCancelled = Effect.retry({ while: (e) => e instanceof PromptCancell
 *
 * Returns `undefined` if the user cancels (Ctrl+C / Escape).
 *
-* Uses `Effect.callback` so fiber interruption propagates via the abort
-* signal to any async resources we own; the clack prompt itself is left
-* to resolve — its result is ignored after interruption.
+* Uses `Effect.callback` so fiber interruption propagates to the clack
+* prompt through its abort signal, releasing stdin and restoring the cursor.
 */
 const prompt = (fn) => Effect.callback((resume, signal) => {
 	let settled = false;
-	fn().then((result) => {
+	fn(signal).then((result) => {
 		if (settled || signal.aborted) return;
 		settled = true;
 		if (p.isCancel(result)) resume(Effect.fail(new PromptCancelled()));
@@ -2809,11 +2952,34 @@ const prompt = (fn) => Effect.callback((resume, signal) => {
 const success = (str) => Effect.sync(() => p.log.success(str));
 const warn = (str) => Effect.sync(() => p.log.warn(str));
 const info = (str) => Effect.sync(() => p.log.info(str));
-const text = (opts) => prompt(() => p.text(opts));
-const password = (opts) => prompt(() => p.password(opts));
-const select = (opts) => prompt(() => p.select(opts));
-const confirm = (opts) => prompt(() => p.confirm(opts));
-const multiselect = (opts) => prompt(() => p.multiselect(opts));
+const text = (opts) => {
+	const validate = opts.validate;
+	return prompt((signal) => p.text({
+		...opts,
+		signal,
+		validate: validate === void 0 ? void 0 : (value) => validate(value ?? "")
+	}));
+};
+const password = (opts) => {
+	const validate = opts.validate;
+	return prompt((signal) => p.password({
+		...opts,
+		signal,
+		validate: validate === void 0 ? void 0 : (value) => validate(value ?? "")
+	}));
+};
+const select = (opts) => prompt((signal) => p.select({
+	...opts,
+	signal
+}));
+const confirm = (opts) => prompt((signal) => p.confirm({
+	...opts,
+	signal
+}));
+const multiselect = (opts) => prompt((signal) => p.multiselect({
+	...opts,
+	signal
+}));
 /**
 * Open a URL in the user's default browser.
 *
@@ -2882,7 +3048,7 @@ const fromEnvironment = Layer.effect(Region.Region, Effect.gen(function* () {
 init_AuthProvider();
 init_Credentials();
 const AWS_AUTH_PROVIDER_NAME = "AWS";
-const options$5 = [
+const options$6 = [
 	{
 		value: "sso",
 		label: "SSO",
@@ -2957,7 +3123,7 @@ const AwsAuth = AuthProviderLayer()(AWS_AUTH_PROVIDER_NAME, Effect.gen(function*
 	});
 	const configureInteractive = (profileName) => select({
 		message: "AWS authentication method",
-		options: options$5
+		options: options$6
 	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("sso", () => Effect.gen(function* () {
 		const config = {
 			method: "sso",
@@ -3104,7 +3270,7 @@ const clearDistilledSsoCache = (ssoProfile) => Effect.gen(function* () {
 init_AuthProvider();
 init_Credentials();
 const STORAGE_KEY = "axiom-stored";
-const options$4 = [{
+const options$5 = [{
 	value: "env",
 	label: "Environment Variables",
 	hint: "AXIOM_TOKEN (or AXIOM_API_KEY) + optional AXIOM_ORG_ID, AXIOM_URL"
@@ -3184,7 +3350,7 @@ const AxiomAuth = AuthProviderLayer()(AXIOM_AUTH_PROVIDER_NAME, Effect.gen(funct
 	});
 	const configureInteractive = (profileName) => select({
 		message: "Axiom authentication method",
-		options: options$4
+		options: options$5
 	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
 	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
 		if (ctx.ci) return { method: "env" };
@@ -3388,13 +3554,42 @@ const revoke = (credentials) => Effect.gen(function* () {
 	});
 });
 /**
+* Exchange a code copied from the hosted relay page, or extract the code from
+* either the hosted or loopback callback URL.
+*/
+const exchangeCallbackInput$1 = (input, authorization) => Effect.gen(function* () {
+	const value = input.trim();
+	let code = value;
+	let state = null;
+	try {
+		const url = new URL(value);
+		code = url.searchParams.get("code") ?? "";
+		state = url.searchParams.get("state");
+	} catch {
+		const separator = value.lastIndexOf("#");
+		if (separator >= 0) {
+			code = value.slice(0, separator);
+			state = value.slice(separator + 1);
+		}
+	}
+	if (!code) return yield* new OAuthError$1({
+		error: "invalid_request",
+		errorDescription: "The authorization code is missing."
+	});
+	if (state !== null && state !== authorization.state) return yield* new OAuthError$1({
+		error: "invalid_request",
+		errorDescription: "The authorization state does not match."
+	});
+	return yield* exchange$1(code, authorization.verifier);
+});
+/**
 * Start a local HTTP server to listen for the OAuth callback, exchange
 * the authorization code, and return the credentials.
 *
 * Times out after 5 minutes.
 */
 const callback$1 = (authorization) => Effect.tryPromise({
-	try: () => callbackPromise$1(authorization),
+	try: (signal) => callbackPromise$1(authorization, signal),
 	catch: (err) => {
 		if (err instanceof OAuthError$1) return err;
 		return new OAuthError$1({
@@ -3403,11 +3598,21 @@ const callback$1 = (authorization) => Effect.tryPromise({
 		});
 	}
 });
-function callbackPromise$1(authorization) {
-	const { pathname, port } = new URL(OAUTH_REDIRECT_URI$1);
+function callbackPromise$1(authorization, signal) {
+	const { pathname, port } = new URL(OAUTH_LOCAL_CALLBACK_URI$1);
 	return new Promise((resolve, reject) => {
 		const server = http.createServer(async (req, res) => {
 			const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+			if (url.pathname === "/auth/ping") {
+				res.writeHead(req.method === "OPTIONS" ? 204 : 200, {
+					"Access-Control-Allow-Origin": new URL(OAUTH_REDIRECT_URI$1).origin,
+					"Access-Control-Allow-Methods": "GET, OPTIONS",
+					"Access-Control-Allow-Private-Network": "true",
+					"Cache-Control": "no-store"
+				});
+				res.end();
+				return;
+			}
 			if (url.pathname !== pathname) {
 				res.statusCode = 404;
 				res.end("Not Found");
@@ -3469,8 +3674,10 @@ function callbackPromise$1(authorization) {
 		}, 300 * 1e3);
 		function cleanup() {
 			clearTimeout(timeout);
+			signal.removeEventListener("abort", cleanup);
 			server.close();
 		}
+		signal.addEventListener("abort", cleanup, { once: true });
 		server.on("error", (err) => {
 			cleanup();
 			reject(new OAuthError$1({
@@ -3486,7 +3693,7 @@ function callbackPromise$1(authorization) {
 //#region lib/Cloudflare/Auth/AuthProvider.js
 init_AuthProvider();
 init_Credentials();
-const options$3 = [
+const options$4 = [
 	{
 		value: "oauth",
 		label: "OAuth",
@@ -3573,8 +3780,12 @@ const CloudflareAuth = AuthProviderLayer()(CLOUDFLARE_AUTH_PROVIDER_NAME, Effect
 		yield* info("Cloudflare: opening browser for OAuth login...");
 		yield* info(authorization.url);
 		yield* openUrl(authorization.url).pipe(Effect.catch(() => warn("Cloudflare: could not open browser automatically. Please open the URL above manually.")));
-		yield* info("Cloudflare: waiting for authorization (up to 5 minutes)...");
-		const credentials = yield* callback$1(authorization);
+		yield* info("Cloudflare: waiting for authorization (up to 5 minutes).");
+		const credentials = yield* Effect.raceFirst(callback$1(authorization), text({
+			message: "Paste the authorization code or callback URL",
+			placeholder: "The browser will complete this automatically when local",
+			validate: (value) => value.trim().length > 0 ? void 0 : "Paste a code or URL"
+		}).pipe(Effect.flatMap((input) => exchangeCallbackInput$1(input, authorization))));
 		yield* store.write(profileName, "cf-oauth", credentials);
 		yield* success("Cloudflare: OAuth credentials saved.");
 		return credentials;
@@ -3643,7 +3854,7 @@ const CloudflareAuth = AuthProviderLayer()(CLOUDFLARE_AUTH_PROVIDER_NAME, Effect
 	});
 	const configureInteractive = (profileName) => select({
 		message: "Cloudflare authentication method",
-		options: options$3
+		options: options$4
 	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("oauth", () => configureOAuth(profileName)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
 	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
 		const config = ctx.ci ? { method: "env" } : yield* configureInteractive(profileName);
@@ -3852,7 +4063,8 @@ const DEFAULT_SCOPES = [
 	"zone:read"
 ];
 const OAUTH_CLIENT_ID$1 = "6d8c2255-0773-45f6-b376-2914632e6f91";
-const OAUTH_REDIRECT_URI$1 = "http://localhost:9976/auth/callback";
+const OAUTH_REDIRECT_URI$1 = "https://alchemy.run/auth/callback";
+const OAUTH_LOCAL_CALLBACK_URI$1 = "http://localhost:9976/auth/callback";
 const OAUTH_ENDPOINTS$1 = {
 	authorize: "https://dash.cloudflare.com/oauth2/authorize",
 	token: "https://dash.cloudflare.com/oauth2/token",
@@ -3918,7 +4130,7 @@ const resolveGitHubBaseUrlFromEnv = Effect.gen(function* () {
 //#region lib/GitHub/AuthProvider.js
 init_AuthProvider();
 init_Credentials();
-const options$2 = [
+const options$3 = [
 	{
 		value: "gh-cli",
 		label: "GitHub CLI",
@@ -4019,7 +4231,7 @@ const makeGitHubAuth = (authOptions) => AuthProviderLayer()(GITHUB_AUTH_PROVIDER
 	const configureInteractive = (profileName) => Effect.gen(function* () {
 		const method = yield* select({
 			message: "GitHub authentication method",
-			options: options$2
+			options: options$3
 		});
 		const baseUrl = fixed !== void 0 ? void 0 : yield* promptBaseUrl;
 		const verifyHost = fixed !== void 0 ? fixed.baseUrl : baseUrl;
@@ -4095,7 +4307,7 @@ init_AuthProvider();
 init_Credentials();
 init_Profile();
 const NEON_AUTH_PROVIDER_NAME = "Neon";
-const options$1 = [{
+const options$2 = [{
 	value: "env",
 	label: "Environment Variable",
 	hint: "NEON_API_KEY"
@@ -4125,7 +4337,7 @@ const NeonAuth = AuthProviderLayer()(NEON_AUTH_PROVIDER_NAME, Effect.gen(functio
 	});
 	const configureInteractive = (profileName) => select({
 		message: "Neon authentication method",
-		options: options$1
+		options: options$2
 	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
 	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
 		if (ctx.ci) return { method: "env" };
@@ -4198,7 +4410,8 @@ var OAuthError = class extends Data.TaggedError("OAuthError") {};
 */
 const OAUTH_CLIENT_ID = "pscale_app_aa12e3938baebb788aac443f66e422da";
 const OAUTH_CLIENT_SECRET = "pscale_app_secret_yyZ3Q8oe99GP9_yA5wrA5er6RuN6Lz9dC66Bj1OJzpg";
-const OAUTH_REDIRECT_URI = "http://localhost:9976/auth/callback";
+const OAUTH_REDIRECT_URI = "https://alchemy.run/auth/callback";
+const OAUTH_LOCAL_CALLBACK_URI = "http://localhost:9976/auth/callback";
 const OAUTH_ENDPOINTS = {
 	authorize: "https://app.planetscale.com/oauth/authorize",
 	token: "https://auth.planetscale.com/oauth/token"
@@ -4288,13 +4501,42 @@ const refresh = (credentials) => tokenRequest({
 	client_secret: OAUTH_CLIENT_SECRET
 });
 /**
+* Exchange a code copied from the hosted relay page, or extract the code from
+* either the hosted or loopback callback URL.
+*/
+const exchangeCallbackInput = (input, authorization) => Effect.gen(function* () {
+	const value = input.trim();
+	let code = value;
+	let state = null;
+	try {
+		const url = new URL(value);
+		code = url.searchParams.get("code") ?? "";
+		state = url.searchParams.get("state");
+	} catch {
+		const separator = value.lastIndexOf("#");
+		if (separator >= 0) {
+			code = value.slice(0, separator);
+			state = value.slice(separator + 1);
+		}
+	}
+	if (!code) return yield* new OAuthError({
+		error: "invalid_request",
+		errorDescription: "The authorization code is missing."
+	});
+	if (state !== null && state !== authorization.state) return yield* new OAuthError({
+		error: "invalid_request",
+		errorDescription: "The authorization state does not match."
+	});
+	return yield* exchange(code);
+});
+/**
 * Start a local HTTP server to listen for the OAuth callback, exchange
 * the authorization code, and return the credentials.
 *
 * Times out after 5 minutes.
 */
 const callback = (authorization) => Effect.tryPromise({
-	try: () => callbackPromise(authorization),
+	try: (signal) => callbackPromise(authorization, signal),
 	catch: (err) => {
 		if (err instanceof OAuthError) return err;
 		return new OAuthError({
@@ -4303,11 +4545,21 @@ const callback = (authorization) => Effect.tryPromise({
 		});
 	}
 });
-function callbackPromise(authorization) {
-	const { pathname, port } = new URL(OAUTH_REDIRECT_URI);
+function callbackPromise(authorization, signal) {
+	const { pathname, port } = new URL(OAUTH_LOCAL_CALLBACK_URI);
 	return new Promise((resolve, reject) => {
 		const server = http.createServer(async (req, res) => {
 			const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+			if (url.pathname === "/auth/ping") {
+				res.writeHead(req.method === "OPTIONS" ? 204 : 200, {
+					"Access-Control-Allow-Origin": new URL(OAUTH_REDIRECT_URI).origin,
+					"Access-Control-Allow-Methods": "GET, OPTIONS",
+					"Access-Control-Allow-Private-Network": "true",
+					"Cache-Control": "no-store"
+				});
+				res.end();
+				return;
+			}
 			if (url.pathname !== pathname) {
 				res.statusCode = 404;
 				res.end("Not Found");
@@ -4369,8 +4621,10 @@ function callbackPromise(authorization) {
 		}, 300 * 1e3);
 		function cleanup() {
 			clearTimeout(timeout);
+			signal.removeEventListener("abort", cleanup);
 			server.close();
 		}
+		signal.addEventListener("abort", cleanup, { once: true });
 		server.on("error", (err) => {
 			cleanup();
 			reject(new OAuthError({
@@ -4426,7 +4680,7 @@ const selectOrganization = (accessToken) => Effect.gen(function* () {
 		}))
 	}).pipe(retryOnce);
 }).pipe((e) => withOAuthCredentials(accessToken, e));
-const options = [
+const options$1 = [
 	{
 		value: "env",
 		label: "Environment Variables",
@@ -4462,8 +4716,12 @@ const PlanetscaleAuth = AuthProviderLayer()(PLANETSCALE_AUTH_PROVIDER_NAME, Effe
 		yield* info("Planetscale: opening browser for OAuth login...");
 		yield* info(authorization.url);
 		yield* openUrl(authorization.url).pipe(Effect.catch(() => warn("Planetscale: could not open browser automatically. Please open the URL above manually.")));
-		yield* info("Planetscale: waiting for authorization (up to 5 minutes)...");
-		const credentials = yield* callback(authorization);
+		yield* info("Planetscale: waiting for authorization (up to 5 minutes).");
+		const credentials = yield* Effect.raceFirst(callback(authorization), text({
+			message: "Paste the authorization code or callback URL",
+			placeholder: "The browser will complete this automatically when local",
+			validate: (value) => value.trim().length > 0 ? void 0 : "Paste a code or URL"
+		}).pipe(Effect.flatMap((input) => exchangeCallbackInput(input, authorization))));
 		yield* store.write(profileName, "planetscale-oauth", credentials);
 		yield* success("Planetscale: OAuth credentials saved.");
 		return credentials;
@@ -4504,7 +4762,7 @@ const PlanetscaleAuth = AuthProviderLayer()(PLANETSCALE_AUTH_PROVIDER_NAME, Effe
 	});
 	const configureInteractive = (profileName) => select({
 		message: "Planetscale authentication method",
-		options
+		options: options$1
 	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("oauth", () => configureOAuth(profileName)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
 	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
 		if (ctx.ci) return { method: "env" };
@@ -4589,6 +4847,108 @@ const PlanetscaleAuth = AuthProviderLayer()(PLANETSCALE_AUTH_PROVIDER_NAME, Effe
 	};
 }));
 
+//#endregion
+//#region lib/Prisma/AuthProvider.js
+init_AuthProvider();
+init_Credentials();
+init_Profile();
+const PRISMA_AUTH_PROVIDER_NAME = "Prisma";
+const PRISMA_SERVICE_TOKEN_ENV = "PRISMA_SERVICE_TOKEN";
+const PRISMA_API_TOKEN_ENV = "PRISMA_API_TOKEN";
+const options = [{
+	value: "env",
+	label: "Environment Variable",
+	hint: `${PRISMA_SERVICE_TOKEN_ENV} or ${PRISMA_API_TOKEN_ENV}`
+}, {
+	value: "stored",
+	label: "Service Token",
+	hint: "enter interactively, stored in ~/.alchemy/credentials"
+}];
+const nonEmptyToken = (token) => token !== void 0 && Redacted.value(token).trim().length > 0;
+const validStoredCredentials = (credentials) => credentials?.type === "serviceToken" && credentials.serviceToken.trim().length > 0;
+const trimToken = (token) => Redacted.make(Redacted.value(token).trim());
+const readEnvServiceToken = Effect.fnUntraced(function* () {
+	const serviceToken = yield* getEnvRedacted(PRISMA_SERVICE_TOKEN_ENV);
+	if (nonEmptyToken(serviceToken)) return {
+		serviceToken: trimToken(serviceToken),
+		envName: PRISMA_SERVICE_TOKEN_ENV
+	};
+	const apiToken = yield* getEnvRedacted(PRISMA_API_TOKEN_ENV);
+	if (nonEmptyToken(apiToken)) return {
+		serviceToken: trimToken(apiToken),
+		envName: PRISMA_API_TOKEN_ENV
+	};
+});
+/**
+* Layer that registers the Prisma Management API auth provider.
+*/
+const PrismaAuth = AuthProviderLayer()(PRISMA_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+	const profiles = yield* AlchemyProfile;
+	const store = yield* CredentialsStore;
+	const loginStored = Effect.fnUntraced(function* (profileName) {
+		const serviceToken = yield* password({
+			message: "Prisma Service Token",
+			validate: (v) => v.trim().length === 0 ? "Required" : void 0
+		}).pipe(retryOnce);
+		yield* store.write(profileName, "prisma-stored", {
+			type: "serviceToken",
+			serviceToken: serviceToken.trim()
+		});
+		yield* success("Prisma: credentials saved.");
+		return { method: "stored" };
+	});
+	const configureInteractive = (profileName) => select({
+		message: "Prisma authentication method",
+		options
+	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+	const configure = (profileName, ctx) => Effect.gen(function* () {
+		if (ctx.ci) return { method: "env" };
+		return yield* configureInteractive(profileName);
+	}).pipe(Effect.mapError((e) => new AuthError({
+		message: "failed to configure credentials",
+		cause: e
+	})));
+	const read = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fnUntraced(function* () {
+		const envToken = yield* readEnvServiceToken();
+		if (!envToken) return yield* new AuthError({ message: `Prisma env credentials not found. Set ${PRISMA_SERVICE_TOKEN_ENV} or ${PRISMA_API_TOKEN_ENV}.` });
+		return {
+			type: "serviceToken",
+			serviceToken: envToken.serviceToken,
+			source: {
+				type: "env",
+				details: envToken.envName
+			}
+		};
+	})), Match.when({ method: "stored" }, () => store.read(profileName, "prisma-stored").pipe(Effect.flatMap((creds) => !validStoredCredentials(creds) ? Effect.fail(new AuthError({ message: creds == null ? "Prisma stored credentials not found. Run: alchemy login --configure" : "Prisma stored credentials are invalid. Run: alchemy login --configure" })) : Effect.succeed({
+		type: "serviceToken",
+		serviceToken: Redacted.make(creds.serviceToken.trim()),
+		source: { type: "stored" }
+	})))), Match.exhaustive);
+	const login = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => readEnvServiceToken().pipe(Effect.flatMap((envToken) => envToken ? Effect.void : Effect.gen(function* () {
+		const next = yield* configureInteractive(profileName);
+		const existing = yield* profiles.getProfile(profileName);
+		yield* profiles.setProfile(profileName, {
+			...existing,
+			[PRISMA_AUTH_PROVIDER_NAME]: next
+		});
+	})))), Match.when({ method: "stored" }, () => store.read(profileName, "prisma-stored").pipe(Effect.flatMap((creds) => validStoredCredentials(creds) ? Effect.void : loginStored(profileName)))), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
+		message: "login failed",
+		cause: e
+	})));
+	const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.delete(profileName, "prisma-stored").pipe(Effect.andThen(success("Prisma: stored credentials removed")))), Match.exhaustive);
+	const prettyPrint = (profileName, config) => read(profileName, config).pipe(Effect.tap((creds) => {
+		const source = creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type;
+		return Effect.all([Console.log(`  serviceToken: ${displayRedacted(creds.serviceToken, 9)}`), Console.log(`  source: ${source}`)]);
+	}), Effect.catch((e) => Console.error(`  Failed to retrieve credentials: ${e}`)));
+	return {
+		configure,
+		login,
+		logout,
+		prettyPrint,
+		read
+	};
+}));
+
 //#endregion
 //#region lib/Cli/commands/_shared.js
 init_AuthProvider();
@@ -4704,13 +5064,13 @@ const placeholderStack = (name) => ({
 * entrypoint is fatal (login / nuke let it propagate) or best-effort
 * (profile show wraps the call in `Effect.catchCause`).
 */
-const buildStackProviders = Effect.fn("buildStackProviders")(function* (options$6) {
-	const authProviders = options$6.registry ?? {};
-	const stackEffect = yield* importStack(options$6.main);
-	const configProvider = withProfileOverride(yield* loadConfigProvider(options$6.envFile), options$6.profile);
+const buildStackProviders = Effect.fn("buildStackProviders")(function* (options$7) {
+	const authProviders = options$7.registry ?? {};
+	const stackEffect = yield* importStack(options$7.main);
+	const configProvider = withProfileOverride(yield* loadConfigProvider(options$7.envFile), options$7.profile);
 	return {
 		authProviders,
-		context: yield* Layer.build((stackEffect.providers ?? Layer.empty).pipe(Layer.provideMerge(stackEffect.state ?? Layer.empty), Layer.provideMerge(Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(configProvider), options$6.logger ?? Logger.layer([fileLogger("out")], { mergeWithExisting: true }), Layer.succeed(Stage, "placeholder"), Layer.succeed(Stack, placeholderStack(stackEffect.stackName)), options$6.extra ?? Layer.empty)))),
+		context: yield* Layer.build((stackEffect.providers ?? Layer.empty).pipe(Layer.provideMerge(stackEffect.state ?? Layer.empty), Layer.provideMerge(Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(configProvider), options$7.logger ?? Logger.layer([fileLogger("out")], { mergeWithExisting: true }), Layer.succeed(Stage, "placeholder"), Layer.succeed(Stack, placeholderStack(stackEffect.stackName)), options$7.extra ?? Layer.empty)))),
 		stackEffect
 	};
 });
@@ -4720,14 +5080,14 @@ const buildStackProviders = Effect.fn("buildStackProviders")(function* (options$
 * `alchemy profile show` can pretty-print any provider a profile mentions,
 * even one the current stack doesn't wire up.
 */
-const builtinAuth = Layer.mergeAll(AwsAuth, AxiomAuth, CloudflareAuth, GitHubAuth, NeonAuth, PlanetscaleAuth);
+const builtinAuth = Layer.mergeAll(AwsAuth, AxiomAuth, CloudflareAuth, GitHubAuth, NeonAuth, PlanetscaleAuth, PrismaAuth);
 /**
 * Build {@link builtinAuth} against `registry` so every built-in auth
 * provider registers itself, without importing any stack entrypoint.
 */
-const buildBuiltinAuthProviders = Effect.fn("buildBuiltinAuthProviders")(function* (options$6) {
-	const authProviders = options$6.registry ?? {};
-	yield* Layer.build(Layer.provide(builtinAuth, Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(options$6.envFile), options$6.profile)), Logger.layer([fileLogger("out")], { mergeWithExisting: true }))));
+const buildBuiltinAuthProviders = Effect.fn("buildBuiltinAuthProviders")(function* (options$7) {
+	const authProviders = options$7.registry ?? {};
+	yield* Layer.build(Layer.provide(builtinAuth, Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(options$7.envFile), options$7.profile)), Logger.layer([fileLogger("out")], { mergeWithExisting: true }))));
 	return authProviders;
 });
 
@@ -4765,7 +5125,7 @@ const stackSpanAttrs = (args) => ({
 	"alchemy.adopt": !!args.adopt
 });
 const adopt = Flag.boolean("adopt").pipe(Flag.withDescription("Adopt pre-existing cloud resources that conflict with this stack instead of failing. Useful for re-importing infrastructure into a fresh state store."), Flag.withDefault(false));
-const execStack = Effect.fn(function* ({ main, stage: stage$1, envFile: envFile$1, profile: profile$1, dryRun: dryRun$1 = false, force: force$1 = false, yes: yes$1 = false, destroy = false, dev = false, adopt: adopt$1 = false }) {
+const execStack = Effect.fn(function* ({ main, stage: stage$1, envFile: envFile$1, profile: profile$1, dryRun: dryRun$1 = false, force: force$1 = false, yes: yes$1 = false, destroy: destroy$1 = false, dev = false, adopt: adopt$1 = false }) {
 	const stackEffect = yield* importStack(main);
 	const services$1 = Layer.mergeAll(Layer.effect(AlchemyContext, AlchemyContext.pipe(Effect.map((ctx) => ({
 		...ctx,
@@ -4777,13 +5137,7 @@ const execStack = Effect.fn(function* ({ main, stage: stage$1, envFile: envFile$
 		const cli = yield* Cli;
 		const stack = yield* stackEffect;
 		yield* Effect.gen(function* () {
-			const updatePlan = yield* make(destroy ? {
-				...stack,
-				resources: {},
-				bindings: {},
-				actions: {},
-				output: {}
-			} : stack, { force: force$1 });
+			const updatePlan = destroy$1 ? yield* destroy(stack) : yield* make(stack, { force: force$1 });
 			if (dryRun$1) yield* cli.displayPlan(updatePlan);
 			else {
 				const hasChanges = Object.keys(updatePlan.deletions).length > 0 || Object.values(updatePlan.resources).some((node) => node.action !== "noop" || node.bindings.some((b) => b.action !== "noop"));