alchemy 2.0.0-beta.66 → 2.0.0-beta.68

package/bin/exec.js

@@ -22,27 +22,37 @@ import * as HttpBody from "effect/unstable/http/HttpBody";
 import * as HttpClient from "effect/unstable/http/HttpClient";
 import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
-import "effect/Scope";
+import * as Scope from "effect/Scope";
 import * as Deferred from "effect/Deferred";
 import * as Data from "effect/Data";
-import * as Duration from "effect/Duration";
 import { flow, pipe } from "effect/Function";
 import { SingleShotGen } from "effect/Utils";
 import * as Effectable from "effect/Effectable";
 import "effect/Predicate";
 import "effect/Record";
+import { defaultTeardown } from "effect/Runtime";
 import http from "node:http";
 import * as Cause from "effect/Cause";
 import * as Exit from "effect/Exit";
 import * as Stream from "effect/Stream";
 import * as NodeUtil from "node:util";
+import { exitHook } from "@alchemy.run/node-utils/exit-hook";
 import * as Console from "effect/Console";
+import * as Queue from "effect/Queue";
+import * as HttpServer from "effect/unstable/http/HttpServer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as ChildProcess$1 from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner$1 from "effect/unstable/process/ChildProcessSpawner";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import * as NodeChildProcess from "node:child_process";
 import * as Command from "effect/unstable/cli/Command";
 import * as Flag from "effect/unstable/cli/Flag";
+import * as Duration from "effect/Duration";
 import * as Metric from "effect/Metric";
 import * as Argument from "effect/unstable/cli/Argument";
 import * as CliError from "effect/unstable/cli/CliError";
-import { pathToFileURL } from "node:url";
 import * as DistilledAuth from "@distilled.cloud/aws/Auth";
 import { Credentials } from "@distilled.cloud/aws/Credentials";
 import * as STS from "@distilled.cloud/aws/sts";
@@ -55,10 +65,8 @@ import * as Region from "@distilled.cloud/aws/Region";
 import { DEFAULT_API_BASE_URL } from "@distilled.cloud/axiom/Credentials";
 import * as cfAccounts from "@distilled.cloud/cloudflare/accounts";
 import * as CfCredentialsModule from "@distilled.cloud/cloudflare/Credentials";
-import * as ChildProcess$1 from "effect/unstable/process/ChildProcess";
-import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { listOrganizations } from "@distilled.cloud/planetscale";
 import * as PsCredentialsModule from "@distilled.cloud/planetscale/Credentials";
-import { listOrganizations } from "@distilled.cloud/planetscale/Operations";
 import { jsx, jsxs } from "react/jsx-runtime";
 import { Box, Text, render, useApp, useInput } from "ink";
 import { useEffect, useMemo, useRef, useState } from "react";
@@ -157,7 +165,7 @@ var init_Lock = __esm({ "lib/Auth/Lock.js": (() => {
 //#endregion
 //#region lib/Auth/AuthProvider.js
 var AUTH_LANDING_HOST, AUTH_SUCCESS_URL, AUTH_ERROR_URL, LOCKED_METHODS, INTERACTIVE_METHODS, interactiveMutex, AuthError, AuthProviders, AuthProvider, AuthProviderLayer, getAuthProvider;
-var init_AuthProvider = __esm({ "lib/Auth/AuthProvider.js": (() => {
+var init_AuthProvider$1 = __esm({ "lib/Auth/AuthProvider.js": (() => {
 	init_Lock();
 	AUTH_LANDING_HOST = "https://alchemy.run";
 	AUTH_SUCCESS_URL = `${AUTH_LANDING_HOST}/auth/success`;
@@ -202,7 +210,7 @@ var init_AuthProvider = __esm({ "lib/Auth/AuthProvider.js": (() => {
 var rootDir, configFilePath, ALCHEMY_PROFILE, CONFIG_VERSION, emptyConfig, AlchemyProfile, ProfileLive, withProfileOverride;
 var init_Profile = __esm({ "lib/Auth/Profile.js": (() => {
 	init_interactive();
-	init_AuthProvider();
+	init_AuthProvider$1();
 	rootDir = path.join(os.homedir(), ".alchemy");
 	configFilePath = path.join(rootDir, "profiles.json");
 	ALCHEMY_PROFILE = Config.string("ALCHEMY_PROFILE").pipe(Config.withDefault("default"));
@@ -457,9 +465,10 @@ var init_Resource = __esm({ "lib/Resource.js": (() => {
 
 //#endregion
 //#region lib/RuntimeContext.js
-var sanitizeKey, RuntimeContext, CurrentRuntimeContext;
+var sanitizeKey, isRedactedMarker, RuntimeContext, CurrentRuntimeContext;
 var init_RuntimeContext = __esm({ "lib/RuntimeContext.js": (() => {
 	sanitizeKey = (key) => key.replaceAll(/[^a-zA-Z0-9]/g, "_");
+	isRedactedMarker = (value) => typeof value === "object" && value !== null && value._tag === "Redacted" && "value" in value;
 	RuntimeContext = class extends EffectContext.Service()("RuntimeContext") {
 		static phantom = Layer.empty;
 	};
@@ -475,17 +484,33 @@ var init_Stage = __esm({ "lib/Stage.js": (() => {
 
 //#endregion
 //#region lib/State/State.js
-var isActionState, State;
+var isActionState, StateStoreError, State;
 var init_State = __esm({ "lib/State/State.js": (() => {
 	isActionState = (s) => !!s && s.kind === "action";
+	StateStoreError = class extends Data.TaggedError("StateStoreError") {};
 	State = class extends EffectContext.Service()("alchemy/State") {};
 }) });
 
 //#endregion
 //#region lib/Util/data.js
-var isPrimitive;
+var isPrimitive, isPlainData, mapPlainData;
 var init_data = __esm({ "lib/Util/data.js": (() => {
 	isPrimitive = (value) => value === void 0 || value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string" || typeof value === "symbol" || typeof value === "bigint";
+	isPlainData = (value) => {
+		if (Array.isArray(value)) return true;
+		if (typeof value !== "object" || value === null) return false;
+		const proto = Object.getPrototypeOf(value);
+		return proto === Object.prototype || proto === null;
+	};
+	mapPlainData = (value, ancestors, walk) => {
+		if (ancestors.has(value)) return void 0;
+		ancestors.add(value);
+		try {
+			return Array.isArray(value) ? value.map(walk) : Object.fromEntries(Object.entries(value).map(([key, child]) => [key, walk(child)]));
+		} finally {
+			ancestors.delete(value);
+		}
+	};
 }) });
 
 //#endregion
@@ -511,7 +536,7 @@ function proxy(self) {
 	});
 	return proxy$1;
 }
-var inspect, of$1, asOutput, isOutput, ExprSymbol, exprKind, isExpr, BaseExpr, isResourceExpr, ResourceExpr, isPropExpr, PropExpr, isLiteralExpr, LiteralExpr, VoidExpr, isApplyExpr, ApplyExpr, isFlatMapExpr, FlatMapExpr, isEffectExpr, EffectExpr, isNamedExpr, NamedExpr, isAllExpr, AllExpr, isRefExpr, RefExpr, isStackRefExpr, StackRefExpr, stackRef, MissingSourceError, InvalidReferenceError, evaluate, hasOutputs, upstreamAny, upstream, resolveUpstream, toObject;
+var inspect, of$1, asOutput, isOutput, ExprSymbol, exprKind, isExpr, BaseExpr, isResourceExpr, ResourceExpr, isPropExpr, PropExpr, isLiteralExpr, LiteralExpr, VoidExpr, isApplyExpr, ApplyExpr, isFlatMapExpr, FlatMapExpr, isEffectExpr, EffectExpr, isNamedExpr, NamedExpr, isAllExpr, AllExpr, isRefExpr, RefExpr, isStackRefExpr, StackRefExpr, stackRef, MissingSourceError, InvalidReferenceError, evaluate, hasOutputs, alreadySeen, upstreamAny, upstream, resolveUpstream, toObject;
 var init_Output = __esm({ "lib/Output.js": (() => {
 	init_Ref();
 	init_Resource();
@@ -709,10 +734,10 @@ var init_Output = __esm({ "lib/Output.js": (() => {
 			return `stackRef(${this.stack}${this.stage ? `, { stage: ${this.stage} }` : ""})`;
 		}
 	};
-	stackRef = (stack, options$6 = {}) => Effect.succeed(new StackRefExpr(stack, options$6.stage));
+	stackRef = (stack, options$7 = {}) => Effect.succeed(new StackRefExpr(stack, options$7.stage));
 	MissingSourceError = class extends Data.TaggedError("MissingSourceError") {};
 	InvalidReferenceError = class extends Data.TaggedError("InvalidReferenceError") {};
-	evaluate = (expr, upstream$1) => Effect.gen(function* () {
+	evaluate = (expr, upstream$1, ancestors = /* @__PURE__ */ new Set()) => Effect.gen(function* () {
 		if (isResource(expr)) {
 			const srcId = expr.FQN;
 			const src = upstream$1[srcId];
@@ -772,36 +797,50 @@ var init_Output = __esm({ "lib/Output.js": (() => {
 				return output;
 			}
 		}
-		if (Array.isArray(expr)) return yield* Effect.all(expr.map((item) => evaluate(item, upstream$1)));
-		else if (Config.isConfig(expr)) return yield* evaluate(yield* expr, upstream$1);
-		else if (Duration.isDuration(expr) || Redacted.isRedacted(expr)) return expr;
-		else if (typeof expr === "object" && expr !== null) return Object.fromEntries(yield* Effect.all(Object.entries(expr).map(([key, value]) => evaluate(value, upstream$1).pipe(Effect.map((value$1) => [key, value$1])))));
+		if (Config.isConfig(expr)) return yield* evaluate(yield* expr, upstream$1, ancestors);
+		else if (isPlainData(expr)) {
+			if (ancestors.has(expr)) return;
+			const nested = new Set(ancestors).add(expr);
+			if (Array.isArray(expr)) return yield* Effect.all(expr.map((item) => evaluate(item, upstream$1, nested)));
+			return Object.fromEntries(yield* Effect.all(Object.entries(expr).map(([key, value]) => evaluate(value, upstream$1, nested).pipe(Effect.map((value$1) => [key, value$1])))));
+		}
 		return expr;
 	});
 	hasOutputs = (value) => Object.keys(upstreamAny(value)).length > 0;
-	upstreamAny = (value) => {
+	alreadySeen = (value, seen) => {
+		if (seen.has(value)) return true;
+		seen.add(value);
+		return false;
+	};
+	upstreamAny = (value, seen = /* @__PURE__ */ new WeakSet()) => {
 		if (isResource(value)) return { [value.FQN]: value };
-		else if (isExpr(value)) return upstream(value);
-		else if (Array.isArray(value)) return Object.assign({}, ...value.map(resolveUpstream));
-		else if (value && (typeof value === "object" || typeof value === "function")) return Object.assign({}, ...Object.values(value).map((value$1) => resolveUpstream(value$1)));
+		else if (isExpr(value)) return upstream(value, seen);
+		else if (isPlainData(value)) {
+			if (alreadySeen(value, seen)) return {};
+			return Object.assign({}, ...Object.values(value).map((value$1) => resolveUpstream(value$1, seen)));
+		}
 		return {};
 	};
-	upstream = (expr) => {
+	upstream = (expr, seen = /* @__PURE__ */ new WeakSet()) => {
 		if (isResource(expr)) return { [expr.FQN]: expr };
 		else if (isResourceExpr(expr)) return { [expr.src.FQN]: expr.src };
-		else if (isPropExpr(expr)) return upstream(expr.expr);
-		else if (isAllExpr(expr)) return Object.assign({}, ...expr.outs.map((out) => upstream(out)));
-		else if (isEffectExpr(expr) || isApplyExpr(expr) || isFlatMapExpr(expr) || isNamedExpr(expr)) return upstream(expr.expr);
-		else if (Array.isArray(expr)) return expr.map(upstream).reduce(toObject, {});
-		else if (typeof expr === "object" && expr !== null) return Object.values(expr).map((v) => upstream(v)).reduce(toObject, {});
+		else if (isPropExpr(expr)) return upstream(expr.expr, seen);
+		else if (isAllExpr(expr)) return Object.assign({}, ...expr.outs.map((out) => upstream(out, seen)));
+		else if (isEffectExpr(expr) || isApplyExpr(expr) || isFlatMapExpr(expr) || isNamedExpr(expr)) return upstream(expr.expr, seen);
+		else if (isPlainData(expr)) {
+			if (alreadySeen(expr, seen)) return {};
+			return Object.values(expr).map((v) => upstream(v, seen)).reduce(toObject, {});
+		}
 		return {};
 	};
-	resolveUpstream = (value) => {
+	resolveUpstream = (value, seen = /* @__PURE__ */ new WeakSet()) => {
 		if (isPrimitive(value)) return {};
 		else if (isResource(value)) return { [value.FQN]: value };
-		else if (isOutput(value)) return upstream(value);
-		else if (Array.isArray(value)) return Object.fromEntries(value.map((v) => resolveUpstream(v)).flatMap(Object.entries));
-		else if (typeof value === "object" || typeof value === "function") return Object.fromEntries(Object.values(value).map(resolveUpstream).flatMap(Object.entries));
+		else if (isOutput(value)) return upstream(value, seen);
+		else if (isPlainData(value)) {
+			if (alreadySeen(value, seen)) return {};
+			return Object.fromEntries(Object.values(value).map((v) => resolveUpstream(v, seen)).flatMap(Object.entries));
+		}
 		return {};
 	};
 	toObject = (acc, v) => ({
@@ -855,10 +894,26 @@ var init_FileLogger = __esm({ "lib/Util/FileLogger.js": (() => {
 	});
 }) });
 
+//#endregion
+//#region lib/Util/Node.js
+var initialCwd, disableCrossSpawnChdir, isTransformTypesSupported, transformTypesFlags;
+var init_Node = __esm({ "lib/Util/Node.js": (() => {
+	initialCwd = process.cwd();
+	disableCrossSpawnChdir = () => {
+		process.chdir.disabled = true;
+	};
+	isTransformTypesSupported = (version = process.versions.node) => {
+		const [major, minor] = version.split(".").map(Number);
+		return major === 22 && minor >= 7 || major >= 23 && major < 26;
+	};
+	transformTypesFlags = () => isTransformTypesSupported() ? ["--experimental-transform-types", "--no-warnings=ExperimentalWarning"] : [];
+}) });
+
 //#endregion
 //#region lib/Util/PlatformServices.js
-var isBun, platformLayer, PlatformServices, runMain;
+var isBun, platformLayer, PlatformServices, exitingTeardown, runMain;
 var init_PlatformServices = __esm({ "lib/Util/PlatformServices.js": (() => {
+	init_Node();
 	isBun = typeof Bun !== "undefined";
 	platformLayer = (constructors) => Layer.unwrap(Effect.promise(async () => {
 		if (isBun) return await constructors.bun();
@@ -874,15 +929,27 @@ var init_PlatformServices = __esm({ "lib/Util/PlatformServices.js": (() => {
 			return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
 		}
 	});
-	runMain = (effect, options$6) => {
-		if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options$6));
-		else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options$6));
+	exitingTeardown = (exit, onExit) => {
+		defaultTeardown(exit, (code) => {
+			const finalCode = code !== 0 ? code : Number(process.exitCode ?? 0) || 0;
+			setTimeout(() => process.exit(finalCode), 0);
+			onExit(finalCode);
+		});
+	};
+	runMain = (effect, options$7) => {
+		disableCrossSpawnChdir();
+		const opts = {
+			...options$7,
+			teardown: options$7?.teardown ?? exitingTeardown
+		};
+		if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, opts));
+		else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, opts));
 	};
 }) });
 
 //#endregion
 //#region lib/Stack.js
-var Stack, createStageProxy, StackName, make$2, CurrentStack, platform;
+var Stack, createStageProxy, StackName, make$3, CurrentStack, platform;
 var init_Stack = __esm({ "lib/Stack.js": (() => {
 	init_Credentials();
 	init_Profile();
@@ -891,31 +958,31 @@ var init_Stack = __esm({ "lib/Stack.js": (() => {
 	init_effect();
 	init_FileLogger();
 	init_PlatformServices();
-	Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (stackName, options$6, eff) => {
+	Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (stackName, options$7, eff) => {
 		if (!stackName) return (stackName$1) => Object.assign(stackRef(stackName$1).pipe(effectClass), {
 			stackName: stackName$1,
 			stage: createStageProxy(stackName$1),
-			state: options$6?.state,
-			providers: options$6?.providers,
-			make: (options$7, eff$1) => Stack(stackName$1, options$7, eff$1)
+			state: options$7?.state,
+			providers: options$7?.providers,
+			make: (options$8, eff$1) => Stack(stackName$1, options$8, eff$1)
 		});
-		return eff.pipe(make$2({
+		return eff.pipe(make$3({
 			name: stackName,
-			...options$6
+			...options$7
 		}), (eff$1) => Object.assign(eff$1, {
 			stackName,
 			stage: createStageProxy(stackName),
-			state: options$6?.state,
-			providers: options$6?.providers
+			state: options$7?.state,
+			providers: options$7?.providers
 		}));
 	}));
 	createStageProxy = (stackName) => new Proxy({}, { get: (_, stage$1) => stackRef(stackName, { stage: stage$1 }) });
 	StackName = Stack.use((stack) => Effect.succeed(stack.name));
-	make$2 = (options$6) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
-		if (options$6.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options$6.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options$6.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://alchemy.run/state-store for available state stores.`));
-		if (options$6.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options$6.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options$6.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
-		return options$6.providers.pipe(Layer.provideMerge(options$6.state), Layer.provideMerge(Layer.effect(Stack, Stage.pipe(Effect.map((stage$1) => options$6.stack ?? {
-			name: options$6.name,
+	make$3 = (options$7) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
+		if (options$7.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options$7.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options$7.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://alchemy.run/state-store for available state stores.`));
+		if (options$7.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options$7.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options$7.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
+		return options$7.providers.pipe(Layer.provideMerge(options$7.state), Layer.provideMerge(Layer.effect(Stack, Stage.pipe(Effect.map((stage$1) => options$7.stack ?? {
+			name: options$7.name,
 			stage: stage$1,
 			resources: {},
 			bindings: {},
@@ -925,10 +992,10 @@ var init_Stack = __esm({ "lib/Stack.js": (() => {
 		effect,
 		Stack,
 		Effect.context()
-	]).pipe(Effect.map(([output, stack, services$1]) => ({
+	]).pipe(Effect.map(([output, stack, services]) => ({
 		...stack,
 		output,
-		services: EffectContext.merge(services$1, context)
+		services: EffectContext.merge(services, context)
 	})), Effect.provideContext(context))));
 	CurrentStack = Effect.serviceOption(Stack).pipe(Effect.map(Option.getOrUndefined));
 	platform = Layer.mergeAll(PlatformServices, FetchHttpClient.layer, Logger.layer([fileLogger("out")], { mergeWithExisting: true }), Layer.provide(ProfileLive, PlatformServices), Layer.provide(CredentialsStoreLive, PlatformServices));
@@ -936,72 +1003,254 @@ var init_Stack = __esm({ "lib/Stack.js": (() => {
 
 //#endregion
 //#region lib/Local/RpcSerialization.js
-init_Output();
-const unwrapRpcHandlers = (handlers, streamKeys) => {
-	return Object.fromEntries(Object.entries(handlers).map(([key, value]) => [key, typeof value === "function" ? streamKeys?.includes(key) ? unwrapRpcStreamHandler(value) : unwrapRpcEffectHandler(value) : typeof value === "object" && value !== null && !Array.isArray(value) ? unwrapRpcHandlers(value) : value]));
-};
-const serializeError = Schema.encodeSync(Schema.Defect());
-const unwrapRpcEffectHandler = (handler) => flow((...args) => serializeRpcArgs(args), (args) => Effect.promise(() => handler(args)), Effect.flatMap((exit) => {
-	if (exit._tag === "Success") return Exit.succeed(exit.value);
-	return Exit.failCause(Cause.fromReasons(exit.cause.map((reason) => {
-		switch (reason._tag) {
-			case "Fail": return Cause.makeFailReason(reason.error);
-			case "Die": return Cause.makeDieReason(reason.defect);
-			case "Interrupt": return Cause.makeInterruptReason(reason.fiberId);
-		}
-	})));
-}));
-const unwrapRpcStreamHandler = (handler) => flow((...args) => serializeRpcArgs(args), (args) => handler(args), (stream) => Stream.fromReadableStream({
-	evaluate: () => stream,
-	onError: (error) => error
-}));
-const serializeRpcArgs = (value) => {
-	if (Redacted.isRedacted(value)) return {
-		_tag: "Redacted",
-		value: Redacted.value(value)
+var unwrapRpcHandlers, serializeError, unwrapRpcEffectHandler, unwrapRpcStreamHandler, serializeRpcArgs, isEffectMarker, isContextMarker, deserializeRpcArgs;
+var init_RpcSerialization = __esm({ "lib/Local/RpcSerialization.js": (() => {
+	init_Output();
+	init_RuntimeContext();
+	unwrapRpcHandlers = (handlers, streamKeys) => {
+		return Object.fromEntries(Object.entries(handlers).map(([key, value]) => [key, typeof value === "function" ? streamKeys?.includes(key) ? unwrapRpcStreamHandler(value) : unwrapRpcEffectHandler(value) : typeof value === "object" && value !== null && !Array.isArray(value) ? unwrapRpcHandlers(value) : value]));
 	};
-	if (isOutput(value)) return {
-		_tag: "Output",
-		description: NodeUtil.inspect(value)
+	serializeError = Schema.encodeSync(Schema.Defect());
+	unwrapRpcEffectHandler = (handler) => flow((...args) => serializeRpcArgs(args), (args) => Effect.promise(() => handler(args)), Effect.flatMap((exit) => {
+		if (exit._tag === "Success") return Exit.succeed(deserializeRpcArgs(exit.value));
+		return Exit.failCause(Cause.fromReasons(exit.cause.map((reason) => {
+			switch (reason._tag) {
+				case "Fail": return Cause.makeFailReason(reason.error);
+				case "Die": return Cause.makeDieReason(reason.defect);
+				case "Interrupt": return Cause.makeInterruptReason(reason.fiberId);
+			}
+		})));
+	}));
+	unwrapRpcStreamHandler = (handler) => flow((...args) => serializeRpcArgs(args), (args) => handler(args), (stream) => Stream.fromReadableStream({
+		evaluate: () => stream,
+		onError: (error) => error
+	}));
+	serializeRpcArgs = (value) => {
+		if (Redacted.isRedacted(value)) return {
+			_tag: "Redacted",
+			value: Redacted.value(value)
+		};
+		if (isOutput(value)) return {
+			_tag: "Output",
+			description: NodeUtil.inspect(value)
+		};
+		if (Effect.isEffect(value)) return {
+			_tag: "~alchemy/Rpc/Effect",
+			description: NodeUtil.inspect(value)
+		};
+		if (EffectContext.isContext(value)) return {
+			_tag: "~alchemy/Rpc/Context",
+			description: NodeUtil.inspect(value)
+		};
+		if (typeof value === "function") return null;
+		if (Array.isArray(value)) return value.map(serializeRpcArgs);
+		if (value && typeof value === "object" && !("toJSON" in value)) return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, serializeRpcArgs(child)]));
+		return value;
 	};
-	if (typeof value === "function") return null;
-	if (Array.isArray(value)) return value.map(serializeRpcArgs);
-	if (value && typeof value === "object" && !("toJSON" in value)) return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, serializeRpcArgs(child)]));
-	return value;
-};
+	isEffectMarker = (value) => "_tag" in value && value._tag === "~alchemy/Rpc/Effect" && "description" in value && typeof value.description === "string";
+	isContextMarker = (value) => "_tag" in value && value._tag === "~alchemy/Rpc/Context" && "description" in value && typeof value.description === "string";
+	deserializeRpcArgs = (value) => {
+		if (Array.isArray(value)) return value.map(deserializeRpcArgs);
+		else if (typeof value === "object" && value !== null) {
+			if (isRedactedMarker(value)) return Redacted.make(value.value);
+			else if ("_tag" in value && value._tag === "Output" && "description" in value && typeof value.description === "string") return new NamedExpr(new EffectExpr(VoidExpr, () => Effect.never), value.description);
+			else if (isEffectMarker(value)) {
+				const description = value.description;
+				return Effect.suspend(() => Effect.die(/* @__PURE__ */ new Error(`An Effect from the resource's props cannot cross the RPC provider boundary and was replaced by a placeholder: ${description}`)));
+			} else if (isContextMarker(value)) return EffectContext.empty();
+			return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, deserializeRpcArgs(child)]));
+		}
+		return value;
+	};
+}) });
 
 //#endregion
 //#region lib/Local/RpcProviderProxy.js
-init_AlchemyContext();
-init_Stack();
-var RpcProviderProxy = class extends EffectContext.Service()("alchemy/Local/RpcProviderProxy") {};
-const SPAWNER_URL_ENV_KEY = "ALCHEMY_RPC_SPAWNER_URL";
-const make$1 = Effect.fn(function* (spawnerUrl) {
-	const client = yield* HttpClient.HttpClient;
-	const getSession = Effect.fn(function* (serverEntryUrl) {
-		const alchemyContext = yield* AlchemyContext;
-		const stack = yield* Stack;
-		const payload = {
-			serverEntryUrl,
+var RpcProviderProxy, SPAWNER_URL_ENV_KEY, make$2, fromEnv;
+var init_RpcProviderProxy = __esm({ "lib/Local/RpcProviderProxy.js": (() => {
+	init_AlchemyContext();
+	init_Stack();
+	init_RpcSerialization();
+	RpcProviderProxy = class extends EffectContext.Service()("alchemy/Local/RpcProviderProxy") {};
+	SPAWNER_URL_ENV_KEY = "ALCHEMY_RPC_SPAWNER_URL";
+	make$2 = Effect.fn(function* (spawnerUrl) {
+		const client = yield* HttpClient.HttpClient;
+		const getSession = Effect.fn(function* (serverEntryUrl) {
+			const alchemyContext = yield* AlchemyContext;
+			const stack = yield* Stack;
+			const payload = {
+				serverEntryUrl,
+				alchemyContext,
+				stack: {
+					name: stack.name,
+					stage: stack.stage
+				}
+			};
+			return newWebSocketRpcSession(yield* (yield* client.post(spawnerUrl, { body: yield* HttpBody.json(payload) })).text);
+		}, (effect, serverEntryUrl) => Effect.catch(effect, (error) => Effect.die(new Error(`Failed to create provider RPC session for "${serverEntryUrl}"`, { cause: error }))));
+		const cache = yield* Cache.make({
+			lookup: getSession,
+			capacity: Infinity,
+			requireServicesAt: "lookup"
+		});
+		return RpcProviderProxy.of({ get: Effect.fn(function* (mainUrl, providerName) {
+			const session = yield* Cache.get(cache, mainUrl);
+			return unwrapRpcHandlers(yield* Effect.promise(() => session.getProvider(providerName)), ["tail"]);
+		}) });
+	});
+	fromEnv = () => Layer.effect(RpcProviderProxy, Config.string(SPAWNER_URL_ENV_KEY).pipe(Effect.flatMap(make$2)));
+}) });
+
+//#endregion
+//#region lib/Util/killProcessGroup.js
+var killProcessGroup;
+var init_killProcessGroup = __esm({ "lib/Util/killProcessGroup.js": (() => {
+	killProcessGroup = (pid, signal) => {
+		try {
+			if (process.platform === "win32") NodeChildProcess.execSync(`taskkill /pid ${pid} /T /F`);
+			else process.kill(-pid, signal);
+		} catch {}
+	};
+}) });
+
+//#endregion
+//#region lib/Local/RpcServerEnvironment.js
+const RPC_SERVER_ENVIRONMENT_KEY = "ALCHEMY_RPC_SERVER_ENVIRONMENT";
+
+//#endregion
+//#region lib/Local/RpcSpawner.js
+init_killProcessGroup();
+init_Node();
+init_RpcProviderProxy();
+var RpcSpawner = class extends EffectContext.Service()("alchemy/Local/RpcSpawner") {};
+/**
+* Path on the spawner's HTTP server that streams sidecar output as NDJSON
+* ({@link SidecarLogLine} per line). Consumed by {@link forwardSidecarLogs}
+* from the exec child, which owns the terminal renderer.
+*/
+const LOGS_PATH = "/logs";
+const make$1 = Effect.fn(function* ({ profile: profile$1, envFile: envFile$1 }) {
+	const spawner = yield* ChildProcessSpawner$1.ChildProcessSpawner;
+	const scope = yield* Effect.scope;
+	const cache = yield* Cache.make({
+		lookup: (payload) => spawn(payload).pipe(Scope.provide(scope)),
+		capacity: Infinity
+	});
+	const subscribers = /* @__PURE__ */ new Set();
+	const publish = (line) => Effect.suspend(() => {
+		if (subscribers.size > 0) {
+			for (const notify of subscribers) notify(line);
+			return Effect.void;
+		}
+		return line.channel === "stderr" ? Console.error(line.line) : Console.log(line.line);
+	});
+	const spawn = Effect.fn(function* ({ serverEntryUrl, alchemyContext, stack }) {
+		const bin = typeof globalThis.Bun !== "undefined" ? "bun" : "node";
+		const main = fileURLToPath(serverEntryUrl);
+		const environment = {
+			profile: profile$1,
+			envFile: envFile$1,
 			alchemyContext,
-			stack: {
-				name: stack.name,
-				stage: stack.stage
-			}
+			stack
+		};
+		const command = ChildProcess$1.make(bin, {
+			bun: ["run", main],
+			node: main.endsWith(".ts") ? [...transformTypesFlags(), main] : [main]
+		}[bin], {
+			stdout: "pipe",
+			stderr: "pipe",
+			detached: false,
+			env: { [RPC_SERVER_ENVIRONMENT_KEY]: JSON.stringify(environment) },
+			extendEnv: true
+		});
+		const handle = yield* spawner.spawn(command);
+		yield* handle.stderr.pipe(Stream.decodeText, Stream.splitLines, Stream.runForEach((line) => publish({
+			channel: "stderr",
+			line
+		})), Effect.ignore, Effect.forkScoped);
+		const unregister = exitHook(() => {
+			killProcessGroup(handle.pid, "SIGKILL");
+		});
+		const kill = handle.kill({ forceKillAfter: "500 millis" }).pipe(Effect.tap(() => Effect.sync(unregister)));
+		yield* Effect.addFinalizer(() => kill.pipe(Effect.ignore));
+		const url = yield* getRpcAddress(handle.stdout, (line) => publish({
+			channel: "stdout",
+			line
+		}));
+		const ws = yield* Effect.acquireRelease(Effect.sync(() => new WebSocket(new URL("/parent", url))), (ws$1) => Effect.sync(() => ws$1.close()));
+		return {
+			url,
+			isRunning: Effect.zipWith(handle.isRunning, Effect.sync(() => ws.readyState === WebSocket.CONNECTING || ws.readyState === WebSocket.OPEN), (a, b) => a && b, { concurrent: true }),
+			kill
 		};
-		return newWebSocketRpcSession(yield* (yield* client.post(spawnerUrl, { body: yield* HttpBody.json(payload) })).text);
-	}, (effect, serverEntryUrl) => Effect.catch(effect, (error) => Effect.die(new Error(`Failed to create provider RPC session for "${serverEntryUrl}"`, { cause: error }))));
-	const cache = yield* Cache.make({
-		lookup: getSession,
-		capacity: Infinity,
-		requireServicesAt: "lookup"
 	});
-	return RpcProviderProxy.of({ get: Effect.fn(function* (mainUrl, providerName) {
-		const session = yield* Cache.get(cache, mainUrl);
-		return unwrapRpcHandlers(yield* Effect.promise(() => session.getProvider(providerName)), ["tail"]);
-	}) });
+	const register = Effect.fn(function* (payload, attempt = 0) {
+		const child = yield* Cache.get(cache, payload);
+		if (yield* child.isRunning) return child.url;
+		if (attempt > 3) return yield* Effect.die(/* @__PURE__ */ new Error(`Failed to spawn RPC server for "${payload.serverEntryUrl}" after ${attempt} attempts.`));
+		yield* child.kill;
+		yield* Cache.invalidate(cache, payload);
+		return yield* register(payload, attempt + 1);
+	});
+	const server = yield* HttpServer.HttpServer;
+	const encoder = new TextEncoder();
+	yield* server.serve(Effect.gen(function* () {
+		const request = yield* HttpServerRequest;
+		if (request.url.startsWith(LOGS_PATH)) {
+			const queue = yield* Queue.make();
+			const notify = (line) => {
+				Queue.offerUnsafe(queue, encoder.encode(`${JSON.stringify(line)}\n`));
+			};
+			subscribers.add(notify);
+			return HttpServerResponse.stream(Stream.fromQueue(queue).pipe(Stream.ensuring(Effect.sync(() => subscribers.delete(notify)))), { contentType: "application/x-ndjson" });
+		}
+		const url = yield* register(yield* request.json);
+		return HttpServerResponse.text(url);
+	}));
+	return RpcSpawner.of({ url: HttpServer.formatAddress(server.address) });
+});
+const RPC_ADDRESS_REGEX = /(<ALCHEMY_RPC_ADDRESS>)(.+)(<\/ALCHEMY_RPC_ADDRESS>)/;
+const getRpcAddress = (stdout, publish) => Effect.gen(function* () {
+	const address = yield* Deferred.make();
+	let done = false;
+	yield* stdout.pipe(Stream.decodeText, Stream.splitLines, Stream.runForEach((line) => {
+		if (done) return publish(line);
+		const match = line.match(RPC_ADDRESS_REGEX);
+		if (match) {
+			done = true;
+			return Deferred.succeed(address, match[2]);
+		}
+		return Effect.void;
+	}), Effect.forkScoped);
+	return yield* Deferred.await(address);
 });
-const fromEnv = () => Layer.effect(RpcProviderProxy, Config.string(SPAWNER_URL_ENV_KEY).pipe(Effect.flatMap(make$1)));
+const parseSidecarLogLine = (raw) => {
+	try {
+		const parsed = JSON.parse(raw);
+		return typeof parsed?.line === "string" ? parsed : void 0;
+	} catch {
+		return;
+	}
+};
+/**
+* Pull sidecar output from the spawner (the outer `alchemy dev` process)
+* into THIS process's Console. The exec child owns the terminal renderer —
+* Ink patches its `console`, so lines printed here are inserted cleanly
+* above the repainting progress region instead of racing it on the shared
+* tty. Forks in the ambient scope and never fails: when no spawner is
+* configured (`ALCHEMY_RPC_SPAWNER_URL` absent — plain deploy/destroy) it is
+* a no-op, and if the connection drops the spawner's own fallback printing
+* takes over.
+*/
+const forwardSidecarLogs = Config.string(SPAWNER_URL_ENV_KEY).pipe(Effect.flatMap((spawnerUrl) => {
+	return Effect.gen(function* () {
+		yield* (yield* (yield* HttpClient.HttpClient).get(new URL(LOGS_PATH, spawnerUrl).toString())).stream.pipe(Stream.decodeText, Stream.splitLines, Stream.runForEach((raw) => Effect.suspend(() => {
+			const parsed = parseSidecarLogLine(raw);
+			if (parsed === void 0) return Effect.void;
+			return parsed.channel === "stderr" ? Console.error(parsed.line) : Console.log(parsed.line);
+		})));
+	}).pipe(Effect.ignore, Effect.andThen(Effect.sleep("1 second")), Effect.forever);
+}), Effect.ignore, Effect.forkScoped, Effect.asVoid);
 
 //#endregion
 //#region lib/ActionRuntimeContext.js
@@ -1043,106 +1292,76 @@ const makeResolveContext = (resolved) => ({
 
 //#endregion
 //#region lib/Diff.js
-init_Output();
-init_data();
-const isResolved = (value) => !_hasUnresolved(value);
-const _hasUnresolved = (value) => {
-	if (value == null || isPrimitive(value)) return false;
-	if (isExpr(value) || Effect.isEffect(value)) return true;
-	if (Array.isArray(value)) return value.some(_hasUnresolved);
-	if (typeof value === "object") return Object.values(value).some(_hasUnresolved);
-	return false;
-};
-/**
-* Deeply replace every unresolved plan-time expression (an `Output`/`Expr`
-* or an un-evaluated `Effect`) with `undefined`, leaving resolved values
-* (including opaque `Redacted`/`Duration` instances) intact.
-*
-* Persisted resource state must only ever hold plain data. Durable (JSON)
-* state stores already enforce this implicitly — Output proxies are
-* function-typed, so `JSON.stringify` silently drops them — but the
-* in-memory store used by tests retains live proxies, which would later be
-* fed back into provider lifecycle operations as `olds` after an
-* interrupted apply (e.g. `read` during a destroy plan) and blow up on
-* first string coercion. Sanitizing at the commit boundary keeps both
-* store kinds consistent with the provider contract that `olds` is
-* resolved `Props`.
-*/
-const stripUnresolved = (value) => _stripUnresolved(value);
-const _stripUnresolved = (value) => {
-	if (value == null || isPrimitive(value)) return value;
-	if (isExpr(value) || Effect.isEffect(value)) return void 0;
-	if (Redacted.isRedacted(value) || Duration.isDuration(value)) return value;
-	if (Array.isArray(value)) return value.map(_stripUnresolved);
-	if (typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, _stripUnresolved(item)]));
-	return value;
-};
-const havePropsChanged = (oldProps, newProps) => hasOutputs(newProps) || JSON.stringify(canonicalize(stripUnresolved(oldProps ?? {}), false)) !== JSON.stringify(canonicalize(stripUnresolved(newProps ?? {}), false));
-const canonicalize = (value, stripNullish) => {
-	if (stripNullish && value == null) return void 0;
-	if (Redacted.isRedacted(value)) return {
-		_tag: "Redacted",
-		value: Redacted.value(value)
+var isResolved, _hasUnresolved, stripUnresolved, _stripUnresolved, havePropsChanged, canonicalize, bySid, sortBindings, dedupeBindings, diffBindings;
+var init_Diff = __esm({ "lib/Diff.js": (() => {
+	init_Output();
+	init_data();
+	isResolved = (value) => !_hasUnresolved(value);
+	_hasUnresolved = (value, seen = /* @__PURE__ */ new WeakSet()) => {
+		if (value == null || isPrimitive(value)) return false;
+		if (isExpr(value) || Effect.isEffect(value)) return true;
+		if (isPlainData(value)) {
+			if (seen.has(value)) return false;
+			seen.add(value);
+			return Object.values(value).some((v) => _hasUnresolved(v, seen));
+		}
+		return false;
 	};
-	if (Array.isArray(value)) return value.map((v) => canonicalize(v, stripNullish));
-	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).filter(([, nested]) => !stripNullish || nested != null).sort(([a], [b]) => a.localeCompare(b)).map(([key, nested]) => [key, canonicalize(nested, stripNullish)]));
-	return value;
-};
-/**
-* Deterministic ordering for binding rows.
-*
-* Bindings are registered by concurrently-built layers (a Function/Worker's
-* capability layers run real IO — bundling, fs — before calling `host.bind`),
-* so the registration order of `stack.bindings[fqn]` is not stable across
-* deploys. `diffBindings` itself is sid-keyed and order-insensitive, but the
-* row order flows into provider `diff`/`reconcile` inputs and persisted
-* state — any consumer that hashes or deep-compares the binding array (e.g.
-* a metadata hash over bindings) would churn on registration-order flips.
-* Sorting by `sid` at every boundary makes binding rows stable.
-*/
-const bySid = (a, b) => a.sid < b.sid ? -1 : a.sid > b.sid ? 1 : 0;
-const sortBindings = (bindings) => [...bindings].sort(bySid);
-/**
-* Collapse bindings that share the same `sid`, keeping the last occurrence,
-* and return them in deterministic (sid-sorted) order.
-*
-* The same binding can be recorded more than once on a target resource — e.g.
-* a KV namespace bound to both a Worker and a Workflow ends up pushed twice to
-* `stack.bindings[fqn]`. `diffBindings` already collapses these implicitly via
-* its `Map` keyed by `sid`, so the `reconcile` path never observes duplicates.
-* Use this helper to give a provider's `diff` handler the same de-duplicated
-* binding set, keeping plan-time hashing consistent with deploy-time.
-*/
-const dedupeBindings = (bindings) => sortBindings(Array.from(new Map(bindings.map((b) => [b.sid, b])).values()));
-const diffBindings = (oldBindings, newBindings) => {
-	const oldMap = new Map(oldBindings.map((b) => [b.sid, b]));
-	const newMap = new Map(newBindings.map((b) => [b.sid, b]));
-	return sortBindings([...Array.from(oldMap).filter(([sid]) => !newMap.has(sid)).map(([sid, old]) => ({
-		sid,
-		action: "delete",
-		data: old.data
-	})), ...Array.from(newMap).map(([sid, binding]) => {
-		const old = oldMap.get(sid);
-		return {
-			sid,
-			action: !old ? "create" : havePropsChanged(old.data, binding.data) ? "update" : "noop",
-			data: binding.data
+	stripUnresolved = (value) => _stripUnresolved(value);
+	_stripUnresolved = (value, ancestors = /* @__PURE__ */ new WeakSet()) => {
+		if (value == null || isPrimitive(value)) return value;
+		if (isExpr(value) || Effect.isEffect(value)) return void 0;
+		if (Redacted.isRedacted(value) || Duration.isDuration(value) || value instanceof Date) return value;
+		if (isPlainData(value)) return mapPlainData(value, ancestors, (child) => _stripUnresolved(child, ancestors));
+	};
+	havePropsChanged = (oldProps, newProps) => hasOutputs(newProps) || JSON.stringify(canonicalize(stripUnresolved(oldProps ?? {}), false)) !== JSON.stringify(canonicalize(stripUnresolved(newProps ?? {}), false));
+	canonicalize = (value, stripNullish, ancestors = /* @__PURE__ */ new WeakSet()) => {
+		if (stripNullish && value == null) return void 0;
+		if (Redacted.isRedacted(value)) return {
+			_tag: "Redacted",
+			value: Redacted.value(value)
 		};
-	})]);
-};
+		if (Duration.isDuration(value) || value instanceof Date) return value;
+		if (isPlainData(value)) {
+			const rebuilt = mapPlainData(value, ancestors, (child) => canonicalize(child, stripNullish, ancestors));
+			if (rebuilt === void 0 || Array.isArray(rebuilt)) return rebuilt;
+			return Object.fromEntries(Object.entries(rebuilt).filter(([, nested]) => !stripNullish || nested != null).sort(([a], [b]) => a.localeCompare(b)));
+		}
+		if (value && typeof value === "object") return;
+		return value;
+	};
+	bySid = (a, b) => a.sid < b.sid ? -1 : a.sid > b.sid ? 1 : 0;
+	sortBindings = (bindings) => [...bindings].sort(bySid);
+	dedupeBindings = (bindings) => sortBindings(Array.from(new Map(bindings.map((b) => [b.sid, b])).values()));
+	diffBindings = (oldBindings, newBindings) => {
+		const oldMap = new Map(oldBindings.map((b) => [b.sid, b]));
+		const newMap = new Map(newBindings.map((b) => [b.sid, b]));
+		return sortBindings([...Array.from(oldMap).filter(([sid]) => !newMap.has(sid)).map(([sid, old]) => ({
+			sid,
+			action: "delete",
+			data: old.data
+		})), ...Array.from(newMap).map(([sid, binding]) => {
+			const old = oldMap.get(sid);
+			return {
+				sid,
+				action: !old ? "create" : havePropsChanged(old.data, binding.data) ? "update" : "noop",
+				data: binding.data
+			};
+		})]);
+	};
+}) });
 
 //#endregion
 //#region lib/InstanceId.js
-/** A 16-byte (128-bit) random hex-encoded string representing an physical instance of a logical resource */
-var InstanceId = class extends EffectContext.Service()("instance-id") {};
-/**
-* @returns Hex-encoded instance ID (16 random bytes)
-*/
-const generateInstanceId = () => Effect.sync(() => {
-	const bytes = new Uint8Array(16);
-	crypto.getRandomValues(bytes);
-	return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-});
+var InstanceId, generateInstanceId;
+var init_InstanceId = __esm({ "lib/InstanceId.js": (() => {
+	InstanceId = class extends EffectContext.Service()("instance-id") {};
+	generateInstanceId = () => Effect.sync(() => {
+		const bytes = new Uint8Array(16);
+		crypto.getRandomValues(bytes);
+		return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+	});
+}) });
 
 //#endregion
 //#region lib/Util/types.js
@@ -1332,13 +1551,16 @@ init_types();
 init_AdoptPolicy();
 init_AlchemyContext();
 init_Artifacts();
+init_Diff();
 init_FQN();
+init_InstanceId();
 init_Output();
 init_Provider();
 init_ProviderMode();
 init_Resource();
+init_data();
 init_sha256();
-const make = (stack, options$6 = {}) => Effect.gen(function* () {
+const make = (stack, options$7 = {}) => Effect.gen(function* () {
 	const state = yield* yield* State;
 	const resources = Object.values(stack.resources);
 	const actions = Object.values(stack.actions ?? {});
@@ -1394,7 +1616,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		return yield* resolvedResources[resourceExpr.src.FQN] ??= yield* Effect.cached(Effect.gen(function* () {
 			const resource = resourceExpr.src;
 			const { provider, mode } = yield* resolveProviderAndMode(resource);
-			const props = yield* resolveInput(resource.Props);
+			const props = materializeStableRefs(yield* resolveInput(resource.Props));
 			const persisted = yield* state.get({
 				stack: stackName,
 				stage: stage$1,
@@ -1422,24 +1644,58 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 				if (havePropsChanged(oldProps, props)) return withStables(oldState?.attr);
 			} else if (diff.action === "update") return withStables(oldState?.attr);
 			else if (diff.action === "replace") return resourceExpr;
-			if (options$6.force) return withStables(oldState?.attr);
+			if (options$7.force) return withStables(oldState?.attr);
 			if (oldState.status === "created" || oldState.status === "updated" || oldState.status === "replaced") return oldState?.attr;
 			else return resourceExpr;
 		}));
 	});
-	const resolveInput = (input) => Effect.gen(function* () {
+	/**
+	* Resolve an input value as far as *truth* permits, keeping everything
+	* else evaluable. A whole-resource reference to an updating upstream
+	* stays a `ResourceExpr` (its stable attributes riding along): the
+	* non-stable attributes are unknown at plan time and MUST be
+	* re-evaluated — Apply runs `Output.evaluate(node.props, outputs)`
+	* against the upstream's fresh post-reconcile attributes right before
+	* `reconcile`. This is the value plan nodes carry; the diff-facing view
+	* is derived from it by {@link materializeStableRefs}.
+	*/
+	const resolveInput = (input, ancestors = /* @__PURE__ */ new Set()) => Effect.gen(function* () {
 		if (!input) return input;
 		else if (isExpr(input)) return yield* resolveOutput(input);
-		else if (Config.isConfig(input)) return yield* resolveInput(yield* input);
-		else if (Duration.isDuration(input) || Redacted.isRedacted(input)) return input;
-		else if (Array.isArray(input)) return yield* Effect.all(input.map(resolveInput), { concurrency: "unbounded" });
+		else if (Config.isConfig(input)) return yield* resolveInput(yield* input, ancestors);
 		else if (isResource(input)) {
 			const resolved = yield* resolveOutput(of$1(input));
-			if (isResourceExpr(resolved) && resolved.stables) return yield* resolveInput(resolved.stables);
-			return yield* resolveInput(resolved);
-		} else if (typeof input === "object") return Object.fromEntries(yield* Effect.all(Object.entries(input).map(([key, value]) => resolveInput(value).pipe(Effect.map((value$1) => [key, value$1]))), { concurrency: "unbounded" }));
+			if (isResourceExpr(resolved)) return resolved;
+			return yield* resolveInput(resolved, ancestors);
+		} else if (isPlainData(input)) {
+			if (ancestors.has(input)) return;
+			const nested = new Set(ancestors).add(input);
+			if (Array.isArray(input)) return yield* Effect.all(input.map((item) => resolveInput(item, nested)), { concurrency: "unbounded" });
+			return Object.fromEntries(yield* Effect.all(Object.entries(input).map(([key, value]) => resolveInput(value, nested).pipe(Effect.map((value$1) => [key, value$1]))), { concurrency: "unbounded" }));
+		}
 		return input;
 	});
+	/**
+	* Project a {@link resolveInput} resolution into the DIFF-facing view:
+	* replace each whole-resource `ResourceExpr` that carries stable
+	* attributes (an upstream being *updated* in place — see `withStables` in
+	* `resolveResource`) with a plain object of those stables, so the known
+	* values flow into the consumer's `diff` and `havePropsChanged` instead
+	* of the whole reference looking unresolved and `isResolved`
+	* short-circuiting (#670 — this forced the Neon `Branch` to hand-extract
+	* `project.projectId`).
+	*
+	* The projection is deliberately lossy — diffs compare VALUES. Plan nodes
+	* never carry it: they keep the evaluable resolution so `reconcile` sees
+	* the upstream's fresh non-stable attributes (e.g. a Lambda Version's
+	* `version` number — #993's alias promotion bug).
+	*/
+	const materializeStableRefs = (input, ancestors = /* @__PURE__ */ new WeakSet()) => {
+		if (isResourceExpr(input) && input.stables) return materializeStableRefs(input.stables, ancestors);
+		else if (isExpr(input)) return input;
+		else if (!input || !isPlainData(input)) return input;
+		return mapPlainData(input, ancestors, (child) => materializeStableRefs(child, ancestors));
+	};
 	const resolveOutput = (expr) => Effect.gen(function* () {
 		if (isResourceExpr(expr)) return yield* resolveResource(expr);
 		else if (isPropExpr(expr)) return (yield* resolveOutput(expr.expr))?.[expr.identifier];
@@ -1528,9 +1784,11 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		const { provider, mode } = yield* resolveProviderAndMode(resource);
 		const id = resource.LogicalId;
 		const fqn = resource.FQN;
-		const news = yield* resolveInput(resource.Props);
+		const applyProps = yield* resolveInput(resource.Props);
+		const news = materializeStableRefs(applyProps);
 		const downstream = newDownstreamDependencies[fqn] ?? [];
-		const newBindings = dedupeBindings(yield* resolveInput(stack.bindings[fqn] ?? []));
+		const applyBindings = dedupeBindings(yield* resolveInput(stack.bindings[fqn] ?? []));
+		const newBindings = materializeStableRefs(applyBindings);
 		const persisted = yield* state.get({
 			stack: stackName,
 			stage: stage$1,
@@ -1574,7 +1832,11 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			}
 		}
 		const oldBindings = dedupeBindings(oldState?.bindings ?? []);
-		const bindingDiffs = diffBindings(oldBindings, newBindings);
+		const applyBindingData = new Map(applyBindings.map((b) => [b.sid, b.data]));
+		const bindingDiffs = diffBindings(oldBindings, newBindings).map((b) => b.action === "delete" || !applyBindingData.has(b.sid) ? b : {
+			...b,
+			data: applyBindingData.get(b.sid)
+		});
 		const modeSwitched = hasModeSwitched(mode, oldState);
 		const Node = (node) => ({
 			...node,
@@ -1586,7 +1848,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		});
 		if (oldState === void 0) return Node({
 			action: "create",
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else if (!modeSwitched && oldState.status === "creating" && oldState.attr === void 0) {
@@ -1597,7 +1859,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 					instanceId: oldState.instanceId,
 					olds: oldState.props,
 					output: oldState.attr
-				}).pipe(providePlanScope(fqn, oldState.instanceId));
+				}).pipe(providePlanScope(fqn, oldState.instanceId), Effect.catchDefect((defect) => Effect.logWarning(`Recovery read for '${fqn}' crashed; treating the interrupted create as not recoverable and re-driving it.`, defect).pipe(Effect.as(void 0))));
 				if (attr !== void 0) {
 					if (Unowned.is(attr)) {
 						if (!(resource.Adopt ?? (yield* shouldAdopt))) return yield* new OwnedBySomeoneElse({
@@ -1626,74 +1888,74 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			news,
 			oldBindings,
 			newBindings
-		}).pipe(providePlanScope(fqn, oldState.instanceId))).pipe(Effect.map((diff$1) => diff$1 ?? { action: havePropsChanged(oldProps, news) || bindingDiffs.some((b) => b.action !== "noop") ? "update" : "noop" }), Effect.map((diff$1) => options$6.force && diff$1.action === "noop" ? { action: "update" } : diff$1), Effect.map((diff$1) => forceUpdateAfterAdoption && diff$1.action === "noop" ? { action: "update" } : diff$1));
+		}).pipe(providePlanScope(fqn, oldState.instanceId))).pipe(Effect.map((diff$1) => diff$1 ?? { action: havePropsChanged(oldProps, news) || bindingDiffs.some((b) => b.action !== "noop") ? "update" : "noop" }), Effect.map((diff$1) => options$7.force && diff$1.action === "noop" ? { action: "update" } : diff$1), Effect.map((diff$1) => forceUpdateAfterAdoption && diff$1.action === "noop" ? { action: "update" } : diff$1));
 		if (oldState.status === "creating") if (diff.action === "noop") return Node({
 			action: "create",
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else if (diff.action === "update") return Node({
 			action: "create",
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else return Node({
 			action: "replace",
-			props: news,
+			props: applyProps,
 			deleteFirst: diff.deleteFirst ?? false,
 			state: oldState
 		});
 		else if (oldState.status === "updating") if (diff.action === "update" || diff.action === "noop") return Node({
 			action: "update",
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else return Node({
 			action: "replace",
 			deleteFirst: diff.deleteFirst ?? false,
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else if (oldState.status === "replacing") if (diff.action === "noop") return Node({
 			action: "replace",
 			deleteFirst: oldState.deleteFirst,
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else if (diff.action === "update") return Node({
 			action: "replace",
 			deleteFirst: oldState.deleteFirst,
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else return Node({
 			restart: true,
 			action: "replace",
 			deleteFirst: diff.deleteFirst ?? oldState.deleteFirst,
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else if (oldState.status === "replaced") if (diff.action === "noop") return Node({
 			action: "replace",
 			deleteFirst: oldState.deleteFirst,
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else if (diff.action === "update") return Node({
 			action: "update",
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else return Node({
 			restart: true,
 			action: "replace",
 			deleteFirst: diff.deleteFirst ?? oldState.deleteFirst,
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else if (oldState.status === "deleting") return Node({
 			action: "create",
-			props: news,
+			props: applyProps,
 			state: {
 				...oldState,
 				status: "creating",
@@ -1703,12 +1965,12 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		else if (diff.action === "update") return Node({
 			action: "update",
 			adopting: forceUpdateAfterAdoption,
-			props: news,
+			props: applyProps,
 			state: oldState
 		});
 		else if (diff.action === "replace") return Node({
 			action: "replace",
-			props: news,
+			props: applyProps,
 			state: oldState,
 			deleteFirst: diff?.deleteFirst ?? false
 		});
@@ -1720,7 +1982,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 	const actionGraph = Object.fromEntries(yield* Effect.all(actions.map(Effect.fn("plan.diff.action")(function* (action) {
 		const fqn = action.FQN;
 		const downstream = newDownstreamDependencies[fqn] ?? [];
-		const inputHash = yield* hashInput(yield* resolveInput(action.Input));
+		const inputHash = yield* hashInput(materializeStableRefs(yield* resolveInput(action.Input)));
 		const oldState = yield* state.get({
 			stack: stackName,
 			stage: stage$1,
@@ -1736,7 +1998,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			forced: false
 		}];
 		const prior = oldState;
-		if (prior?.status === "ran" && prior.inputHash === inputHash && !options$6.force) return [fqn, {
+		if (prior?.status === "ran" && prior.inputHash === inputHash && !options$7.force) return [fqn, {
 			kind: "action",
 			action: "noop",
 			def: action,
@@ -1750,7 +2012,7 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 			input: action.Input,
 			state: prior,
 			downstream,
-			forced: !!options$6.force
+			forced: !!options$7.force
 		}];
 	})), { concurrency: "unbounded" }));
 	const cycleMembers = combinedCycleMembers;
@@ -1871,13 +2133,14 @@ const make = (stack, options$6 = {}) => Effect.gen(function* () {
 		deletions,
 		actionDeletions,
 		output: stack.output,
-		cycleMembers
+		cycleMembers,
+		defaultMode: runDefaultMode
 	};
 }).pipe(ensureArtifactStore, Effect.withSpan("plan.make", { attributes: {
 	"alchemy.stack": stack.name,
 	"alchemy.stage": stack.stage,
 	"alchemy.resources.count": Object.keys(stack.resources).length,
-	"alchemy.force": !!options$6.force
+	"alchemy.force": !!options$7.force
 } }));
 /**
 * Build the plan that destroys every resource of `(stack.name, stack.stage)`.
@@ -1912,6 +2175,8 @@ init_AdoptPolicy();
 init_RuntimeContext();
 init_Artifacts();
 init_Cli();
+init_Diff();
+init_InstanceId();
 init_Output();
 init_Provider();
 init_Stack();
@@ -1946,11 +2211,12 @@ const apply = (plan) => Effect.gen(function* () {
 	yield* executePlan(plan, tracker, terminalStatuses, session, state, stackName, stage$1);
 	yield* collectGarbage(plan, session);
 	yield* converge(plan, tracker, terminalStatuses, session, state, stackName, stage$1);
-	yield* Effect.forEach(Array.from(terminalStatuses.values()), ({ id, type, status }) => session.emit({
+	yield* Effect.forEach(Array.from(terminalStatuses.values()), ({ id, type, status, providerMode }) => session.emit({
 		kind: "status-change",
 		id,
 		type,
-		status
+		status,
+		providerMode
 	}), { concurrency: "unbounded" });
 	yield* session.done();
 	if (plan.destroy) {
@@ -1958,6 +2224,11 @@ const apply = (plan) => Effect.gen(function* () {
 			stack: stackName,
 			stage: stage$1
 		});
+		const remaining = yield* state.list({
+			stack: stackName,
+			stage: stage$1
+		});
+		if (remaining.length > 0) return yield* Effect.fail(new StateStoreError({ message: `destroy of ${stackName}/${stage$1} reported success but ${remaining.length} state row(s) remain (${remaining.join(", ")}) — the destroy session could not see the stack's persisted state, so its cloud resources were NOT deleted` }));
 		return;
 	}
 	if (!plan.output) return;
@@ -2009,24 +2280,29 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 			message: note
 		})
 	};
+	const fromProviderMode = node.action === "replace" && node.mode !== void 0 && node.state.providerMode !== void 0 && node.state.providerMode !== node.mode ? node.state.providerMode : void 0;
 	const report = (status) => session.emit({
 		kind: "status-change",
 		id: logicalId,
 		type: node.resource.Type,
-		status
+		status,
+		providerMode: node.mode,
+		fromProviderMode
 	});
 	const markTerminal = (status) => Effect.gen(function* () {
 		terminalStatuses.set(fqn, {
 			id: logicalId,
 			type: node.resource.Type,
-			status
+			status,
+			providerMode: node.mode
 		});
 		if (inCycle) return;
 		yield* session.emit({
 			kind: "status-change",
 			id: logicalId,
 			type: node.resource.Type,
-			status
+			status,
+			providerMode: node.mode
 		});
 	});
 	const signalReady = Deferred.succeed(ready[fqn], void 0);
@@ -2238,6 +2514,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				...node.state,
 				attr,
 				props: news,
+				bindings: bindingOutputs,
 				providerMode: node.mode
 			});
 			else yield* commit({
@@ -2425,7 +2702,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 		kind: "status-change",
 		id: node.resource.LogicalId,
 		type: node.resource.Type,
-		status: "fail"
+		status: "fail",
+		providerMode: node.mode
 	});
 })), Effect.withSpan("apply.resource", { attributes: {
 	"alchemy.resource.fqn": fqn,
@@ -2609,7 +2887,8 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
 			terminalStatuses.set(fqn, {
 				id: logicalId,
 				type: node.resource.Type,
-				status: "updated"
+				status: "updated",
+				providerMode: node.mode
 			});
 		}
 		for (const [fqn, node] of Object.entries(plan.actions)) {
@@ -2758,7 +3037,8 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 				kind: "status-change",
 				id: logicalId,
 				type: resourceType,
-				status
+				status,
+				providerMode
 			});
 			const scopedSession = {
 				...session,
@@ -2826,7 +3106,7 @@ const collectGarbage = Effect.fn(function* (plan, session) {
 							instanceId,
 							olds: props,
 							output: void 0
-						}).pipe(instrumentLifecycle("read", fqn, resourceType, logicalId, instanceId));
+						}).pipe(instrumentLifecycle("read", fqn, resourceType, logicalId, instanceId), Effect.catchDefect((defect) => scopedSession.note(`Recovery read crashed while looking up this resource's interrupted create (${String(defect)}) — if a physical resource was created, it must be cleaned up manually.`).pipe(Effect.as(void 0))));
 						if (recovered !== void 0) if (Unowned.is(recovered)) yield* scopedSession.note("Resource exists in the cloud but is not owned by this stack — leaving it in place (re-deploy with --adopt to take ownership, then destroy).");
 						else attr = stripUnowned(recovered);
 					} else yield* scopedSession.note("No attributes were recorded for this resource (its create was interrupted) and the provider does not implement `read` — if a physical resource was created, it must be cleaned up manually.");
@@ -2925,93 +3205,82 @@ const excludeDeletedBindings = (bindings) => bindings.flatMap(({ action, sid, da
 
 //#endregion
 //#region lib/Util/Clank.js
-var PromptCancelled = class extends Data.TaggedError("PromptCancelled") {};
-const retryIfCancelled = Effect.retry({ while: (e) => e instanceof PromptCancelled });
-/**
-* Wraps a clack prompt (which returns a `Promise<T | symbol>` where the
-* symbol indicates user cancellation) in an Effect.
-*
-* Returns `undefined` if the user cancels (Ctrl+C / Escape).
-*
-* Uses `Effect.callback` so fiber interruption propagates to the clack
-* prompt through its abort signal, releasing stdin and restoring the cursor.
-*/
-const prompt = (fn) => Effect.callback((resume, signal) => {
-	let settled = false;
-	fn(signal).then((result) => {
-		if (settled || signal.aborted) return;
-		settled = true;
-		if (p.isCancel(result)) resume(Effect.fail(new PromptCancelled()));
-		else resume(Effect.succeed(result));
-	}, (err) => {
-		if (settled || signal.aborted) return;
-		settled = true;
-		resume(Effect.die(err));
+var PromptCancelled, retryIfCancelled, prompt, success, warn, info, text, password, select, confirm, multiselect, openUrl;
+var init_Clank = __esm({ "lib/Util/Clank.js": (() => {
+	PromptCancelled = class extends Data.TaggedError("PromptCancelled") {};
+	retryIfCancelled = Effect.retry({ while: (e) => e instanceof PromptCancelled });
+	prompt = (fn) => Effect.callback((resume, signal) => {
+		let settled = false;
+		fn(signal).then((result) => {
+			if (settled || signal.aborted) return;
+			settled = true;
+			if (p.isCancel(result)) resume(Effect.fail(new PromptCancelled()));
+			else resume(Effect.succeed(result));
+		}, (err) => {
+			if (settled || signal.aborted) return;
+			settled = true;
+			resume(Effect.die(err));
+		});
 	});
-});
-const success = (str) => Effect.sync(() => p.log.success(str));
-const warn = (str) => Effect.sync(() => p.log.warn(str));
-const info = (str) => Effect.sync(() => p.log.info(str));
-const text = (opts) => {
-	const validate = opts.validate;
-	return prompt((signal) => p.text({
+	success = (str) => Effect.sync(() => p.log.success(str));
+	warn = (str) => Effect.sync(() => p.log.warn(str));
+	info = (str) => Effect.sync(() => p.log.info(str));
+	text = (opts) => {
+		const validate = opts.validate;
+		return prompt((signal) => p.text({
+			...opts,
+			signal,
+			validate: validate === void 0 ? void 0 : (value) => validate(value ?? "")
+		}));
+	};
+	password = (opts) => {
+		const validate = opts.validate;
+		return prompt((signal) => p.password({
+			...opts,
+			signal,
+			validate: validate === void 0 ? void 0 : (value) => validate(value ?? "")
+		}));
+	};
+	select = (opts) => prompt((signal) => p.select({
 		...opts,
-		signal,
-		validate: validate === void 0 ? void 0 : (value) => validate(value ?? "")
+		signal
 	}));
-};
-const password = (opts) => {
-	const validate = opts.validate;
-	return prompt((signal) => p.password({
+	confirm = (opts) => prompt((signal) => p.confirm({
 		...opts,
-		signal,
-		validate: validate === void 0 ? void 0 : (value) => validate(value ?? "")
+		signal
 	}));
-};
-const select = (opts) => prompt((signal) => p.select({
-	...opts,
-	signal
-}));
-const confirm = (opts) => prompt((signal) => p.confirm({
-	...opts,
-	signal
-}));
-const multiselect = (opts) => prompt((signal) => p.multiselect({
-	...opts,
-	signal
-}));
-/**
-* Open a URL in the user's default browser.
-*
-* On Windows, uses rundll32's FileProtocolHandler — a built-in shim that
-* opens URLs in the default browser. It accepts the URL as a direct
-* argument (no shell, no quoting of `&`). cmd.exe `start` would treat
-* `&` in OAuth URLs as a command separator, and `explorer.exe` treats
-* its arg as a path.
-*/
-const openUrl = (url) => Effect.gen(function* () {
-	const [cmd, args] = process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
-	yield* (yield* ChildProcess.make(cmd, [...args], { shell: false })).exitCode;
-}).pipe(Effect.scoped);
+	multiselect = (opts) => prompt((signal) => p.multiselect({
+		...opts,
+		signal
+	}));
+	openUrl = (url) => Effect.gen(function* () {
+		const [cmd, args] = process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+		yield* (yield* ChildProcess.make(cmd, [...args], { shell: false })).exitCode;
+	}).pipe(Effect.scoped);
+}) });
 
 //#endregion
 //#region lib/Auth/Env.js
-init_AuthProvider();
-const getEnv = (key) => Config.string(key).pipe(Effect.orElseSucceed(() => void 0));
-const getEnvRequired = (key) => Config.string(key).pipe(Effect.catch(() => Effect.fail(new AuthError({ message: `Missing required env: ${key}` }))));
-const getEnvRedacted = (key) => Config.redacted(key).pipe(Effect.orElseSucceed(() => void 0));
-const getEnvRedactedRequired = (key) => Config.redacted(key).pipe(Effect.catch(() => Effect.fail(new AuthError({ message: `Missing required env: ${key}` }))));
-const retryOnce = (self) => self.pipe(Effect.retry({
-	times: 1,
-	while: (e) => e instanceof PromptCancelled
-}), Effect.mapError((e) => new AuthError({
-	message: "User cancelled prompt",
-	cause: e
-})));
+var getEnv, getEnvRequired, getEnvRedacted, getEnvRedactedRequired, retryOnce;
+var init_Env = __esm({ "lib/Auth/Env.js": (() => {
+	init_Clank();
+	init_AuthProvider$1();
+	getEnv = (key) => Config.string(key).pipe(Effect.orElseSucceed(() => void 0));
+	getEnvRequired = (key) => Config.string(key).pipe(Effect.catch(() => Effect.fail(new AuthError({ message: `Missing required env: ${key}` }))));
+	getEnvRedacted = (key) => Config.redacted(key).pipe(Effect.orElseSucceed(() => void 0));
+	getEnvRedactedRequired = (key) => Config.redacted(key).pipe(Effect.catch(() => Effect.fail(new AuthError({ message: `Missing required env: ${key}` }))));
+	retryOnce = (self) => self.pipe(Effect.retry({
+		times: 1,
+		while: (e) => e instanceof PromptCancelled
+	}), Effect.mapError((e) => new AuthError({
+		message: "User cancelled prompt",
+		cause: e
+	})));
+}) });
 
 //#endregion
 //#region lib/AWS/Environment.js
-init_AuthProvider();
+init_AuthProvider$1();
 init_Profile();
 const AWS_PROFILE = Config.string("AWS_PROFILE").pipe(Config.withDefault("default"));
 const AWS_REGION = Config.string("AWS_REGION");
@@ -3045,10 +3314,12 @@ const fromEnvironment = Layer.effect(Region.Region, Effect.gen(function* () {
 
 //#endregion
 //#region lib/AWS/AuthProvider.js
-init_AuthProvider();
+init_AuthProvider$1();
 init_Credentials();
+init_Env();
+init_Clank();
 const AWS_AUTH_PROVIDER_NAME = "AWS";
-const options$5 = [
+const options$6 = [
 	{
 		value: "sso",
 		label: "SSO",
@@ -3085,7 +3356,8 @@ const AwsAuth = AuthProviderLayer()(AWS_AUTH_PROVIDER_NAME, Effect.gen(function*
 	const getAccountId = ({ accessKeyId, secretAccessKey, sessionToken, region }) => STS.getCallerIdentity({}).pipe(Effect.provide(Layer.mergeAll(Layer.succeed(Credentials, Effect.succeed({
 		accessKeyId,
 		secretAccessKey,
-		sessionToken
+		sessionToken,
+		region
 	})), of(region))), Effect.flatMap((self) => self.Account ? Effect.succeed(self.Account) : Effect.die(/* @__PURE__ */ new Error("No account ID found"))));
 	const loginStored = Effect.fn(function* (profileName) {
 		const accessKeyId = yield* text({
@@ -3123,7 +3395,7 @@ const AwsAuth = AuthProviderLayer()(AWS_AUTH_PROVIDER_NAME, Effect.gen(function*
 	});
 	const configureInteractive = (profileName) => select({
 		message: "AWS authentication method",
-		options: options$5
+		options: options$6
 	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("sso", () => Effect.gen(function* () {
 		const config = {
 			method: "sso",
@@ -3159,7 +3431,8 @@ const AwsAuth = AuthProviderLayer()(AWS_AUTH_PROVIDER_NAME, Effect.gen(function*
 			credentials: Effect.succeed({
 				accessKeyId,
 				secretAccessKey,
-				sessionToken
+				sessionToken,
+				region
 			}),
 			region,
 			source: { type: "env" }
@@ -3169,7 +3442,8 @@ const AwsAuth = AuthProviderLayer()(AWS_AUTH_PROVIDER_NAME, Effect.gen(function*
 		credentials: Effect.succeed({
 			accessKeyId: Redacted.make(creds.accessKeyId),
 			secretAccessKey: Redacted.make(creds.secretAccessKey),
-			sessionToken: creds.sessionToken ? Redacted.make(creds.sessionToken) : void 0
+			sessionToken: creds.sessionToken ? Redacted.make(creds.sessionToken) : void 0,
+			region: creds.region
 		}),
 		region: creds.region,
 		source: { type: "stored" }
@@ -3267,10 +3541,12 @@ const clearDistilledSsoCache = (ssoProfile) => Effect.gen(function* () {
 
 //#endregion
 //#region lib/Axiom/AuthProvider.js
-init_AuthProvider();
+init_AuthProvider$1();
 init_Credentials();
+init_Env();
+init_Clank();
 const STORAGE_KEY = "axiom-stored";
-const options$4 = [{
+const options$5 = [{
 	value: "env",
 	label: "Environment Variables",
 	hint: "AXIOM_TOKEN (or AXIOM_API_KEY) + optional AXIOM_ORG_ID, AXIOM_URL"
@@ -3350,7 +3626,7 @@ const AxiomAuth = AuthProviderLayer()(AXIOM_AUTH_PROVIDER_NAME, Effect.gen(funct
 	});
 	const configureInteractive = (profileName) => select({
 		message: "Axiom authentication method",
-		options: options$4
+		options: options$5
 	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
 	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
 		if (ctx.ci) return { method: "env" };
@@ -3420,22 +3696,13 @@ const AxiomAuth = AuthProviderLayer()(AXIOM_AUTH_PROVIDER_NAME, Effect.gen(funct
 
 //#endregion
 //#region lib/Cloudflare/StateStore/CredentialsFile.js
-/**
-* Filename (under `~/.alchemy/credentials/{profile}/`) used to cache the
-* Cloudflare-deployed HTTP state store's endpoint + bearer token.
-*
-* Kept in this leaf module (rather than `StateStore/State.ts`) so the
-* Cloudflare auth provider can invalidate the cache on
-* `login --configure` / `logout` without importing the heavy state-store
-* module and creating an import cycle
-* (`StateStore/State.ts` -> `Providers.ts` -> `Auth/AuthProvider.ts`).
-*/
-const CREDENTIALS_FILE = "cloudflare-state-store";
+var CREDENTIALS_FILE;
+var init_CredentialsFile = __esm({ "lib/Cloudflare/StateStore/CredentialsFile.js": (() => {
+	CREDENTIALS_FILE = "cloudflare-state-store";
+}) });
 
 //#endregion
 //#region lib/Cloudflare/Auth/OAuthClient.js
-init_AuthProvider();
-var OAuthError$1 = class extends Data.TaggedError("OAuthError") {};
 function generateState$1(length = 32) {
 	return crypto$1.randomBytes(length).toString("base64url");
 }
@@ -3455,42 +3722,6 @@ function extractCredentials$1(json) {
 		scopes: json.scope.split(" ")
 	};
 }
-const tokenRequest$1 = (body) => Effect.gen(function* () {
-	const res = yield* Effect.tryPromise({
-		try: () => fetch(OAUTH_ENDPOINTS$1.token, {
-			method: "POST",
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/x-www-form-urlencoded"
-			},
-			body: new URLSearchParams(body).toString()
-		}),
-		catch: (err) => new OAuthError$1({
-			error: "network_error",
-			errorDescription: `Token request failed: ${err}`
-		})
-	});
-	if (!res.ok) {
-		const json = yield* Effect.tryPromise({
-			try: () => res.json(),
-			catch: () => new OAuthError$1({
-				error: "parse_error",
-				errorDescription: `Token endpoint returned ${res.status}`
-			})
-		});
-		return yield* new OAuthError$1({
-			error: json.error,
-			errorDescription: json.error_description
-		});
-	}
-	return extractCredentials$1(yield* Effect.tryPromise({
-		try: () => res.json(),
-		catch: () => new OAuthError$1({
-			error: "parse_error",
-			errorDescription: "Failed to parse token response"
-		})
-	}));
-});
 /**
 * Generate an authorization URL with PKCE for the given scopes.
 */
@@ -3511,93 +3742,6 @@ function authorize$1(scopes) {
 		verifier: pkce.verifier
 	};
 }
-/**
-* Exchange an authorization code for OAuth credentials.
-*/
-const exchange$1 = (code, verifier) => tokenRequest$1({
-	grant_type: "authorization_code",
-	code,
-	code_verifier: verifier,
-	client_id: OAUTH_CLIENT_ID$1,
-	redirect_uri: OAUTH_REDIRECT_URI$1
-});
-/**
-* Refresh expired OAuth credentials.
-*/
-const refresh$1 = (credentials) => tokenRequest$1({
-	grant_type: "refresh_token",
-	refresh_token: credentials.refresh,
-	client_id: OAUTH_CLIENT_ID$1,
-	redirect_uri: OAUTH_REDIRECT_URI$1
-});
-/**
-* Revoke OAuth credentials.
-*/
-const revoke = (credentials) => Effect.gen(function* () {
-	yield* Effect.tryPromise({
-		try: () => fetch(OAUTH_ENDPOINTS$1.revoke, {
-			method: "POST",
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/x-www-form-urlencoded"
-			},
-			body: new URLSearchParams({
-				refresh_token: credentials.refresh,
-				client_id: OAUTH_CLIENT_ID$1,
-				redirect_uri: OAUTH_REDIRECT_URI$1
-			}).toString()
-		}),
-		catch: (err) => new OAuthError$1({
-			error: "network_error",
-			errorDescription: `Revoke request failed: ${err}`
-		})
-	});
-});
-/**
-* Exchange a code copied from the hosted relay page, or extract the code from
-* either the hosted or loopback callback URL.
-*/
-const exchangeCallbackInput$1 = (input, authorization) => Effect.gen(function* () {
-	const value = input.trim();
-	let code = value;
-	let state = null;
-	try {
-		const url = new URL(value);
-		code = url.searchParams.get("code") ?? "";
-		state = url.searchParams.get("state");
-	} catch {
-		const separator = value.lastIndexOf("#");
-		if (separator >= 0) {
-			code = value.slice(0, separator);
-			state = value.slice(separator + 1);
-		}
-	}
-	if (!code) return yield* new OAuthError$1({
-		error: "invalid_request",
-		errorDescription: "The authorization code is missing."
-	});
-	if (state !== null && state !== authorization.state) return yield* new OAuthError$1({
-		error: "invalid_request",
-		errorDescription: "The authorization state does not match."
-	});
-	return yield* exchange$1(code, authorization.verifier);
-});
-/**
-* Start a local HTTP server to listen for the OAuth callback, exchange
-* the authorization code, and return the credentials.
-*
-* Times out after 5 minutes.
-*/
-const callback$1 = (authorization) => Effect.tryPromise({
-	try: (signal) => callbackPromise$1(authorization, signal),
-	catch: (err) => {
-		if (err instanceof OAuthError$1) return err;
-		return new OAuthError$1({
-			error: "callback_error",
-			errorDescription: `OAuth callback failed: ${err}`
-		});
-	}
-});
 function callbackPromise$1(authorization, signal) {
 	const { pathname, port } = new URL(OAUTH_LOCAL_CALLBACK_URI$1);
 	return new Promise((resolve, reject) => {
@@ -3688,392 +3832,498 @@ function callbackPromise$1(authorization, signal) {
 		server.listen(Number(port));
 	});
 }
+var OAuthError$1, tokenRequest$1, exchange$1, refresh$1, revoke, exchangeCallbackInput$1, callback$1;
+var init_OAuthClient = __esm({ "lib/Cloudflare/Auth/OAuthClient.js": (() => {
+	init_AuthProvider$1();
+	init_AuthProvider();
+	OAuthError$1 = class extends Data.TaggedError("OAuthError") {};
+	tokenRequest$1 = (body) => Effect.gen(function* () {
+		const res = yield* Effect.tryPromise({
+			try: () => fetch(OAUTH_ENDPOINTS$1.token, {
+				method: "POST",
+				headers: {
+					Accept: "application/json",
+					"Content-Type": "application/x-www-form-urlencoded"
+				},
+				body: new URLSearchParams(body).toString()
+			}),
+			catch: (err) => new OAuthError$1({
+				error: "network_error",
+				errorDescription: `Token request failed: ${err}`
+			})
+		});
+		if (!res.ok) {
+			const json = yield* Effect.tryPromise({
+				try: () => res.json(),
+				catch: () => new OAuthError$1({
+					error: "parse_error",
+					errorDescription: `Token endpoint returned ${res.status}`
+				})
+			});
+			return yield* new OAuthError$1({
+				error: json.error,
+				errorDescription: json.error_description
+			});
+		}
+		return extractCredentials$1(yield* Effect.tryPromise({
+			try: () => res.json(),
+			catch: () => new OAuthError$1({
+				error: "parse_error",
+				errorDescription: "Failed to parse token response"
+			})
+		}));
+	});
+	exchange$1 = (code, verifier) => tokenRequest$1({
+		grant_type: "authorization_code",
+		code,
+		code_verifier: verifier,
+		client_id: OAUTH_CLIENT_ID$1,
+		redirect_uri: OAUTH_REDIRECT_URI$1
+	});
+	refresh$1 = (credentials) => tokenRequest$1({
+		grant_type: "refresh_token",
+		refresh_token: credentials.refresh,
+		client_id: OAUTH_CLIENT_ID$1,
+		redirect_uri: OAUTH_REDIRECT_URI$1
+	});
+	revoke = (credentials) => Effect.gen(function* () {
+		yield* Effect.tryPromise({
+			try: () => fetch(OAUTH_ENDPOINTS$1.revoke, {
+				method: "POST",
+				headers: {
+					Accept: "application/json",
+					"Content-Type": "application/x-www-form-urlencoded"
+				},
+				body: new URLSearchParams({
+					refresh_token: credentials.refresh,
+					client_id: OAUTH_CLIENT_ID$1,
+					redirect_uri: OAUTH_REDIRECT_URI$1
+				}).toString()
+			}),
+			catch: (err) => new OAuthError$1({
+				error: "network_error",
+				errorDescription: `Revoke request failed: ${err}`
+			})
+		});
+	});
+	exchangeCallbackInput$1 = (input, authorization) => Effect.gen(function* () {
+		const value = input.trim();
+		let code = value;
+		let state = null;
+		try {
+			const url = new URL(value);
+			code = url.searchParams.get("code") ?? "";
+			state = url.searchParams.get("state");
+		} catch {
+			const separator = value.lastIndexOf("#");
+			if (separator >= 0) {
+				code = value.slice(0, separator);
+				state = value.slice(separator + 1);
+			}
+		}
+		if (!code) return yield* new OAuthError$1({
+			error: "invalid_request",
+			errorDescription: "The authorization code is missing."
+		});
+		if (state !== null && state !== authorization.state) return yield* new OAuthError$1({
+			error: "invalid_request",
+			errorDescription: "The authorization state does not match."
+		});
+		return yield* exchange$1(code, authorization.verifier);
+	});
+	callback$1 = (authorization) => Effect.tryPromise({
+		try: (signal) => callbackPromise$1(authorization, signal),
+		catch: (err) => {
+			if (err instanceof OAuthError$1) return err;
+			return new OAuthError$1({
+				error: "callback_error",
+				errorDescription: `OAuth callback failed: ${err}`
+			});
+		}
+	});
+}) });
 
 //#endregion
 //#region lib/Cloudflare/Auth/AuthProvider.js
-init_AuthProvider();
-init_Credentials();
-const options$3 = [
-	{
-		value: "oauth",
-		label: "OAuth",
-		hint: "recommended — browser-based login with automatic token refresh"
-	},
-	{
-		value: "env",
-		label: "Environment Variables",
-		hint: "CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL"
-	},
-	{
-		value: "stored",
-		label: "API Token or API Key",
-		hint: "enter credentials interactively, stored in ~/.alchemy/credentials"
-	}
-];
-const CLOUDFLARE_AUTH_PROVIDER_NAME = "Cloudflare";
-const withOAuthCredentials$1 = (accessToken, effect) => Effect.provide(effect, Layer.mergeAll(CfCredentialsModule.fromOAuth({
-	load: Effect.succeed({ accessToken }),
-	refresh: () => Effect.die("refresh not expected during account selection")
-}), FetchHttpClient.layer));
-const selectAccount = (accessToken) => Effect.gen(function* () {
-	const accounts = (yield* (yield* cfAccounts.listAccounts)({})).result;
-	if (accounts.length === 0) return yield* new AuthError({ message: "Cloudflare: no accounts found for this credential." });
-	if (accounts.length === 1) {
-		const account = accounts[0];
-		yield* info(`Cloudflare: using account: ${account.name} (${account.id})`);
-		return account.id;
-	}
-	return yield* select({
-		message: "Select a Cloudflare account",
-		options: accounts.map((a) => ({
-			value: a.id,
-			label: a.name,
-			hint: a.id
-		}))
-	}).pipe(retryOnce);
-}).pipe((e) => withOAuthCredentials$1(accessToken, e));
-/**
-* Cloudflare account IDs are 32 lowercase hex characters. Placeholder
-* values ("", "-", "dummy", …) end up interpolated into API paths and
-* surface as baffling `InvalidRoute: Could not route to
-* /accounts/<value>/...` errors, so reject them up front with an
-* actionable message instead.
-*/
-const ACCOUNT_ID_PATTERN = /^[0-9a-f]{32}$/i;
-const validateAccountId = (accountId, source) => {
-	const trimmed = accountId?.trim() ?? "";
-	if (trimmed.length === 0) return Effect.fail(new AuthError({ message: `Cloudflare account ID is missing (${source}). Set CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login' and provide your account ID (found in the Cloudflare dashboard under Workers & Pages → Account details).` }));
-	if (!ACCOUNT_ID_PATTERN.test(trimmed)) return Effect.fail(new AuthError({ message: `'${trimmed}' is not a valid Cloudflare account ID (${source}) — expected 32 hex characters. Copy the account ID from the Cloudflare dashboard (Workers & Pages → Account details) into CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login'.` }));
-	return Effect.succeed(trimmed.toLowerCase());
-};
-const promptAccountId = () => getEnv("CLOUDFLARE_ACCOUNT_ID").pipe(Effect.flatMap((envAccountId) => text({
-	message: "Cloudflare Account ID (Enter to skip)",
-	placeholder: envAccountId ?? "",
-	defaultValue: envAccountId ?? "",
-	validate: (v) => v.trim().length === 0 || ACCOUNT_ID_PATTERN.test(v.trim()) ? void 0 : "Expected a 32-character hex account ID (Workers & Pages → Account details)"
-}).pipe(retryOnce)));
-const promptOAuthScopes = () => confirm({
-	message: "Customize OAuth scopes? (default covers typical use cases)",
-	initialValue: false
-}).pipe(retryOnce, Effect.flatMap((customize) => {
-	if (!customize) return Effect.succeed([...DEFAULT_SCOPES]);
-	return multiselect({
-		message: "Select OAuth scopes",
-		initialValues: DEFAULT_SCOPES,
-		options: Object.entries(ALL_SCOPES).map(([value, hint]) => ({
-			value,
-			label: value,
-			hint
-		})),
-		required: true
-	}).pipe(Effect.map((s) => s), retryOnce);
-}));
-/**
-* Layer that registers the Cloudflare {@link AuthProvider} into the
-* {@link AuthProviders} registry when built. Include this in the Cloudflare
-* `providers()` layer so `alchemy login` can discover it.
-*/
-const CloudflareAuth = AuthProviderLayer()(CLOUDFLARE_AUTH_PROVIDER_NAME, Effect.gen(function* () {
-	const store = yield* CredentialsStore;
-	const oauthLogin = (profileName, scopes) => Effect.gen(function* () {
-		const authorization = authorize$1([...scopes, "offline_access"]);
-		yield* info("Cloudflare: opening browser for OAuth login...");
-		yield* info(authorization.url);
-		yield* openUrl(authorization.url).pipe(Effect.catch(() => warn("Cloudflare: could not open browser automatically. Please open the URL above manually.")));
-		yield* info("Cloudflare: waiting for authorization (up to 5 minutes).");
-		const credentials = yield* Effect.raceFirst(callback$1(authorization), text({
-			message: "Paste the authorization code or callback URL",
-			placeholder: "The browser will complete this automatically when local",
-			validate: (value) => value.trim().length > 0 ? void 0 : "Paste a code or URL"
-		}).pipe(Effect.flatMap((input) => exchangeCallbackInput$1(input, authorization))));
-		yield* store.write(profileName, "cf-oauth", credentials);
-		yield* success("Cloudflare: OAuth credentials saved.");
-		return credentials;
-	});
-	const loginStored = Effect.fn(function* (profileName) {
-		const credentialType = yield* select({
-			message: "Cloudflare credential type",
-			options: [{
-				value: "apiToken",
-				label: "API Token",
-				hint: "recommended"
-			}, {
-				value: "apiKey",
-				label: "API Key + Email"
-			}]
+var options$4, CLOUDFLARE_AUTH_PROVIDER_NAME, withOAuthCredentials$1, selectAccount, ACCOUNT_ID_PATTERN, validateAccountId, promptAccountId, promptOAuthScopes, CloudflareAuth, ALL_SCOPES, DEFAULT_SCOPES, OAUTH_CLIENT_ID$1, OAUTH_REDIRECT_URI$1, OAUTH_LOCAL_CALLBACK_URI$1, OAUTH_ENDPOINTS$1;
+var init_AuthProvider = __esm({ "lib/Cloudflare/Auth/AuthProvider.js": (() => {
+	init_AuthProvider$1();
+	init_Credentials();
+	init_Env();
+	init_Clank();
+	init_CredentialsFile();
+	init_OAuthClient();
+	options$4 = [
+		{
+			value: "oauth",
+			label: "OAuth",
+			hint: "recommended — browser-based login with automatic token refresh"
+		},
+		{
+			value: "env",
+			label: "Environment Variables",
+			hint: "CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL"
+		},
+		{
+			value: "stored",
+			label: "API Token or API Key",
+			hint: "enter credentials interactively, stored in ~/.alchemy/credentials"
+		}
+	];
+	CLOUDFLARE_AUTH_PROVIDER_NAME = "Cloudflare";
+	withOAuthCredentials$1 = (accessToken, effect) => Effect.provide(effect, Layer.mergeAll(CfCredentialsModule.fromOAuth({
+		load: Effect.succeed({ accessToken }),
+		refresh: () => Effect.die("refresh not expected during account selection")
+	}), FetchHttpClient.layer));
+	selectAccount = (accessToken) => Effect.gen(function* () {
+		const accounts = (yield* (yield* cfAccounts.listAccounts)({})).result;
+		if (accounts.length === 0) return yield* new AuthError({ message: "Cloudflare: no accounts found for this credential." });
+		if (accounts.length === 1) {
+			const account = accounts[0];
+			yield* info(`Cloudflare: using account: ${account.name} (${account.id})`);
+			return account.id;
+		}
+		return yield* select({
+			message: "Select a Cloudflare account",
+			options: accounts.map((a) => ({
+				value: a.id,
+				label: a.name,
+				hint: a.id
+			}))
 		}).pipe(retryOnce);
-		return yield* Match.value(credentialType).pipe(Match.when("apiToken", () => Effect.gen(function* () {
-			const apiToken = yield* password({
-				message: "Cloudflare API Token",
-				validate: (v) => v.length === 0 ? "Required" : void 0
+	}).pipe((e) => withOAuthCredentials$1(accessToken, e));
+	ACCOUNT_ID_PATTERN = /^[0-9a-f]{32}$/i;
+	validateAccountId = (accountId, source) => {
+		const trimmed = accountId?.trim() ?? "";
+		if (trimmed.length === 0) return Effect.fail(new AuthError({ message: `Cloudflare account ID is missing (${source}). Set CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login' and provide your account ID (found in the Cloudflare dashboard under Workers & Pages → Account details).` }));
+		if (!ACCOUNT_ID_PATTERN.test(trimmed)) return Effect.fail(new AuthError({ message: `'${trimmed}' is not a valid Cloudflare account ID (${source}) — expected 32 hex characters. Copy the account ID from the Cloudflare dashboard (Workers & Pages → Account details) into CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login'.` }));
+		return Effect.succeed(trimmed.toLowerCase());
+	};
+	promptAccountId = () => getEnv("CLOUDFLARE_ACCOUNT_ID").pipe(Effect.flatMap((envAccountId) => text({
+		message: "Cloudflare Account ID (Enter to skip)",
+		placeholder: envAccountId ?? "",
+		defaultValue: envAccountId ?? "",
+		validate: (v) => v.trim().length === 0 || ACCOUNT_ID_PATTERN.test(v.trim()) ? void 0 : "Expected a 32-character hex account ID (Workers & Pages → Account details)"
+	}).pipe(retryOnce)));
+	promptOAuthScopes = () => confirm({
+		message: "Customize OAuth scopes? (default covers typical use cases)",
+		initialValue: false
+	}).pipe(retryOnce, Effect.flatMap((customize) => {
+		if (!customize) return Effect.succeed([...DEFAULT_SCOPES]);
+		return multiselect({
+			message: "Select OAuth scopes",
+			initialValues: DEFAULT_SCOPES,
+			options: Object.entries(ALL_SCOPES).map(([value, hint]) => ({
+				value,
+				label: value,
+				hint
+			})),
+			required: true
+		}).pipe(Effect.map((s) => s), retryOnce);
+	}));
+	CloudflareAuth = AuthProviderLayer()(CLOUDFLARE_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+		const store = yield* CredentialsStore;
+		const oauthLogin = (profileName, scopes) => Effect.gen(function* () {
+			const authorization = authorize$1([...scopes, "offline_access"]);
+			yield* info("Cloudflare: opening browser for OAuth login...");
+			yield* info(authorization.url);
+			yield* openUrl(authorization.url).pipe(Effect.catch(() => warn("Cloudflare: could not open browser automatically. Please open the URL above manually.")));
+			yield* info("Cloudflare: waiting for authorization (up to 5 minutes).");
+			const credentials = yield* Effect.raceFirst(callback$1(authorization), text({
+				message: "Paste the authorization code or callback URL",
+				placeholder: "The browser will complete this automatically when local",
+				validate: (value) => value.trim().length > 0 ? void 0 : "Paste a code or URL"
+			}).pipe(Effect.flatMap((input) => exchangeCallbackInput$1(input, authorization))));
+			yield* store.write(profileName, "cf-oauth", credentials);
+			yield* success("Cloudflare: OAuth credentials saved.");
+			return credentials;
+		});
+		const loginStored = Effect.fn(function* (profileName) {
+			const credentialType = yield* select({
+				message: "Cloudflare credential type",
+				options: [{
+					value: "apiToken",
+					label: "API Token",
+					hint: "recommended"
+				}, {
+					value: "apiKey",
+					label: "API Key + Email"
+				}]
 			}).pipe(retryOnce);
-			const accountId = yield* promptAccountId();
-			yield* store.write(profileName, "cf-stored", {
+			return yield* Match.value(credentialType).pipe(Match.when("apiToken", () => Effect.gen(function* () {
+				const apiToken = yield* password({
+					message: "Cloudflare API Token",
+					validate: (v) => v.length === 0 ? "Required" : void 0
+				}).pipe(retryOnce);
+				const accountId = yield* promptAccountId();
+				yield* store.write(profileName, "cf-stored", {
+					type: "apiToken",
+					apiToken,
+					accountId
+				});
+				yield* success("Cloudflare: credentials saved.");
+				return {
+					method: "stored",
+					credentialType: "apiToken"
+				};
+			})), Match.when("apiKey", () => Effect.gen(function* () {
+				const apiKey = yield* text({
+					message: "Cloudflare API Key",
+					validate: (v) => v.length === 0 ? "Required" : void 0
+				}).pipe(retryOnce);
+				const email = yield* text({
+					message: "Cloudflare Email",
+					validate: (v) => v.length === 0 ? "Required" : void 0
+				}).pipe(retryOnce);
+				const accountId = yield* promptAccountId();
+				yield* store.write(profileName, "cf-stored", {
+					type: "apiKey",
+					apiKey,
+					email,
+					accountId
+				});
+				yield* success("Cloudflare: credentials saved.");
+				return {
+					method: "stored",
+					credentialType: "apiKey"
+				};
+			})), Match.exhaustive);
+		});
+		const configureOAuth = Effect.fn(function* (profileName) {
+			const scopes = yield* promptOAuthScopes();
+			return {
+				method: "oauth",
+				scopes,
+				accountId: yield* selectAccount((yield* oauthLogin(profileName, scopes)).access).pipe(Effect.mapError((e) => new AuthError({
+					message: "Cloudflare: could not list accounts",
+					cause: e
+				})))
+			};
+		});
+		const configureInteractive = (profileName) => select({
+			message: "Cloudflare authentication method",
+			options: options$4
+		}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("oauth", () => configureOAuth(profileName)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+		const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
+			const config = ctx.ci ? { method: "env" } : yield* configureInteractive(profileName);
+			yield* store.delete(profileName, CREDENTIALS_FILE).pipe(Effect.ignore);
+			return config;
+		}).pipe(Effect.mapError((e) => new AuthError({
+			message: "failed to configure credentials",
+			cause: e
+		})));
+		const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fn(function* () {
+			const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID").pipe(Effect.flatMap((id) => validateAccountId(id, "from the CLOUDFLARE_ACCOUNT_ID env var")));
+			const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
+			if (apiToken) return {
 				type: "apiToken",
 				apiToken,
-				accountId
-			});
-			yield* success("Cloudflare: credentials saved.");
-			return {
-				method: "stored",
-				credentialType: "apiToken"
+				accountId,
+				source: { type: "env" }
 			};
-		})), Match.when("apiKey", () => Effect.gen(function* () {
-			const apiKey = yield* text({
-				message: "Cloudflare API Key",
-				validate: (v) => v.length === 0 ? "Required" : void 0
-			}).pipe(retryOnce);
-			const email = yield* text({
-				message: "Cloudflare Email",
-				validate: (v) => v.length === 0 ? "Required" : void 0
-			}).pipe(retryOnce);
-			const accountId = yield* promptAccountId();
-			yield* store.write(profileName, "cf-stored", {
+			const apiKey = yield* getEnvRedacted("CLOUDFLARE_API_KEY");
+			const email = yield* getEnvRedacted("CLOUDFLARE_EMAIL");
+			if (apiKey && email) return {
 				type: "apiKey",
 				apiKey,
 				email,
-				accountId
-			});
-			yield* success("Cloudflare: credentials saved.");
-			return {
-				method: "stored",
-				credentialType: "apiKey"
+				accountId,
+				source: { type: "env" }
 			};
-		})), Match.exhaustive);
-	});
-	const configureOAuth = Effect.fn(function* (profileName) {
-		const scopes = yield* promptOAuthScopes();
-		return {
-			method: "oauth",
-			scopes,
-			accountId: yield* selectAccount((yield* oauthLogin(profileName, scopes)).access).pipe(Effect.mapError((e) => new AuthError({
-				message: "Cloudflare: could not list accounts",
+			return yield* new AuthError({ message: "Cloudflare env credentials not found. Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL." });
+		})), Match.when({ method: "stored" }, () => store.read(profileName, "cf-stored").pipe(Effect.flatMap((creds) => creds == null ? Effect.fail(new AuthError({ message: "Cloudflare stored credentials not found. Run: alchemy login --configure" })) : Effect.gen(function* () {
+			const envAccountId = yield* getEnv("CLOUDFLARE_ACCOUNT_ID");
+			const accountId = yield* validateAccountId(creds.accountId?.trim() || envAccountId, `stored for profile '${profileName}'`);
+			return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c$1) => ({
+				type: "apiToken",
+				apiToken: Redacted.make(c$1.apiToken),
+				accountId,
+				source: { type: "stored" }
+			})), Match.when({ type: "apiKey" }, (c$1) => ({
+				type: "apiKey",
+				apiKey: Redacted.make(c$1.apiKey),
+				email: Redacted.make(c$1.email),
+				accountId,
+				source: { type: "stored" }
+			})), Match.exhaustive);
+		})))), Match.when({ method: "oauth" }, (cfg) => Effect.gen(function* () {
+			const accountId = yield* validateAccountId(cfg.accountId, `configured for profile '${profileName}'`);
+			const creds = yield* store.read(profileName, "cf-oauth");
+			if (creds == null || creds.type !== "oauth") return yield* Effect.fail(new AuthError({ message: "Cloudflare OAuth credentials not found. Run: alchemy login" }));
+			const fresh = creds.expires > Date.now() + 1e4 ? creds : yield* refresh$1(creds).pipe(Effect.tap((refreshed) => store.write(profileName, "cf-oauth", refreshed)), Effect.mapError((e) => new AuthError({
+				message: "Cloudflare OAuth refresh failed. Run: alchemy login",
 				cause: e
-			})))
-		};
-	});
-	const configureInteractive = (profileName) => select({
-		message: "Cloudflare authentication method",
-		options: options$3
-	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("oauth", () => configureOAuth(profileName)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
-	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
-		const config = ctx.ci ? { method: "env" } : yield* configureInteractive(profileName);
-		yield* store.delete(profileName, CREDENTIALS_FILE).pipe(Effect.ignore);
-		return config;
-	}).pipe(Effect.mapError((e) => new AuthError({
-		message: "failed to configure credentials",
-		cause: e
-	})));
-	const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fn(function* () {
-		const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID").pipe(Effect.flatMap((id) => validateAccountId(id, "from the CLOUDFLARE_ACCOUNT_ID env var")));
-		const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
-		if (apiToken) return {
-			type: "apiToken",
-			apiToken,
-			accountId,
-			source: { type: "env" }
-		};
-		const apiKey = yield* getEnvRedacted("CLOUDFLARE_API_KEY");
-		const email = yield* getEnvRedacted("CLOUDFLARE_EMAIL");
-		if (apiKey && email) return {
-			type: "apiKey",
-			apiKey,
-			email,
-			accountId,
-			source: { type: "env" }
-		};
-		return yield* new AuthError({ message: "Cloudflare env credentials not found. Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL." });
-	})), Match.when({ method: "stored" }, () => store.read(profileName, "cf-stored").pipe(Effect.flatMap((creds) => creds == null ? Effect.fail(new AuthError({ message: "Cloudflare stored credentials not found. Run: alchemy login --configure" })) : Effect.gen(function* () {
-		const envAccountId = yield* getEnv("CLOUDFLARE_ACCOUNT_ID");
-		const accountId = yield* validateAccountId(creds.accountId?.trim() || envAccountId, `stored for profile '${profileName}'`);
-		return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c$1) => ({
-			type: "apiToken",
-			apiToken: Redacted.make(c$1.apiToken),
-			accountId,
-			source: { type: "stored" }
-		})), Match.when({ type: "apiKey" }, (c$1) => ({
-			type: "apiKey",
-			apiKey: Redacted.make(c$1.apiKey),
-			email: Redacted.make(c$1.email),
-			accountId,
-			source: { type: "stored" }
+			})));
+			return {
+				type: "oauth",
+				accessToken: Redacted.make(fresh.access),
+				expires: fresh.expires,
+				accountId,
+				source: { type: "oauth" }
+			};
 		})), Match.exhaustive);
-	})))), Match.when({ method: "oauth" }, (cfg) => Effect.gen(function* () {
-		const accountId = yield* validateAccountId(cfg.accountId, `configured for profile '${profileName}'`);
-		const creds = yield* store.read(profileName, "cf-oauth");
-		if (creds == null || creds.type !== "oauth") return yield* Effect.fail(new AuthError({ message: "Cloudflare OAuth credentials not found. Run: alchemy login" }));
-		const fresh = creds.expires > Date.now() + 1e4 ? creds : yield* refresh$1(creds).pipe(Effect.tap((refreshed) => store.write(profileName, "cf-oauth", refreshed)), Effect.mapError((e) => new AuthError({
-			message: "Cloudflare OAuth refresh failed. Run: alchemy login",
+		const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.delete(profileName, "cf-stored").pipe(Effect.andThen(success("Cloudflare: stored credentials removed")))), Match.when({ method: "oauth" }, () => store.read(profileName, "cf-oauth").pipe(Effect.tap((creds) => creds?.type === "oauth" ? revoke(creds).pipe(Effect.catchTag("OAuthError", (err) => warn(`Cloudflare: could not revoke OAuth token: ${err.errorDescription}`))) : Effect.void), Effect.andThen(store.delete(profileName, "cf-oauth")), Effect.andThen(success("Cloudflare: OAuth credentials removed.")))), Match.exhaustive).pipe(Effect.andThen(store.delete(profileName, CREDENTIALS_FILE).pipe(Effect.ignore)));
+		const login = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.read(profileName, "cf-stored").pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.when({ method: "oauth" }, (c$1) => Effect.gen(function* () {
+			const creds = yield* store.read(profileName, "cf-oauth");
+			if (creds?.type === "oauth") {
+				yield* info("Cloudflare: refreshing OAuth credentials...");
+				yield* refresh$1(creds).pipe(Effect.flatMap((refreshed) => store.write(profileName, "cf-oauth", refreshed).pipe(Effect.andThen(success("Cloudflare: OAuth credentials refreshed.")))), Effect.catchTag("OAuthError", () => oauthLogin(profileName, c$1.scopes).pipe(Effect.asVoid)));
+				return;
+			}
+			yield* oauthLogin(profileName, c$1.scopes);
+		})), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
+			message: "login failed",
 			cause: e
 		})));
-		return {
-			type: "oauth",
-			accessToken: Redacted.make(fresh.access),
-			expires: fresh.expires,
-			accountId,
-			source: { type: "oauth" }
-		};
-	})), Match.exhaustive);
-	const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.delete(profileName, "cf-stored").pipe(Effect.andThen(success("Cloudflare: stored credentials removed")))), Match.when({ method: "oauth" }, () => store.read(profileName, "cf-oauth").pipe(Effect.tap((creds) => creds?.type === "oauth" ? revoke(creds).pipe(Effect.catchTag("OAuthError", (err) => warn(`Cloudflare: could not revoke OAuth token: ${err.errorDescription}`))) : Effect.void), Effect.andThen(store.delete(profileName, "cf-oauth")), Effect.andThen(success("Cloudflare: OAuth credentials removed.")))), Match.exhaustive).pipe(Effect.andThen(store.delete(profileName, CREDENTIALS_FILE).pipe(Effect.ignore)));
-	const login = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.read(profileName, "cf-stored").pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.when({ method: "oauth" }, (c$1) => Effect.gen(function* () {
-		const creds = yield* store.read(profileName, "cf-oauth");
-		if (creds?.type === "oauth") {
-			yield* info("Cloudflare: refreshing OAuth credentials...");
-			yield* refresh$1(creds).pipe(Effect.flatMap((refreshed) => store.write(profileName, "cf-oauth", refreshed).pipe(Effect.andThen(success("Cloudflare: OAuth credentials refreshed.")))), Effect.catchTag("OAuthError", () => oauthLogin(profileName, c$1.scopes).pipe(Effect.asVoid)));
-			return;
-		}
-		yield* oauthLogin(profileName, c$1.scopes);
-	})), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
-		message: "login failed",
-		cause: e
-	})));
-	const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
-		const sourceStr = creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type;
-		return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c$1) => Effect.all([
-			Console.log(`  apiToken: ${displayRedacted(c$1.apiToken, 9)}`),
-			Console.log(`  accountId: ${c$1.accountId}`),
-			Console.log(`  source: ${sourceStr}`)
-		])), Match.when({ type: "apiKey" }, (c$1) => Effect.all([
-			Console.log(`  apiKey: ${displayRedacted(c$1.apiKey)}`),
-			Console.log(`  email:  ${displayRedacted(c$1.email)}`),
-			Console.log(`  accountId: ${c$1.accountId}`),
-			Console.log(`  source: ${sourceStr}`)
-		])), Match.when({ type: "oauth" }, (c$1) => {
-			const remainingMs = c$1.expires - Date.now();
-			const expiresAt = new Date(c$1.expires).toISOString();
-			const expiresStr = remainingMs <= 0 ? `expired (${expiresAt})` : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
-			return Effect.all([
-				Console.log(`  accessToken: ${displayRedacted(c$1.accessToken)}`),
-				Console.log(`  expires: ${expiresStr}`),
+		const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
+			const sourceStr = creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type;
+			return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c$1) => Effect.all([
+				Console.log(`  apiToken: ${displayRedacted(c$1.apiToken, 9)}`),
 				Console.log(`  accountId: ${c$1.accountId}`),
 				Console.log(`  source: ${sourceStr}`)
-			]);
-		}), Match.exhaustive);
+			])), Match.when({ type: "apiKey" }, (c$1) => Effect.all([
+				Console.log(`  apiKey: ${displayRedacted(c$1.apiKey)}`),
+				Console.log(`  email:  ${displayRedacted(c$1.email)}`),
+				Console.log(`  accountId: ${c$1.accountId}`),
+				Console.log(`  source: ${sourceStr}`)
+			])), Match.when({ type: "oauth" }, (c$1) => {
+				const remainingMs = c$1.expires - Date.now();
+				const expiresAt = new Date(c$1.expires).toISOString();
+				const expiresStr = remainingMs <= 0 ? `expired (${expiresAt})` : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
+				return Effect.all([
+					Console.log(`  accessToken: ${displayRedacted(c$1.accessToken)}`),
+					Console.log(`  expires: ${expiresStr}`),
+					Console.log(`  accountId: ${c$1.accountId}`),
+					Console.log(`  source: ${sourceStr}`)
+				]);
+			}), Match.exhaustive);
+		}));
+		return {
+			configure: configureCredentials,
+			logout,
+			login,
+			prettyPrint,
+			read: resolveCredentials
+		};
 	}));
-	return {
-		configure: configureCredentials,
-		logout,
-		login,
-		prettyPrint,
-		read: resolveCredentials
+	ALL_SCOPES = {
+		"access:read": "See Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
+		"access:write": "See and change Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
+		"account:read": "See your account info such as account details, analytics, and memberships",
+		"agw:read": "Grants read level access to Agents Gateway",
+		"agw:run": "Grants run level access to Agents Gateway",
+		"agw:write": "Grants read and write level access to Agents Gateway",
+		"ai:read": "Grants read level access to Workers AI",
+		"ai:write": "Grants write level access to Workers AI",
+		"aiaudit:read": "Grants read level access to AI Audit",
+		"aiaudit:write": "Grants write level access to AI Audit",
+		"aig:read": "Grants read level access to AI Gateway",
+		"aig:write": "Grants write level access to AI Gateway",
+		"auditlogs:read": "View Cloudflare Account Audit Logs",
+		"browser:read": "Grants read level access to Browser Rendering",
+		"browser:write": "Grants write level access to Browser Rendering",
+		"cfone:read": "Grants read level access to Cloudforce One data",
+		"cfone:write": "Grants write level access to Cloudforce One data",
+		"cloudchamber:write": "See and make changes to Cloudchamber",
+		"connectivity:admin": "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel",
+		"connectivity:bind": "read, list, and bind to Connectivity Directory services, as well as read and list Cloudflare Tunnels",
+		"connectivity:read": "See Connectivity Directory services and Cloudflare Tunnels",
+		"constellation:write": "Grants write access to Constellation configuration and models",
+		"containers:write": "See and make changes to Workers Containers",
+		"d1:write": "See and make changes to D1",
+		"dex:read": "Grants read level access to Cloudflare DEX",
+		"dex:write": "Grants write level access to Cloudflare DEX",
+		"dns_analytics:read": "Grants read level access to Cloudflare DNS Analytics",
+		"dns_records:edit": "Grants edit level access to dns records",
+		"dns_records:read": "Grants read level access to dns records",
+		"dns_settings:read": "Grants read level access to Cloudflare DNS Settings",
+		"firstpartytags:write": "Can see, edit and publish Google tag gateway configuration.",
+		"lb:edit": "Grants edit level access to lb and lb pools",
+		"lb:read": "Grants read level access to lb and lb pools",
+		"logpush:read": "See Cloudflare Logpush data",
+		"logpush:write": "See and change Cloudflare Logpush data",
+		"notification:read": "View Cloudflare Notifications",
+		"notification:write": "View and Modify Cloudflare Notifications",
+		"pages:read": "See Cloudflare Pages projects, settings and deployments",
+		"pages:write": "See and change Cloudflare Pages projects, settings and deployments",
+		"pipelines:read": "Grants read level access to Cloudflare Pipelines",
+		"pipelines:setup": "Grants permission to generate R2 tokens for Workers Pipelines",
+		"pipelines:write": "Grants write level access to Cloudflare Pipelines",
+		"query_cache:write": "See and make changes to Hyperdrive",
+		"queues:write": "See and change Cloudflare Queues settings and data",
+		"r2_catalog:write": "Grants write level access to R2 Data Catalog",
+		"radar:read": "Grants access to read Cloudflare Radar data",
+		"ai-search:read": "Grants read level access to AI Search",
+		"ai-search:write": "Grants write level access to AI Search",
+		"ai-search:run": "Grants run level access to AI Search",
+		"secrets_store:read": "Grants read level access to Secrets Store",
+		"secrets_store:write": "Grants write level access to Secrets Store",
+		"ssl_certs:write": "Grants read and write access to SSL MTLS certificates or Certificate Store",
+		"sso-connector:read": "See Cloudflare SSO connectors",
+		"sso-connector:write": "See Cloudflare SSO connectors to toggle activation and deactivation of SSO",
+		"teams:pii": "See personally identifiable Cloudflare Teams data",
+		"teams:read": "See Cloudflare Teams data such as zones, gateway, and argo tunnel details",
+		"teams:secure_location": "See all DNS Location data but can only change secure DNS Locations",
+		"teams:write": "See and change Cloudflare Teams data such as zones, gateway, and argo tunnel details",
+		"url_scanner:read": "Grants read level access to URL Scanner",
+		"url_scanner:write": "Grants write level access to URL Scanner",
+		"user:read": "See your user info such as name, email address, and account memberships",
+		"vectorize:write": "See and make changes to Vectorize",
+		"workers:read": "See Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
+		"workers:write": "See and change Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
+		"workers_builds:read": "See Cloudflare Workers Builds data such as builds, build configuration, and build logs",
+		"workers_builds:write": "See and change Cloudflare Workers Builds data such as builds, build configuration, and build logs",
+		"workers_kv:write": "See and change Cloudflare Workers KV Storage data such as keys and namespaces",
+		"workers_observability:read": "Grants read access to Cloudflare Workers Observability",
+		"workers_observability:write": "Grants read and write access to Cloudflare Workers Observability",
+		"workers_observability_telemetry:write": "Grants write access to Cloudflare Workers Observability Telemetry API",
+		"workers_routes:write": "See and change Cloudflare Workers data such as filters and routes",
+		"workers_scripts:write": "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data",
+		"workers_tail:read": "See Cloudflare Workers tail and script data",
+		"zone:read": "Grants read level access to account zone"
 	};
-}));
-const ALL_SCOPES = {
-	"access:read": "See Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
-	"access:write": "See and change Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
-	"account:read": "See your account info such as account details, analytics, and memberships",
-	"agw:read": "Grants read level access to Agents Gateway",
-	"agw:run": "Grants run level access to Agents Gateway",
-	"agw:write": "Grants read and write level access to Agents Gateway",
-	"ai:read": "Grants read level access to Workers AI",
-	"ai:write": "Grants write level access to Workers AI",
-	"aiaudit:read": "Grants read level access to AI Audit",
-	"aiaudit:write": "Grants write level access to AI Audit",
-	"aig:read": "Grants read level access to AI Gateway",
-	"aig:write": "Grants write level access to AI Gateway",
-	"auditlogs:read": "View Cloudflare Account Audit Logs",
-	"browser:read": "Grants read level access to Browser Rendering",
-	"browser:write": "Grants write level access to Browser Rendering",
-	"cfone:read": "Grants read level access to Cloudforce One data",
-	"cfone:write": "Grants write level access to Cloudforce One data",
-	"cloudchamber:write": "See and make changes to Cloudchamber",
-	"connectivity:admin": "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel",
-	"connectivity:bind": "read, list, and bind to Connectivity Directory services, as well as read and list Cloudflare Tunnels",
-	"connectivity:read": "See Connectivity Directory services and Cloudflare Tunnels",
-	"constellation:write": "Grants write access to Constellation configuration and models",
-	"containers:write": "See and make changes to Workers Containers",
-	"d1:write": "See and make changes to D1",
-	"dex:read": "Grants read level access to Cloudflare DEX",
-	"dex:write": "Grants write level access to Cloudflare DEX",
-	"dns_analytics:read": "Grants read level access to Cloudflare DNS Analytics",
-	"dns_records:edit": "Grants edit level access to dns records",
-	"dns_records:read": "Grants read level access to dns records",
-	"dns_settings:read": "Grants read level access to Cloudflare DNS Settings",
-	"firstpartytags:write": "Can see, edit and publish Google tag gateway configuration.",
-	"lb:edit": "Grants edit level access to lb and lb pools",
-	"lb:read": "Grants read level access to lb and lb pools",
-	"logpush:read": "See Cloudflare Logpush data",
-	"logpush:write": "See and change Cloudflare Logpush data",
-	"notification:read": "View Cloudflare Notifications",
-	"notification:write": "View and Modify Cloudflare Notifications",
-	"pages:read": "See Cloudflare Pages projects, settings and deployments",
-	"pages:write": "See and change Cloudflare Pages projects, settings and deployments",
-	"pipelines:read": "Grants read level access to Cloudflare Pipelines",
-	"pipelines:setup": "Grants permission to generate R2 tokens for Workers Pipelines",
-	"pipelines:write": "Grants write level access to Cloudflare Pipelines",
-	"query_cache:write": "See and make changes to Hyperdrive",
-	"queues:write": "See and change Cloudflare Queues settings and data",
-	"r2_catalog:write": "Grants write level access to R2 Data Catalog",
-	"radar:read": "Grants access to read Cloudflare Radar data",
-	"ai-search:read": "Grants read level access to AI Search",
-	"ai-search:write": "Grants write level access to AI Search",
-	"ai-search:run": "Grants run level access to AI Search",
-	"secrets_store:read": "Grants read level access to Secrets Store",
-	"secrets_store:write": "Grants write level access to Secrets Store",
-	"ssl_certs:write": "Grants read and write access to SSL MTLS certificates or Certificate Store",
-	"sso-connector:read": "See Cloudflare SSO connectors",
-	"sso-connector:write": "See Cloudflare SSO connectors to toggle activation and deactivation of SSO",
-	"teams:pii": "See personally identifiable Cloudflare Teams data",
-	"teams:read": "See Cloudflare Teams data such as zones, gateway, and argo tunnel details",
-	"teams:secure_location": "See all DNS Location data but can only change secure DNS Locations",
-	"teams:write": "See and change Cloudflare Teams data such as zones, gateway, and argo tunnel details",
-	"url_scanner:read": "Grants read level access to URL Scanner",
-	"url_scanner:write": "Grants write level access to URL Scanner",
-	"user:read": "See your user info such as name, email address, and account memberships",
-	"vectorize:write": "See and make changes to Vectorize",
-	"workers:read": "See Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
-	"workers:write": "See and change Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
-	"workers_builds:read": "See Cloudflare Workers Builds data such as builds, build configuration, and build logs",
-	"workers_builds:write": "See and change Cloudflare Workers Builds data such as builds, build configuration, and build logs",
-	"workers_kv:write": "See and change Cloudflare Workers KV Storage data such as keys and namespaces",
-	"workers_observability:read": "Grants read access to Cloudflare Workers Observability",
-	"workers_observability:write": "Grants read and write access to Cloudflare Workers Observability",
-	"workers_observability_telemetry:write": "Grants write access to Cloudflare Workers Observability Telemetry API",
-	"workers_routes:write": "See and change Cloudflare Workers data such as filters and routes",
-	"workers_scripts:write": "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data",
-	"workers_tail:read": "See Cloudflare Workers tail and script data",
-	"zone:read": "Grants read level access to account zone"
-};
-const DEFAULT_SCOPES = [
-	"account:read",
-	"ai-search:write",
-	"ai-search:run",
-	"ai:write",
-	"aig:read",
-	"aig:write",
-	"cloudchamber:write",
-	"connectivity:admin",
-	"containers:write",
-	"d1:write",
-	"pages:write",
-	"pipelines:write",
-	"queues:write",
-	"secrets_store:write",
-	"ssl_certs:write",
-	"user:read",
-	"vectorize:write",
-	"workers_kv:write",
-	"workers_observability:read",
-	"workers_observability:write",
-	"workers_observability_telemetry:write",
-	"workers_routes:write",
-	"workers_scripts:write",
-	"workers_tail:read",
-	"workers:write",
-	"zone:read"
-];
-const OAUTH_CLIENT_ID$1 = "6d8c2255-0773-45f6-b376-2914632e6f91";
-const OAUTH_REDIRECT_URI$1 = "https://alchemy.run/auth/callback";
-const OAUTH_LOCAL_CALLBACK_URI$1 = "http://localhost:9976/auth/callback";
-const OAUTH_ENDPOINTS$1 = {
-	authorize: "https://dash.cloudflare.com/oauth2/authorize",
-	token: "https://dash.cloudflare.com/oauth2/token",
-	revoke: "https://dash.cloudflare.com/oauth2/revoke"
-};
+	DEFAULT_SCOPES = [
+		"account:read",
+		"ai-search:write",
+		"ai-search:run",
+		"ai:write",
+		"aig:read",
+		"aig:write",
+		"cloudchamber:write",
+		"connectivity:admin",
+		"containers:write",
+		"d1:write",
+		"pages:write",
+		"pipelines:write",
+		"queues:write",
+		"secrets_store:write",
+		"ssl_certs:write",
+		"user:read",
+		"vectorize:write",
+		"workers_kv:write",
+		"workers_observability:read",
+		"workers_observability:write",
+		"workers_observability_telemetry:write",
+		"workers_routes:write",
+		"workers_scripts:write",
+		"workers_tail:read",
+		"workers:write",
+		"zone:read"
+	];
+	OAUTH_CLIENT_ID$1 = "6d8c2255-0773-45f6-b376-2914632e6f91";
+	OAUTH_REDIRECT_URI$1 = "https://alchemy.run/auth/callback";
+	OAUTH_LOCAL_CALLBACK_URI$1 = "http://localhost:9976/auth/callback";
+	OAUTH_ENDPOINTS$1 = {
+		authorize: "https://dash.cloudflare.com/oauth2/authorize",
+		token: "https://dash.cloudflare.com/oauth2/token",
+		revoke: "https://dash.cloudflare.com/oauth2/revoke"
+	};
+}) });
 
 //#endregion
 //#region lib/GitHub/BaseUrl.js
-init_AuthProvider();
+init_AuthProvider$1();
+init_Env();
 /**
 * Normalize a user-supplied GitHub host or URL into the REST API base URL
 * Octokit expects, following the same conventions as the `gh` CLI and the
@@ -4128,9 +4378,11 @@ const resolveGitHubBaseUrlFromEnv = Effect.gen(function* () {
 
 //#endregion
 //#region lib/GitHub/AuthProvider.js
-init_AuthProvider();
+init_AuthProvider$1();
 init_Credentials();
-const options$2 = [
+init_Env();
+init_Clank();
+const options$3 = [
 	{
 		value: "gh-cli",
 		label: "GitHub CLI",
@@ -4231,7 +4483,7 @@ const makeGitHubAuth = (authOptions) => AuthProviderLayer()(GITHUB_AUTH_PROVIDER
 	const configureInteractive = (profileName) => Effect.gen(function* () {
 		const method = yield* select({
 			message: "GitHub authentication method",
-			options: options$2
+			options: options$3
 		});
 		const baseUrl = fixed !== void 0 ? void 0 : yield* promptBaseUrl;
 		const verifyHost = fixed !== void 0 ? fixed.baseUrl : baseUrl;
@@ -4303,11 +4555,13 @@ const GitHubAuth = makeGitHubAuth();
 
 //#endregion
 //#region lib/Neon/AuthProvider.js
-init_AuthProvider();
+init_AuthProvider$1();
 init_Credentials();
+init_Env();
 init_Profile();
+init_Clank();
 const NEON_AUTH_PROVIDER_NAME = "Neon";
-const options$1 = [{
+const options$2 = [{
 	value: "env",
 	label: "Environment Variable",
 	hint: "NEON_API_KEY"
@@ -4337,7 +4591,7 @@ const NeonAuth = AuthProviderLayer()(NEON_AUTH_PROVIDER_NAME, Effect.gen(functio
 	});
 	const configureInteractive = (profileName) => select({
 		message: "Neon authentication method",
-		options: options$1
+		options: options$2
 	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
 	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
 		if (ctx.ci) return { method: "env" };
@@ -4386,7 +4640,7 @@ const NeonAuth = AuthProviderLayer()(NEON_AUTH_PROVIDER_NAME, Effect.gen(functio
 
 //#endregion
 //#region lib/Planetscale/OAuthClient.js
-init_AuthProvider();
+init_AuthProvider$1();
 var OAuthError = class extends Data.TaggedError("OAuthError") {};
 /**
 * Registered PlanetScale OAuth application credentials.
@@ -4638,8 +4892,10 @@ function callbackPromise(authorization, signal) {
 
 //#endregion
 //#region lib/Planetscale/AuthProvider.js
-init_AuthProvider();
+init_AuthProvider$1();
 init_Credentials();
+init_Env();
+init_Clank();
 /**
 * Canonical name registered in {@link AuthProviders}. Use this key to look
 * up the PlanetScale {@link AuthProvider} from inside provider Layers.
@@ -4680,7 +4936,7 @@ const selectOrganization = (accessToken) => Effect.gen(function* () {
 		}))
 	}).pipe(retryOnce);
 }).pipe((e) => withOAuthCredentials(accessToken, e));
-const options = [
+const options$1 = [
 	{
 		value: "env",
 		label: "Environment Variables",
@@ -4762,7 +5018,7 @@ const PlanetscaleAuth = AuthProviderLayer()(PLANETSCALE_AUTH_PROVIDER_NAME, Effe
 	});
 	const configureInteractive = (profileName) => select({
 		message: "Planetscale authentication method",
-		options
+		options: options$1
 	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("oauth", () => configureOAuth(profileName)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
 	const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
 		if (ctx.ci) return { method: "env" };
@@ -4847,10 +5103,115 @@ const PlanetscaleAuth = AuthProviderLayer()(PLANETSCALE_AUTH_PROVIDER_NAME, Effe
 	};
 }));
 
+//#endregion
+//#region lib/Prisma/AuthProvider.js
+init_AuthProvider$1();
+init_Credentials();
+init_Env();
+init_Profile();
+init_Clank();
+const PRISMA_AUTH_PROVIDER_NAME = "Prisma";
+const PRISMA_SERVICE_TOKEN_ENV = "PRISMA_SERVICE_TOKEN";
+const PRISMA_API_TOKEN_ENV = "PRISMA_API_TOKEN";
+const options = [{
+	value: "env",
+	label: "Environment Variable",
+	hint: `${PRISMA_SERVICE_TOKEN_ENV} or ${PRISMA_API_TOKEN_ENV}`
+}, {
+	value: "stored",
+	label: "Service Token",
+	hint: "enter interactively, stored in ~/.alchemy/credentials"
+}];
+const nonEmptyToken = (token) => token !== void 0 && Redacted.value(token).trim().length > 0;
+const validStoredCredentials = (credentials) => credentials?.type === "serviceToken" && credentials.serviceToken.trim().length > 0;
+const trimToken = (token) => Redacted.make(Redacted.value(token).trim());
+const readEnvServiceToken = Effect.fnUntraced(function* () {
+	const serviceToken = yield* getEnvRedacted(PRISMA_SERVICE_TOKEN_ENV);
+	if (nonEmptyToken(serviceToken)) return {
+		serviceToken: trimToken(serviceToken),
+		envName: PRISMA_SERVICE_TOKEN_ENV
+	};
+	const apiToken = yield* getEnvRedacted(PRISMA_API_TOKEN_ENV);
+	if (nonEmptyToken(apiToken)) return {
+		serviceToken: trimToken(apiToken),
+		envName: PRISMA_API_TOKEN_ENV
+	};
+});
+/**
+* Layer that registers the Prisma Management API auth provider.
+*/
+const PrismaAuth = AuthProviderLayer()(PRISMA_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+	const profiles = yield* AlchemyProfile;
+	const store = yield* CredentialsStore;
+	const loginStored = Effect.fnUntraced(function* (profileName) {
+		const serviceToken = yield* password({
+			message: "Prisma Service Token",
+			validate: (v) => v.trim().length === 0 ? "Required" : void 0
+		}).pipe(retryOnce);
+		yield* store.write(profileName, "prisma-stored", {
+			type: "serviceToken",
+			serviceToken: serviceToken.trim()
+		});
+		yield* success("Prisma: credentials saved.");
+		return { method: "stored" };
+	});
+	const configureInteractive = (profileName) => select({
+		message: "Prisma authentication method",
+		options
+	}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+	const configure = (profileName, ctx) => Effect.gen(function* () {
+		if (ctx.ci) return { method: "env" };
+		return yield* configureInteractive(profileName);
+	}).pipe(Effect.mapError((e) => new AuthError({
+		message: "failed to configure credentials",
+		cause: e
+	})));
+	const read = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fnUntraced(function* () {
+		const envToken = yield* readEnvServiceToken();
+		if (!envToken) return yield* new AuthError({ message: `Prisma env credentials not found. Set ${PRISMA_SERVICE_TOKEN_ENV} or ${PRISMA_API_TOKEN_ENV}.` });
+		return {
+			type: "serviceToken",
+			serviceToken: envToken.serviceToken,
+			source: {
+				type: "env",
+				details: envToken.envName
+			}
+		};
+	})), Match.when({ method: "stored" }, () => store.read(profileName, "prisma-stored").pipe(Effect.flatMap((creds) => !validStoredCredentials(creds) ? Effect.fail(new AuthError({ message: creds == null ? "Prisma stored credentials not found. Run: alchemy login --configure" : "Prisma stored credentials are invalid. Run: alchemy login --configure" })) : Effect.succeed({
+		type: "serviceToken",
+		serviceToken: Redacted.make(creds.serviceToken.trim()),
+		source: { type: "stored" }
+	})))), Match.exhaustive);
+	const login = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => readEnvServiceToken().pipe(Effect.flatMap((envToken) => envToken ? Effect.void : Effect.gen(function* () {
+		const next = yield* configureInteractive(profileName);
+		const existing = yield* profiles.getProfile(profileName);
+		yield* profiles.setProfile(profileName, {
+			...existing,
+			[PRISMA_AUTH_PROVIDER_NAME]: next
+		});
+	})))), Match.when({ method: "stored" }, () => store.read(profileName, "prisma-stored").pipe(Effect.flatMap((creds) => validStoredCredentials(creds) ? Effect.void : loginStored(profileName)))), Match.exhaustive).pipe(Effect.mapError((e) => new AuthError({
+		message: "login failed",
+		cause: e
+	})));
+	const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store.delete(profileName, "prisma-stored").pipe(Effect.andThen(success("Prisma: stored credentials removed")))), Match.exhaustive);
+	const prettyPrint = (profileName, config) => read(profileName, config).pipe(Effect.tap((creds) => {
+		const source = creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type;
+		return Effect.all([Console.log(`  serviceToken: ${displayRedacted(creds.serviceToken, 9)}`), Console.log(`  source: ${source}`)]);
+	}), Effect.catch((e) => Console.error(`  Failed to retrieve credentials: ${e}`)));
+	return {
+		configure,
+		login,
+		logout,
+		prettyPrint,
+		read
+	};
+}));
+
 //#endregion
 //#region lib/Cli/commands/_shared.js
-init_AuthProvider();
+init_AuthProvider$1();
 init_Profile();
+init_AuthProvider();
 init_Stack();
 init_Stage();
 init_ConfigProvider();
@@ -4962,13 +5323,13 @@ const placeholderStack = (name) => ({
 * entrypoint is fatal (login / nuke let it propagate) or best-effort
 * (profile show wraps the call in `Effect.catchCause`).
 */
-const buildStackProviders = Effect.fn("buildStackProviders")(function* (options$6) {
-	const authProviders = options$6.registry ?? {};
-	const stackEffect = yield* importStack(options$6.main);
-	const configProvider = withProfileOverride(yield* loadConfigProvider(options$6.envFile), options$6.profile);
+const buildStackProviders = Effect.fn("buildStackProviders")(function* (options$7) {
+	const authProviders = options$7.registry ?? {};
+	const stackEffect = yield* importStack(options$7.main);
+	const configProvider = withProfileOverride(yield* loadConfigProvider(options$7.envFile), options$7.profile);
 	return {
 		authProviders,
-		context: yield* Layer.build((stackEffect.providers ?? Layer.empty).pipe(Layer.provideMerge(stackEffect.state ?? Layer.empty), Layer.provideMerge(Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(configProvider), options$6.logger ?? Logger.layer([fileLogger("out")], { mergeWithExisting: true }), Layer.succeed(Stage, "placeholder"), Layer.succeed(Stack, placeholderStack(stackEffect.stackName)), options$6.extra ?? Layer.empty)))),
+		context: yield* Layer.build((stackEffect.providers ?? Layer.empty).pipe(Layer.provideMerge(stackEffect.state ?? Layer.empty), Layer.provideMerge(Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(configProvider), options$7.logger ?? Logger.layer([fileLogger("out")], { mergeWithExisting: true }), Layer.succeed(Stage, "placeholder"), Layer.succeed(Stack, placeholderStack(stackEffect.stackName)), options$7.extra ?? Layer.empty)))),
 		stackEffect
 	};
 });
@@ -4978,14 +5339,14 @@ const buildStackProviders = Effect.fn("buildStackProviders")(function* (options$
 * `alchemy profile show` can pretty-print any provider a profile mentions,
 * even one the current stack doesn't wire up.
 */
-const builtinAuth = Layer.mergeAll(AwsAuth, AxiomAuth, CloudflareAuth, GitHubAuth, NeonAuth, PlanetscaleAuth);
+const builtinAuth = Layer.mergeAll(AwsAuth, AxiomAuth, CloudflareAuth, GitHubAuth, NeonAuth, PlanetscaleAuth, PrismaAuth);
 /**
 * Build {@link builtinAuth} against `registry` so every built-in auth
 * provider registers itself, without importing any stack entrypoint.
 */
-const buildBuiltinAuthProviders = Effect.fn("buildBuiltinAuthProviders")(function* (options$6) {
-	const authProviders = options$6.registry ?? {};
-	yield* Layer.build(Layer.provide(builtinAuth, Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(options$6.envFile), options$6.profile)), Logger.layer([fileLogger("out")], { mergeWithExisting: true }))));
+const buildBuiltinAuthProviders = Effect.fn("buildBuiltinAuthProviders")(function* (options$7) {
+	const authProviders = options$7.registry ?? {};
+	yield* Layer.build(Layer.provide(builtinAuth, Layer.mergeAll(Layer.succeed(AuthProviders, authProviders), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(options$7.envFile), options$7.profile)), Logger.layer([fileLogger("out")], { mergeWithExisting: true }))));
 	return authProviders;
 });
 
@@ -4994,7 +5355,7 @@ const buildBuiltinAuthProviders = Effect.fn("buildBuiltinAuthProviders")(functio
 init_AdoptPolicy();
 init_AlchemyContext();
 init_Artifacts();
-init_AuthProvider();
+init_AuthProvider$1();
 init_Profile();
 init_Cli();
 init_Stage();
@@ -5025,7 +5386,7 @@ const stackSpanAttrs = (args) => ({
 const adopt = Flag.boolean("adopt").pipe(Flag.withDescription("Adopt pre-existing cloud resources that conflict with this stack instead of failing. Useful for re-importing infrastructure into a fresh state store."), Flag.withDefault(false));
 const execStack = Effect.fn(function* ({ main, stage: stage$1, envFile: envFile$1, profile: profile$1, dryRun: dryRun$1 = false, force: force$1 = false, yes: yes$1 = false, destroy: destroy$1 = false, dev = false, adopt: adopt$1 = false }) {
 	const stackEffect = yield* importStack(main);
-	const services$1 = Layer.mergeAll(Layer.effect(AlchemyContext, AlchemyContext.pipe(Effect.map((ctx) => ({
+	const services = Layer.mergeAll(Layer.effect(AlchemyContext, AlchemyContext.pipe(Effect.map((ctx) => ({
 		...ctx,
 		dev,
 		adopt: adopt$1,
@@ -5047,7 +5408,7 @@ const execStack = Effect.fn(function* ({ main, stage: stage$1, envFile: envFile$
 				if (dev) return yield* Effect.never;
 			}
 		}).pipe(Effect.provide(stack.services));
-	}).pipe(Effect.provide(services$1));
+	}).pipe(Effect.provide(services));
 });
 const deployCommand = Command.make("deploy", {
 	dryRun,
@@ -5080,9 +5441,24 @@ const planCommand = Command.make("plan", {
 	dryRun: true
 })));
 
+//#endregion
+//#region lib/Cli/ModeTag.js
+var modeLabel, formatModeNote;
+var init_ModeTag = __esm({ "lib/Cli/ModeTag.js": (() => {
+	modeLabel = (mode) => mode === "live" ? "remote" : "local";
+	formatModeNote = (options$7) => {
+		const { mode, priorMode } = options$7;
+		if (mode === void 0) return void 0;
+		if (priorMode !== void 0 && priorMode !== mode) return `${priorMode} → ${mode}`;
+		if ((options$7.defaultMode ?? "live") === "live" && mode === "live") return void 0;
+		return modeLabel(mode);
+	};
+}) });
+
 //#endregion
 //#region lib/Cli/LoggingCli.js
 init_Cli();
+init_ModeTag();
 const ESC = "\x1B[";
 const RESET = `${ESC}0m`;
 const useColor = process.stdout.hasColors?.() ?? !!process.stdout.isTTY;
@@ -5117,6 +5493,16 @@ const statusColor$1 = (status) => {
 };
 const tag = (id) => bold(`[${id}]`);
 const isTerminal = (status) => status === "created" || status === "updated" || status === "deleted" || status === "retained" || status === "replaced" || status === "fail";
+/**
+* Dim `(local)` / `(remote)` / `(local → live)` suffix for a resource row,
+* or `""` when the row's mode matches the run default (the quiet common
+* case). See {@link formatModeNote} for the rule.
+*/
+const modeSuffix = (options$7) => {
+	const note = formatModeNote(options$7);
+	return note ? ` ${dim(`(${note})`)}` : "";
+};
+/** Exported for unit tests — pure plan-preview rendering. */
 const formatPlanLines = (plan) => {
 	const items = [...Object.values(plan.resources), ...Object.values(plan.deletions)];
 	if (items.length === 0) return [bold("Plan:") + " no changes"];
@@ -5132,7 +5518,12 @@ const formatPlanLines = (plan) => {
 	const lines = [`${bold("Plan:")} ${summary}`];
 	for (const item of sorted) {
 		const action = actionColor$1[item.action](item.action);
-		lines.push(`${tag(item.resource.LogicalId)} ${action}`);
+		const mode = modeSuffix({
+			mode: item.mode,
+			priorMode: item.action === "replace" ? item.state.providerMode : void 0,
+			defaultMode: plan.defaultMode
+		});
+		lines.push(`${tag(item.resource.LogicalId)} ${action}${mode}`);
 		for (const binding of item.bindings) {
 			if (binding.action === "noop") continue;
 			const bindingAction = actionColor$1[binding.action](binding.action);
@@ -5162,10 +5553,15 @@ const LoggingCli = Layer.succeed(Cli, Cli.of({
 				if (event.kind === "annotate") return Console.log(`${tag(event.id)} ${blue(event.message)}`);
 				const id = event.bindingId ? `${event.id}/${event.bindingId}` : event.id;
 				const status = statusColor$1(event.status)(event.status);
+				const mode = modeSuffix({
+					mode: event.providerMode,
+					priorMode: event.fromProviderMode,
+					defaultMode: plan.defaultMode
+				});
 				const msg = event.message ? ` ${dim("—")} ${event.message}` : "";
 				if (isTerminal(event.status)) if (event.status === "fail") counts.fail++;
 				else counts.ok++;
-				return Console.log(`${tag(id)} ${status}${msg}`);
+				return Console.log(`${tag(id)} ${status}${mode}${msg}`);
 			}),
 			done: () => Console.log(`\n${bold("Done:")} ${green(`${counts.ok} succeeded`)}${counts.fail ? dim(", ") + red(`${counts.fail} failed`) : ""}`)
 		};
@@ -5248,7 +5644,9 @@ var init_NamespaceTree = __esm({ "lib/Cli/NamespaceTree.js": (() => {
 				path: [...node.path, resource.resource.LogicalId],
 				action: resource.action,
 				resourceType: resource.resource.Type,
-				bindingCount: resource.bindings.length
+				bindingCount: resource.bindings.length,
+				providerMode: resource.mode,
+				fromProviderMode: resource.action === "replace" && resource.mode !== void 0 && resource.state.providerMode !== void 0 && resource.state.providerMode !== resource.mode ? resource.state.providerMode : void 0
 			});
 			for (const binding of [...resource.bindings].sort((a, b) => a.sid.localeCompare(b.sid))) result.push({
 				type: "binding",
@@ -5425,6 +5823,11 @@ function Plan({ plan }) {
 						})
 					]
 				}, key);
+				const modeNote = formatModeNote({
+					mode: item.providerMode,
+					priorMode: item.fromProviderMode,
+					defaultMode: plan.defaultMode
+				});
 				return jsxs(Box, {
 					flexDirection: "row",
 					children: [
@@ -5451,6 +5854,17 @@ function Plan({ plan }) {
 								]
 							})
 						}),
+						modeNote && jsx(Box, {
+							marginLeft: 1,
+							children: jsxs(Text, {
+								color: "blackBright",
+								children: [
+									"(",
+									modeNote,
+									")"
+								]
+							})
+						}),
 						item.bindingCount !== void 0 && item.bindingCount > 0 && jsx(Box, {
 							marginLeft: 1,
 							children: jsxs(Text, {
@@ -5471,6 +5885,7 @@ function Plan({ plan }) {
 var getActionColor, getActionIcon, actionColor;
 var init_Plan = __esm({ "lib/Cli/tui/components/Plan.js": (() => {
 	init_NamespaceTree();
+	init_ModeTag();
 	getActionColor = (action) => ({
 		noop: "gray",
 		create: "green",
@@ -5668,6 +6083,11 @@ function PlanProgress(props) {
 			const displayStatus = getDisplayStatus(row, task.status);
 			const color = statusColor(displayStatus);
 			const icon = statusIcon(task.status, spinner);
+			const modeNote = formatModeNote({
+				mode: row.providerMode,
+				priorMode: row.fromProviderMode,
+				defaultMode: plan.defaultMode
+			});
 			return jsxs(Box, {
 				flexDirection: "column",
 				children: [jsxs(Box, {
@@ -5693,6 +6113,14 @@ function PlanProgress(props) {
 								")"
 							]
 						}),
+						modeNote ? jsxs(Text, {
+							dimColor: true,
+							children: [
+								" (",
+								modeNote,
+								")"
+							]
+						}) : null,
 						jsxs(Text, {
 							color,
 							children: [" ", displayStatus]
@@ -5762,6 +6190,7 @@ function useGlobalSpinner(intervalMs = 80) {
 var getTaskKey, buildProgressRows, buildLogicalIdIndex, buildInitialTasks, spinnerFrames, findCrudByLogicalId;
 var init_PlanProgress = __esm({ "lib/Cli/tui/components/PlanProgress.js": (() => {
 	init_NamespaceTree();
+	init_ModeTag();
 	getTaskKey = (item) => item.path.join("/");
 	buildProgressRows = (plan) => {
 		return flattenTree(buildNamespaceTree([...Object.values(plan.resources), ...Object.values(plan.deletions).filter((item) => item !== void 0)], [...Object.values(plan.actions ?? {}), ...Object.values(plan.actionDeletions ?? {})].filter((t) => t !== void 0))).filter((item) => item.type !== "binding").map((item) => {
@@ -5787,6 +6216,8 @@ var init_PlanProgress = __esm({ "lib/Cli/tui/components/PlanProgress.js": (() =>
 				depth: item.depth,
 				resourceType: item.resourceType ?? "unknown",
 				action: item.action,
+				providerMode: item.providerMode,
+				fromProviderMode: item.fromProviderMode,
 				persistedApplyStatus: item.action === "noop" ? (() => {
 					const crud = findCrudByLogicalId(plan, item.id);
 					return crud?.action === "noop" ? crud.state.status : void 0;
@@ -5857,6 +6288,7 @@ var init_InkCLI = __esm({ "lib/Cli/tui/InkCLI.js": (() => {
 		unmount();
 	});
 	startApplySession = Effect.fn(function* (plan) {
+		yield* displayPlan(plan);
 		const listeners = /* @__PURE__ */ new Set();
 		const { unmount } = render(jsx(PlanProgress, {
 			plan,
@@ -5887,9 +6319,13 @@ const selectCli = () => isNonInteractive() ? LoggingCli : Layer.unwrap(Effect.pr
 init_AlchemyContext();
 init_Credentials();
 init_Profile();
+init_RpcProviderProxy();
 init_PlatformServices();
-const services = Layer.merge(selectCli(), fromEnv()).pipe(Layer.provideMerge(Layer.mergeAll(AlchemyContextLive, ProfileLive, CredentialsStoreLive)), Layer.provideMerge(Layer.mergeAll(PlatformServices, FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()))));
-const exec = () => execStack(Schema.decodeSync(ExecStackOptions)(JSON.parse(process.env.ALCHEMY_EXEC_OPTIONS))).pipe(Effect.provide(services), Effect.scoped);
+const makeServices = (dev) => Layer.merge(dev ? LoggingCli : selectCli(), fromEnv()).pipe(Layer.provideMerge(Layer.mergeAll(AlchemyContextLive, ProfileLive, CredentialsStoreLive)), Layer.provideMerge(Layer.mergeAll(PlatformServices, FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()))));
+const exec = () => {
+	const options$7 = Schema.decodeSync(ExecStackOptions)(JSON.parse(process.env.ALCHEMY_EXEC_OPTIONS));
+	return forwardSidecarLogs.pipe(Effect.andThen(execStack(options$7)), Effect.provide(makeServices(options$7.dev)), Effect.scoped);
+};
 
 //#endregion
 //#region bin/exec.ts