alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/lib/Apply.d.ts

@@ -3,22 +3,24 @@ import type { ConfigError } from "effect/Config";
 import * as Effect from "effect/Effect";
 import type { PlatformError } from "effect/PlatformError";
 import type { Simplify } from "effect/Types";
-import type { AuthError } from "./Auth/AuthProvider.ts";
+import type { AuthError, NeedsReauth } from "./Auth/AuthProvider.ts";
 import { type CredentialsRequired } from "./Auth/Demand.ts";
-import { Cli } from "./Cli/Cli.ts";
+import { type PlanDisplayOptions, type PlanStatusSession } from "./Report.ts";
 import type { Input } from "./Input.ts";
 import * as Output from "./Output.ts";
 import { type Delete, type Plan } from "./Plan.ts";
 import { Stack } from "./Stack.ts";
 import { Stage } from "./Stage.ts";
 import { State, StateStoreError } from "./State/index.ts";
-export type ApplyEffect<P extends Plan, Err = never, Req = never> = Effect.Effect<{
-    [k in keyof AppliedPlan<P>]: AppliedPlan<P>[k];
-}, Err, Req>;
 export type AppliedPlan<P extends Plan> = {
     [id in keyof P["resources"]]: P["resources"][id] extends Delete | undefined | never ? never : Simplify<P["resources"][id]["resource"]["attr"]>;
 };
-export declare const apply: <P extends Plan>(plan: P) => Effect.Effect<Input.Resolve<P["output"]>, Output.InvalidReferenceError | Output.MissingSourceError | StateStoreError | DestroyError | CredentialsRequired | AuthError | PlatformError | ConfigError, Cli | State | Stack | Stage>;
+export interface ApplyOptions {
+    planDisplay?: PlanDisplayOptions;
+    /** Structured event sink for non-CLI callers. */
+    session?: PlanStatusSession;
+}
+export declare const apply: <P extends Plan>(plan: P, options?: ApplyOptions) => Effect.Effect<Input.Resolve<P["output"]>, Output.InvalidReferenceError | Output.MissingSourceError | StateStoreError | DestroyError | CredentialsRequired | AuthError | NeedsReauth | PlatformError | ConfigError, State | Stack | Stage>;
 /** A provider delete (or its attr-recovery read / state commit) that failed. */
 export interface DeleteFailure {
     fqn: string;

package/lib/Apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Apply.d.ts","sourceRoot":"","sources":["../src/Apply.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAK7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAGL,GAAG,EACJ,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,IAAI,EACV,MAAM,WAAW,CAAC;AAQnB,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAcL,KAAK,EACL,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,MAAM,WAAW,CACrB,CAAC,SAAS,IAAI,EACd,GAAG,GAAG,KAAK,EACX,GAAG,GAAG,KAAK,IACT,MAAM,CAAC,MAAM,CACf;KACG,CAAC,IAAI,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/C,EACD,GAAG,EACH,GAAG,CACJ,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,IAAI,IAAI;KACvC,EAAE,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,SAC5C,MAAM,GACN,SAAS,GACT,KAAK,GACL,KAAK,GACL,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;CACrD,CAAC;AA2DF,eAAO,MAAM,KAAK,GAAI,CAAC,SAAS,IAAI,QAC5B,CAAC,KACN,MAAM,CAAC,MAAM,CACd,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EACxB,MAAM,CAAC,qBAAqB,GAC5B,MAAM,CAAC,kBAAkB,GACzB,eAAe,GACf,YAAY,GACZ,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,WAAW,EACb,GAAG,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAuK1B,CAAC;AAk4CJ,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;;;;AAED;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACvC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAe7B;CACF"}
+{"version":3,"file":"Apply.d.ts","sourceRoot":"","sources":["../src/Apply.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAK7C,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EAIvB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,IAAI,EACV,MAAM,WAAW,CAAC;AAQnB,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAcL,KAAK,EACL,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,IAAI,IAAI;KACvC,EAAE,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,SAC5C,MAAM,GACN,SAAS,GACT,KAAK,GACL,KAAK,GACL,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,iDAAiD;IACjD,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AA2DD,eAAO,MAAM,KAAK,GAAI,CAAC,SAAS,IAAI,QAC5B,CAAC,YACE,YAAY,KACpB,MAAM,CAAC,MAAM,CACd,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EACxB,MAAM,CAAC,qBAAqB,GAC5B,MAAM,CAAC,kBAAkB,GACzB,eAAe,GACf,YAAY,GACZ,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,aAAa,GACb,WAAW,EACb,KAAK,GAAG,KAAK,GAAG,KAAK,CAwMpB,CAAC;AA+9CJ,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;;;;AAED;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACvC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAe7B;CACF"}

package/lib/Apply.js

@@ -2,14 +2,16 @@ import * as Cause from "effect/Cause";
 import * as Data from "effect/Data";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
 import * as Option from "effect/Option";
+import * as Predicate from "effect/Predicate";
 import { makeResolveContext } from "./ActionRuntimeContext.js";
 import { stripUnowned, Unowned } from "./AdoptPolicy.js";
 import { AlchemyContext } from "./AlchemyContext.js";
 import { demandPlanCredentials, } from "./Auth/Demand.js";
 import { RuntimeContext } from "./RuntimeContext.js";
 import { Artifacts, ArtifactStore, createArtifactStore, ensureArtifactStore, makeScopedArtifacts, } from "./Artifacts.js";
-import { Cli, } from "./Cli/Cli.js";
+import { Cli, noopSession, } from "./Report.js";
 import { havePropsChanged, stripUnresolved } from "./Diff.js";
 import { generateInstanceId, InstanceId } from "./InstanceId.js";
 import * as Output from "./Output.js";
@@ -41,7 +43,7 @@ const instrumentLifecycle = (op, fqn, resourceType, logicalId, instanceId) => (e
         "alchemy.resource.op": op,
     },
 }));
-export const apply = (plan) => Effect.gen(function* () {
+export const apply = (plan, options = {}) => Effect.gen(function* () {
     // Credential-free dev: a dev-mode plan that needs the real cloud
     // (`Alchemy.remote()` rows, remote-proxied bindings, deletions of rows
     // stamped `providerMode: "live"`) demands cloud credentials exactly
@@ -55,88 +57,107 @@ export const apply = (plan) => Effect.gen(function* () {
     if (Option.isSome(alchemy) && alchemy.value.dev) {
         yield* demandPlanCredentials(plan);
     }
-    const cli = yield* Cli;
-    const session = yield* cli.startApplySession(plan);
-    const state = yield* yield* State;
-    const stack = yield* Stack;
-    const stage = yield* Stage;
-    const stackName = stack.name;
-    const tracker = {};
-    const terminalStatuses = new Map();
-    // ── FQN migrations (renamedFrom) ──
-    // Persist renames before any lifecycle operation runs: a node whose row
-    // was found under a former FQN carries that row pre-remapped in
-    // `node.state` (see Plan's rename resolution). Commit it at the current
-    // FQN FIRST, then drop the former row — in that order, so an
-    // interruption leaves rows at both FQNs with the same instanceId, which
-    // the next plan recognizes as an in-flight migration (and never as an
-    // orphan to delete).
-    //
-    // In a same-deploy shift (A→B while B→C), C's former FQN `B` is
-    // simultaneously B's migration TARGET. C must NOT delete it: B's own
-    // `state.set` supersedes the stale copy, and the migrations run
-    // concurrently — the delete could land after B's write and destroy the
-    // freshly migrated row.
-    const migrationTargets = new Set(Object.values(plan.resources)
-        .filter((node) => node.renamedFrom?.length && node.state !== undefined)
-        .map((node) => node.resource.FQN));
-    yield* Effect.forEach(Object.values(plan.resources), (node) => {
-        const { renamedFrom, state: row } = node;
-        return renamedFrom === undefined ||
-            renamedFrom.length === 0 ||
-            row === undefined
-            ? Effect.void
-            : Effect.gen(function* () {
-                yield* state.set({
-                    stack: stackName,
-                    stage,
-                    fqn: node.resource.FQN,
-                    value: row,
+    // Renderer resolution: an explicit session wins, then the ambient Cli
+    // renderer service (the bundled CLI, LoggingCli in tests, or a custom
+    // implementation), else events are dropped.
+    const session = options.session ??
+        (yield* Effect.serviceOption(Cli).pipe(Effect.flatMap(Option.match({
+            onNone: () => Effect.succeed(noopSession),
+            onSome: (cli) => cli.startApplySession(plan, options.planDisplay),
+        }))));
+    // The nested gen exists so `onExit` can settle the session on every
+    // exit path without introducing a scope: local dev providers start
+    // long-running processes in the AMBIENT scope during reconcile, so
+    // wrapping this body in Effect.scoped would kill them when apply
+    // returns.
+    return yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        const stack = yield* Stack;
+        const stage = yield* Stage;
+        const stackName = stack.name;
+        const tracker = {};
+        const terminalStatuses = new Map();
+        // ── FQN migrations (renamedFrom) ──
+        // Persist renames before any lifecycle operation runs: a node whose row
+        // was found under a former FQN carries that row pre-remapped in
+        // `node.state` (see Plan's rename resolution). Commit it at the current
+        // FQN FIRST, then drop the former row — in that order, so an
+        // interruption leaves rows at both FQNs with the same instanceId, which
+        // the next plan recognizes as an in-flight migration (and never as an
+        // orphan to delete).
+        //
+        // In a same-deploy shift (A→B while B→C), C's former FQN `B` is
+        // simultaneously B's migration TARGET. C must NOT delete it: B's own
+        // `state.set` supersedes the stale copy, and the migrations run
+        // concurrently — the delete could land after B's write and destroy the
+        // freshly migrated row.
+        const migrationTargets = new Set(Object.values(plan.resources)
+            .filter((node) => node.renamedFrom?.length && node.state !== undefined)
+            .map((node) => node.resource.FQN));
+        yield* Effect.forEach(Object.values(plan.resources), (node) => {
+            const { renamedFrom, state: row } = node;
+            return renamedFrom === undefined ||
+                renamedFrom.length === 0 ||
+                row === undefined
+                ? Effect.void
+                : Effect.gen(function* () {
+                    yield* state.set({
+                        stack: stackName,
+                        stage,
+                        fqn: node.resource.FQN,
+                        value: row,
+                    });
+                    yield* Effect.forEach(renamedFrom.filter((formerFqn) => !migrationTargets.has(formerFqn)), (formerFqn) => state.delete({ stack: stackName, stage, fqn: formerFqn }), { concurrency: "unbounded" });
                 });
-                yield* Effect.forEach(renamedFrom.filter((formerFqn) => !migrationTargets.has(formerFqn)), (formerFqn) => state.delete({ stack: stackName, stage, fqn: formerFqn }), { concurrency: "unbounded" });
-            });
-    }, { concurrency: "unbounded" });
-    yield* executePlan(plan, tracker, terminalStatuses, session, state, stackName, stage);
-    // TODO(sam): support roll back to previous state if errors occur during expansion
-    // -> RISK: some UPDATEs may not be reversible (i.e. trigger replacements)
-    // TODO(sam): should pivot be done separately? E.g shift traffic?
-    yield* collectGarbage(plan, session);
-    yield* converge(plan, tracker, terminalStatuses, session, state, stackName, stage);
-    yield* Effect.forEach(Array.from(terminalStatuses.values()), ({ id, type, status, providerMode }) => session.emit({ kind: "status-change", id, type, status, providerMode }), { concurrency: "unbounded" });
-    yield* session.done();
-    if (plan.destroy) {
-        // The destroy converged: every resource row was deleted above. Drop
-        // the rest of the stage's persisted state — notably the stack output
-        // record written by the last deploy — so `getOutput` returns
-        // undefined and `listStages` no longer reports the stage.
-        // https://github.com/alchemy-run/alchemy/issues/961
-        yield* state.deleteStack({ stack: stackName, stage });
-        // Invariant: a successful destroy leaves the stage EMPTY. If rows
-        // survive, this destroy session could not actually see (or delete)
-        // the stack's state — e.g. its plan listed an empty store while
-        // committed rows existed — and reporting success here would silently
-        // leak every cloud resource those rows track. Fail loudly instead so
-        // the leak surfaces in the run that caused it.
-        const remaining = yield* state.list({ stack: stackName, stage });
-        if (remaining.length > 0) {
-            return yield* Effect.fail(new StateStoreError({
-                message: `destroy of ${stackName}/${stage} reported success but ${remaining.length} ` +
-                    `state row(s) remain (${remaining.join(", ")}) — the destroy session could ` +
-                    `not see the stack's persisted state, so its cloud resources were NOT deleted`,
-            }));
+        }, { concurrency: "unbounded" });
+        yield* executePlan(plan, tracker, terminalStatuses, session, state, stackName, stage);
+        // TODO(sam): support roll back to previous state if errors occur during expansion
+        // -> RISK: some UPDATEs may not be reversible (i.e. trigger replacements)
+        // TODO(sam): should pivot be done separately? E.g shift traffic?
+        yield* collectGarbage(plan, session);
+        yield* converge(plan, tracker, terminalStatuses, session, state, stackName, stage);
+        yield* Effect.forEach(Array.from(terminalStatuses.values()), ({ fqn, id, type, status, providerMode }) => session.emit({
+            _tag: "apply.resource.status",
+            fqn,
+            id,
+            type,
+            status,
+            providerMode,
+        }), { concurrency: "unbounded" });
+        if (plan.destroy) {
+            // The destroy converged: every resource row was deleted above. Drop
+            // the rest of the stage's persisted state — notably the stack output
+            // record written by the last deploy — so `getOutput` returns
+            // undefined and `listStages` no longer reports the stage.
+            // https://github.com/alchemy-run/alchemy/issues/961
+            yield* state.deleteStack({ stack: stackName, stage });
+            // Invariant: a successful destroy leaves the stage EMPTY. If rows
+            // survive, this destroy session could not actually see (or delete)
+            // the stack's state — e.g. its plan listed an empty store while
+            // committed rows existed — and reporting success here would silently
+            // leak every cloud resource those rows track. Fail loudly instead so
+            // the leak surfaces in the run that caused it.
+            const remaining = yield* state.list({ stack: stackName, stage });
+            if (remaining.length > 0) {
+                return yield* Effect.fail(new StateStoreError({
+                    message: `destroy of ${stackName}/${stage} reported success but ${remaining.length} ` +
+                        `state row(s) remain (${remaining.join(", ")}) — the destroy session could ` +
+                        `not see the stack's persisted state, so its cloud resources were NOT deleted`,
+                }));
+            }
+            return undefined;
         }
-        return undefined;
-    }
-    if (!plan.output) {
-        return undefined;
-    }
-    const outputs = Object.fromEntries(Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]));
-    const resolved = yield* Output.evaluate(plan.output, outputs);
-    // Persist the stack's evaluated outputs so cross-stack references
-    // (`yield* OtherStack` / `OtherStack.stage.<name>` / `Output.stackRef`)
-    // can read them back out of the state store.
-    yield* state.setOutput({ stack: stackName, stage, value: resolved });
-    return resolved;
+        if (!plan.output) {
+            return undefined;
+        }
+        const outputs = Object.fromEntries(Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]));
+        const resolved = yield* Output.evaluate(plan.output, outputs);
+        // Persist the stack's evaluated outputs so cross-stack references
+        // (`yield* OtherStack` / `OtherStack.stage.<name>` / `Output.stackRef`)
+        // can read them back out of the state store.
+        yield* state.setOutput({ stack: stackName, stage, value: resolved });
+        return resolved;
+    }).pipe(Effect.onExit((exit) => session.done(Exit.isSuccess(exit) ? "success" : "failure")));
 }).pipe(ensureArtifactStore, Effect.withSpan("apply", {
     attributes: {
         "alchemy.resources.count": Object.keys(plan.resources).length,
@@ -197,6 +218,35 @@ const executePlan = Effect.fn(function* (plan, tracker, terminalStatuses, sessio
         return yield* Effect.failCause(failures.map((f) => f.cause).reduce(Cause.combine));
     }
 });
+/**
+ * First human-readable line of a lifecycle failure, for the per-resource
+ * `fail` status event. The full cause is still aggregated and raised when
+ * the whole apply settles — this exists so a failed row explains itself the
+ * moment it fails instead of only after every sibling has finished.
+ * `undefined` for interrupt-only causes (nothing failed, the run was
+ * cancelled).
+ */
+const failureMessage = (cause) => {
+    for (const reason of cause.reasons) {
+        const error = Cause.isFailReason(reason)
+            ? reason.error
+            : Cause.isDieReason(reason)
+                ? reason.defect
+                : undefined;
+        if (error === undefined)
+            continue;
+        const tag = Predicate.hasProperty(error, "_tag") && typeof error._tag === "string"
+            ? error._tag
+            : undefined;
+        const message = Predicate.hasProperty(error, "message") &&
+            typeof error.message === "string"
+            ? error.message
+            : String(error);
+        const line = message.split("\n", 1)[0];
+        return tag !== undefined && !line.includes(tag) ? `${tag}: ${line}` : line;
+    }
+    return undefined;
+};
 const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, session, state, stackName, stage, getOutputs, waitForDeps, failures, inCycle) => Effect.gen(function* () {
     const logicalId = node.resource.LogicalId;
     const namespace = node.resource.Namespace;
@@ -226,7 +276,13 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
     });
     const scopedSession = {
         ...session,
-        note: (note) => session.emit({ id: logicalId, kind: "annotate", message: note }),
+        note: (note, options) => session.emit({
+            fqn,
+            id: logicalId,
+            _tag: "apply.resource.note",
+            message: note,
+            kind: options?.kind,
+        }),
     };
     // On a mode-switch replacement (local ⇄ live) surface the transition:
     // the old generation's stamped mode → the mode resolved for this run.
@@ -237,7 +293,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
         ? node.state.providerMode
         : undefined;
     const report = (status) => session.emit({
-        kind: "status-change",
+        _tag: "apply.resource.status",
+        fqn,
         id: logicalId,
         type: node.resource.Type,
         status,
@@ -246,6 +303,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
     });
     const markTerminal = (status) => Effect.gen(function* () {
         terminalStatuses.set(fqn, {
+            fqn,
             id: logicalId,
             type: node.resource.Type,
             status,
@@ -276,7 +334,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
         if (inCycle)
             return;
         yield* session.emit({
-            kind: "status-change",
+            _tag: "apply.resource.status",
+            fqn,
             id: logicalId,
             type: node.resource.Type,
             status,
@@ -308,12 +367,22 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
         //    the persisted row, see `Plan.ts`'s delete node) would act on the
         //    stale one — destroying a resource the user had marked `retain`.
         //    See https://github.com/alchemy-run/alchemy/issues/1248.
+        // 3. `downstream` — a dependent that repins from resource A to B
+        //    (e.g. a HostnameAssociation switching certificates) updates
+        //    *itself*, while A and B are both noops. Delete ordering reads the
+        //    persisted `downstream` of the resource being deleted, so without
+        //    this commit a later destroy deletes B concurrently with the
+        //    dependent that still references it (and needlessly waits on A).
         const policyChanged = node.state.removalPolicy !== node.resource.RemovalPolicy;
-        if (node.state.resourceType !== node.resource.Type || policyChanged) {
+        const downstreamChanged = !sameSet(node.state.downstream ?? [], node.downstream);
+        if (node.state.resourceType !== node.resource.Type ||
+            policyChanged ||
+            downstreamChanged) {
             yield* commit({
                 ...node.state,
                 resourceType: node.resource.Type,
                 removalPolicy: node.resource.RemovalPolicy,
+                downstream: node.downstream,
             });
         }
         // A policy flip is otherwise invisible (the row is a noop), and it is
@@ -511,7 +580,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
             return;
         }
         // ── update ──
-        if (node.action === "update") {
+        if (node.action === "update" || node.action === "adopted") {
             // Cycle members publish their previous live attr *before* waiting on
             // upstreams so the SCC can converge — peers in the cycle would
             // otherwise deadlock waiting on each other. Phase 3 (`converge`)
@@ -567,7 +636,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     removalPolicy: node.resource.RemovalPolicy,
                     providerMode: node.mode,
                 });
-            yield* report("updating");
+            yield* report(node.action === "adopted" ? "adopting" : "updating");
             const previousProps = adopting
                 ? undefined
                 : node.state.status === "created" ||
@@ -630,7 +699,20 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
             // above and `signalReady` is a no-op the second time.
             yield* signalReady;
             yield* signalReadyStable;
-            yield* markTerminal("updated");
+            if (node.action === "adopted") {
+                terminalStatuses.set(fqn, {
+                    fqn,
+                    id: logicalId,
+                    type: node.resource.Type,
+                    status: "adopted",
+                    providerMode: node.mode,
+                });
+                if (!inCycle)
+                    yield* report("adopted");
+            }
+            else {
+                yield* markTerminal("updated");
+            }
             return;
         }
         // ── replace ──
@@ -843,7 +925,6 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
             yield* markTerminal("created");
             return;
         }
-        // @ts-expect-error - node is never, this should be unreachable
         return yield* Effect.die(`Unknown action: ${node.action}`);
     });
 }).pipe(Effect.catchCause((cause) => 
@@ -862,10 +943,12 @@ Effect.gen(function* () {
     yield* Deferred.failCause(ready[fqn], cause);
     yield* Deferred.failCause(readyStable[fqn], cause);
     yield* session.emit({
-        kind: "status-change",
+        _tag: "apply.resource.status",
+        fqn,
         id: node.resource.LogicalId,
         type: node.resource.Type,
         status: "fail",
+        message: failureMessage(cause),
         providerMode: node.mode,
     });
 })), Effect.withSpan("apply.resource", {
@@ -907,7 +990,8 @@ const executeActionNode = (fqn, node, tracker, ready, readyStable, terminalStatu
         value: { ...value, namespace },
     });
     const report = (status) => session.emit({
-        kind: "status-change",
+        _tag: "apply.resource.status",
+        fqn,
         id: logicalId,
         type: task.Type,
         status,
@@ -924,6 +1008,7 @@ const executeActionNode = (fqn, node, tracker, ready, readyStable, terminalStatu
         yield* signalReady;
         yield* signalReadyStable;
         terminalStatuses.set(fqn, {
+            fqn,
             id: logicalId,
             type: task.Type,
             status: "skipped",
@@ -978,6 +1063,7 @@ const executeActionNode = (fqn, node, tracker, ready, readyStable, terminalStatu
     yield* signalReady;
     yield* signalReadyStable;
     terminalStatuses.set(fqn, {
+        fqn,
         id: logicalId,
         type: task.Type,
         status: "ran",
@@ -993,10 +1079,12 @@ const executeActionNode = (fqn, node, tracker, ready, readyStable, terminalStatu
     yield* Deferred.failCause(ready[fqn], cause);
     yield* Deferred.failCause(readyStable[fqn], cause);
     yield* session.emit({
-        kind: "status-change",
+        _tag: "apply.resource.status",
+        fqn,
         id: node.def.LogicalId,
         type: node.def.Type,
         status: "fail",
+        message: failureMessage(cause),
     });
 })), Effect.withSpan("apply.action", {
     attributes: {
@@ -1037,7 +1125,13 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
             const instanceId = tracker[fqn].instanceId;
             const scopedSession = {
                 ...session,
-                note: (note) => session.emit({ id: logicalId, kind: "annotate", message: note }),
+                note: (note, options) => session.emit({
+                    fqn,
+                    id: logicalId,
+                    _tag: "apply.resource.note",
+                    message: note,
+                    kind: options?.kind,
+                }),
             };
             const attr = yield* node.provider
                 .reconcile({
@@ -1085,9 +1179,10 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
                 },
             });
             terminalStatuses.set(fqn, {
+                fqn,
                 id: logicalId,
                 type: node.resource.Type,
-                status: "updated",
+                status: node.action === "adopted" ? "adopted" : "updated",
                 providerMode: node.mode,
             });
         }
@@ -1149,6 +1244,7 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
                 instanceId: fqn,
             };
             terminalStatuses.set(fqn, {
+                fqn,
                 id: node.def.LogicalId,
                 type: node.def.Type,
                 status: "ran",
@@ -1189,14 +1285,16 @@ const collectGarbage = Effect.fn(function* (plan, session) {
         ? Effect.void
         : Effect.gen(function* () {
             yield* session.emit({
-                kind: "status-change",
+                _tag: "apply.resource.status",
+                fqn,
                 id: node.def.LogicalId,
                 type: node.def.Type,
                 status: "deleting",
             });
             yield* state.delete({ stack: stackName, stage, fqn });
             yield* session.emit({
-                kind: "status-change",
+                _tag: "apply.resource.status",
+                fqn,
                 id: node.def.LogicalId,
                 type: node.def.Type,
                 status: "deleted",
@@ -1276,7 +1374,8 @@ const collectGarbage = Effect.fn(function* (plan, session) {
                 },
             });
             const report = (status) => session.emit({
-                kind: "status-change",
+                _tag: "apply.resource.status",
+                fqn,
                 id: logicalId,
                 type: resourceType,
                 status,
@@ -1284,10 +1383,12 @@ const collectGarbage = Effect.fn(function* (plan, session) {
             });
             const scopedSession = {
                 ...session,
-                note: (note) => session.emit({
+                note: (note, options) => session.emit({
+                    fqn,
                     id: logicalId,
-                    kind: "annotate",
+                    _tag: "apply.resource.note",
                     message: note,
+                    kind: options?.kind,
                 }),
             };
             return yield* (deletions[fqn] ??= yield* Effect.cached(Effect.gen(function* () {
@@ -1333,14 +1434,14 @@ const collectGarbage = Effect.fn(function* (plan, session) {
             function deleteResourceBody() {
                 return Effect.gen(function* () {
                     if (isDeleteNode(node)) {
-                        yield* report("deleting");
-                        if (node.resource.RemovalPolicy === "retain") {
+                        yield* report(node.action === "orphaned" ? "orphaning" : "deleting");
+                        if (node.action === "orphaned") {
                             yield* state.delete({
                                 stack: stackName,
                                 stage,
                                 fqn,
                             });
-                            yield* report("retained");
+                            yield* report("orphaned");
                             // Retention is intentional — it never blocks dependencies.
                             return "deleted";
                         }
@@ -1545,4 +1646,9 @@ const collectGarbage = Effect.fn(function* (plan, session) {
     }
 });
 const excludeDeletedBindings = (bindings) => bindings.flatMap(({ action, sid, data }) => action === "delete" ? [] : [{ sid, data }]);
+/** Order-insensitive equality of two FQN lists. */
+const sameSet = (a, b) => {
+    const sa = new Set(a);
+    return sa.size === new Set(b).size && b.every((fqn) => sa.has(fqn));
+};
 //# sourceMappingURL=Apply.js.map