alchemy 2.0.0-cli-shim.1 → 2.0.0-fix-redacted

package/bin/alchemy.js

@@ -8,12 +8,21 @@ import * as EffectContext from "effect/Context";
 import * as FileSystem from "effect/FileSystem";
 import * as Path$1 from "effect/Path";
 import { Path } from "effect/Path";
+import { PassThrough, Stream } from "node:stream";
+import process$1, { cwd, env } from "node:process";
+import os from "node:os";
+import { execFileSync } from "node:child_process";
+import * as fs$1 from "node:fs";
+import fs from "node:fs";
+import tty from "node:tty";
+import { EventEmitter } from "node:events";
+import { Buffer as Buffer$1 } from "node:buffer";
 import * as Cause from "effect/Cause";
 import * as Config from "effect/Config";
 import * as Console from "effect/Console";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
-import * as Argument from "effect/unstable/cli/Argument";
+import * as Argument$1 from "effect/unstable/cli/Argument";
 import * as CliError from "effect/unstable/cli/CliError";
 import * as Flag$1 from "effect/unstable/cli/Flag";
 import "@clack/prompts";
@@ -28,19 +37,10 @@ import * as Schedule from "effect/Schedule";
 import { Credentials, fromAwsCredentialIdentity } from "@distilled.cloud/aws/Credentials";
 import * as Deferred from "effect/Deferred";
 import { pipe } from "effect/Function";
+import * as Redacted from "effect/Redacted";
 import { SingleShotGen } from "effect/Utils";
 import { pipeArguments } from "effect/Pipeable";
-import { PassThrough, Stream } from "node:stream";
-import process$1, { cwd, env } from "node:process";
-import os from "node:os";
-import { execFileSync } from "node:child_process";
-import * as fs$1 from "node:fs";
-import fs from "node:fs";
-import tty from "node:tty";
-import { EventEmitter } from "node:events";
-import { Buffer as Buffer$1 } from "node:buffer";
-import * as Redacted from "effect/Redacted";
-import { Command, Flag } from "effect/unstable/cli";
+import { Argument, Command, Flag } from "effect/unstable/cli";
 import * as Stream$1 from "effect/Stream";
 
 //#region rolldown:runtime
@@ -74,7 +74,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "2.0.0-cli-shim.1";
+var version = "2.0.0-fix-redacted";
 
 //#endregion
 //#region src/AlchemyContext.ts
@@ -89,582 +89,6 @@ const AlchemyContextLive = Layer.effect(AlchemyContext, Effect.gen(function* ()
 	};
 }));
 
-//#endregion
-//#region src/Util/PlatformServices.ts
-const isBun$1 = typeof Bun !== "undefined";
-const PlatformServices = Effect.promise(async () => {
-	if (isBun$1) {
-		const [BunServices, BunSocket] = await Promise.all([import("@effect/platform-bun/BunServices"), import("@effect/platform-bun/BunSocket")]);
-		return Layer.merge(BunServices.layer, BunSocket.layerWebSocketConstructor);
-	} else {
-		const [NodeServices, NodeSocket] = await Promise.all([import("@effect/platform-node/NodeServices"), import("@effect/platform-node/NodeSocket")]);
-		return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
-	}
-}).pipe(Layer.unwrap);
-const runMain = (effect, options) => {
-	if (isBun$1) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options));
-	else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options));
-};
-
-//#endregion
-//#region src/Auth/AuthProvider.ts
-var AuthError = class extends Schema.TaggedErrorClass()("AuthError", {
-	message: Schema.String,
-	cause: Schema.optional(Schema.Defect)
-}) {};
-var AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
-
-//#endregion
-//#region src/Util/Clank.ts
-var PromptCancelled = class extends Data.TaggedError("PromptCancelled") {};
-const retryIfCancelled = Effect.retry({ while: (e) => e instanceof PromptCancelled });
-
-//#endregion
-//#region bin/commands/_shared.ts
-const USER = Config.string("USER").pipe(Config.orElse(() => Config.string("USERNAME")), Config.withDefault("unknown"));
-const STAGE = Config.string("stage").pipe(Config.option, (a) => a.asEffect(), Effect.map(Option.getOrUndefined));
-/**
-* `true` if `e` is a {@link PromptCancelled}, or an {@link AuthError} whose
-* `cause` chain bottoms out in one. Schema-tagged errors don't always
-* survive `instanceof` across module boundaries, so we also accept any
-* object whose `_tag` matches.
-*/
-const isPromptCancellation = (e) => {
-	for (let cur = e, i = 0; cur != null && i < 16; i++) {
-		if (cur instanceof PromptCancelled) return true;
-		if (typeof cur === "object" && cur._tag === "PromptCancelled") return true;
-		if (cur instanceof AuthError || typeof cur === "object" && cur._tag === "AuthError") {
-			cur = cur.cause;
-			continue;
-		}
-		return false;
-	}
-	return false;
-};
-/**
-* Catches user cancellations (Ctrl+C inside a prompt, surfaced as
-* {@link PromptCancelled} or wrapped in an {@link AuthError}) and exits
-* the CLI cleanly with a friendly message instead of dumping a stack
-* trace.
-*/
-const handleCancellation = (self$1) => self$1.pipe(Effect.catchCause((cause) => {
-	return cause.reasons.some((r) => {
-		if (Cause.isFailReason(r)) return isPromptCancellation(r.error);
-		if (Cause.isDieReason(r)) return isPromptCancellation(r.defect);
-		return false;
-	}) ? Console.log("\nCancelled.") : Effect.failCause(cause);
-}), Effect.onInterrupt(() => Console.log("\nInterrupted.")));
-const stage = Flag$1.string("stage").pipe(Flag$1.withSchema(Schema.String.check(Schema.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))), Flag$1.withDescription("Stage to deploy to, defaults to dev_${USER}"), Flag$1.optional, Flag$1.map(Option.getOrUndefined), Flag$1.mapEffect(Effect.fn(function* (stage$1) {
-	if (stage$1) return stage$1;
-	return yield* STAGE.pipe(Effect.catch(() => Effect.fail(new CliError.MissingOption({ option: "stage" }))), Effect.flatMap((s) => s === void 0 ? USER.asEffect().pipe(Effect.map((user) => `dev_${user}`), Effect.catch(() => Effect.succeed("unknown"))) : Effect.succeed(s)));
-})));
-const envFile = Flag$1.file("env-file").pipe(Flag$1.optional, Flag$1.withDescription("File to load environment variables from, defaults to .env"));
-const dryRun = Flag$1.boolean("dry-run").pipe(Flag$1.withDescription("Dry run the deployment, do not actually deploy"), Flag$1.withDefault(false));
-const yes = Flag$1.boolean("yes").pipe(Flag$1.withDescription("Yes to all prompts"), Flag$1.withDefault(false));
-const force = Flag$1.boolean("force").pipe(Flag$1.withDescription("Force updates for resources that would otherwise no-op"), Flag$1.withDefault(false));
-const main = Argument.file("main", { mustExist: true }).pipe(Argument.withDescription("Main file to deploy, defaults to alchemy.run.ts"), Argument.withDefault("alchemy.run.ts"));
-const profile = Flag$1.string("profile").pipe(Flag$1.withDescription("Auth profile to use (~/.alchemy/profiles.json). Defaults to 'default' or $ALCHEMY_PROFILE."), Flag$1.optional, Flag$1.map(Option.getOrElse(() => "default")));
-const resourceFilter = Flag$1.string("filter").pipe(Flag$1.withDescription("Comma-separated logical resource IDs (e.g. Api,Sandbox). Only those resources are included."), Flag$1.optional, Flag$1.map(Option.getOrUndefined));
-const TAIL_COLORS = [
-	"\x1B[36m",
-	"\x1B[35m",
-	"\x1B[33m",
-	"\x1B[32m",
-	"\x1B[34m",
-	"\x1B[91m",
-	"\x1B[96m",
-	"\x1B[95m",
-	"\x1B[93m",
-	"\x1B[92m"
-];
-const TAIL_RESET = "\x1B[0m";
-const formatLocalTimestamp = (date) => {
-	return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}-${String(date.getDate()).padStart(2, "0")} ${String(date.getHours()).padStart(2, "0")}:${String(date.getMinutes()).padStart(2, "0")}:${String(date.getSeconds()).padStart(2, "0")}.${String(date.getMilliseconds()).padStart(3, "0")} ${new Intl.DateTimeFormat("en-US", { timeZoneName: "short" }).formatToParts(date).find((p) => p.type === "timeZoneName")?.value ?? ""}`;
-};
-const parseResourceFilter = (filter) => {
-	if (filter === void 0) return void 0;
-	const ids = filter.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-	if (ids.length === 0) return void 0;
-	return new Set(ids);
-};
-const parseSince = (value) => {
-	const match = value.match(/^(\d+)([smhd])$/);
-	if (match) {
-		const num = parseInt(match[1], 10);
-		const unit = match[2];
-		const ms = unit === "s" ? num * 1e3 : unit === "m" ? num * 6e4 : unit === "h" ? num * 36e5 : num * 864e5;
-		return new Date(Date.now() - ms);
-	}
-	const parsed = new Date(value);
-	if (isNaN(parsed.getTime())) throw new Error(`Invalid --since value: '${value}'. Use a duration (e.g. '1h', '30m') or ISO date.`);
-	return parsed;
-};
-const importStack = Effect.fn(function* (main$1) {
-	const path = yield* Path$1.Path;
-	const stackEffect = (yield* Effect.promise(() => import(path.resolve(process.cwd(), main$1)))).default;
-	if (!Effect.isEffect(stackEffect)) return yield* Effect.die(/* @__PURE__ */ new Error(`Main file '${main$1}' must export a default stack definition (export default Alchemy.Stack({...}))`));
-	return stackEffect;
-});
-
-//#endregion
-//#region src/AWS/Environment.ts
-const AWS_PROFILE = Config.string("AWS_PROFILE").pipe(Config.withDefault("default"));
-const AWS_REGION = Config.string("AWS_REGION");
-var AWSEnvironment = class extends EffectContext.Service()("AWS::Environment") {};
-/**
-* Build an `AWSEnvironment` from an SSO profile (`AWS_PROFILE` env var,
-* defaults to `"default"`). Uses the profile's `sso_account_id` and `region`,
-* and resolves credentials lazily via `aws sso login`.
-*/
-const Default = Layer.effect(AWSEnvironment, Effect.suspend(() => loadDefault())).pipe(Layer.orDie);
-const loadDefault = () => Effect.gen(function* () {
-	const profileName = yield* AWS_PROFILE;
-	const auth = yield* Auth.Default;
-	const profile$1 = yield* auth.loadProfile(profileName);
-	if (!profile$1.sso_account_id) return yield* Effect.die(`AWS SSO profile '${profileName}' is missing sso_account_id`);
-	const region = profile$1.region ?? (yield* AWS_REGION.pipe(Config.option, Config.map(Option.getOrElse(() => "us-east-1"))));
-	return {
-		profile: profileName,
-		accountId: profile$1.sso_account_id,
-		region,
-		credentials: auth.loadProfileCredentials(profileName)
-	};
-});
-const isStatic = (shape) => shape.credentials != null && typeof shape.credentials.accessKeyId === "string";
-/**
-* Build an `AWSEnvironment` Layer directly from values — useful for
-* static credentials in CI or tests.
-*
-* Named `makeEnvironment` rather than `of` because `Context.Service.of`
-* already exists with different semantics (builds the service value, not
-* a Layer); putting both on `AWSEnvironment` would be confusing.
-*/
-const makeEnvironment = (shape) => Layer.succeed(AWSEnvironment, isStatic(shape) ? {
-	...shape,
-	credentials: Effect.succeed(fromAwsCredentialIdentity(shape.credentials))
-} : shape);
-
-//#endregion
-//#region src/AWS/Bootstrap.ts
-/**
-* Tag key used to identify the alchemy assets bucket.
-*/
-const ASSETS_BUCKET_TAG = "alchemy::assets-bucket";
-/**
-* Tag key used to scope the alchemy assets bucket to an AWS region.
-*/
-const ASSETS_BUCKET_REGION_TAG = "alchemy::assets-bucket-region";
-/**
-* Build an account-regional namespace bucket name.
-*
-* Account-regional buckets must follow the naming convention:
-*   `<prefix>-<accountId>-<region>-an`
-*
-* @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/gpbucketnamespaces.html#account-regional-gp-buckets
-*/
-const createAssetsBucketName = (accountId, region) => `alchemy-assets-${accountId}-${region}-an`.toLowerCase();
-const createAssetsBucketTags = (region) => [{
-	Key: ASSETS_BUCKET_TAG,
-	Value: "true"
-}, {
-	Key: ASSETS_BUCKET_REGION_TAG,
-	Value: region
-}];
-const getBucketTags = (bucketName) => s3.getBucketTagging({ Bucket: bucketName }).pipe(Effect.map((response) => response.TagSet ?? []), Effect.catchTag("NoSuchTagSet", () => Effect.succeed([])));
-const hasAssetsBucketTag = (tags) => tags.some((tag) => tag.Key === ASSETS_BUCKET_TAG && tag.Value === "true");
-const normalizeBucketRegion = (location) => {
-	if (!location) return "us-east-1";
-	if (location === "EU") return "eu-west-1";
-	return location;
-};
-const bucketMatchesRegion = (tags, region) => {
-	const taggedRegion = tags.find((tag) => tag.Key === ASSETS_BUCKET_REGION_TAG)?.Value;
-	return taggedRegion === void 0 ? void 0 : taggedRegion === region;
-};
-const lookupAssetsBuckets = Effect.gen(function* () {
-	const region = yield* Region;
-	const buckets = (yield* s3.listBuckets({})).Buckets ?? [];
-	const matchingBuckets = [];
-	for (const bucket of buckets) {
-		const bucketName = bucket.Name;
-		if (!bucketName) continue;
-		const tags = yield* getBucketTags(bucketName).pipe(Effect.catch(() => Effect.succeed([])));
-		if (!hasAssetsBucketTag(tags)) continue;
-		const taggedRegionMatch = bucketMatchesRegion(tags, region);
-		if (taggedRegionMatch === true) {
-			matchingBuckets.push(bucketName);
-			continue;
-		}
-		if (taggedRegionMatch === false) continue;
-		if ((yield* s3.getBucketLocation({ Bucket: bucketName }).pipe(Effect.map((response) => normalizeBucketRegion(response.LocationConstraint)), Effect.catch(() => Effect.succeed(void 0)))) === region) matchingBuckets.push(bucketName);
-	}
-	return matchingBuckets;
-});
-const lookupAssetsBucket = Effect.gen(function* () {
-	const matchingBuckets = yield* lookupAssetsBuckets;
-	for (const bucketName of matchingBuckets) return Option.some(bucketName);
-	return Option.none();
-});
-const ensureAssetsBucketTags = Effect.fn(function* (bucketName, region) {
-	const tagSet = [...(yield* getBucketTags(bucketName)).filter((tag) => tag.Key !== ASSETS_BUCKET_TAG && tag.Key !== ASSETS_BUCKET_REGION_TAG), ...createAssetsBucketTags(region)];
-	yield* s3.putBucketTagging({
-		Bucket: bucketName,
-		Tagging: { TagSet: tagSet.map((tag) => ({
-			Key: tag.Key,
-			Value: tag.Value
-		})) }
-	});
-});
-const deleteAllObjects = Effect.fn(function* (bucketName) {
-	let continuationToken;
-	do {
-		const listResponse = yield* s3.listObjectsV2({
-			Bucket: bucketName,
-			ContinuationToken: continuationToken
-		});
-		if (listResponse.Contents && listResponse.Contents.length > 0) yield* s3.deleteObjects({
-			Bucket: bucketName,
-			Delete: {
-				Objects: listResponse.Contents.map((obj) => ({ Key: obj.Key })),
-				Quiet: true
-			}
-		});
-		continuationToken = listResponse.NextContinuationToken;
-	} while (continuationToken);
-	let keyMarker;
-	let versionIdMarker;
-	do {
-		const listVersionsResponse = yield* s3.listObjectVersions({
-			Bucket: bucketName,
-			KeyMarker: keyMarker,
-			VersionIdMarker: versionIdMarker
-		});
-		const objectsToDelete = [...(listVersionsResponse.Versions ?? []).map((v) => ({
-			Key: v.Key,
-			VersionId: v.VersionId
-		})), ...(listVersionsResponse.DeleteMarkers ?? []).map((dm) => ({
-			Key: dm.Key,
-			VersionId: dm.VersionId
-		}))];
-		if (objectsToDelete.length > 0) yield* s3.deleteObjects({
-			Bucket: bucketName,
-			Delete: {
-				Objects: objectsToDelete,
-				Quiet: true
-			}
-		});
-		keyMarker = listVersionsResponse.NextKeyMarker;
-		versionIdMarker = listVersionsResponse.NextVersionIdMarker;
-	} while (keyMarker);
-});
-/**
-* Bootstrap the AWS environment by creating the assets bucket.
-*
-* This is idempotent - running it multiple times is safe.
-* The bucket is tagged and later discovered by tag lookup instead of by name.
-*/
-const bootstrap = Effect.fn(function* () {
-	const region = yield* Region;
-	const existingBucket = yield* lookupAssetsBucket;
-	if (Option.isSome(existingBucket)) {
-		yield* ensureAssetsBucketTags(existingBucket.value, region);
-		yield* Effect.logInfo(`Assets bucket already exists: ${existingBucket.value}`);
-		return {
-			bucketName: existingBucket.value,
-			created: false
-		};
-	}
-	const { accountId } = yield* AWSEnvironment;
-	const bucketName = createAssetsBucketName(accountId, region);
-	yield* s3.createBucket({
-		Bucket: bucketName,
-		BucketNamespace: "account-regional",
-		CreateBucketConfiguration: {
-			Tags: createAssetsBucketTags(region),
-			...region === "us-east-1" ? {} : { LocationConstraint: region }
-		}
-	}).pipe(Effect.catchTag("BucketAlreadyOwnedByYou", () => Effect.void), Effect.retry({
-		while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
-		schedule: Schedule.exponential(100)
-	}));
-	yield* s3.headBucket({ Bucket: bucketName }).pipe(Effect.retry({ schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10))) }));
-	yield* Effect.logInfo(`Created assets bucket: ${bucketName}`);
-	return {
-		bucketName,
-		created: true
-	};
-});
-const destroyBootstrap = Effect.fn(function* () {
-	const bucketNames = yield* lookupAssetsBuckets;
-	for (const bucketName of bucketNames) {
-		yield* Effect.logInfo(`Destroying assets bucket: ${bucketName}`);
-		yield* deleteAllObjects(bucketName);
-		yield* s3.deleteBucket({ Bucket: bucketName }).pipe(Effect.retry({
-			while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
-			schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10)))
-		}));
-	}
-	return {
-		bucketNames,
-		destroyed: bucketNames.length
-	};
-});
-
-//#endregion
-//#region src/AWS/Credentials.ts
-/**
-* Lazy `Credentials` layer derived from the surrounding {@link AWSEnvironment}.
-* Credentials are resolved on first access (not during layer construction),
-* matching the existing @distilled.cloud/aws semantics.
-*/
-const fromEnvironment$1 = Layer.effect(Credentials, Effect.map(AWSEnvironment.asEffect(), (env$2) => env$2.credentials));
-
-//#endregion
-//#region src/AWS/Region.ts
-/**
-* Derive the AWS region from the surrounding {@link AWSEnvironment}.
-*/
-const fromEnvironment = Layer.effect(Region$1.Region, Effect.map(AWSEnvironment.asEffect(), (env$2) => env$2.region));
-
-//#endregion
-//#region src/Util/ConfigProvider.ts
-const loadConfigProvider = (envFile$1) => {
-	if (Option.isSome(envFile$1)) return ConfigProvider.fromDotEnv({ path: envFile$1.value }).pipe(Effect.map((dotEnv) => ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv())));
-	return Effect.gen(function* () {
-		if (!(yield* (yield* FileSystem.FileSystem).exists(".env"))) return ConfigProvider.fromEnv();
-		return ConfigProvider.orElse(yield* ConfigProvider.fromDotEnv({ path: ".env" }), ConfigProvider.fromEnv());
-	});
-};
-
-//#endregion
-//#region src/Util/FileLogger.ts
-const fileLogger = Effect.fnUntraced(function* (...segments) {
-	const { dotAlchemy } = yield* AlchemyContext;
-	const fs$2 = yield* FileSystem.FileSystem;
-	const path = yield* Path;
-	const logFile = path.join(dotAlchemy, "log", ...segments);
-	yield* fs$2.makeDirectory(path.dirname(logFile), { recursive: true });
-	return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
-});
-
-//#endregion
-//#region bin/commands/bootstrap.ts
-const awsProfile = Flag$1.string("profile").pipe(Flag$1.withDescription("AWS profile to use for credentials"), Flag$1.optional, Flag$1.map(Option.getOrElse(() => "default")));
-const awsRegion = Flag$1.string("region").pipe(Flag$1.withDescription("AWS region to bootstrap (defaults to AWS_REGION env var)"), Flag$1.optional, Flag$1.map(Option.getOrUndefined));
-const bootstrapDestroy = Flag$1.boolean("destroy").pipe(Flag$1.withDescription("Destroy all bootstrap buckets in the selected region"), Flag$1.withDefault(false));
-const bootstrapCommand = Command$1.make("bootstrap", {
-	envFile,
-	profile: awsProfile,
-	region: awsRegion,
-	destroy: bootstrapDestroy
-}, Effect.fnUntraced(function* ({ envFile: envFile$1, profile: profile$1, region, destroy }) {
-	const logger = Logger.layer([fileLogger("bootstrap.txt")]);
-	return yield* Effect.gen(function* () {
-		const ssoProfile = yield* Auth.loadProfile(profile$1);
-		if (!ssoProfile.sso_account_id) return yield* Effect.die(`AWS SSO profile '${profile$1}' is missing sso_account_id`);
-		const ambient = yield* Effect.context();
-		const environment = makeEnvironment({
-			accountId: ssoProfile.sso_account_id,
-			region: region ?? ssoProfile.region ?? "us-east-1",
-			credentials: Auth.loadProfileCredentials(profile$1).pipe(Effect.provide(ambient)),
-			profile: profile$1
-		});
-		const awsLayers = Layer.provideMerge(Layer.mergeAll(fromEnvironment, fromEnvironment$1), environment);
-		return yield* Effect.gen(function* () {
-			const provider = yield* loadConfigProvider(envFile$1);
-			const bootstrapLayer = Layer.provide(awsLayers, Layer.succeed(ConfigProvider.ConfigProvider, provider));
-			if (destroy) {
-				yield* destroyBootstrap().pipe(Effect.tap((result) => result.destroyed === 0 ? Console.log("✓ No bootstrap buckets found to destroy") : Console.log(`✓ Destroyed ${result.destroyed} bootstrap bucket(s): ${result.bucketNames.join(", ")}`)), Effect.provide(bootstrapLayer));
-				return;
-			}
-			yield* bootstrap().pipe(Effect.tap(({ bucketName, created }) => created ? Console.log(`✓ Created assets bucket: ${bucketName}`) : Console.log(`✓ Assets bucket already exists: ${bucketName}`)), Effect.provide(bootstrapLayer));
-		});
-	}).pipe(Effect.provide(logger));
-}));
-
-//#endregion
-//#region src/Artifacts.ts
-/**
-* Per-resource in-memory artifacts shared across a single `Plan.make -> apply`
-* execution.
-*
-* The engine scopes this service by resource `FQN` before invoking lifecycle
-* handlers, so providers should treat it as a resource-local bag for expensive,
-* deterministic intermediate results that can be reused across phases.
-*
-* Expected usage:
-*
-* - `diff` computes an expensive artifact once and stores it
-* - `create` / `update` reads the same artifact and skips recomputing it
-* - artifacts are ephemeral and must never be required for correctness on a
-*   later deploy because the bag is reset between runs
-*
-* Example:
-*
-* ```ts
-* const artifacts = yield* Artifacts;
-* const cached = yield* artifacts.get<PreparedBundle>("bundle");
-* if (cached) return cached;
-*
-* const bundle = yield* prepareBundle();
-* yield* artifacts.set("bundle", bundle);
-* return bundle;
-* ```
-*/
-var Artifacts = class extends EffectContext.Service()("Artifacts") {};
-var ArtifactStore = class extends EffectContext.Service()("Artifacts/Store") {};
-/**
-* Create a fresh root store for one deploy/test run.
-*/
-const createArtifactStore = () => /* @__PURE__ */ new Map();
-const getOrCreateBag = (store, fqn) => {
-	const existing = store.get(fqn);
-	if (existing) return existing;
-	const bag = /* @__PURE__ */ new Map();
-	store.set(fqn, bag);
-	return bag;
-};
-const makeScopedArtifacts = (store, fqn) => {
-	const bag = getOrCreateBag(store, fqn);
-	return {
-		get: (key) => Effect.sync(() => bag.get(key)),
-		set: (key, value) => Effect.sync(() => {
-			bag.set(key, value);
-		}),
-		delete: (key) => Effect.sync(() => {
-			bag.delete(key);
-		})
-	};
-};
-/**
-* Ensure an artifact root exists, reusing the ambient store when one is already
-* present. This lets nested helpers participate in the same run-scoped cache.
-*/
-const ensureArtifactStore = (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrUndefined), Effect.flatMap((existing) => effect.pipe(Effect.provideService(ArtifactStore, existing ?? createArtifactStore()))));
-
-//#endregion
-//#region src/Cli/Cli.ts
-var Cli = class extends EffectContext.Service()("CLI") {};
-
-//#endregion
-//#region src/Util/service.ts
-const GenericService = () => (Kind) => {
-	const service = EffectContext.Service(Kind);
-	const make$2 = (Type) => EffectContext.Service(`${Kind}<${Type}>`);
-	return Object.assign(Object.setPrototypeOf(make$2, service), service);
-};
-
-//#endregion
-//#region src/ExecutionContext.ts
-const ExecutionContext = GenericService()("Alchemy::ExecutionContext");
-const CurrentExecutionContext = Effect.serviceOption(ExecutionContext).pipe(Effect.map(Option.getOrUndefined));
-
-//#endregion
-//#region src/Ref.ts
-const RefMetadata = Symbol.for("alchemy/RefMetadata");
-const isRef = (s) => s && s[RefMetadata] !== void 0;
-const getRefMetadata = (ref$1) => ref$1[RefMetadata];
-const ref = ({ stack, id, stage: stage$1 }) => {
-	const ref$1 = new Proxy({}, { get: (_, prop) => {
-		if (prop === RefMetadata) return {
-			stack,
-			stage: stage$1,
-			id
-		};
-		return of(ref$1)[prop];
-	} });
-	return ref$1;
-};
-
-//#endregion
-//#region src/FQN.ts
-/**
-* Separator used in FQN strings.
-*/
-const FQN_SEPARATOR = "/";
-/**
-* Encode an FQN for safe filesystem storage.
-* Replaces `/` (FQN separator) with `__` to avoid subdirectory creation.
-*/
-const encodeFqn = (fqn) => fqn.replaceAll(FQN_SEPARATOR, "__");
-/**
-* Decode a filename back to FQN.
-*/
-const decodeFqn = (filename) => filename.replaceAll("__", FQN_SEPARATOR);
-/**
-* Convert a NamespaceNode chain to an array of namespace IDs, from root to leaf.
-*
-* @example
-* ```ts
-* const ns = { Id: "Child", Parent: { Id: "Parent", Parent: { Id: "Root" } } };
-* toPath(ns); // ["Root", "Parent", "Child"]
-* ```
-*/
-const toPath = (ns) => {
-	if (!ns) return [];
-	const path = [];
-	let current = ns;
-	while (current) {
-		path.unshift(current.Id);
-		current = current.Parent;
-	}
-	return path;
-};
-/**
-* Create a fully-qualified name (FQN) from a namespace and logical ID.
-* The FQN is a flat key suitable for state storage.
-*
-* @example
-* ```ts
-* const ns = { Id: "Child", Parent: { Id: "Parent" } };
-* toFqn(ns, "MyResource"); // "Parent/Child/MyResource"
-* toFqn(undefined, "MyResource"); // "MyResource"
-* ```
-*/
-const toFqn = (ns, logicalId) => {
-	const path = toPath(ns);
-	path.push(logicalId);
-	return path.join(FQN_SEPARATOR);
-};
-/**
-* Parse an FQN back into namespace path segments and the logical ID.
-*
-* @example
-* ```ts
-* parseFqn("Parent/Child/MyResource"); // { path: ["Parent", "Child"], logicalId: "MyResource" }
-* parseFqn("MyResource"); // { path: [], logicalId: "MyResource" }
-* ```
-*/
-const parseFqn = (fqn) => {
-	const parts = fqn.split(FQN_SEPARATOR);
-	return {
-		path: parts,
-		logicalId: parts.pop()
-	};
-};
-
-//#endregion
-//#region src/Provider.ts
-const Provider = (type) => EffectContext.Service()(type);
-const isProviderCollectionService = (value) => {
-	return typeof value === "object" && value !== null && "kind" in value && value.kind === "ProviderCollection";
-};
-const findProviderByType = (type) => tryFindProviderByType(type).pipe(Effect.flatMap(Option.match({
-	onNone: () => Effect.die(`Provider not found for ${type}`),
-	onSome: (provider) => Effect.succeed(provider)
-})));
-const tryFindProviderByType = Effect.fnUntraced(function* (resourceType) {
-	const Tag = Provider(resourceType);
-	const direct = yield* Effect.serviceOption(Tag);
-	if (Option.isSome(direct)) return direct;
-	const context = yield* Effect.context();
-	for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
-		const provider = value.get(resourceType);
-		if (provider) return Option.some(provider);
-	}
-	return Option.none();
-});
-
 //#endregion
 //#region ../../node_modules/.bun/react@19.2.5/node_modules/react/cjs/react.production.js
 var require_react_production = /* @__PURE__ */ __commonJS({ "../../node_modules/.bun/react@19.2.5/node_modules/react/cjs/react.production.js": ((exports) => {
@@ -1882,7 +1306,7 @@ function throttle(func, throttleMs = 0, options = {}) {
 //#region ../../node_modules/.bun/environment@1.1.0/node_modules/environment/index.js
 const isBrowser = globalThis.window?.document !== void 0;
 const isNode = globalThis.process?.versions?.node !== void 0;
-const isBun = globalThis.process?.versions?.bun !== void 0;
+const isBun$1 = globalThis.process?.versions?.bun !== void 0;
 const isDeno = globalThis.Deno?.version?.deno !== void 0;
 const isElectron = globalThis.process?.versions?.electron !== void 0;
 const isJsDom = globalThis.navigator?.userAgent?.includes("jsdom") === true;
@@ -42867,15 +42291,86 @@ const useInput = (inputHandler, options = {}) => {
 		inputHandler
 	]);
 };
-var use_input_default = useInput;
-
-//#endregion
-//#region ../../node_modules/.bun/ink@6.8.0+4d40c05051311df7/node_modules/ink/build/hooks/use-app.js
+var use_input_default = useInput;
+
+//#endregion
+//#region ../../node_modules/.bun/ink@6.8.0+4d40c05051311df7/node_modules/ink/build/hooks/use-app.js
+/**
+`useApp` is a React hook that exposes a method to manually exit the app (unmount).
+*/
+const useApp = () => (0, import_react.useContext)(AppContext_default);
+var use_app_default = useApp;
+
+//#endregion
+//#region src/Cli/Cli.ts
+var Cli = class extends EffectContext.Service()("CLI") {};
+
+//#endregion
+//#region src/FQN.ts
+/**
+* Separator used in FQN strings.
+*/
+const FQN_SEPARATOR = "/";
+/**
+* Encode an FQN for safe filesystem storage.
+* Replaces `/` (FQN separator) with `__` to avoid subdirectory creation.
+*/
+const encodeFqn = (fqn) => fqn.replaceAll(FQN_SEPARATOR, "__");
+/**
+* Decode a filename back to FQN.
+*/
+const decodeFqn = (filename) => filename.replaceAll("__", FQN_SEPARATOR);
+/**
+* Convert a NamespaceNode chain to an array of namespace IDs, from root to leaf.
+*
+* @example
+* ```ts
+* const ns = { Id: "Child", Parent: { Id: "Parent", Parent: { Id: "Root" } } };
+* toPath(ns); // ["Root", "Parent", "Child"]
+* ```
+*/
+const toPath = (ns) => {
+	if (!ns) return [];
+	const path = [];
+	let current = ns;
+	while (current) {
+		path.unshift(current.Id);
+		current = current.Parent;
+	}
+	return path;
+};
 /**
-`useApp` is a React hook that exposes a method to manually exit the app (unmount).
+* Create a fully-qualified name (FQN) from a namespace and logical ID.
+* The FQN is a flat key suitable for state storage.
+*
+* @example
+* ```ts
+* const ns = { Id: "Child", Parent: { Id: "Parent" } };
+* toFqn(ns, "MyResource"); // "Parent/Child/MyResource"
+* toFqn(undefined, "MyResource"); // "MyResource"
+* ```
 */
-const useApp = () => (0, import_react.useContext)(AppContext_default);
-var use_app_default = useApp;
+const toFqn = (ns, logicalId) => {
+	const path = toPath(ns);
+	path.push(logicalId);
+	return path.join(FQN_SEPARATOR);
+};
+/**
+* Parse an FQN back into namespace path segments and the logical ID.
+*
+* @example
+* ```ts
+* parseFqn("Parent/Child/MyResource"); // { path: ["Parent", "Child"], logicalId: "MyResource" }
+* parseFqn("MyResource"); // { path: [], logicalId: "MyResource" }
+* ```
+*/
+const parseFqn = (fqn) => {
+	const parts = fqn.split(FQN_SEPARATOR);
+	return {
+		path: parts,
+		logicalId: parts.pop()
+	};
+};
 
 //#endregion
 //#region src/Cli/NamespaceTree.ts
@@ -43422,227 +42917,732 @@ const buildLogicalIdIndex = (rows) => {
 		if (keys) keys.push(row.key);
 		else index.set(row.id, [row.key]);
 	}
-	return index;
-};
-function toPlanTask(rowOrId, planItem) {
-	if (typeof rowOrId === "string") return {
-		key: rowOrId,
-		id: rowOrId,
-		type: planItem.resource.Type,
-		status: planItem.action === "noop" ? planItem.state.status : "pending",
-		updatedAt: Date.now()
+	return index;
+};
+function toPlanTask(rowOrId, planItem) {
+	if (typeof rowOrId === "string") return {
+		key: rowOrId,
+		id: rowOrId,
+		type: planItem.resource.Type,
+		status: planItem.action === "noop" ? planItem.state.status : "pending",
+		updatedAt: Date.now()
+	};
+	return {
+		key: rowOrId.key,
+		id: rowOrId.id,
+		type: rowOrId.resourceType,
+		status: rowOrId.action === "noop" ? rowOrId.persistedApplyStatus ?? "created" : "pending",
+		updatedAt: Date.now()
+	};
+}
+const buildInitialTasks = (rows) => new Map(rows.flatMap((row) => row.type === "resource" ? [[row.key, toPlanTask(row)]] : []));
+function PlanProgress(props) {
+	const { source, plan } = props;
+	const spinner = useGlobalSpinner();
+	const rows = (0, import_react.useMemo)(() => buildProgressRows(plan), [plan]);
+	const logicalIdIndex = (0, import_react.useMemo)(() => buildLogicalIdIndex(rows), [rows]);
+	const [tasks, setTasks] = (0, import_react.useState)(() => buildInitialTasks(rows));
+	const unsubscribeRef = (0, import_react.useRef)(null);
+	(0, import_react.useEffect)(() => {
+		unsubscribeRef.current?.();
+		unsubscribeRef.current = source.subscribe((event) => {
+			setTasks((prev) => {
+				const next = new Map(prev);
+				const keys = logicalIdIndex.get(event.id) ?? [];
+				if (event.kind === "status-change") {
+					if (!event.bindingId) for (const key of keys) {
+						const current = next.get(key);
+						next.set(key, {
+							key,
+							id: event.id,
+							type: event.type,
+							status: event.status,
+							message: event.message ?? current?.message,
+							updatedAt: Date.now()
+						});
+					}
+				} else for (const key of keys) {
+					const current = next.get(key);
+					if (!current) continue;
+					next.set(key, {
+						...current,
+						message: event.message,
+						updatedAt: Date.now()
+					});
+				}
+				return next;
+			});
+		});
+		return () => {
+			unsubscribeRef.current?.();
+			unsubscribeRef.current = null;
+		};
+	}, [logicalIdIndex, source]);
+	(0, import_react.useEffect)(() => {
+		setTasks(buildInitialTasks(rows));
+	}, [rows]);
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, {
+		flexDirection: "column",
+		children: rows.map((row) => {
+			const indent = "  ".repeat(row.depth);
+			if (row.type === "namespace") return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, {
+				flexDirection: "row",
+				children: [
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { children: indent }),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, {
+						width: 2,
+						children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, {
+							color: "blueBright",
+							children: "↳ "
+						})
+					}),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, {
+						color: "blueBright",
+						children: row.id
+					})
+				]
+			}, row.key);
+			const task = tasks.get(row.key) ?? toPlanTask(row);
+			const displayStatus = getDisplayStatus(row, task.status);
+			const color = statusColor(displayStatus);
+			const icon = statusIcon(task.status, spinner);
+			return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, {
+				flexDirection: "column",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, {
+					flexDirection: "row",
+					children: [
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { children: indent }),
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, {
+							width: 2,
+							children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, {
+								color,
+								children: [icon, " "]
+							})
+						}),
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, {
+							bold: true,
+							children: task.id
+						}),
+						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, {
+							dimColor: true,
+							children: [
+								" (",
+								task.type,
+								")"
+							]
+						}),
+						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, {
+							color,
+							children: [" ", displayStatus]
+						})
+					]
+				}), task.message ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, {
+					paddingLeft: row.depth * 2 + 2,
+					children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, {
+						dimColor: true,
+						children: ["• ", task.message]
+					})
+				}) : null]
+			}, row.key);
+		})
+	});
+}
+function getDisplayStatus(row, status) {
+	if (row.action === "noop" && (status === "created" || status === "updated")) return "no change";
+	return status;
+}
+function statusColor(status) {
+	switch (status) {
+		case "no change": return "gray";
+		case "pending": return "gray";
+		case "creating":
+		case "created": return "green";
+		case "updating":
+		case "updated": return "yellow";
+		case "deleting":
+		case "deleted": return "red";
+		case "fail": return "redBright";
+		default: return;
+	}
+}
+function statusIcon(status, spinnerChar) {
+	if (isInProgress(status)) return spinnerChar;
+	if (status === "fail") return "✗";
+	return "✓";
+}
+function isInProgress(status) {
+	return status === "pending" || status === "creating" || status === "updating" || status === "deleting";
+}
+const spinnerFrames = [
+	"⠋",
+	"⠙",
+	"⠹",
+	"⠸",
+	"⠼",
+	"⠴",
+	"⠦",
+	"⠧",
+	"⠇",
+	"⠏"
+];
+function useGlobalSpinner(intervalMs = 80) {
+	const [index, setIndex] = (0, import_react.useState)(0);
+	(0, import_react.useEffect)(() => {
+		const timer = setInterval(() => {
+			setIndex((i) => (i + 1) % spinnerFrames.length);
+		}, intervalMs);
+		return () => clearInterval(timer);
+	}, [intervalMs]);
+	return spinnerFrames[index];
+}
+const findCrudByLogicalId = (plan, logicalId) => {
+	for (const node of Object.values(plan.resources)) if (node.resource.LogicalId === logicalId) return node;
+	for (const node of Object.values(plan.deletions)) if (node?.resource.LogicalId === logicalId) return node;
+};
+
+//#endregion
+//#region src/Cli/InkCLI.tsx
+const inkCLI = () => Layer.succeed(Cli, Cli.of({
+	approvePlan,
+	displayPlan,
+	startApplySession
+}));
+const approvePlan = Effect.fn(function* (plan) {
+	let approved = false;
+	const { waitUntilExit } = render_default(/* @__PURE__ */ (0, import_jsx_runtime.jsx)(ApprovePlan, {
+		plan,
+		approve: (a) => approved = a
+	}));
+	yield* Effect.promise(waitUntilExit);
+	return approved;
+});
+const displayPlan = (plan) => Effect.sync(() => {
+	const { unmount } = render_default(/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Plan, { plan }));
+	unmount();
+});
+const startApplySession = Effect.fn(function* (plan) {
+	const listeners = /* @__PURE__ */ new Set();
+	const { unmount } = render_default(/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PlanProgress, {
+		plan,
+		source: { subscribe(listener) {
+			listeners.add(listener);
+			return () => listeners.delete(listener);
+		} }
+	}));
+	return {
+		done: Effect.fn(function* () {
+			yield* Effect.sleep(10);
+			yield* Effect.sync(() => unmount());
+		}),
+		emit: (event) => Effect.sync(() => {
+			for (const listener of listeners) listener(event);
+		})
+	};
+});
+
+//#endregion
+//#region src/Util/PlatformServices.ts
+const isBun = typeof Bun !== "undefined";
+const PlatformServices = Effect.promise(async () => {
+	if (isBun) {
+		const [BunServices, BunSocket] = await Promise.all([import("@effect/platform-bun/BunServices"), import("@effect/platform-bun/BunSocket")]);
+		return Layer.merge(BunServices.layer, BunSocket.layerWebSocketConstructor);
+	} else {
+		const [NodeServices, NodeSocket] = await Promise.all([import("@effect/platform-node/NodeServices"), import("@effect/platform-node/NodeSocket")]);
+		return Layer.merge(NodeServices.layer, NodeSocket.layerWebSocketConstructor);
+	}
+}).pipe(Layer.unwrap);
+const runMain = (effect, options) => {
+	if (isBun) import("@effect/platform-bun/BunRuntime").then((BunRuntime) => BunRuntime.runMain(effect, options));
+	else import("@effect/platform-node/NodeRuntime").then((NodeRuntime) => NodeRuntime.runMain(effect, options));
+};
+
+//#endregion
+//#region src/Auth/AuthProvider.ts
+var AuthError = class extends Schema.TaggedErrorClass()("AuthError", {
+	message: Schema.String,
+	cause: Schema.optional(Schema.Defect)
+}) {};
+var AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
+
+//#endregion
+//#region src/Util/Clank.ts
+var PromptCancelled = class extends Data.TaggedError("PromptCancelled") {};
+const retryIfCancelled = Effect.retry({ while: (e) => e instanceof PromptCancelled });
+
+//#endregion
+//#region bin/commands/_shared.ts
+const USER = Config.string("USER").pipe(Config.orElse(() => Config.string("USERNAME")), Config.withDefault("unknown"));
+const STAGE = Config.string("stage").pipe(Config.option, (a) => a.asEffect(), Effect.map(Option.getOrUndefined));
+/**
+* `true` if `e` is a {@link PromptCancelled}, or an {@link AuthError} whose
+* `cause` chain bottoms out in one. Schema-tagged errors don't always
+* survive `instanceof` across module boundaries, so we also accept any
+* object whose `_tag` matches.
+*/
+const isPromptCancellation = (e) => {
+	for (let cur = e, i = 0; cur != null && i < 16; i++) {
+		if (cur instanceof PromptCancelled) return true;
+		if (typeof cur === "object" && cur._tag === "PromptCancelled") return true;
+		if (cur instanceof AuthError || typeof cur === "object" && cur._tag === "AuthError") {
+			cur = cur.cause;
+			continue;
+		}
+		return false;
+	}
+	return false;
+};
+/**
+* Catches user cancellations (Ctrl+C inside a prompt, surfaced as
+* {@link PromptCancelled} or wrapped in an {@link AuthError}) and exits
+* the CLI cleanly with a friendly message instead of dumping a stack
+* trace.
+*/
+const handleCancellation = (self$1) => self$1.pipe(Effect.catchCause((cause) => {
+	return cause.reasons.some((r) => {
+		if (Cause.isFailReason(r)) return isPromptCancellation(r.error);
+		if (Cause.isDieReason(r)) return isPromptCancellation(r.defect);
+		return false;
+	}) ? Console.log("\nCancelled.") : Effect.failCause(cause);
+}), Effect.onInterrupt(() => Console.log("\nInterrupted.")));
+const stage = Flag$1.string("stage").pipe(Flag$1.withSchema(Schema.String.check(Schema.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))), Flag$1.withDescription("Stage to deploy to, defaults to dev_${USER}"), Flag$1.optional, Flag$1.map(Option.getOrUndefined), Flag$1.mapEffect(Effect.fn(function* (stage$1) {
+	if (stage$1) return stage$1;
+	return yield* STAGE.pipe(Effect.catch(() => Effect.fail(new CliError.MissingOption({ option: "stage" }))), Effect.flatMap((s) => s === void 0 ? USER.asEffect().pipe(Effect.map((user) => `dev_${user}`), Effect.catch(() => Effect.succeed("unknown"))) : Effect.succeed(s)));
+})));
+const envFile = Flag$1.file("env-file").pipe(Flag$1.optional, Flag$1.withDescription("File to load environment variables from, defaults to .env"));
+const dryRun = Flag$1.boolean("dry-run").pipe(Flag$1.withDescription("Dry run the deployment, do not actually deploy"), Flag$1.withDefault(false));
+const yes = Flag$1.boolean("yes").pipe(Flag$1.withDescription("Yes to all prompts"), Flag$1.withDefault(false));
+const force = Flag$1.boolean("force").pipe(Flag$1.withDescription("Force updates for resources that would otherwise no-op"), Flag$1.withDefault(false));
+const main = Argument$1.file("main", { mustExist: true }).pipe(Argument$1.withDescription("Main file to deploy, defaults to alchemy.run.ts"), Argument$1.withDefault("alchemy.run.ts"));
+const profile = Flag$1.string("profile").pipe(Flag$1.withDescription("Auth profile to use (~/.alchemy/profiles.json). Defaults to 'default' or $ALCHEMY_PROFILE."), Flag$1.optional, Flag$1.map(Option.getOrElse(() => "default")));
+const resourceFilter = Flag$1.string("filter").pipe(Flag$1.withDescription("Comma-separated logical resource IDs (e.g. Api,Sandbox). Only those resources are included."), Flag$1.optional, Flag$1.map(Option.getOrUndefined));
+const TAIL_COLORS = [
+	"\x1B[36m",
+	"\x1B[35m",
+	"\x1B[33m",
+	"\x1B[32m",
+	"\x1B[34m",
+	"\x1B[91m",
+	"\x1B[96m",
+	"\x1B[95m",
+	"\x1B[93m",
+	"\x1B[92m"
+];
+const TAIL_RESET = "\x1B[0m";
+const formatLocalTimestamp = (date) => {
+	return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}-${String(date.getDate()).padStart(2, "0")} ${String(date.getHours()).padStart(2, "0")}:${String(date.getMinutes()).padStart(2, "0")}:${String(date.getSeconds()).padStart(2, "0")}.${String(date.getMilliseconds()).padStart(3, "0")} ${new Intl.DateTimeFormat("en-US", { timeZoneName: "short" }).formatToParts(date).find((p) => p.type === "timeZoneName")?.value ?? ""}`;
+};
+const parseResourceFilter = (filter) => {
+	if (filter === void 0) return void 0;
+	const ids = filter.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+	if (ids.length === 0) return void 0;
+	return new Set(ids);
+};
+const parseSince = (value) => {
+	const match = value.match(/^(\d+)([smhd])$/);
+	if (match) {
+		const num = parseInt(match[1], 10);
+		const unit = match[2];
+		const ms = unit === "s" ? num * 1e3 : unit === "m" ? num * 6e4 : unit === "h" ? num * 36e5 : num * 864e5;
+		return new Date(Date.now() - ms);
+	}
+	const parsed = new Date(value);
+	if (isNaN(parsed.getTime())) throw new Error(`Invalid --since value: '${value}'. Use a duration (e.g. '1h', '30m') or ISO date.`);
+	return parsed;
+};
+const importStack = Effect.fn(function* (main$1) {
+	const path = yield* Path$1.Path;
+	const stackEffect = (yield* Effect.promise(() => import(path.resolve(process.cwd(), main$1)))).default;
+	if (!Effect.isEffect(stackEffect)) return yield* Effect.die(/* @__PURE__ */ new Error(`Main file '${main$1}' must export a default stack definition (export default Alchemy.Stack({...}))`));
+	return stackEffect;
+});
+
+//#endregion
+//#region src/AWS/Environment.ts
+const AWS_PROFILE = Config.string("AWS_PROFILE").pipe(Config.withDefault("default"));
+const AWS_REGION = Config.string("AWS_REGION");
+var AWSEnvironment = class extends EffectContext.Service()("AWS::Environment") {};
+/**
+* Build an `AWSEnvironment` from an SSO profile (`AWS_PROFILE` env var,
+* defaults to `"default"`). Uses the profile's `sso_account_id` and `region`,
+* and resolves credentials lazily via `aws sso login`.
+*/
+const Default = Layer.effect(AWSEnvironment, Effect.suspend(() => loadDefault())).pipe(Layer.orDie);
+const loadDefault = () => Effect.gen(function* () {
+	const profileName = yield* AWS_PROFILE;
+	const auth = yield* Auth.Default;
+	const profile$1 = yield* auth.loadProfile(profileName);
+	if (!profile$1.sso_account_id) return yield* Effect.die(`AWS SSO profile '${profileName}' is missing sso_account_id`);
+	const region = profile$1.region ?? (yield* AWS_REGION.pipe(Config.option, Config.map(Option.getOrElse(() => "us-east-1"))));
+	return {
+		profile: profileName,
+		accountId: profile$1.sso_account_id,
+		region,
+		credentials: auth.loadProfileCredentials(profileName)
+	};
+});
+const isStatic = (shape) => shape.credentials != null && typeof shape.credentials.accessKeyId === "string";
+/**
+* Build an `AWSEnvironment` Layer directly from values — useful for
+* static credentials in CI or tests.
+*
+* Named `makeEnvironment` rather than `of` because `Context.Service.of`
+* already exists with different semantics (builds the service value, not
+* a Layer); putting both on `AWSEnvironment` would be confusing.
+*/
+const makeEnvironment = (shape) => Layer.succeed(AWSEnvironment, isStatic(shape) ? {
+	...shape,
+	credentials: Effect.succeed(fromAwsCredentialIdentity(shape.credentials))
+} : shape);
+
+//#endregion
+//#region src/AWS/Bootstrap.ts
+/**
+* Tag key used to identify the alchemy assets bucket.
+*/
+const ASSETS_BUCKET_TAG = "alchemy::assets-bucket";
+/**
+* Tag key used to scope the alchemy assets bucket to an AWS region.
+*/
+const ASSETS_BUCKET_REGION_TAG = "alchemy::assets-bucket-region";
+/**
+* Build an account-regional namespace bucket name.
+*
+* Account-regional buckets must follow the naming convention:
+*   `<prefix>-<accountId>-<region>-an`
+*
+* @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/gpbucketnamespaces.html#account-regional-gp-buckets
+*/
+const createAssetsBucketName = (accountId, region) => `alchemy-assets-${accountId}-${region}-an`.toLowerCase();
+const createAssetsBucketTags = (region) => [{
+	Key: ASSETS_BUCKET_TAG,
+	Value: "true"
+}, {
+	Key: ASSETS_BUCKET_REGION_TAG,
+	Value: region
+}];
+const getBucketTags = (bucketName) => s3.getBucketTagging({ Bucket: bucketName }).pipe(Effect.map((response) => response.TagSet ?? []), Effect.catchTag("NoSuchTagSet", () => Effect.succeed([])));
+const hasAssetsBucketTag = (tags) => tags.some((tag) => tag.Key === ASSETS_BUCKET_TAG && tag.Value === "true");
+const normalizeBucketRegion = (location) => {
+	if (!location) return "us-east-1";
+	if (location === "EU") return "eu-west-1";
+	return location;
+};
+const bucketMatchesRegion = (tags, region) => {
+	const taggedRegion = tags.find((tag) => tag.Key === ASSETS_BUCKET_REGION_TAG)?.Value;
+	return taggedRegion === void 0 ? void 0 : taggedRegion === region;
+};
+const lookupAssetsBuckets = Effect.gen(function* () {
+	const region = yield* Region;
+	const buckets = (yield* s3.listBuckets({})).Buckets ?? [];
+	const matchingBuckets = [];
+	for (const bucket of buckets) {
+		const bucketName = bucket.Name;
+		if (!bucketName) continue;
+		const tags = yield* getBucketTags(bucketName).pipe(Effect.catch(() => Effect.succeed([])));
+		if (!hasAssetsBucketTag(tags)) continue;
+		const taggedRegionMatch = bucketMatchesRegion(tags, region);
+		if (taggedRegionMatch === true) {
+			matchingBuckets.push(bucketName);
+			continue;
+		}
+		if (taggedRegionMatch === false) continue;
+		if ((yield* s3.getBucketLocation({ Bucket: bucketName }).pipe(Effect.map((response) => normalizeBucketRegion(response.LocationConstraint)), Effect.catch(() => Effect.succeed(void 0)))) === region) matchingBuckets.push(bucketName);
+	}
+	return matchingBuckets;
+});
+const lookupAssetsBucket = Effect.gen(function* () {
+	const matchingBuckets = yield* lookupAssetsBuckets;
+	for (const bucketName of matchingBuckets) return Option.some(bucketName);
+	return Option.none();
+});
+const ensureAssetsBucketTags = Effect.fn(function* (bucketName, region) {
+	const tagSet = [...(yield* getBucketTags(bucketName)).filter((tag) => tag.Key !== ASSETS_BUCKET_TAG && tag.Key !== ASSETS_BUCKET_REGION_TAG), ...createAssetsBucketTags(region)];
+	yield* s3.putBucketTagging({
+		Bucket: bucketName,
+		Tagging: { TagSet: tagSet.map((tag) => ({
+			Key: tag.Key,
+			Value: tag.Value
+		})) }
+	});
+});
+const deleteAllObjects = Effect.fn(function* (bucketName) {
+	let continuationToken;
+	do {
+		const listResponse = yield* s3.listObjectsV2({
+			Bucket: bucketName,
+			ContinuationToken: continuationToken
+		});
+		if (listResponse.Contents && listResponse.Contents.length > 0) yield* s3.deleteObjects({
+			Bucket: bucketName,
+			Delete: {
+				Objects: listResponse.Contents.map((obj) => ({ Key: obj.Key })),
+				Quiet: true
+			}
+		});
+		continuationToken = listResponse.NextContinuationToken;
+	} while (continuationToken);
+	let keyMarker;
+	let versionIdMarker;
+	do {
+		const listVersionsResponse = yield* s3.listObjectVersions({
+			Bucket: bucketName,
+			KeyMarker: keyMarker,
+			VersionIdMarker: versionIdMarker
+		});
+		const objectsToDelete = [...(listVersionsResponse.Versions ?? []).map((v) => ({
+			Key: v.Key,
+			VersionId: v.VersionId
+		})), ...(listVersionsResponse.DeleteMarkers ?? []).map((dm) => ({
+			Key: dm.Key,
+			VersionId: dm.VersionId
+		}))];
+		if (objectsToDelete.length > 0) yield* s3.deleteObjects({
+			Bucket: bucketName,
+			Delete: {
+				Objects: objectsToDelete,
+				Quiet: true
+			}
+		});
+		keyMarker = listVersionsResponse.NextKeyMarker;
+		versionIdMarker = listVersionsResponse.NextVersionIdMarker;
+	} while (keyMarker);
+});
+/**
+* Bootstrap the AWS environment by creating the assets bucket.
+*
+* This is idempotent - running it multiple times is safe.
+* The bucket is tagged and later discovered by tag lookup instead of by name.
+*/
+const bootstrap = Effect.fn(function* () {
+	const region = yield* Region;
+	const existingBucket = yield* lookupAssetsBucket;
+	if (Option.isSome(existingBucket)) {
+		yield* ensureAssetsBucketTags(existingBucket.value, region);
+		yield* Effect.logInfo(`Assets bucket already exists: ${existingBucket.value}`);
+		return {
+			bucketName: existingBucket.value,
+			created: false
+		};
+	}
+	const { accountId } = yield* AWSEnvironment;
+	const bucketName = createAssetsBucketName(accountId, region);
+	yield* s3.createBucket({
+		Bucket: bucketName,
+		BucketNamespace: "account-regional",
+		CreateBucketConfiguration: {
+			Tags: createAssetsBucketTags(region),
+			...region === "us-east-1" ? {} : { LocationConstraint: region }
+		}
+	}).pipe(Effect.catchTag("BucketAlreadyOwnedByYou", () => Effect.void), Effect.retry({
+		while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
+		schedule: Schedule.exponential(100)
+	}));
+	yield* s3.headBucket({ Bucket: bucketName }).pipe(Effect.retry({ schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10))) }));
+	yield* Effect.logInfo(`Created assets bucket: ${bucketName}`);
+	return {
+		bucketName,
+		created: true
 	};
+});
+const destroyBootstrap = Effect.fn(function* () {
+	const bucketNames = yield* lookupAssetsBuckets;
+	for (const bucketName of bucketNames) {
+		yield* Effect.logInfo(`Destroying assets bucket: ${bucketName}`);
+		yield* deleteAllObjects(bucketName);
+		yield* s3.deleteBucket({ Bucket: bucketName }).pipe(Effect.retry({
+			while: (e) => e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
+			schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10)))
+		}));
+	}
 	return {
-		key: rowOrId.key,
-		id: rowOrId.id,
-		type: rowOrId.resourceType,
-		status: rowOrId.action === "noop" ? rowOrId.persistedApplyStatus ?? "created" : "pending",
-		updatedAt: Date.now()
+		bucketNames,
+		destroyed: bucketNames.length
 	};
-}
-const buildInitialTasks = (rows) => new Map(rows.flatMap((row) => row.type === "resource" ? [[row.key, toPlanTask(row)]] : []));
-function PlanProgress(props) {
-	const { source, plan } = props;
-	const spinner = useGlobalSpinner();
-	const rows = (0, import_react.useMemo)(() => buildProgressRows(plan), [plan]);
-	const logicalIdIndex = (0, import_react.useMemo)(() => buildLogicalIdIndex(rows), [rows]);
-	const [tasks, setTasks] = (0, import_react.useState)(() => buildInitialTasks(rows));
-	const unsubscribeRef = (0, import_react.useRef)(null);
-	(0, import_react.useEffect)(() => {
-		unsubscribeRef.current?.();
-		unsubscribeRef.current = source.subscribe((event) => {
-			setTasks((prev) => {
-				const next = new Map(prev);
-				const keys = logicalIdIndex.get(event.id) ?? [];
-				if (event.kind === "status-change") {
-					if (!event.bindingId) for (const key of keys) {
-						const current = next.get(key);
-						next.set(key, {
-							key,
-							id: event.id,
-							type: event.type,
-							status: event.status,
-							message: event.message ?? current?.message,
-							updatedAt: Date.now()
-						});
-					}
-				} else for (const key of keys) {
-					const current = next.get(key);
-					if (!current) continue;
-					next.set(key, {
-						...current,
-						message: event.message,
-						updatedAt: Date.now()
-					});
-				}
-				return next;
-			});
-		});
-		return () => {
-			unsubscribeRef.current?.();
-			unsubscribeRef.current = null;
-		};
-	}, [logicalIdIndex, source]);
-	(0, import_react.useEffect)(() => {
-		setTasks(buildInitialTasks(rows));
-	}, [rows]);
-	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, {
-		flexDirection: "column",
-		children: rows.map((row) => {
-			const indent = "  ".repeat(row.depth);
-			if (row.type === "namespace") return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, {
-				flexDirection: "row",
-				children: [
-					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { children: indent }),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, {
-						width: 2,
-						children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, {
-							color: "blueBright",
-							children: "↳ "
-						})
-					}),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, {
-						color: "blueBright",
-						children: row.id
-					})
-				]
-			}, row.key);
-			const task = tasks.get(row.key) ?? toPlanTask(row);
-			const displayStatus = getDisplayStatus(row, task.status);
-			const color = statusColor(displayStatus);
-			const icon = statusIcon(task.status, spinner);
-			return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, {
-				flexDirection: "column",
-				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, {
-					flexDirection: "row",
-					children: [
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { children: indent }),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, {
-							width: 2,
-							children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, {
-								color,
-								children: [icon, " "]
-							})
-						}),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, {
-							bold: true,
-							children: task.id
-						}),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, {
-							dimColor: true,
-							children: [
-								" (",
-								task.type,
-								")"
-							]
-						}),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, {
-							color,
-							children: [" ", displayStatus]
-						})
-					]
-				}), task.message ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, {
-					paddingLeft: row.depth * 2 + 2,
-					children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, {
-						dimColor: true,
-						children: ["• ", task.message]
-					})
-				}) : null]
-			}, row.key);
-		})
+});
+
+//#endregion
+//#region src/AWS/Credentials.ts
+/**
+* Lazy `Credentials` layer derived from the surrounding {@link AWSEnvironment}.
+* Credentials are resolved on first access (not during layer construction),
+* matching the existing @distilled.cloud/aws semantics.
+*/
+const fromEnvironment$1 = Layer.effect(Credentials, Effect.map(AWSEnvironment.asEffect(), (env$2) => env$2.credentials));
+
+//#endregion
+//#region src/AWS/Region.ts
+/**
+* Derive the AWS region from the surrounding {@link AWSEnvironment}.
+*/
+const fromEnvironment = Layer.effect(Region$1.Region, Effect.map(AWSEnvironment.asEffect(), (env$2) => env$2.region));
+
+//#endregion
+//#region src/Util/ConfigProvider.ts
+const loadConfigProvider = (envFile$1) => {
+	if (Option.isSome(envFile$1)) return ConfigProvider.fromDotEnv({ path: envFile$1.value }).pipe(Effect.map((dotEnv) => ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv())));
+	return Effect.gen(function* () {
+		if (!(yield* (yield* FileSystem.FileSystem).exists(".env"))) return ConfigProvider.fromEnv();
+		return ConfigProvider.orElse(yield* ConfigProvider.fromDotEnv({ path: ".env" }), ConfigProvider.fromEnv());
 	});
-}
-function getDisplayStatus(row, status) {
-	if (row.action === "noop" && (status === "created" || status === "updated")) return "no change";
-	return status;
-}
-function statusColor(status) {
-	switch (status) {
-		case "no change": return "gray";
-		case "pending": return "gray";
-		case "creating":
-		case "created": return "green";
-		case "updating":
-		case "updated": return "yellow";
-		case "deleting":
-		case "deleted": return "red";
-		case "fail": return "redBright";
-		default: return;
-	}
-}
-function statusIcon(status, spinnerChar) {
-	if (isInProgress(status)) return spinnerChar;
-	if (status === "fail") return "✗";
-	return "✓";
-}
-function isInProgress(status) {
-	return status === "pending" || status === "creating" || status === "updating" || status === "deleting";
-}
-const spinnerFrames = [
-	"⠋",
-	"⠙",
-	"⠹",
-	"⠸",
-	"⠼",
-	"⠴",
-	"⠦",
-	"⠧",
-	"⠇",
-	"⠏"
-];
-function useGlobalSpinner(intervalMs = 80) {
-	const [index, setIndex] = (0, import_react.useState)(0);
-	(0, import_react.useEffect)(() => {
-		const timer = setInterval(() => {
-			setIndex((i) => (i + 1) % spinnerFrames.length);
-		}, intervalMs);
-		return () => clearInterval(timer);
-	}, [intervalMs]);
-	return spinnerFrames[index];
-}
-const findCrudByLogicalId = (plan, logicalId) => {
-	for (const node of Object.values(plan.resources)) if (node.resource.LogicalId === logicalId) return node;
-	for (const node of Object.values(plan.deletions)) if (node?.resource.LogicalId === logicalId) return node;
 };
 
 //#endregion
-//#region src/Cli/InkCLI.tsx
-const inkCLI = () => Layer.succeed(Cli, Cli.of({
-	approvePlan,
-	displayPlan,
-	startApplySession
-}));
-const approvePlan = Effect.fn(function* (plan) {
-	let approved = false;
-	const { waitUntilExit } = render_default(/* @__PURE__ */ (0, import_jsx_runtime.jsx)(ApprovePlan, {
-		plan,
-		approve: (a) => approved = a
-	}));
-	yield* Effect.promise(waitUntilExit);
-	return approved;
-});
-const displayPlan = (plan) => Effect.sync(() => {
-	const { unmount } = render_default(/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Plan, { plan }));
-	unmount();
+//#region src/Util/FileLogger.ts
+const fileLogger = Effect.fnUntraced(function* (...segments) {
+	const { dotAlchemy } = yield* AlchemyContext;
+	const fs$2 = yield* FileSystem.FileSystem;
+	const path = yield* Path;
+	const logFile = path.join(dotAlchemy, "log", ...segments);
+	yield* fs$2.makeDirectory(path.dirname(logFile), { recursive: true });
+	return yield* Logger.formatLogFmt.pipe(Logger.toFile(logFile, { flag: "a" }));
 });
-const startApplySession = Effect.fn(function* (plan) {
-	const listeners = /* @__PURE__ */ new Set();
-	const { unmount } = render_default(/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PlanProgress, {
-		plan,
-		source: { subscribe(listener) {
-			listeners.add(listener);
-			return () => listeners.delete(listener);
-		} }
-	}));
+
+//#endregion
+//#region bin/commands/bootstrap.ts
+const awsProfile = Flag$1.string("profile").pipe(Flag$1.withDescription("AWS profile to use for credentials"), Flag$1.optional, Flag$1.map(Option.getOrElse(() => "default")));
+const awsRegion = Flag$1.string("region").pipe(Flag$1.withDescription("AWS region to bootstrap (defaults to AWS_REGION env var)"), Flag$1.optional, Flag$1.map(Option.getOrUndefined));
+const bootstrapDestroy = Flag$1.boolean("destroy").pipe(Flag$1.withDescription("Destroy all bootstrap buckets in the selected region"), Flag$1.withDefault(false));
+const bootstrapCommand = Command$1.make("bootstrap", {
+	envFile,
+	profile: awsProfile,
+	region: awsRegion,
+	destroy: bootstrapDestroy
+}, Effect.fnUntraced(function* ({ envFile: envFile$1, profile: profile$1, region, destroy }) {
+	const logger = Logger.layer([fileLogger("bootstrap.txt")]);
+	return yield* Effect.gen(function* () {
+		const ssoProfile = yield* Auth.loadProfile(profile$1);
+		if (!ssoProfile.sso_account_id) return yield* Effect.die(`AWS SSO profile '${profile$1}' is missing sso_account_id`);
+		const ambient = yield* Effect.context();
+		const environment = makeEnvironment({
+			accountId: ssoProfile.sso_account_id,
+			region: region ?? ssoProfile.region ?? "us-east-1",
+			credentials: Auth.loadProfileCredentials(profile$1).pipe(Effect.provide(ambient)),
+			profile: profile$1
+		});
+		const awsLayers = Layer.provideMerge(Layer.mergeAll(fromEnvironment, fromEnvironment$1), environment);
+		return yield* Effect.gen(function* () {
+			const provider = yield* loadConfigProvider(envFile$1);
+			const bootstrapLayer = Layer.provide(awsLayers, Layer.succeed(ConfigProvider.ConfigProvider, provider));
+			if (destroy) {
+				yield* destroyBootstrap().pipe(Effect.tap((result) => result.destroyed === 0 ? Console.log("✓ No bootstrap buckets found to destroy") : Console.log(`✓ Destroyed ${result.destroyed} bootstrap bucket(s): ${result.bucketNames.join(", ")}`)), Effect.provide(bootstrapLayer));
+				return;
+			}
+			yield* bootstrap().pipe(Effect.tap(({ bucketName, created }) => created ? Console.log(`✓ Created assets bucket: ${bucketName}`) : Console.log(`✓ Assets bucket already exists: ${bucketName}`)), Effect.provide(bootstrapLayer));
+		});
+	}).pipe(Effect.provide(logger));
+}));
+
+//#endregion
+//#region src/Artifacts.ts
+/**
+* Per-resource in-memory artifacts shared across a single `Plan.make -> apply`
+* execution.
+*
+* The engine scopes this service by resource `FQN` before invoking lifecycle
+* handlers, so providers should treat it as a resource-local bag for expensive,
+* deterministic intermediate results that can be reused across phases.
+*
+* Expected usage:
+*
+* - `diff` computes an expensive artifact once and stores it
+* - `create` / `update` reads the same artifact and skips recomputing it
+* - artifacts are ephemeral and must never be required for correctness on a
+*   later deploy because the bag is reset between runs
+*
+* Example:
+*
+* ```ts
+* const artifacts = yield* Artifacts;
+* const cached = yield* artifacts.get<PreparedBundle>("bundle");
+* if (cached) return cached;
+*
+* const bundle = yield* prepareBundle();
+* yield* artifacts.set("bundle", bundle);
+* return bundle;
+* ```
+*/
+var Artifacts = class extends EffectContext.Service()("Artifacts") {};
+var ArtifactStore = class extends EffectContext.Service()("Artifacts/Store") {};
+/**
+* Create a fresh root store for one deploy/test run.
+*/
+const createArtifactStore = () => /* @__PURE__ */ new Map();
+const getOrCreateBag = (store, fqn) => {
+	const existing = store.get(fqn);
+	if (existing) return existing;
+	const bag = /* @__PURE__ */ new Map();
+	store.set(fqn, bag);
+	return bag;
+};
+const makeScopedArtifacts = (store, fqn) => {
+	const bag = getOrCreateBag(store, fqn);
 	return {
-		done: Effect.fn(function* () {
-			yield* Effect.sleep(10);
-			yield* Effect.sync(() => unmount());
+		get: (key) => Effect.sync(() => bag.get(key)),
+		set: (key, value) => Effect.sync(() => {
+			bag.set(key, value);
 		}),
-		emit: (event) => Effect.sync(() => {
-			for (const listener of listeners) listener(event);
+		delete: (key) => Effect.sync(() => {
+			bag.delete(key);
 		})
 	};
+};
+/**
+* Ensure an artifact root exists, reusing the ambient store when one is already
+* present. This lets nested helpers participate in the same run-scoped cache.
+*/
+const ensureArtifactStore = (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrUndefined), Effect.flatMap((existing) => effect.pipe(Effect.provideService(ArtifactStore, existing ?? createArtifactStore()))));
+
+//#endregion
+//#region src/Util/service.ts
+const GenericService = () => (Kind) => {
+	const service = EffectContext.Service(Kind);
+	const make$2 = (Type) => EffectContext.Service(`${Kind}<${Type}>`);
+	return Object.assign(Object.setPrototypeOf(make$2, service), service);
+};
+
+//#endregion
+//#region src/ExecutionContext.ts
+const ExecutionContext = GenericService()("Alchemy::ExecutionContext");
+const CurrentExecutionContext = Effect.serviceOption(ExecutionContext).pipe(Effect.map(Option.getOrUndefined));
+
+//#endregion
+//#region src/Ref.ts
+const RefMetadata = Symbol.for("alchemy/RefMetadata");
+const isRef = (s) => s && s[RefMetadata] !== void 0;
+const getRefMetadata = (ref$1) => ref$1[RefMetadata];
+const ref = ({ stack, id, stage: stage$1 }) => {
+	const ref$1 = new Proxy({}, { get: (_, prop) => {
+		if (prop === RefMetadata) return {
+			stack,
+			stage: stage$1,
+			id
+		};
+		return of(ref$1)[prop];
+	} });
+	return ref$1;
+};
+
+//#endregion
+//#region src/Provider.ts
+const Provider = (type) => EffectContext.Service()(type);
+const isProviderCollectionService = (value) => {
+	return typeof value === "object" && value !== null && "kind" in value && value.kind === "ProviderCollection";
+};
+const findProviderByType = (type) => tryFindProviderByType(type).pipe(Effect.flatMap(Option.match({
+	onNone: () => Effect.die(`Provider not found for ${type}`),
+	onSome: (provider) => Effect.succeed(provider)
+})));
+const tryFindProviderByType = Effect.fnUntraced(function* (resourceType) {
+	const Tag = Provider(resourceType);
+	const direct = yield* Effect.serviceOption(Tag);
+	if (Option.isSome(direct)) return direct;
+	const context = yield* Effect.context();
+	for (const value of context.mapUnsafe.values()) if (isProviderCollectionService(value)) {
+		const provider = value.get(resourceType);
+		if (provider) return Option.some(provider);
+	}
+	return Option.none();
 });
 
 //#endregion
@@ -43675,12 +43675,16 @@ const Stack = Object.assign(taggedFunction(EffectContext.Service()("Stack"), (st
 	id: stackName
 }) }) }))));
 const StackName = Stack.use((stack) => Effect.succeed(stack.name));
-const make$1 = (options) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => options.providers.pipe(Layer.provideMerge(options.state), Layer.provideMerge(Layer.effect(Stack, Stage.asEffect().pipe(Effect.map((stage$1) => options.stack ?? {
-	name: options.name,
-	stage: stage$1,
-	resources: {},
-	bindings: {}
-})))), Layer.buildWithScope(scope))), Effect.flatMap((context) => Effect.all([
+const make$1 = (options) => (effect) => Effect.scope.pipe(Effect.flatMap((scope) => {
+	if (options.state == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a state store. Add a \`state\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(),\n    state: Cloudflare.state(), // <-- required\n  }, ...)\nSee https://alchemy.run/concepts/state-store for available state stores.`));
+	if (options.providers == null) return Effect.die(/* @__PURE__ */ new Error(`Stack "${options.name}" is missing a providers layer. Add a \`providers\` layer to the stack options, e.g.:\n  Alchemy.Stack("${options.name}", {\n    providers: Cloudflare.providers(), // <-- required\n    state: Cloudflare.state(),\n  }, ...)`));
+	return options.providers.pipe(Layer.provideMerge(options.state), Layer.provideMerge(Layer.effect(Stack, Stage.asEffect().pipe(Effect.map((stage$1) => options.stack ?? {
+		name: options.name,
+		stage: stage$1,
+		resources: {},
+		bindings: {}
+	})))), Layer.buildWithScope(scope));
+}), Effect.flatMap((context) => Effect.all([
 	effect,
 	Stack.asEffect(),
 	Effect.context()
@@ -43895,6 +43899,7 @@ const evaluate = (expr, upstream$1) => Effect.gen(function* () {
 		}
 	}
 	if (Array.isArray(expr)) return yield* Effect.all(expr.map((item) => evaluate(item, upstream$1)));
+	else if (Redacted.isRedacted(expr)) return expr;
 	else if (typeof expr === "object" && expr !== null) return Object.fromEntries(yield* Effect.all(Object.entries(expr).map(([key, value]) => evaluate(value, upstream$1).pipe(Effect.map((value$1) => [key, value$1])))));
 	return expr;
 });
@@ -45471,7 +45476,7 @@ var UnsatisfiedResourceCycle = class extends Data.TaggedError("UnsatisfiedResour
 //#region bin/commands/deploy.ts
 const execStack = Effect.fn(function* ({ main: main$1, stage: stage$1, envFile: envFile$1, profile: profile$1, dryRun: dryRun$1 = false, force: force$1 = false, yes: yes$1 = false, destroy = false }) {
 	const stackEffect = yield* importStack(main$1);
-	const services$1 = Layer.mergeAll(Layer.succeed(ArtifactStore, createArtifactStore()), Layer.succeed(AuthProviders, yield* Effect.serviceOption(AuthProviders).pipe(Effect.map(Option.getOrElse(() => ({}))))), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(envFile$1), profile$1)), inkCLI(), Logger.layer([fileLogger("out")]), Layer.succeed(Stage, stage$1));
+	const services$1 = Layer.mergeAll(Layer.succeed(ArtifactStore, createArtifactStore()), Layer.succeed(AuthProviders, yield* Effect.serviceOption(AuthProviders).pipe(Effect.map(Option.getOrElse(() => ({}))))), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(envFile$1), profile$1)), Logger.layer([fileLogger("out")]), Layer.succeed(Stage, stage$1));
 	yield* Effect.gen(function* () {
 		const cli$1 = yield* Cli;
 		const stack = yield* stackEffect;
@@ -45631,6 +45636,155 @@ const logsCommand = Command.make("logs", {
 	}).pipe(Effect.provide(services$1));
 }));
 
+//#endregion
+//#region bin/commands/state.ts
+/**
+* When set, the State service is replaced with the on-disk
+* `LocalState` (`.alchemy/state` under the cwd) instead of whatever
+* the stack file configures (e.g. the Cloudflare HTTP state store).
+* Useful for inspecting orphaned local state after a partially-failed
+* bootstrap.
+*/
+const localFlag = Flag.boolean("local").pipe(Flag.withDescription("Read from local .alchemy/state instead of the stack's configured state store"), Flag.withDefault(false));
+const stackArg = Argument.string("stack").pipe(Argument.withDescription("Stack name (e.g. AlchemyEffectWebsite)"));
+Argument.string("stage").pipe(Argument.withDescription("Stage name (e.g. dev_samgoodwin, prod)"));
+const fqnArg = Argument.string("fqn").pipe(Argument.withDescription("Fully-qualified resource name"));
+/**
+* Build the layer stack used by every `alchemy state ...` subcommand.
+*
+* The stack file is imported and evaluated so that its `state` layer
+* (Cloudflare HTTP store, in-memory, etc.) is in scope. Pass `local`
+* to swap the configured State for an on-disk LocalState instead.
+*/
+const withStateService = (args, body) => Effect.gen(function* () {
+	const stackEffect = yield* importStack(args.main);
+	const services$1 = Layer.mergeAll(Layer.succeed(AuthProviders, {}), ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(args.envFile), args.profile)), Logger.layer([fileLogger("out")]), Layer.succeed(Stage, args.stage), args.local ? localState() : Layer.empty);
+	return yield* Effect.gen(function* () {
+		const stack = yield* stackEffect;
+		return yield* Effect.gen(function* () {
+			return yield* body(yield* State);
+		}).pipe(Effect.provide(stack.services));
+	}).pipe(Effect.provide(services$1));
+});
+const stacksCommand = Command.make("stacks", {
+	main,
+	envFile,
+	stage,
+	profile,
+	local: localFlag
+}, Effect.fnUntraced(function* (args) {
+	yield* withStateService(args, (state) => Effect.gen(function* () {
+		const stacks = yield* state.listStacks();
+		if (stacks.length === 0) {
+			yield* Console.log("(no stacks)");
+			return;
+		}
+		for (const s of [...stacks].sort()) yield* Console.log(s);
+	}));
+}));
+const stagesCommand = Command.make("stages", {
+	stack: stackArg,
+	main,
+	envFile,
+	stage,
+	profile,
+	local: localFlag
+}, Effect.fnUntraced(function* ({ stack: stackName,...rest }) {
+	yield* withStateService(rest, (state) => Effect.gen(function* () {
+		const stages = yield* state.listStages(stackName);
+		if (stages.length === 0) {
+			yield* Console.log(`(no stages in ${stackName})`);
+			return;
+		}
+		for (const s of [...stages].sort()) yield* Console.log(s);
+	}));
+}));
+const resourcesCommand = Command.make("resources", {
+	stack: stackArg,
+	stageName: Argument.string("stage").pipe(Argument.withDescription("Stage to list resources from")),
+	main,
+	envFile,
+	stage,
+	profile,
+	local: localFlag
+}, Effect.fnUntraced(function* ({ stack: stackName, stageName,...rest }) {
+	yield* withStateService(rest, (state) => Effect.gen(function* () {
+		const fqns = yield* state.list({
+			stack: stackName,
+			stage: stageName
+		});
+		if (fqns.length === 0) {
+			yield* Console.log(`(no resources in ${stackName}/${stageName})`);
+			return;
+		}
+		for (const f of [...fqns].sort()) yield* Console.log(f);
+	}));
+}));
+const getCommand = Command.make("get", {
+	stack: stackArg,
+	stageName: Argument.string("stage").pipe(Argument.withDescription("Stage the resource lives in")),
+	fqn: fqnArg,
+	main,
+	envFile,
+	stage,
+	profile,
+	local: localFlag
+}, Effect.fnUntraced(function* ({ stack: stackName, stageName, fqn,...rest }) {
+	yield* withStateService(rest, (state) => Effect.gen(function* () {
+		const value = yield* state.get({
+			stack: stackName,
+			stage: stageName,
+			fqn
+		});
+		if (value === void 0) {
+			yield* Console.log(`(not found: ${stackName}/${stageName}/${fqn})`);
+			return;
+		}
+		yield* Console.log(JSON.stringify(encodeState(value), null, 2));
+	}));
+}));
+const treeCommand = Command.make("tree", {
+	main,
+	envFile,
+	stage,
+	profile,
+	local: localFlag
+}, Effect.fnUntraced(function* (args) {
+	yield* withStateService(args, (state) => Effect.gen(function* () {
+		const stacks = [...yield* state.listStacks()].sort();
+		if (stacks.length === 0) {
+			yield* Console.log("(empty state store)");
+			return;
+		}
+		for (const stk of stacks) {
+			yield* Console.log(stk);
+			const stages = [...yield* state.listStages(stk)].sort();
+			for (let i = 0; i < stages.length; i++) {
+				const stg = stages[i];
+				const stageBranch = i === stages.length - 1 ? "└─" : "├─";
+				yield* Console.log(`${stageBranch} ${stg}`);
+				const indent = i === stages.length - 1 ? "   " : "│  ";
+				const fqns = [...yield* state.list({
+					stack: stk,
+					stage: stg
+				})].sort();
+				for (let j = 0; j < fqns.length; j++) {
+					const fqn = fqns[j];
+					const leaf = j === fqns.length - 1 ? "└─" : "├─";
+					yield* Console.log(`${indent}${leaf} ${fqn}`);
+				}
+			}
+		}
+	}));
+}));
+const stateCommand = Command.make("state", {}).pipe(Command.withSubcommands([
+	stacksCommand,
+	stagesCommand,
+	resourcesCommand,
+	getCommand,
+	treeCommand
+]));
+
 //#endregion
 //#region bin/commands/tail.ts
 const tailCommand = Command$1.make("tail", {
@@ -45700,10 +45854,11 @@ const root = Command$1.make("alchemy", {}).pipe(Command$1.withSubcommands([
 	planCommand,
 	tailCommand,
 	logsCommand,
-	loginCommand
+	loginCommand,
+	stateCommand
 ]));
 const cli = Command$1.run(root, { version });
-const services = Layer.mergeAll(Layer.provideMerge(AlchemyContextLive, PlatformServices), FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()));
+const services = Layer.mergeAll(Layer.provideMerge(AlchemyContextLive, PlatformServices), FetchHttpClient.layer, ConfigProvider.layer(ConfigProvider.fromEnv()), inkCLI());
 cli.pipe(Effect.provide(services), Effect.scoped, handleCancellation, runMain);
 
 //#endregion